This CheckBounds simplified operator is similar to the HBoundsCheck in
Crankshaft, and is hooked up to the new type feedback support in the
SimplifiedLowering. We use it to check the index bounds for keyed
property accesses.

Note to perf sheriffs: This will tank quite a few benchmarks, as the
operator makes some redundant branch elimination ineffective for
certain patterns of keyed accesses. This does require more serious
redundancy elimination, which we will do in a separate CL. So ignore
any regressions from this CL, we know there will be a few.

R=jarin@chromium.org
BUG=v8:4470,v8:5100

Review-Url: https://codereview.chromium.org/2035893004
Cr-Commit-Position: refs/heads/master@{#36947}

Port 7ceed92a
Port 89d8c57b

Original commit message:

    Import base::ieee754::atan() and base::ieee754::atan2() from fdlibm and
    introduce Float64Atan and Float64Atan2 TurboFan operators based on those,
    similar to what we already did for Float64Log and Float64Log1p. Rewrite
    Math.atan() and Math.atan2() as TurboFan builtin and use the operators
    to also inline Math.atan() and Math.atan2() into optimized TurboFan functions.

    Import base::ieee754::log1p() from fdlibm and introduce a Float64Log1p
    TurboFan operator based on that, similar to what we do for Float64Log.
    Rewrite Math.log1p() as TurboFan builtin and use that operator to also
    inline Math.log1p() into optimized TurboFan functions.

    Also unify the handling of the special IEEE 754 functions somewhat in
    the TurboFan backends. At some point we can hopefully express this
    completely in the InstructionSelector (once we have an idea what to do
    with the ST(0) return issue on IA-32/X87).

    Drive-by-fix: Add some more test coverage for the log function.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com, bjaideep@ca.ibm.com
BUG=

Review-Url: https://codereview.chromium.org/2064783002
Cr-Commit-Position: refs/heads/master@{#36946}

Port e95cfafb

Original commit message:

    This fixes FastNewStrictArgumentsStub and FastNewRestParameterStub to no
    longer assume that the strict arguments object being allocated will fit
    into new-space. The case where said object needs to move to large object
    space is now handled in the runtime.

R=mstarzinger@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com, bjaideep@ca.ibm.com
BUG=

Review-Url: https://codereview.chromium.org/2064023002
Cr-Commit-Position: refs/heads/master@{#36945}

LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2067463003
Cr-Commit-Position: refs/heads/master@{#36944}

MemSize should use Relocatable constants, remove unconditional throw
on no linear memory as this should be patched on GrowMemory.

R=mtrofin@chromium.org, bradnelson@chromium.org

Review-Url: https://codereview.chromium.org/2067433003
Cr-Commit-Position: refs/heads/master@{#36943}

This CL introduces the new type system for the ASM
type-checker/validator.

BUG=

Review-Url: https://codereview.chromium.org/2045703007
Cr-Commit-Position: refs/heads/master@{#36942}

Revert of change most cases of variable redeclaration from TypeError to SyntaxError (patchset #8 id:140001 of https://codereview.chromium.org/2048703002/ )

Reason for revert:
This is going to break the LayoutTest inspector-protocol/console/console-let-const-with-api.html as seen in https://build.chromium.org/p/tryserver.v8/builders/v8_linux_blink_rel/builds/2247 . Please run this test manually, using instructions at https://www.chromium.org/developers/testing/webkit-layout-tests , and fix on the Chrome side if needed before resubmitting this patch.

Original issue's description:
> change most cases of variable redeclaration from TypeError to SyntaxError.
>
> Code like `let a; eval("var a;");` should throw a SyntaxError, not a TypeError
> (this caused a test262 failure.). However, the code `eval("function NaN() {}");`
> should actually throw a TypeError. This patch changes most cases of
> redeclaration errors from TypeError to SyntaxError. See the test
> mjsunit/regress/redeclaration-error-types for a thorough analysis with spec
> references.
>
> The relevant sections of the spec are ES#sec-globaldeclarationinstantiation and
> ES#sec-evaldeclarationinstantiation
>
> BUG=v8:4955
> LOG=y
>
> Committed: https://crrev.com/2b787561763d0f7e8dab698652715a742cf78291
> Cr-Commit-Position: refs/heads/master@{#36940}

TBR=adamk@chromium.org,jwolfe@igalia.com
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4955

Review-Url: https://codereview.chromium.org/2064793002
Cr-Commit-Position: refs/heads/master@{#36941}

Code like `let a; eval("var a;");` should throw a SyntaxError, not a TypeError
(this caused a test262 failure.). However, the code `eval("function NaN() {}");`
should actually throw a TypeError. This patch changes most cases of
redeclaration errors from TypeError to SyntaxError. See the test
mjsunit/regress/redeclaration-error-types for a thorough analysis with spec
references.

The relevant sections of the spec are ES#sec-globaldeclarationinstantiation and
ES#sec-evaldeclarationinstantiation

BUG=v8:4955
LOG=y

Review-Url: https://codereview.chromium.org/2048703002
Cr-Commit-Position: refs/heads/master@{#36940}

This patch declares a new rest parameter for the derived constructor,
and passes it to base constructor after calling PrepareSpreadArguments.

This patch also updates the test262.status to account for
the now passing test.

BUG=v8:4890

Review-Url: https://codereview.chromium.org/2056993004
Cr-Commit-Position: refs/heads/master@{#36939}

BUG=v8:4483, v8:4907, 618603
LOG=N
R=neis@chromium.org, yangguo@chromium.org, littledan@chromium.org

Review-Url: https://codereview.chromium.org/2051423003
Cr-Commit-Position: refs/heads/master@{#36938}

With cl https://codereview.chromium.org/2043033002 blink will add new wrappers
to its marking deque (and maintain this deque) so black allocated wrappers are
not a problem anymore. To limit the scope of when blink has to detect wrappers,
we need to tell blink when we start and when we end full gcs. For that we can
nicely use TracePrologue and TraceEpilogue.

LOG=no
BUG=468240

Review-Url: https://codereview.chromium.org/2051103002
Cr-Commit-Position: refs/heads/master@{#36937}

* The default text (placeholder) in the search box is now present.
* All key events handled by turbolizer are not passed through to Chrome.

Review-Url: https://codereview.chromium.org/2061713002
Cr-Commit-Position: refs/heads/master@{#36936}

Port 7ceed92a
Port 89d8c57b

Original commit message:

    Import base::ieee754::atan() and base::ieee754::atan2() from fdlibm and
    introduce Float64Atan and Float64Atan2 TurboFan operators based on those,
    similar to what we already did for Float64Log and Float64Log1p. Rewrite
    Math.atan() and Math.atan2() as TurboFan builtin and use the operators
    to also inline Math.atan() and Math.atan2() into optimized TurboFan functions.

    Import base::ieee754::log1p() from fdlibm and introduce a Float64Log1p
    TurboFan operator based on that, similar to what we do for Float64Log.
    Rewrite Math.log1p() as TurboFan builtin and use that operator to also
    inline Math.log1p() into optimized TurboFan functions.

    Also unify the handling of the special IEEE 754 functions somewhat in
    the TurboFan backends. At some point we can hopefully express this
    completely in the InstructionSelector (once we have an idea what to do
    with the ST(0) return issue on IA-32/X87).

    Drive-by-fix: Add some more test coverage for the log function.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=v8:5086,v8:5092,v8:5095
LOG=N

Review-Url: https://codereview.chromium.org/2061753002
Cr-Commit-Position: refs/heads/master@{#36935}

Port e95cfafb

Original commit message:

    This fixes FastNewStrictArgumentsStub and FastNewRestParameterStub to no
    longer assume that the strict arguments object being allocated will fit
    into new-space. The case where said object needs to move to large object
    space is now handled in the runtime.

R=mstarzinger@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=chromium:614727
LOG=N

Review-Url: https://codereview.chromium.org/2060893002
Cr-Commit-Position: refs/heads/master@{#36934}

In order to update v8 api and still be able to build chromium, we had to keep
code in suboptimal state. Now when chromium caught up, we can perform cleanup :)

LOG=no
BUG=468240

Review-Url: https://codereview.chromium.org/2057613002
Cr-Commit-Position: refs/heads/master@{#36933}

Fix bugs and add a few small useful features:

* Fix Schedule view to properly parse schedule output and respond to switching
  back to graph views.
* Add shorcuts for showing edges of selected nodes.
  - 'i' shows all inputs
  - 'o' shows all outputs
  - '1'-'9' shows all nodes nth input where 1 <= n <= 9
  - 'c' shows all control inputs
  - 'e' shows all effect inputs
* Holding the control key down when using a edge-showing shortcut toggles edge
  state rather the just showing.
* 'a' selects all nodes in graph view.
* Node selection is preserved between graph views and Schedule views.
* Holding control key down when using regular expression search shows currently
  hidden nodes that match the regex search.
* Pane expansion buttons now respond to clicks in entire button area.
* Default text in regex search box makes searching more discoverable.

Review-Url: https://codereview.chromium.org/2059193002
Cr-Commit-Position: refs/heads/master@{#36932}

R=bmeurer@chromium.org, bradnelson@chromium.org
BUG=v8:5086, v8:5095

Review-Url: https://codereview.chromium.org/2062773002
Cr-Commit-Position: refs/heads/master@{#36931}

It's sufficient to bailout when seeing that the function literal is a
generator or async function, as those are the only cases in which there can be
yields.

Also: add a comment on --turbo-from-bytecode and Ignition generators.

R=mstarzinger@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2060843002
Cr-Commit-Position: refs/heads/master@{#36930}

It seems that I forgot to remove the DCHECK when refactoring this
function, even though the comment had it right.  It also seems that
this is hard to trigger.  The minimal example I found, after fuzzer's
bug, was:

   eval, x[eval]

R=adamk@chromium.org
BUG=chromium:619476
LOG=N

Review-Url: https://codereview.chromium.org/2058413002
Cr-Commit-Position: refs/heads/master@{#36929}

The AstNumberingVisitor is by now strictly running after we allocated
the SharedFunctionInfo. This removes some left-over code from before
that invariant was holding.

R=mvstanton@chromium.org

Review-Url: https://codereview.chromium.org/1965803002
Cr-Commit-Position: refs/heads/master@{#36928}

TBR=bmeurer@chromium.org
BUG=chromium:619538

Review-Url: https://codereview.chromium.org/2066493002
Cr-Commit-Position: refs/heads/master@{#36927}

When running with FLAG_runtime_call_stats, native accessor accesses must
go through the runtime for accurate accounting. Previously the slow_stub()
was used as a handler in order to accomplish this, but it could never be
looked up from the code cache successfully due to mismatched code flags,
which could cause more handler recompilations than in normal operation.
This patch fixes that by emitting a runtime call into the compiled
handler instead of using the slow_stub().

Drive-by cleanup: drop the unused StoreIC_Megamorphic builtin.

Review-Url: https://codereview.chromium.org/2054133002
Cr-Commit-Position: refs/heads/master@{#36926}

Revert of [wasm] Refactor function name table and lookup (patchset #2 id:20001 of https://codereview.chromium.org/2057523002/ )

Reason for revert:
[Sheriff] Speculative revert for flaky gc stress crashes, e.g.:
https://build.chromium.org/p/client.v8/builders/V8%20Mac%20GC%20Stress/builds/6592
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/builds/6143

Original issue's description:
> [wasm] Refactor function name table and lookup
>
> The function name table will now always be set; a CHECK will fail if
> the length would exceed the integer range.
> Also, the resolution of undefined function names to "<WASM UNNAMED>" is
> moved over to the wasm side.
>
> R=titzer@chromium.org
>
> Committed: https://crrev.com/3400ee9f4f21a455b7850ec42a4182a3c0eba310
> Cr-Commit-Position: refs/heads/master@{#36918}

TBR=titzer@chromium.org,clemensh@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2062793002
Cr-Commit-Position: refs/heads/master@{#36925}

This moves the decision whether to optimize generator or async functions
into the AstNumberingVisitor. Optimization heuristics that are based on
the function source should be encapsulated in this class.

R=neis@chromium.org

Review-Url: https://codereview.chromium.org/2065543002
Cr-Commit-Position: refs/heads/master@{#36924}

Revert of Replace all remaining Oddball checks with new function (patchset #10 id:180001 of https://codereview.chromium.org/2043183003/ )

Reason for revert:
failing tests

Original issue's description:
> Replace all remaining Oddball checks with new function
>
> This CL removes the IsUndefined() and Co. methods from Object and HeapObject.
> The new method all take the isolate as parameter.
>
> BUG=
>
> Committed: https://crrev.com/ccefb3ae5fe967288d568013fb04e8761eafebc5
> Cr-Commit-Position: refs/heads/master@{#36921}

TBR=mstarzinger@chromium.org,verwaest@chromium.org,yangguo@chromium.org,ahaas@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review-Url: https://codereview.chromium.org/2060213002
Cr-Commit-Position: refs/heads/master@{#36923}

This makes the aforementioned visitation function independent of the
target architecture by leveraging existing abstractions.

R=mvstanton@chromium.org

Review-Url: https://codereview.chromium.org/2060173002
Cr-Commit-Position: refs/heads/master@{#36922}

This CL removes the IsUndefined() and Co. methods from Object and HeapObject.
The new method all take the isolate as parameter.

BUG=

Review-Url: https://codereview.chromium.org/2043183003
Cr-Commit-Position: refs/heads/master@{#36921}

Array.prototype.sort would not work properly on sloppy arguments of size > 2.

BUG=chromium:618613

Review-Url: https://codereview.chromium.org/2051413004
Cr-Commit-Position: refs/heads/master@{#36920}

We'd like to track performance metrics in an automated way. This CL introduces
--turbo-stats-nvp which exposes --turbo-stats information in {"name"=value} pair
format.

BUG=

Review-Url: https://codereview.chromium.org/2053383002
Cr-Commit-Position: refs/heads/master@{#36919}

The function name table will now always be set; a CHECK will fail if
the length would exceed the integer range.
Also, the resolution of undefined function names to "<WASM UNNAMED>" is
moved over to the wasm side.

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2057523002
Cr-Commit-Position: refs/heads/master@{#36918}

This fixes FastNewStrictArgumentsStub and FastNewRestParameterStub to no
longer assume that the strict arguments object being allocated will fit
into new-space. The case where said object needs to move to large object
space is now handled in the runtime.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-614727
BUG=chromium:614727

Review-Url: https://codereview.chromium.org/2054853002
Cr-Commit-Position: refs/heads/master@{#36917}

Import base::ieee754::atan() and base::ieee754::atan2() from fdlibm and
introduce Float64Atan and Float64Atan2 TurboFan operators based on those,
similar to what we already did for Float64Log and Float64Log1p. Rewrite
Math.atan() and Math.atan2() as TurboFan builtin and use the operators
to also inline Math.atan() and Math.atan2() into optimized TurboFan functions.

R=yangguo@chromium.org
BUG=v8:5086,v8:5095

Review-Url: https://codereview.chromium.org/2065503002
Cr-Commit-Position: refs/heads/master@{#36916}

Review-Url: https://codereview.chromium.org/2033423002
Cr-Commit-Position: refs/heads/master@{#36915}

Import base::ieee754::log1p() from fdlibm and introduce a Float64Log1p
TurboFan operator based on that, similar to what we do for Float64Log.
Rewrite Math.log1p() as TurboFan builtin and use that operator to also
inline Math.log1p() into optimized TurboFan functions.

Also unify the handling of the special IEEE 754 functions somewhat in
the TurboFan backends. At some point we can hopefully express this
completely in the InstructionSelector (once we have an idea what to do
with the ST(0) return issue on IA-32/X87).

Drive-by-fix: Add some more test coverage for the log function.

R=yangguo@chromium.org
BUG=v8:5086,v8:5092

Review-Url: https://codereview.chromium.org/2060743002
Cr-Commit-Position: refs/heads/master@{#36914}

Instead of manually adopting the ancient fdlibm sources, import the msun
versions from FreeBSD instead, which were already adopted to ANSI C.
Still under the same copyright.

R=yangguo@chromium.org
BUG=v8:5065,v8:5086

Review-Url: https://codereview.chromium.org/2065473002
Cr-Commit-Position: refs/heads/master@{#36913}

We were able to achieve our goals for register allocation independent of
the allocation algorithm. Performance data so far is inconclusive re. the
value of the Greedy algorithm, compared to the particular Linear Scan
implementation we're currently using, and the performance measurement
techniques we currently use are too imprecise to help with this matter.

Retiring the algorithm to lower maintenance and evolution cost (e.g. lower
cost of adding aliasing support). Once we improve benchmarking stability,
and establish a suite sensitive enough for codegen improvement studies,
we may revive the algorithm, should the need arise.

BUG=

Review-Url: https://codereview.chromium.org/2060673002
Cr-Commit-Position: refs/heads/master@{#36912}

MemoryOperands, on IA32. This needed to be fixed so that we can
compile wasm code before creating instances, since the compiled code
needs to be patched up for memory and globals references.

This surfaces in asm-to-wasm scenarios.

Added testing (rather, enhanced existing tests).
Note patch#1 where we fail on ia32, and patch#2 with the fix.

BUG=v8:5072

Review-Url: https://codereview.chromium.org/2061583002
Cr-Commit-Position: refs/heads/master@{#36911}

Revert of Add a trace-event for each runtime-stats timer (patchset #6 id:100001 of https://codereview.chromium.org/2052523002/ )

Reason for revert:
Seems to break TSAN, see http://build.chromium.org/p/client.v8/builders/V8%20Linux64%20TSAN/builds/10057

Original issue's description:
> The trace-events will have a high overhead when turned on, but they are in a disabled-by-default category.
>
> As long as the off overhead is negligible, this CL allows us to understand the behavior of V8 rather than its performance at the moment.
>
> BUG=v8:5089
>
> Committed: https://crrev.com/44ec143f26769bd103662643bfeafc7d0834cc90
> Cr-Commit-Position: refs/heads/master@{#36909}

TBR=cbruni@chromium.org,fmeawad@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5089

Review-Url: https://codereview.chromium.org/2064553002
Cr-Commit-Position: refs/heads/master@{#36910}

The trace-events will have a high overhead when turned on, but they are in a disabled-by-default category.

As long as the off overhead is negligible, this CL allows us to understand the behavior of V8 rather than its performance at the moment.

BUG=v8:5089

Review-Url: https://codereview.chromium.org/2052523002
Cr-Commit-Position: refs/heads/master@{#36909}

Rolling v8/build to ea70305807f935b36a930586aa08c66bfc6fbf8d

Rolling v8/tools/mb to 649b5791b19e4ed3df0c5542b23950d34ca8f3e7

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2063593002
Cr-Commit-Position: refs/heads/master@{#36908}