This ensures that there is only one stub that deals with unwinding the
stack. Having more than one place containing that logic is brittle and
error prone, especially when it is a corner case only for RangeErrors.

R=titzer@chromium.org
TEST=mjsunit/regress/regress-crbug-467047
BUG=chromium:467047
LOG=N

Review URL: https://codereview.chromium.org/1012103002

Cr-Commit-Position: refs/heads/master@{#27243}

BUG=v8:3969
LOG=NO
TBR=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1016743003

Cr-Commit-Position: refs/heads/master@{#27242}

The cause was dynamic allocation of an accounting structure used to
create/initialize the type feedback vector, done at the end of the
numbering pass. The solution is to Zone-allocate the structure to
bring it's lifetime in line with the compilation unit.

BUG=

Review URL: https://codereview.chromium.org/1014793003

Cr-Commit-Position: refs/heads/master@{#27241}

The evaluation order of receiver versus arguments is not properly
defined by C++. This caused issues with Clang where the environment
changed after the receiveing environment was already loaded.

R=jarin@chromium.org
BUG=chromium:467531
LOG=N

Review URL: https://codereview.chromium.org/1011123002

Cr-Commit-Position: refs/heads/master@{#27240}

additionally, remove unnecessary deopts when transitioning to global accessor properties from data properties

R=verwaest@chromium.org

BUG=

Review URL: https://codereview.chromium.org/996133002

Cr-Commit-Position: refs/heads/master@{#27239}

The evaluation order of receiver versus arguments is not properly
defined by C++. This caused issues with Clang where the environment
changed after the receiveing environment was already loaded.

R=jarin@chromium.org
BUG=chromium:467531
TEST=mjsunit/regress/regress-crbug-467531
LOG=N

Review URL: https://codereview.chromium.org/1015683002

Cr-Commit-Position: refs/heads/master@{#27238}

Ranges and bitset types now work together, so we don't need these weird
hacks anymore.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/994283005

Cr-Commit-Position: refs/heads/master@{#27237}

R=svenpanne@chromium.org
BUG=v8:3929
LOG=n

Review URL: https://codereview.chromium.org/1010803008

Cr-Commit-Position: refs/heads/master@{#27236}

A hydrogen code stub is not the best approach because it builds a frame
and doesn't have the technology to discard roots at tail call exits.
Platform-specific stubs provide much better performance at this point.

R=verwaest@chromium.org

BUG=

Review URL: https://codereview.chromium.org/988653003

Cr-Commit-Position: refs/heads/master@{#27235}

R=vogelheim@chromium.org

Review URL: https://codereview.chromium.org/1011703003

Cr-Commit-Position: refs/heads/master@{#27234}

BUG=v8:3664
LOG=NO

Review URL: https://codereview.chromium.org/1009343002

Cr-Commit-Position: refs/heads/master@{#27233}

This change introduces a liveness analyzer for local variables in frame states.

The main idea is to use the AstGraphBuilder::Environment class to build the control flow graph, and record local variable loads, stores and checkpoints in the CFG basic blocks (LivenessAnalyzerBlock class).

After the graph building finishes, we run a simple data flow analysis over the CFG to figure out liveness of each local variable at each checkpoint. Finally, we run a pass over all the checkpoints and replace dead local variables in the frame states with the 'undefined' value.

Performance numbers for Embenchen are below.

----------- box2d.js
Current --turbo-deoptimization: EmbenchenBox2d(RunTime): 11265 ms.
d8-master --turbo-deoptimization: EmbenchenBox2d(RunTime): 11768 ms.
d8-master: EmbenchenBox2d(RunTime): 10996 ms.
----------- bullet.js
Current --turbo-deoptimization: EmbenchenBullet(RunTime): 17049 ms.
d8-master --turbo-deoptimization: EmbenchenBullet(RunTime): 17384 ms.
d8-master: EmbenchenBullet(RunTime): 16153 ms.
----------- copy.js
Current --turbo-deoptimization: EmbenchenCopy(RunTime): 4877 ms.
d8-master --turbo-deoptimization: EmbenchenCopy(RunTime): 4938 ms.
d8-master: EmbenchenCopy(RunTime): 4940 ms.
----------- corrections.js
Current --turbo-deoptimization: EmbenchenCorrections(RunTime): 7068 ms.
d8-master --turbo-deoptimization: EmbenchenCorrections(RunTime): 6718 ms.
d8-master: EmbenchenCorrections(RunTime): 6858 ms.
----------- fannkuch.js
Current --turbo-deoptimization: EmbenchenFannkuch(RunTime): 4167 ms.
d8-master --turbo-deoptimization: EmbenchenFannkuch(RunTime): 4608 ms.
d8-master: EmbenchenFannkuch(RunTime): 4149 ms.
----------- fasta.js
Current --turbo-deoptimization: EmbenchenFasta(RunTime): 9981 ms.
d8-master --turbo-deoptimization: EmbenchenFasta(RunTime): 9848 ms.
d8-master: EmbenchenFasta(RunTime): 9640 ms.
----------- lua_binarytrees.js
Current --turbo-deoptimization: EmbenchenLuaBinaryTrees(RunTime): 11571 ms.
d8-master --turbo-deoptimization: EmbenchenLuaBinaryTrees(RunTime): 13089 ms.
d8-master: EmbenchenLuaBinaryTrees(RunTime): 10957 ms.
----------- memops.js
Current --turbo-deoptimization: EmbenchenMemOps(RunTime): 7766 ms.
d8-master --turbo-deoptimization: EmbenchenMemOps(RunTime): 7346 ms.
d8-master: EmbenchenMemOps(RunTime): 7738 ms.
----------- primes.js
Current --turbo-deoptimization: EmbenchenPrimes(RunTime): 7459 ms.
d8-master --turbo-deoptimization: EmbenchenPrimes(RunTime): 7453 ms.
d8-master: EmbenchenPrimes(RunTime): 7451 ms.
----------- skinning.js
Current --turbo-deoptimization: EmbenchenSkinning(RunTime): 15564 ms.
d8-master --turbo-deoptimization: EmbenchenSkinning(RunTime): 15611 ms.
d8-master: EmbenchenSkinning(RunTime): 15583 ms.
----------- zlib.js
Current --turbo-deoptimization: EmbenchenZLib(RunTime): 10825 ms.
d8-master --turbo-deoptimization: EmbenchenZLib(RunTime): 11180 ms.
d8-master: EmbenchenZLib(RunTime): 10823 ms.

BUG=

Review URL: https://codereview.chromium.org/949743002

Cr-Commit-Position: refs/heads/master@{#27232}

the third part of the patch https://codereview.chromium.org/1012633002

this patch
1) moves DeoptInfo builder code to platform independent file lithium-codegen.cc
2) adds inlining_id property to HEnterInlined so we can use it on lithium level.

BUG=chromium:452067
LOG=n

Review URL: https://codereview.chromium.org/1011733005

Cr-Commit-Position: refs/heads/master@{#27231}

R=vogelheim@chromium.org

Review URL: https://codereview.chromium.org/1008923003

Cr-Commit-Position: refs/heads/master@{#27230}

R=svenpanne@chromium.org
BUG=v8:3929
LOG=n

Review URL: https://codereview.chromium.org/1017663002

Cr-Commit-Position: refs/heads/master@{#27229}

Rolling v8/build/gyp to d174d75bf69c682cb62af9187879e01513b35e52

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1014683004

Cr-Commit-Position: refs/heads/master@{#27228}

Improve the code generated for construction of a 64-bit floating point
number from two 32-bit integers.

Previously, this moved FP->core, inserted, then moved core->FP for each
half. Now, we construct the double in an X register and move core->FP.
Typically, the temporary register aliases the input register, so the
sequence improves from six to two instructions.

Patch from Martyn Capewell <m.m.capewell@googlemail.com>.

BUG=

Review URL: https://codereview.chromium.org/1008003004

Cr-Commit-Position: refs/heads/master@{#27227}

Tiny cleanup on the way...

Review URL: https://codereview.chromium.org/1007283006

Cr-Commit-Position: refs/heads/master@{#27226}

The feature itself is still behind a flag.

BUG=v8:3862
R=hpayer@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1014503003

Cr-Commit-Position: refs/heads/master@{#27225}

CpuProfiler: replace FLAG_hydrogen_track_positions with is_tracking_positions method on CompilationInfo

this is the second part of https://codereview.chromium.org/1012633002.

almost mechanical change.
I'd like to enable positions tracking when cpu profiler is working.
But I'll switch it on for cpu-profiler in another patch.

BUG=chromium:452067
LOG=n

Review URL: https://codereview.chromium.org/995183005

Cr-Commit-Position: refs/heads/master@{#27224}

BUG=chromium:467481
LOG=Y

Review URL: https://codereview.chromium.org/1009933002

Cr-Commit-Position: refs/heads/master@{#27223}

Instead of the current approach of storing flat vectors in frame states (and possibly reusing the last vector in AST graph builder), this change list builds a tree for the values and tries to reuse the nodes for different frame states. At the moment, we only use this for the local variable part of frame state, but nothing prevents us from using this for all parts.

This change provides two new classes: one for creating the tree (StateValuesCache) and one for iterating the trees (StateValuesAccess).

BUG=

Review URL: https://codereview.chromium.org/1008213002

Cr-Commit-Position: refs/heads/master@{#27222}

this is the first part of https://codereview.chromium.org/1012633002.
mechanical change.

The motivation: the original patch needs to use List of List but list is not copiable.

BUG=chromium:452067
LOG=n

Review URL: https://codereview.chromium.org/1011733002

Cr-Commit-Position: refs/heads/master@{#27221}

The per-isolate compilation cache is a lot faster still than
the serialized code cache. Promote code to compilation cache
after deserialization.

R=vogelheim@chromium.org
BUG=chromium:399580
LOG=N

Review URL: https://codereview.chromium.org/1008363002

Cr-Commit-Position: refs/heads/master@{#27220}

Fix the resulting warnings by renaming things apart.

BUG=v8:3947
LOG=n

Review URL: https://codereview.chromium.org/1009373002

Cr-Commit-Position: refs/heads/master@{#27219}

Also, include the time for building object groups in the tracing scope
for the overapproximation.

BUG=v8:3862
R=hpayer@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1012593004

Cr-Commit-Position: refs/heads/master@{#27218}

Store buffer does not contain stale pointers anymore. Hence, sweeper threads and store buffer processing does not collide.

BUG=

Review URL: https://codereview.chromium.org/1007273002

Cr-Commit-Position: refs/heads/master@{#27217}

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/1011613003

Cr-Commit-Position: refs/heads/master@{#27216}

Revert of Remove kind field from StackHandler. (patchset #4 id:60001 of https://codereview.chromium.org/1002203002/)

Reason for revert:
Layout test failure in inspector/sources/debugger/debugger-pause-on-promise-rejection.html

Original issue's description:
> Remove kind field from StackHandler.
>
> This makes the Isolate::Throw logic not depend on a prediction of
> whether an exception is caught or uncaught. Such a prediction is
> inherently undecidable because a finally block can decide between
> consuming or re-throwing an exception depending on arbitray control
> flow.
>
> There still is a conservative prediction mechanism in place that
> components like the debugger or tracing can use for reporting.
>
> With this change we can get rid of the StackHandler::kind field, a
> pre-requisite to do table-based lookups of exception handlers.
>
> R=yangguo@chromium.org
>
> Committed: https://crrev.com/96f79568a926966ebcf0685bf9adc947f4e1fbff
> Cr-Commit-Position: refs/heads/master@{#27210}

TBR=yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1009903002

Cr-Commit-Position: refs/heads/master@{#27215}

BUG=

Review URL: https://codereview.chromium.org/1009323002

Cr-Commit-Position: refs/heads/master@{#27214}

BUG=

Review URL: https://codereview.chromium.org/1007613005

Cr-Commit-Position: refs/heads/master@{#27213}

The CL enables the same instructions are selected for Word32 and Word64 compare
operations which is possible due to a fact 32-bit inputs and produced values
are always sign-extended.

TEST=
BUG=

Review URL: https://codereview.chromium.org/1005123002

Cr-Commit-Position: refs/heads/master@{#27212}

BUG=chromium:462908
LOG=NO

Review URL: https://codereview.chromium.org/1010713002

Cr-Commit-Position: refs/heads/master@{#27211}

This makes the Isolate::Throw logic not depend on a prediction of
whether an exception is caught or uncaught. Such a prediction is
inherently undecidable because a finally block can decide between
consuming or re-throwing an exception depending on arbitray control
flow.

There still is a conservative prediction mechanism in place that
components like the debugger or tracing can use for reporting.

With this change we can get rid of the StackHandler::kind field, a
pre-requisite to do table-based lookups of exception handlers.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1002203002

Cr-Commit-Position: refs/heads/master@{#27210}

R=dpranke@chromium.org
TBR=machenbach@chromium.org
BUG=
LOG=n

Review URL: https://codereview.chromium.org/1004113003

Cr-Commit-Position: refs/heads/master@{#27209}

BUG=chromium:465651
LOG=Y

Review URL: https://codereview.chromium.org/997583004

Cr-Commit-Position: refs/heads/master@{#27208}

Revert of Reland of Remove slots that point to unboxed doubles from the StoreBuffer/SlotsBuffer. (patchset #3 id:40001 of https://codereview.chromium.org/988363002/)

Reason for revert:
Increased rate of Chrome crashes. Requires further investigation.

Original issue's description:
> Reland of Remove slots that point to unboxed doubles from the StoreBuffer/SlotsBuffer.
>
> The problem is that tagged slot could become a double slot after migrating of an object to another map with "shifted" fields (for example as a result of generalizing immutable data property to a data field).
> This CL also adds useful machinery that helps triggering incremental write barriers.
>
> BUG=chromium:454297, chromium:465273
> LOG=Y
>
> Committed: https://crrev.com/6d0677d845c47ab9fa297de61d0e3d8e5480a02a
> Cr-Commit-Position: refs/heads/master@{#27141}

TBR=hpayer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:454297, chromium:465273

Review URL: https://codereview.chromium.org/1004623003

Cr-Commit-Position: refs/heads/master@{#27207}

	modified:   test/mjsunit/mjsunit.status

R=danno@chromium.org, svenpanne@chromium.org

BUG=

Review URL: https://codereview.chromium.org/997773003

Cr-Commit-Position: refs/heads/master@{#27206}

BUG=chromium:339474
LOG=Y

Review URL: https://codereview.chromium.org/1002263004

Cr-Commit-Position: refs/heads/master@{#27205}

Enable code dependent on the newly provided common code support for
encoded internal references.

	modified:   src/ppc/code-stubs-ppc.cc
	modified:   test/cctest/cctest.status

R=danno@chromium.org, svenpanne@chromium.org

BUG=

Review URL: https://codereview.chromium.org/1008963002

Cr-Commit-Position: refs/heads/master@{#27204}