When checking for marking a function for optimization, we had a check if
the function is already optimized to return early. This works in non-OSR
cases. For Turbofan OSR even when the current execution of the function
has already been optimized, the function itself will not be replaced
with optimized code. Hence, we may end up checking a function that is
already marked for optimization again. A check for the frame being optimized
avoids these checks.

BUG=

Review-Url: https://codereview.chromium.org/2450233002
Cr-Commit-Position: refs/heads/master@{#40760}

The old code path is going to be removed with the debug context api.

R=kozyatinskiy@chromium.org

Review-Url: https://codereview.chromium.org/2465833002
Cr-Commit-Position: refs/heads/master@{#40759}

Port f07d2cdd

Original commit message:
A load instruction will implicitely clear the top 32 bits when writing to a W
register. This patch avoids generating a `mov` instruction to zero-extend the
result in this case.

For example, this occurs in the generated code for dispatching to the next
bytecode in the interpreter:

  kind = BYTECODE_HANDLER
  name = LdaZero
  compiler = turbofan
  Instructions (size = 36)
  0x32e64c60     0  add x19, x19, #0x1 (1)
  0x32e64c64     4  ldrb w0, [x20, x19]
  0x32e64c68     8  mov w0, w0
                    ^^^^^^^^^^
  0x32e64c6c    12  lsl x0, x0, #3
  0x32e64c70    16  ldr x1, [x21, x0]
  0x32e64c74    20  movz x0, #0x0
  0x32e64c78    24  br x1

Review-Url: https://codereview.chromium.org/2469253002
Cr-Commit-Position: refs/heads/master@{#40758}

The value numbering reducer has collision checks for nodes that mutated,
but kept the same hash, and are now equivalent to another node. However,
it can also accidentally hit itself, if it mutated, changed hash, but
ran over the location it was previously in.

After this patch, it checks to see if it is comparing against itself,
and skips over itself. Additionally, if this check is at the end of the
collisions, it opportunistically removes the duplicate entry and reduces
the size pressure on the list. We can do the same opportunistic clean up
if we happen to find a colliding equivalent entry, since we move it from
its original position to a new one.

Drive-by change: Ensure that the collision replacement checks types in
the same way that normal replacement does.

Review-Url: https://codereview.chromium.org/2475653002
Cr-Commit-Position: refs/heads/master@{#40757}

R=ulan@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2473073002
Cr-Commit-Position: refs/heads/master@{#40756}

BUG=v8:5588
R=jochen@chromium.org

Review-Url: https://codereview.chromium.org/2475433008
Cr-Commit-Position: refs/heads/master@{#40755}

It always has the same number of slots.

R=adamk@chromium.org
TBR=bmeurer@chromium.org
BUG=v8:1569

Review-Url: https://codereview.chromium.org/2460353002
Cr-Commit-Position: refs/heads/master@{#40754}

- split up cctest/test-api/Threading*
- shortened mjsunit/math-floor-part*
- split up cctest/test-serialize/CustomSnapshotDataBlob
- skipped mjsunit/regress/regress-crbug-474297 unless gc-stress
- shortened cctest/test-serialize/CodeSerializerLargeCodeObject

R=jkummerow@chromium.org

Review-Url: https://codereview.chromium.org/2470143004
Cr-Commit-Position: refs/heads/master@{#40753}

Instead of having a MODULE variable's index be 0 or 1, let it be the index of
its cell.  In this CL, we assign the indices but we continue to only use them to
distinguish imports from exports.  Actually using them to directly access the
cells will be done in a later CL.

R=adamk@chromium.org
BUG=v8:1569

Review-Url: https://codereview.chromium.org/2460233003
Cr-Commit-Position: refs/heads/master@{#40752}

R=machenbach@chromium.org

Review-Url: https://codereview.chromium.org/2474863002
Cr-Commit-Position: refs/heads/master@{#40751}

BUG=v8:5598
TBR=adamk@chromium.org
NOTRY=true

Review-Url: https://codereview.chromium.org/2479793003
Cr-Commit-Position: refs/heads/master@{#40750}

TBR=jochen@chromium.org

Review-Url: https://codereview.chromium.org/2474433011
Cr-Commit-Position: refs/heads/master@{#40749}

This is how it would look like.

(gdb) bta
[1 ] V8_Fatal                                         ../../src/base/logging.cc:67
[2 ] v8::internal::Heap::AllocateRaw                  ../../src/heap/heap-inl.h:298
[3 ] v8::internal::Heap::AllocateHeapNumber           ../../src/heap/heap.cc:2432
[4 ] v8::internal::Factory::NewHeapNumber             ../../src/factory.cc:1253
[5 ] v8::internal::Factory::NewNumber                 ../../src/factory.cc:1228
[6 ] v8::internal::__RT_impl_Runtime_ConstructDouble  ../../src/runtime/runtime-test.cc:32
 -> Allow HEAP_ALLOCATION (yes_gc)
 -> Disallow HEAP_ALLOCATION (no_gc)
[7 ] v8::internal::Runtime_ConstructDouble            ../../src/runtime/runtime-test.cc:24

R=jochen@chromium.org

Review-Url: https://codereview.chromium.org/2466263007
Cr-Commit-Position: refs/heads/master@{#40748}

R=machenbach@chromium.org
BUG=v8:5457
NOTRY=true
NOTREECHECKS=true

Review-Url: https://codereview.chromium.org/2471113004
Cr-Commit-Position: refs/heads/master@{#40747}

Use a NumberConstant op rather than an Int32Constant to make assertions in
v8::internal::compiler::EscapeAnalysis::ProcessAllocation() happy.

BUG=v8:5598
R=bmeurer@chromium.org, franzih@chromium.org

Review-Url: https://codereview.chromium.org/2478643002
Cr-Commit-Position: refs/heads/master@{#40746}

This patch is a follow-up patch to enable runtime statistics to use
TracingCategoryObserver.

BUG=v8:5590

Review-Url: https://codereview.chromium.org/2460973003
Cr-Commit-Position: refs/heads/master@{#40745}

BUG=none
R=dgozman@chromium.org
CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_precise_blink_rel

Review-Url: https://codereview.chromium.org/2467853003
Cr-Commit-Position: refs/heads/master@{#40744}

Revert of [Tracing] Use TracingCategoryObserver in runtime statistics (patchset #6 id:140001 of https://codereview.chromium.org/2460973003/ )

Reason for revert:
Static-Initializers failed on Ubuntu-12.04

Original issue's description:
> [Tracing] Use TracingCategoryObserver in runtime statistics
>
> This patch is a follow-up patch to enable runtime statistics to use
> TracingCategoryObserver.
>
> BUG=v8:5590

TBR=cbruni@chromium.org,fmeawad@chromium.org,alph@chromium.org,bmeurer@chromium.org,mlippautz@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5590

Review-Url: https://codereview.chromium.org/2469403005
Cr-Commit-Position: refs/heads/master@{#40743}

This patch is a follow-up patch to enable runtime statistics to use
TracingCategoryObserver.

BUG=v8:5590

Review-Url: https://codereview.chromium.org/2460973003
Cr-Commit-Position: refs/heads/master@{#40742}

Use HeapConstant for string_iterator_map rather than loading it
manually. This avoids unnecessary map checks.

BUG= v8:3822,v8:5267

Review-Url: https://codereview.chromium.org/2479563003
Cr-Commit-Position: refs/heads/master@{#40741}

During instruction selection, match the pattern

  Float64LessThan(#0.0, Float64Abs(x))

which TurboFan generates for NumberToBoolean in the general case,
and which evaluates to false if x is 0, -0 or NaN, and compile this
to a simple (v)ucomisd using not_equal flags condition, which avoids
the costly Float64Abs.

Also consistently generate this pattern in TurboFan and the code
stubs/interpreter for ToBoolean.

R=mstarzinger@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2473923003
Cr-Commit-Position: refs/heads/master@{#40740}

This patch removes TracingCategoryObserver API and moves the creation of
observer inside platform initialization, by assuming that either
Platform::AddTraceStateObserver is implemented correctly to add observer to
tracing controller that implemented by embedders, or default tracing controller
has already been set up and attached to platform before
v8::V8::InitializePlatform is called.

BUG=v8:5590

Review-Url: https://codereview.chromium.org/2471583004
Cr-Commit-Position: refs/heads/master@{#40739}

Since all possible data-encoded prototype chain checks are supported by LoadIC
we can remove this extra iteration.

LoadGlobalIC does not support data handlers yet.

BUG=v8:5561

Review-Url: https://codereview.chromium.org/2479523002
Cr-Commit-Position: refs/heads/master@{#40738}

Revert of [heap] Add a guard for restarting the memory reducer after mark-compact. (patchset #1 id:1 of https://chromiumcodereview.appspot.com/2433933005/ )

Reason for revert:
Speculative revert to see impact on crbug.com/659531

Original issue's description:
> [heap] Add a guard for restarting the memory reducer after mark-compact.
>
> Currently it is possible to get into a cycle of
> mark-compact -> memory reducer -> mark-compact -> memory reducer ...
> where the memory reducer does not free memory.
>
> This patch ensures that the memory reducer restarts only if the
> committed memory increased by sufficient amount after the last run.
>
> BUG=

TBR=hpayer@chromium.org,davidroutier17@gmail.com
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=

Review-Url: https://codereview.chromium.org/2472053003
Cr-Commit-Position: refs/heads/master@{#40737}

Exchanged the ZoneList for a ZoneChunkList to avoid
unnecessary growing.

Review-Url: https://codereview.chromium.org/2468183004
Cr-Commit-Position: refs/heads/master@{#40736}

BUG=v8:5561

Review-Url: https://codereview.chromium.org/2471613006
Cr-Commit-Position: refs/heads/master@{#40735}

Changes the ValueNumberingReducer to grow when at 80% capacity, rather
than at 50% capacity. This matches the behaviour of base/hashmap.

Review-Url: https://codereview.chromium.org/2474873003
Cr-Commit-Position: refs/heads/master@{#40734}

This makes sure the test in question does not rely on specific lifetime
characteristics for local variables within a function. Note that these
lifetimes are not specified by JavaScript and are not observable within
JavaScript proper. The natives syntax however makes it observable.

BUG=v8:5345
TEST=mjsunit/wasm/compiled-module-management
R=mtrofin@chromium.org

Review-Url: https://codereview.chromium.org/2474053002
Cr-Commit-Position: refs/heads/master@{#40733}

BUG=

Review-Url: https://codereview.chromium.org/2472703002
Cr-Commit-Position: refs/heads/master@{#40732}

Port 4447405b

R=danno@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2474023002
Cr-Commit-Position: refs/heads/master@{#40731}

Load the correct 32-bit word to determine if the buffer is shared by
using kBitFieldOffset instead of kBitFieldSlot.

R=ishell@chromium.org,mstarzinger@chromium.org,jkummerow@chromium.org
BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2470023003
Cr-Commit-Position: refs/heads/master@{#40730}

If a WebAssembly function is exported, its js-to-wasm wrapper has a
field which contains a reference to the WebAssembly function.
Originally this reference was an index into the export table, which
then contains an index into the function table, which then contains
the metadata of the WebAssembly function.

With this CL we use the index into the function table directly as
the reference to the WebAssembly function.

TEST=mjsunit/wasm/test-import-export-wrapper
R=rossberg@chromium.org, mtrofin@chromium.org
CC=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2472103002
Cr-Commit-Position: refs/heads/master@{#40729}

BUG=

Review-Url: https://codereview.chromium.org/2477733002
Cr-Commit-Position: refs/heads/master@{#40728}

Cr-Commit-Position: refs/heads/master@{#40727}

With an instance of CodeStubArguments, builtin stub generators can generate code
that accesses the receiver passed to the builtin, as well as access and iterate
over the variable number of arguments that are passed in.

Review-Url: https://codereview.chromium.org/2469273003
Cr-Commit-Position: refs/heads/master@{#40726}

For lowering CheckHeapObject, always report TaggedPointer representation
and let the RepresentationChanger come up with a reasonable conversion from
whatever input representation to TaggedPointer. This way we no longer insert
the useless ChangeSomethingToTagged and then check the result for HeapObject,
i.e. mostly reduces the amount of useless code being generated.

Note there are now two operators ChangeFloat64ToTaggedPointer and the old
ChangeFloat64ToTagged, because their semantics different wrt. the strength
reduction in the SimplifiedOperatorReducer.

Also set the output MachineRepresentation::kTaggedPointer properly in
SimplifiedLowering whenever we know that we produce a HeapObject.

R=jarin@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2476593002
Cr-Commit-Position: refs/heads/master@{#40725}

BUG=v8:4680

Review-Url: https://codereview.chromium.org/2467223005
Cr-Commit-Position: refs/heads/master@{#40724}

Also properly deal with constant indices for String element access in
the JSNativeContextSpecialization.

BUG=chromium:661949
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2474013002
Cr-Commit-Position: refs/heads/master@{#40723}

Removed a wrong condition test in  TwoByteExternalBufferedStream. This changed fixes errors that may occur under some conditions.

Review-Url: https://codereview.chromium.org/2469723002
Cr-Commit-Position: refs/heads/master@{#40722}

Review-Url: https://codereview.chromium.org/2475433005
Cr-Commit-Position: refs/heads/master@{#40721}