Import base::ieee754::exp() from FreeBSD msun and introduce a Float64Exp
TurboFan operator based on that, similar to what we do for Float64Log.
Rewrite Math.exp() as TurboFan builtin and use that operator to also
inline Math.exp() into optimized TurboFan functions.

BUG=v8:3266,v8:3468,v8:3493,v8:5086,v8:5108
R=mvstanton@chromium.org

Review-Url: https://codereview.chromium.org/2077533002
Cr-Commit-Position: refs/heads/master@{#37037}

We report the byte offset as column number, but devtools assumes them
to be 1-based and subtracts one unconditionally before further
processing it. It's a bit unfortunate, but because of that we have to
just add 1 to the reported column number on the public StackTrace API.

R=ahaas@chromium.org, titzer@chromium.org
BUG=chromium:613110

Review-Url: https://codereview.chromium.org/2071563002
Cr-Commit-Position: refs/heads/master@{#37036}

BUG=v8:5095

Review-Url: https://codereview.chromium.org/2063693002
Cr-Commit-Position: refs/heads/master@{#37035}

BUG=v8:4915
LOG=Y

Review-Url: https://codereview.chromium.org/2072683002
Cr-Commit-Position: refs/heads/master@{#37034}

LoadICState was used to hold the TypeofMode flag which is relevant only for LoadGlobalIC.
This CL removes usage of this state from LoadIC and KeyedLoadIC and renames the state
class to LoadGlobalICState.

BUG=chromium:576312
LOG=Y

Review-Url: https://codereview.chromium.org/2065373003
Cr-Commit-Position: refs/heads/master@{#37033}

This is a follow-up to a recent fix to make the exception reporting even
more resilient. The original regression test flushed out more issues on
different configurations.

TBR=yangguo@chromium.org
TEST=mjsunit/regress/regress-crbug-620253
BUG=chromium:620253
NOTREECHECKS=true

Review URL: https://codereview.chromium.org/2071783002 .

Cr-Commit-Position: refs/heads/master@{#37032}

This makes sure exception reporting done by the debug shell behaves
gracefully even near the stack limit. When line number determination
fails we just fallback to not printing source information.

R=yangguo@chromium.org
TEST=mjsunit/regress/regress-crbug-620253
BUG=chromium:620253

Review-Url: https://codereview.chromium.org/2069543007
Cr-Commit-Position: refs/heads/master@{#37031}

BUG=chromium:576312
LOG=Y

Review-Url: https://codereview.chromium.org/2062343002
Cr-Commit-Position: refs/heads/master@{#37030}

Revert of [turbofan] Properly handle dictionary maps in the prototype chain. (patchset #1 id:1 of https://codereview.chromium.org/2067423003/ )

Reason for revert:
As discussed offline with Toon, this is not the correct fix here.

Original issue's description:
> [turbofan] Properly handle dictionary maps in the prototype chain.
>
> Dictionary prototypes don't have stable maps, but still don't matter for
> element access. Generalized the JSNativeContextSpecialization a bit to
> handle everything that Crankshaft can handle in this regard.
>
> R=jarin@chromium.org
> BUG=chromium:616709
>
> Committed: https://crrev.com/1c7bdc7f6f4d9512f4982590bd949f265ee9c8c3
> Cr-Commit-Position: refs/heads/master@{#37019}

TBR=jarin@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:616709

Review-Url: https://codereview.chromium.org/2076493002
Cr-Commit-Position: refs/heads/master@{#37029}

This will be needed during debugging to know function boundaries within
the wasm module bytes, and to extract the bytes for a single function
to disassemble it.

R=titzer@chromium.org
BUG=chromium:613110

Review-Url: https://codereview.chromium.org/2055783002
Cr-Commit-Position: refs/heads/master@{#37028}

Those were wrongly translated from gyp with ia32. This should
land before renaming v8_target_arch to v8_target_cpu.

BUG=chromium:620527
NOTRY=true
TBR=vogelheim@chromium.org

Review-Url: https://codereview.chromium.org/2065323004
Cr-Commit-Position: refs/heads/master@{#37027}

This will be used for disassembling individual wasm function for
showing them in devtools.
The PrintAst function now also optionally provides an offset table
mapping from byte offset to line and column in the generated text.

R=titzer@chromium.org, ahaas@chromium.org
BUG=chromium:613110

Review-Url: https://codereview.chromium.org/2050213002
Cr-Commit-Position: refs/heads/master@{#37026}

BUG=

Review-Url: https://codereview.chromium.org/2062323003
Cr-Commit-Position: refs/heads/master@{#37025}

Review-Url: https://codereview.chromium.org/2035383003
Cr-Commit-Position: refs/heads/master@{#37024}

Port d6473f5c

Original commit message:

    See bug description.

R=mlippautz@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=chromium:619382
LOG=N

Review-Url: https://codereview.chromium.org/2066603007
Cr-Commit-Position: refs/heads/master@{#37023}

R=joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2069363002
Cr-Commit-Position: refs/heads/master@{#37022}

Port 2d1f977c

Original commit message:

    Support for relocatable globals, to facilitate compilation before
    instantiation.

R=mtrofin@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=v8:5072
LOG=N

Review-Url: https://codereview.chromium.org/2069163003
Cr-Commit-Position: refs/heads/master@{#37021}

Those operators don't have JavaScript observable side effects and would
otherwise block load elimination and other optimizations.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2075443003
Cr-Commit-Position: refs/heads/master@{#37020}

Dictionary prototypes don't have stable maps, but still don't matter for
element access. Generalized the JSNativeContextSpecialization a bit to
handle everything that Crankshaft can handle in this regard.

R=jarin@chromium.org
BUG=chromium:616709

Review-Url: https://codereview.chromium.org/2067423003
Cr-Commit-Position: refs/heads/master@{#37019}

These operators don't need to be part of the control chain.

Drive-by-fix: Properly wire the effects during representation selection.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2073683002
Cr-Commit-Position: refs/heads/master@{#37018}

LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2050563002
Cr-Commit-Position: refs/heads/master@{#37017}

Rolling v8/build to 76e9bd0241b00735b5bc402c926d7cb141a726ef

Rolling v8/buildtools to 3780bc523aad1d68a5bd00e05c453a80b2ba0b35

Rolling v8/tools/clang to 8b0c8f71a4d41c7d2cd0d898f3547e9984f79b5d

Rolling v8/tools/mb to bc05800a7cd7833ad7c2d1423cd8b2153470c9bd

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2069333002
Cr-Commit-Position: refs/heads/master@{#37016}

BUG=v8:5004

Review-Url: https://codereview.chromium.org/2070213002
Cr-Commit-Position: refs/heads/master@{#37015}

Port 3e2d60d8

R=yangguo@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com, bjaideep@ca.ibm.com

BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2069193003
Cr-Commit-Position: refs/heads/master@{#37014}

Review-Url: https://codereview.chromium.org/2054343002
Cr-Commit-Position: refs/heads/master@{#37013}

Port 6470ddad

Original commit message:

    This introduces SilenceNaN operator, which makes sure that we only
    store quiet NaNs into holey arrays. We omit the NaN silencing code
    at instruction selection time if the input is an operation that
    cannot possibly produce signalling NaNs.

R=jarin@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com, bjaideep@ca.ibm.com

BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2070583002
Cr-Commit-Position: refs/heads/master@{#37012}

Only Intel needed changes, arm and mips work as expected.

BUG=

Review-Url: https://codereview.chromium.org/2061833003
Cr-Commit-Position: refs/heads/master@{#37011}

BUG=chromium:619491,chromium:611688
LOG=N
R=ulan@chromium.org

Review-Url: https://codereview.chromium.org/2065013002
Cr-Commit-Position: refs/heads/master@{#37010}

Cr-Commit-Position: refs/heads/master@{#37009}

R=jochen@chromium.org, vogelheim@chromium.org
BUG=chromium:617892

Review-Url: https://codereview.chromium.org/2055203002
Cr-Commit-Position: refs/heads/master@{#37008}

Port 3e2d60d8

R=yangguo@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2065423002
Cr-Commit-Position: refs/heads/master@{#37007}

BUG=chromium:576312
LOG=Y

Review-Url: https://codereview.chromium.org/2066763004
Cr-Commit-Position: refs/heads/master@{#37006}

The patch introduces a dedicated dispatching class for JIT code events. It is
set as a helper on the isolate.
This allows classes across v8 to break their dependency on Logger and CpuProfiler.
These two became just regular clients of the dispatcher.

BUG=v8:4789

Review-Url: https://codereview.chromium.org/2061623002
Cr-Commit-Position: refs/heads/master@{#37005}

When seeing a SuspendGenerator bytecode, the register optimizer must flush its
state.

R=oth@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2071443002
Cr-Commit-Position: refs/heads/master@{#37004}

This CheckBounds simplified operator is similar to the HBoundsCheck in
Crankshaft, and is hooked up to the new type feedback support in the
SimplifiedLowering. We use it to check the index bounds for keyed
property accesses.

Note to perf sheriffs: This will tank quite a few benchmarks, as the
operator makes some redundant branch elimination ineffective for
certain patterns of keyed accesses. This does require more serious
redundancy elimination, which we will do in a separate CL. So ignore
any regressions from this CL, we know there will be a few.

R=jarin@chromium.org
BUG=v8:4470,v8:5100

Committed: https://crrev.com/85e5567dae66a918500ae94c5568221137a0f5d4
Review-Url: https://codereview.chromium.org/2035893004
Cr-Original-Commit-Position: refs/heads/master@{#36947}
Cr-Commit-Position: refs/heads/master@{#37003}

The new approach is that instead of compiling custom handlers for
every global object's PropertyCell it uses single dispatcher that
caches PropertyCells in respective slot of the feedback vector.

Currently the new LoadGlobalIC machinery is disabled.

This CL also removes unused LoadGlobalViaContext* stuff.

BUG=chromium:576312
LOG=Y

Review-Url: https://codereview.chromium.org/2065113002
Cr-Commit-Position: refs/heads/master@{#37002}

These simplified operators are used to perform the hole checks when
loading elements from a holey array. Depending on the CheckHoleMode,
they either return the hole as undefined or some NaN, or deoptimize
if the value is the hole or the hole NaN.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2066223002
Cr-Commit-Position: refs/heads/master@{#37001}

If an active generator is found on the stack (FUNCTION_BLOCKED_UNDER_GENERATOR),
and the target function is not found on top of that generator, add the error.

Based on test by wingo@igalia.com and littledan@chromium.org
(https://codereview.chromium.org/2035643003/)

LOG=N
BUG=v8:4483
R=yangguo@chromium.org, littledan@chromium.org

Review-Url: https://codereview.chromium.org/2058733002
Cr-Commit-Position: refs/heads/master@{#37000}

Review-Url: https://codereview.chromium.org/2059403003
Cr-Commit-Position: refs/heads/master@{#36999}

Fix after:
https://codereview.chromium.org/2042253002/
https://codereview.chromium.org/2049743002/

Using the data file is the default now and it shouldn't
be overridden in v8's build_overrides. Also the isolate
logic now needs to include the gni file specifying the
flag.

BUG=chromium:616033
TBR=jochen@chromium.org, vogelheim@chromium.org
NOTRY=true

Review-Url: https://codereview.chromium.org/2062363002
Cr-Commit-Position: refs/heads/master@{#36998}