This change replaces the bitwise masking of uses by storing the most general truncation for all uses.

Review URL: https://codereview.chromium.org/1464763003

Cr-Commit-Position: refs/heads/master@{#32248}

Revert of Add test to check PRNG quality. (patchset #5 id:80001 of https://codereview.chromium.org/1467133006/ )

Reason for revert:
failure here https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosse4/builds/6842/steps/Check/logs/RandomBitCorrelations12

Original issue's description:
> Add test to check PRNG quality.
>
> Credits go to Erik Corry. Taken from:
> https://github.com/dart-lang/fletch/blob/master/src/shared/random_test.cc
>
> R=jkummerow@chromium.org
> BUG=v8:4566
> LOG=N
>
> Committed: https://crrev.com/1a90af55d1e9d7d84e813dc367d475457c7df1ff
> Cr-Commit-Position: refs/heads/master@{#32211}
>
> Committed: https://crrev.com/3d84f05cd77091ea8dde7821973f13f53dbaa730
> Cr-Commit-Position: refs/heads/master@{#32238}
>
> Committed: https://crrev.com/eeee7ab050013782704b5f89e49d06a30b3455c4
> Cr-Commit-Position: refs/heads/master@{#32246}

TBR=jkummerow@chromium.org,erikcorry@google.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4566

Review URL: https://codereview.chromium.org/1472833004

Cr-Commit-Position: refs/heads/master@{#32247}

Credits go to Erik Corry. Taken from:
https://github.com/dart-lang/fletch/blob/master/src/shared/random_test.cc

R=jkummerow@chromium.org
BUG=v8:4566
LOG=N

Committed: https://crrev.com/1a90af55d1e9d7d84e813dc367d475457c7df1ff
Cr-Commit-Position: refs/heads/master@{#32211}

Committed: https://crrev.com/3d84f05cd77091ea8dde7821973f13f53dbaa730
Cr-Commit-Position: refs/heads/master@{#32238}

Review URL: https://codereview.chromium.org/1467133006

Cr-Commit-Position: refs/heads/master@{#32246}

X87: Reshuffle registers in JSConstructStub to avoid trashing costructor and new.target on fast path (so we don't need to push/pop them).

  port 0ef5ad5a (r32219)

  original commit message:
  This CL also fixed register usages in MacroAssembler::Allocate() broken by 2fc2cb99 (r32144).

BUG=

Review URL: https://codereview.chromium.org/1473763003

Cr-Commit-Position: refs/heads/master@{#32245}

  port 1b1db135 (r32220)

  original commit message:
  Change the runtime entries and their associated code stubs for object
  and array literal creation to take the closure instead of the raw
  literals pointer. This is way easier to deal with (and cleaner) in
  TurboFan.

BUG=

Review URL: https://codereview.chromium.org/1472273002

Cr-Commit-Position: refs/heads/master@{#32244}

Revert of Add test to check PRNG quality. (patchset #4 id:60001 of https://codereview.chromium.org/1467133006/ )

Reason for revert:
still timing out

Original issue's description:
> Add test to check PRNG quality.
>
> Credits go to Erik Corry. Taken from:
> https://github.com/dart-lang/fletch/blob/master/src/shared/random_test.cc
>
> R=jkummerow@chromium.org
> BUG=v8:4566
> LOG=N
>
> Committed: https://crrev.com/1a90af55d1e9d7d84e813dc367d475457c7df1ff
> Cr-Commit-Position: refs/heads/master@{#32211}
>
> Committed: https://crrev.com/3d84f05cd77091ea8dde7821973f13f53dbaa730
> Cr-Commit-Position: refs/heads/master@{#32238}

TBR=jkummerow@chromium.org,erikcorry@google.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4566

Review URL: https://codereview.chromium.org/1480533002

Cr-Commit-Position: refs/heads/master@{#32243}

  port 0fb2edd1 (r32217)

  original commit message:
  We still share the code globally, but if we wanted, it would be easy to
  make it per isolate now

BUG=

Review URL: https://codereview.chromium.org/1477683002

Cr-Commit-Position: refs/heads/master@{#32242}

  port 9846f386 (r32205)

  original commit message:
  The literal index is being pushed onto the stack while evaluating
  the non-constant subexpressions, but never used in fullcodegen (and
  hence not used in the optimizing compilers).

BUG=

Review URL: https://codereview.chromium.org/1477673002

Cr-Commit-Position: refs/heads/master@{#32241}

  port 7c45b005 (r32203)

  original commit message:
  This passes the new.target value in a register instead of through a
  side-channel via the construct stub. Note that only TurboFan code uses
  the register value so far, but unoptimized code will be switched soon.

BUG=

Review URL: https://codereview.chromium.org/1477663002

Cr-Commit-Position: refs/heads/master@{#32240}

Rolling v8/tools/clang to aeba05c6d90e906ba60a328e9a5b68f25627dc29

Rolling v8/tools/swarming_client to df99a00d96fae932bae824dccba13156bf7eddd0

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1475893002

Cr-Commit-Position: refs/heads/master@{#32239}

Credits go to Erik Corry. Taken from:
https://github.com/dart-lang/fletch/blob/master/src/shared/random_test.cc

R=jkummerow@chromium.org
BUG=v8:4566
LOG=N

Committed: https://crrev.com/1a90af55d1e9d7d84e813dc367d475457c7df1ff
Cr-Commit-Position: refs/heads/master@{#32211}

Review URL: https://codereview.chromium.org/1467133006

Cr-Commit-Position: refs/heads/master@{#32238}

The first bug was that there are two different "initialization positions"
passed into PatternRewriter::DeclareAndInitializeVariables, and we weren't
setting them all properly for this case.

After further code review, it became clear that we weren't even recording
the correct position (the end of the initializer expression).

The combination of those two bugs caused the hole check elimination code
in full-codegen to skip emitting a hole check.

This patch takes care of both of those things. A follow-up will try
to reduce the number of "initializer positions" we track in the
variable declaration code.

R=littledan@chromium.org
BUG=v8:4568
LOG=n

Review URL: https://codereview.chromium.org/1468143004

Cr-Commit-Position: refs/heads/master@{#32237}

For web compat reasons, we support an initializer in the declaration
part of a for-in loop. But we should disallow this for destructured
declarations (just as we do for lexical declarations). In fact, without
disallowing it, we crash.

Also fix up the PreParser to have the same restrictions here as the parser
(the lexical check was missing there), verified by running the message tests
with --min-preparse-length=0.

In fixing the logic I've also cleaned up the code a bit, removing the
only-called-once DeclarationParsingResult::SingleName method.

BUG=v8:811
LOG=n

Review URL: https://codereview.chromium.org/1471973003

Cr-Commit-Position: refs/heads/master@{#32236}

Reland of Disable non-standard Promise functions in staging (patchset #1 id:1 of https://codereview.chromium.org/1473603002/ )

Reason for revert:
Breakage in Ignition seems unrelated; relanding.

Original issue's description:
> Revert of Disable non-standard Promise functions in staging (patchset #5 id:80001 of https://codereview.chromium.org/1469543003/ )
>
> Reason for revert:
> [Sheriff] This breaks ignition on arm sim debug:
> https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm%20-%20sim%20-%20debug/builds/5317
>
> Seems to not be caught by the cq bot that builds release with dchecks.
>
> Original issue's description:
> > Disable non-standard Promise functions in staging
> >
> > This patch removes Promise functions and methods which are absent
> > from the ES2015 specification when the --es-staging flag is on.
> >
> > BUG=v8:3237
> > R=rossberg
> > LOG=Y
> >
> > Committed: https://crrev.com/941251af7e04d50ac2243da2870249a42111221a
> > Cr-Commit-Position: refs/heads/master@{#32194}
>
> TBR=rossberg@chromium.org,littledan@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=v8:3237
>
> Committed: https://crrev.com/86bd2b3c23b562213d5af158849dcd65f347a827
> Cr-Commit-Position: refs/heads/master@{#32199}

TBR=rossberg@chromium.org,rmcilroy@chromium.org,machenbach@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3237

Review URL: https://codereview.chromium.org/1478533002

Cr-Commit-Position: refs/heads/master@{#32235}

Some highlights of this CL:
* Refactor the mutable state out of Frame into FrameAccessState,
  which is maintained and updated during code generation to
  record whether sp- or fp-based frame access is currently active
  and how deep the stack on top of the frame is.
* The operand resultion in linkage.cc now uses FrameAccessState
  to determine how to generate frame-accessing operands.
* Update all platforms to accurately track additionally pushed
  stack slots (e.g. arguments for calls) in the FrameAccessState.
* Add a flag, --turbo_sp_frame_access, which forces all frame
  access to be sp-based whenever possible. This will likely never
  be used in production, but for testing it's useful in verifying
  that the stack-tracking of each platform maintained in the
  FrameAccessState is correct.
* Use sp-based frame access for gap resolving before tail
  calls. This will allow for slightly more efficient restoration
  of the frame pointer in the tail call in a later CL.
* Remove most ad hoc groping into CallDescriptors to
  determine if a frame is needed, instead consistently use
  predicates like needs_frame(), IsCFunctionCall() and
  IsJSFunctionCall().

BUG=v8:4076
LOG=n

Review URL: https://codereview.chromium.org/1460183002

Cr-Commit-Position: refs/heads/master@{#32234}

Port 1b1db135

Original commit message:
    Change the runtime entries and their associated code stubs for object
    and array literal creation to take the closure instead of the raw
    literals pointer. This is way easier to deal with (and cleaner) in
    TurboFan.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1471823005

Cr-Commit-Position: refs/heads/master@{#32233}

Port 8e28e851

R=verwaest@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1471383002

Cr-Commit-Position: refs/heads/master@{#32232}

Port 7c45b005

Original commit message:
    This passes the new.target value in a register instead of through a
    side-channel via the construct stub. Note that only TurboFan code uses
    the register value so far, but unoptimized code will be switched soon.

R=mstarzinger@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:4544
LOG=n

Review URL: https://codereview.chromium.org/1469283004

Cr-Commit-Position: refs/heads/master@{#32231}

PPC: Reshuffle registers in JSConstructStub to avoid trashing costructor and new.target on fast path (so we don't need to push/pop them).

Port 0ef5ad5a

Original commit message:
    This CL also fixed register usages in MacroAssembler::Allocate() broken by 2fc2cb99 (r32144).

R=ishell@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=chromium:560239
LOG=Y

Review URL: https://codereview.chromium.org/1472823004

Cr-Commit-Position: refs/heads/master@{#32230}

Port 9846f386

Original commit message:
    The literal index is being pushed onto the stack while evaluating
    the non-constant subexpressions, but never used in fullcodegen (and
    hence not used in the optimizing compilers).

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1468273005

Cr-Commit-Position: refs/heads/master@{#32229}

R=epertoso@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1470173003

Cr-Commit-Position: refs/heads/master@{#32228}

Don't replace `TruncateFloat64ToInt32(RoundInt64ToFloat64(value))` with
`value`. Generally, `value` may have a range bigger than the one that
could fit into Int32. Replace it with `TruncateInt64ToInt32(value)`
instead, and only if the `value` fits into Float64 without precision
loss.

Add missing mjsunit test for 52bit multiplication/division optimization
that has landed in refs/heads/master@{#31899}.

BUG=
R=titzer@google.com

Review URL: https://codereview.chromium.org/1433353006

Cr-Commit-Position: refs/heads/master@{#32227}

Revert of Move --harmony-destructuring-bind to shipping (patchset #5 id:80001 of https://codereview.chromium.org/1451843002/ )

Reason for revert:
Fails on V8 Fuzzer: https://build.chromium.org/p/client.v8/builders/V8%20Fuzzer/builds/6028

Original issue's description:
> Move --harmony-destructuring-bind to shipping
>
> Also fix CheckConflictingVarDeclarations() to properly handle
> legacy const bindings. Without that change enabling the flag
> causes code like:
>
>   function f() { const x; var x; }
>
> to throw an early error, rather than wait to throw the error
> until f is invoked.
>
> BUG=v8:811
> LOG=y
> CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
>
> Committed: https://crrev.com/515093630a4a925a66d550561e38293d49633f10
> Cr-Commit-Position: refs/heads/master@{#32222}

TBR=rossberg@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:811

Review URL: https://codereview.chromium.org/1470333002

Cr-Commit-Position: refs/heads/master@{#32226}

Revert of [Interpreter] Add CreateClosure to BytecodeGraphBuilder. (patchset #8 id:140001 of https://codereview.chromium.org/1458603012/ )

Reason for revert:
Build break.

Original issue's description:
> [Interpreter] Add CreateClosure to BytecodeGraphBuilder.
>
> Adds code and tests to support CreateClosure bytecode when building
> graphs.
>
> BUG=v8:4280
> LOG=N
>
> Committed: https://crrev.com/4cceb11b0929abcbc82bf0854554a9b66003335d
> Cr-Commit-Position: refs/heads/master@{#32224}

TBR=bmeurer@chromium.org,mythria@chromium.org,mstarzinger@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4280

Review URL: https://codereview.chromium.org/1471913004

Cr-Commit-Position: refs/heads/master@{#32225}

Adds code and tests to support CreateClosure bytecode when building
graphs.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1458603012

Cr-Commit-Position: refs/heads/master@{#32224}

BUG=

Review URL: https://codereview.chromium.org/1467473002

Cr-Commit-Position: refs/heads/master@{#32223}

Also fix CheckConflictingVarDeclarations() to properly handle
legacy const bindings. Without that change enabling the flag
causes code like:

  function f() { const x; var x; }

to throw an early error, rather than wait to throw the error
until f is invoked.

BUG=v8:811
LOG=y
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1451843002

Cr-Commit-Position: refs/heads/master@{#32222}

sufficient physical registers for all the virtual registers.

This should come in handy for frame elision. There, I noticed that even
for very small functions (==very few virtual registers), because we spill
the context/function marker ranges, we lose the frame elision
opportunity.

There is a subsequent change needed to fully help frame elision -
decoupling spilling of context & function marker from prologue.

BUG=

Review URL: https://codereview.chromium.org/1469743002

Cr-Commit-Position: refs/heads/master@{#32221}

Change the runtime entries and their associated code stubs for object
and array literal creation to take the closure instead of the raw
literals pointer. This is way easier to deal with (and cleaner) in
TurboFan.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1469833005

Cr-Commit-Position: refs/heads/master@{#32220}

Reshuffle registers in JSConstructStub to avoid trashing costructor and new.target on fast path (so we don't need to push/pop them).

This CL also fixed register usages in MacroAssembler::Allocate() broken by 2fc2cb99 (r32144).

BUG=chromium:560239
LOG=Y

Review URL: https://codereview.chromium.org/1468073004

Cr-Commit-Position: refs/heads/master@{#32219}

Optimize ClearNonLiveReferences: collect dependent code only from maps that are embedded in optimize code.

BUG=chromium:554488
LOG=NO

Review URL: https://codereview.chromium.org/1471703002

Cr-Commit-Position: refs/heads/master@{#32218}

We still share the code globally, but if we wanted, it would be easy to
make it per isolate now

BUG=v8:2487
R=yangguo@chromium.org,jkummerow@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1468313004

Cr-Commit-Position: refs/heads/master@{#32217}

Having access to the unfinished schedule inside of raw machine assembler
turned out to be dangerous, because it cannot be used without exporting
which in turn computes the RPO of the schedule.

R=vogelheim@chromium.org

Review URL: https://codereview.chromium.org/1475643002

Cr-Commit-Position: refs/heads/master@{#32216}

Revert of Add test to check PRNG quality. (patchset #3 id:40001 of https://codereview.chromium.org/1467133006/ )

Reason for revert:
[Sheriff] Times out on arm:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim/builds/6202/steps/Check/logs/RandomBitCorrelations

Original issue's description:
> Add test to check PRNG quality.
>
> Credits go to Erik Corry. Taken from:
> https://github.com/dart-lang/fletch/blob/master/src/shared/random_test.cc
>
> R=jkummerow@chromium.org
> BUG=v8:4566
> LOG=N
>
> Committed: https://crrev.com/1a90af55d1e9d7d84e813dc367d475457c7df1ff
> Cr-Commit-Position: refs/heads/master@{#32211}

TBR=jkummerow@chromium.org,erikcorry@google.com,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4566

Review URL: https://codereview.chromium.org/1473613002

Cr-Commit-Position: refs/heads/master@{#32215}

BUG=chromium:534332
LOG=n

Review URL: https://codereview.chromium.org/1468093004

Cr-Commit-Position: refs/heads/master@{#32214}

BUG=

Review URL: https://codereview.chromium.org/1407313004

Cr-Commit-Position: refs/heads/master@{#32213}

BUG=

Review URL: https://codereview.chromium.org/1441043002

Cr-Commit-Position: refs/heads/master@{#32212}

Credits go to Erik Corry. Taken from:
https://github.com/dart-lang/fletch/blob/master/src/shared/random_test.cc

R=jkummerow@chromium.org
BUG=v8:4566
LOG=N

Review URL: https://codereview.chromium.org/1467133006

Cr-Commit-Position: refs/heads/master@{#32211}

BUG=v8:4305
LOG=N

Review URL: https://codereview.chromium.org/1434523002

Cr-Commit-Position: refs/heads/master@{#32210}

Makes it possible for the the inline allocation observers to be sample the
actual object allocation on which the notification triggers.

R=hpayer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1460063006

Cr-Commit-Position: refs/heads/master@{#32209}