Oftentimes we can avoid the Smi check for ToBoolean truncations, since
we already know that the input is always going to be a HeapObject. So
introduce a dedicated TruncateTaggedPointerToBit operator, which uses
the fact that the input is known to be a HeapObject.

BUG=v8:5267
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2738483002
Cr-Commit-Position: refs/heads/master@{#43629}

Change-Id: I58fc4ad8104f9a334a24de181168122f215a0505

BUG=chromium:678427

Change-Id: I58fc4ad8104f9a334a24de181168122f215a0505
Reviewed-on: https://chromium-review.googlesource.com/447980Reviewed-by: Mythri Alle <mythria@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43628}

The parser already changes all negative equality comparison operations
to their positive pendants in {ParserBase::ParseBinaryExpression}. No
other source of the Token::NE exists in the system. We can remove all
handling from the compiler and interpreter backends.

R=bmeurer@chromium.org

Change-Id: I58722c08dd8e498f20c65886fce86b8172737b10
Reviewed-on: https://chromium-review.googlesource.com/449716Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43627}

Part of the performance and refactoring work to move the TypedArray
constructors into CSA. This CL moves ConstructByLength from JS
to CSA.

There are still other callers to typed_array_initialize in
typedarray.js, so we share the implementation using DoInitialize.

In a later CL we can split apart DoInitialize once we have more
TA constructors written in CSA, so that we can reuse specific
parts more easily.

BUG=v8:5977

Change-Id: Ia51e8363970e9a025a82933e56a7baaf82cb1eec
Reviewed-on: https://chromium-review.googlesource.com/448220Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43626}

- Remove TypedArrayIncludes in src/js/typedarray.js
- Implement it to C++ using the IncludesValue implementation
  in ElementsAccessor

BUG=v8:5929

Review-Url: https://codereview.chromium.org/2732823002
Cr-Commit-Position: refs/heads/master@{#43625}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/10e3929..789a49b

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/9b85841..353ee60

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/c9f2fc0..e96a7b4

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: Icfbbf26a5159e4246648fe17793c2c16813cb885
Reviewed-on: https://chromium-review.googlesource.com/451117Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43624}

BUG=v8:4614
R=binji@chromium.org

Review-Url: https://codereview.chromium.org/2623633003
Cr-Commit-Position: refs/heads/master@{#43623}

BUG=chromium:626498

Review-Url: https://codereview.chromium.org/2726213004
Cr-Commit-Position: refs/heads/master@{#43622}

Deletion can cause collisions to be moved in the map which breaks iteration.
For now just remove this support. Also add some additional collision tests
to the test.

BUG=v8:5203

Change-Id: I54a0a4af51da08b3f963dc1d7661dba291e4efea
Reviewed-on: https://chromium-review.googlesource.com/445900Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43621}

If the top-level function cannot be found, we previously assumed an
invocation count of 1. This is wrong when we expect the invocation
counts to be reset for precise coverage.

TBR=jgruber@chromium.org
R=caseq@chromium.org,pfeldman@chromium.org
BUG=v8:5808

Review-Url: https://codereview.chromium.org/2723003007
Cr-Commit-Position: refs/heads/master@{#43620}

This CL provide type with each break location, type could be: call, return or debugger statement.

BUG=chromium:432469
R=yangguo@chromium.org,dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2728563002
Cr-Commit-Position: refs/heads/master@{#43619}

The concurrent marker uses ObjectVisitor to iterate pointers in objects
and local marking bitmaps to keep track of visited objects.

To keep it simple for now, I removed support for multiple tasks
and canceling unfinished tasks.

BUG=chromium:694255

Review-Url: https://codereview.chromium.org/2732053002
Cr-Commit-Position: refs/heads/master@{#43618}

This extends https://codereview.chromium.org/2728983002 to all of Turbofan, for the same reasons: The machine reducer is unreliable in signalling changed nodes and value numbering is unpredictable if not always re-run on changed nodes. Putting value numbering last in all graph reducers patches this.

BUG=v8:6036
R=mstarzinger@chromium.org

Review-Url: https://codereview.chromium.org/2730753003
Cr-Commit-Position: refs/heads/master@{#43617}

This method could be called on pause and will do stepInto next scheduled callback if any will happen until next break.
First implementation support only callbacks chained by Promise.prototype.then.

BUG=chromium:432469
R=yangguo@chromium.org,dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2723273002
Cr-Commit-Position: refs/heads/master@{#43616}

This patch adds a trivial ConcurrentMarking class that can start
background tasks.

BUG=chromium:694255

Review-Url: https://codereview.chromium.org/2728363002
Cr-Commit-Position: refs/heads/master@{#43615}

Review-Url: https://codereview.chromium.org/2736723003
Cr-Commit-Position: refs/heads/master@{#43614}

From asm.js code we might get an empty ArrayBuffer as heap memory. In
this case, both the old memory start and the new memory start will be
nullptr. The size however has to be patched from default_size to 0.

This CL changes code specialization to be able to either patch memory
references, or patch memory sizes or both.

R=titzer@chromium.org, ahaas@chromium.org
BUG=chromium:698587

Change-Id: I4d9d811d75cb83842f23df317e8e7fc02aeb5146
Reviewed-on: https://chromium-review.googlesource.com/450257
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43613}

BUG=chromium:698607
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2735633003
Cr-Commit-Position: refs/heads/master@{#43612}

Drive by: remove two unused methods in optimized code visitor.

Review-Url: https://codereview.chromium.org/2730323002
Cr-Commit-Position: refs/heads/master@{#43611}

BUG=chromium:694255

Review-Url: https://codereview.chromium.org/2735713002
Cr-Commit-Position: refs/heads/master@{#43610}

BUG=chromium:694255

Review-Url: https://codereview.chromium.org/2737483002
Cr-Commit-Position: refs/heads/master@{#43609}

This makes the collection logic of {Projection} nodes (i.e. value
projections for multi-value returning calls) more robust. The projection
nodes by now have a control input, which in turn can make them appear
more than once in the use list of a call. We should limit the use list
inspection to value edges only. This is in preparation of eliding any
redundant {IfSuccess} control node.

R=jarin@chromium.org

Change-Id: I9bb4cc0e2e877976be55a894af972aa83d07d7d7
Reviewed-on: https://chromium-review.googlesource.com/450244Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43608}

BUG=chromium:694255

Review-Url: https://codereview.chromium.org/2734823003
Cr-Commit-Position: refs/heads/master@{#43607}

Instead of creating a signed comparison with INT_MAX, create an unsigned
comparison with 0.  This saves a few bytes in the generated code.

R=jarin@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2715513007
Cr-Commit-Position: refs/heads/master@{#43606}

It's unused since March 2 2017 (https://chromium-review.googlesource.com/448539).
This removes it assuming that leaving it in the header was an oversight.

BUG=v8:5828

Review-Url: https://codereview.chromium.org/2732803002
Cr-Commit-Position: refs/heads/master@{#43605}

DataPropertyParameters are not specific to StoreDataProperty.
Rename it to FeedbackParameter, so it can be used for similar
ICs, e.g., future CollectTypeProfile. Also, the parameter for spread calls contains just one parameter, remove the plural s.

BUG=

Review-Url: https://codereview.chromium.org/2725263003
Cr-Commit-Position: refs/heads/master@{#43604}

The previous fix (http://crrev.com/2720813002) was problematic for
functions containing i64 parameters or returns. Those would throw a
TypeError when called via WASM_TO_JS and JS_TO_WASM.

Instead, we now unwrap the WASM_INTERPRETER_ENTRY function and call it
directly. This removes the option to later redirect back to the
original wasm function, but this functionality is not needed currently.

Plus drive-by fix to put functions in anonymous namespace in
wasm-compiler.cc.

R=ahaas@chromium.org, titzer@chromium.org
BUG=v8:5971, v8:5822

Review-Url: https://codereview.chromium.org/2725333002
Cr-Commit-Position: refs/heads/master@{#43603}

The function list is now filtered by category by default, and sorting improved to break ties better.

Since the butterfly trees get massive, I had to start expanding the call trees on demand. This is implemented by keeping track of all ticks that cross given tree node (+ position where they crosses it). This seems to work quite well - in subsequent CL, I am planning to flip the bottom-up and top-down trees to use this.

Review-Url: https://codereview.chromium.org/2730293002
Cr-Commit-Position: refs/heads/master@{#43602}

The previous method was too brittle as applying a variable number of arguments to Date can be manipulated in too many ways, e.g. concat and apply semantics.

The new method shoud suffice for most cases.

BUG=chromium:698305
NOTRY=true
TBR=yangguo@chromium.org,mstarzinger@chromium.org

Change-Id: If6baf6ca8f1534c41ab8c50a5c507df89fbf0d16
Reviewed-on: https://chromium-review.googlesource.com/449653Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43601}

BUG=v8:6026

Review-Url: https://codereview.chromium.org/2728463006
Cr-Commit-Position: refs/heads/master@{#43600}

Improvements:
- top-down call tree.
- interactive restriction to time interval.

Review-Url: https://codereview.chromium.org/2696903002
Cr-Commit-Position: refs/heads/master@{#43599}

Adwords dominates the numbers and is flaky. Speedometer is measured elsewhere.

Perf sheriffs: This will change the numbers on the RuntimeStats benchmarks.

Change-Id: Id64863b41b95269987c95d48ce90f24cfa86b86d
Reviewed-on: https://chromium-review.googlesource.com/449674Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43598}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/8ce7164..10e3929

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/7ef7617..9b85841

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: Iabe50034cbccb6163ddd8699cf0498c601c18ec2
Reviewed-on: https://chromium-review.googlesource.com/449933Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43597}

A previous patch lifting the restriction on invalid escape sequences in
tagged templates had a bug when two template tokens appeared immediately
adject to each other. This moves invalid escape information from the
tokenizer state proper into the TokenDesc, preventing the overwriting
which caused this issue.

Previous CL is at
https://codereview.chromium.org/2665513002

BUG=v8:6029,v8:5546

Review-Url: https://codereview.chromium.org/2724003006
Cr-Commit-Position: refs/heads/master@{#43596}

BUG=chromium:686003

Review-Url: https://codereview.chromium.org/2705533002
Cr-Commit-Position: refs/heads/master@{#43595}

We don't need the JSStrictNotEqual operator in the compiler, because
this is never generated by the BytecodeGraphBuilder, and the code in
the AstGraphBuilder was dead code. Also remove the backing builtin
StrictNotEqual.

R=mstarzinger@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2727003006
Cr-Commit-Position: refs/heads/master@{#43594}

Spinning up a new background task is expensive, and many times an existing
task will finish it's work before a new task starts work on a job, so enable
the existing tasks to do more than one background job.

BUG=v8:5203

Change-Id: Ibbef317c8bb3921c36a096fed88d244716be9c42
Reviewed-on: https://chromium-review.googlesource.com/441706
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43593}

BUG=chromium:673246
NOTRY=true
TBR=marja@chromium.org

Change-Id: I87faa32ae602a10b68a22fce46ee3bb39a7aa171
Reviewed-on: https://chromium-review.googlesource.com/449754Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43592}

BUG=v8:5516
R=verwaest@chromium.org

Change-Id: Ica04f74788a4812128bce1297aeee23f8c3bec3d
Reviewed-on: https://chromium-review.googlesource.com/449675Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43591}

Also prevent division by zero.

R=tebbi@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2731723002
Cr-Commit-Position: refs/heads/master@{#43590}