In turbofan, after an addition operation where the same register is the
output and both inputs, if deoptimization is performed the input is
overwritten with the output value and the final result is not correct.
This is fixed by restoring the original value of the input before
deoptimization.

BUG=
TEST=mjsunit/regress/regress-int32-truncation

Review-Url: https://codereview.chromium.org/2102063002
Cr-Commit-Position: refs/heads/master@{#37524}

We can already benefit from value numbering (pure) nodes at this point
in the graph, because it makes some later passes more efficient and
reduces the graph size early.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2125613002
Cr-Commit-Position: refs/heads/master@{#37523}

This removes the frame state input representing the before-state from
nodes having the {JSAdd} or the {JSSubtract} operator. Lowering that
inserts number conversions of the inputs has to be disabled when
deoptimization is enabled, because the frame state layout is no longer
known.

R=jarin@chromium.org
BUG=v8:5021

Review-Url: https://codereview.chromium.org/2125593002
Cr-Commit-Position: refs/heads/master@{#37522}

LOG=N

Review-Url: https://codereview.chromium.org/2121123002
Cr-Commit-Position: refs/heads/master@{#37521}

R=neis@chromium.org

Review-Url: https://codereview.chromium.org/2117303003
Cr-Commit-Position: refs/heads/master@{#37520}

This drops the %_ValueOf intrinsic, but keeps the runtime entry
%ValueOf for now, by either migrating the functionality (mostly
Debug mirror or toString/valueOf methods) to C++ or TurboFan
builtins, or switching to the %ValueOf runtime call when it's
not performance critical anyways.

The %_ValueOf intrinsic was one of the last blockers for fixing
the unsound machine operator typing in TurboFan.

R=yangguo@chromium.org
BUG=v8:5049

Committed: https://crrev.com/293bd7882987f00e465710ce468bfb1eaa7d3fa2
Review-Url: https://codereview.chromium.org/2126453002
Cr-Original-Commit-Position: refs/heads/master@{#37512}
Cr-Commit-Position: refs/heads/master@{#37519}

The Number.parseInt (and therefore the parseInt function on the global
object) are often used instead of Math.floor or just plain int32
truncation, and we can easily recognize those cases and provide a fast
path in TurboFan.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2125583002
Cr-Commit-Position: refs/heads/master@{#37518}

This removes the frame state input representing the before-state from
nodes having the {JSMultiply} operator. Lowering that inserts number
conversions of the inputs has to be disabled when deoptimization is
enabled, because the frame state layout is no longer known.

R=jarin@chromium.org
BUG=v8:5021

Review-Url: https://codereview.chromium.org/2111193002
Cr-Commit-Position: refs/heads/master@{#37517}

    The reason:
    same as the CL #37371 (Issue 2111493002: X87: disable some sin/cos/expm1/tan test cases for x87.), please
    refer https://codereview.chromium.org/2111493002 for more details.

    For Acosh/ASinh test cases, the expected values are pre-defined double precision values, the results
    generated by C++ function are extended double precision as the extended double precision is default for x87
    Gcc compiler and std lib on linux platform. The comparison of different precisons caused some of those test
    cases failed.

    This CL disables Acosh/ASinh test cases for x87.

BUG=

Review-Url: https://codereview.chromium.org/2122593002
Cr-Commit-Position: refs/heads/master@{#37516}

  The reason:
  In CreateRandomOperand(), It used the register index 1 for ExplicitOperand(LocationOperand::REGISTER, rep,
  GetRegisterCode(rep, 1)).

  For x87 turbofan compiler, there's only 1 allocatable Float/Double register, i.e.: register index 0. the
  GetRegisterCode(rep, 1) in ExplicitOperand() always return false when rep is MachineRepresentation::kFloat32/kFloat64.

  It caused the test-gap-resolver/FuzzResolver failed at DCHECK_IMPLIES(kind == REGISTER && rep == MachineRepresentation::kFloat32,
  FloatRegister::from_code(index).IsAllocatable(RegisterConfiguration::TURBOFAN)), src/compiler/instruction.cc, line 259, under
  debug mode.

  This CL disable test-gap-resolver/FuzzResolver test case for x87.

BUG=

Review-Url: https://codereview.chromium.org/2120203002
Cr-Commit-Position: refs/heads/master@{#37515}

Revert of [intrinsic] Drop the %_ValueOf intrinsic. (patchset #2 id:20001 of https://codereview.chromium.org/2126453002/ )

Reason for revert:
[Sheriff] Breaks without i18n:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20noi18n%20-%20debug/builds/8466

Original issue's description:
> [intrinsic] Drop the %_ValueOf intrinsic.
>
> This drops the %_ValueOf intrinsic, but keeps the runtime entry
> %ValueOf for now, by either migrating the functionality (mostly
> Debug mirror or toString/valueOf methods) to C++ or TurboFan
> builtins, or switching to the %ValueOf runtime call when it's
> not performance critical anyways.
>
> The %_ValueOf intrinsic was one of the last blockers for fixing
> the unsound machine operator typing in TurboFan.
>
> R=yangguo@chromium.org
> BUG=v8:5049
>
> Committed: https://crrev.com/293bd7882987f00e465710ce468bfb1eaa7d3fa2
> Cr-Commit-Position: refs/heads/master@{#37512}

TBR=yangguo@chromium.org,bmeurer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5049

Review-Url: https://codereview.chromium.org/2117273002
Cr-Commit-Position: refs/heads/master@{#37514}

This concerns formatting of calls to, e.g., Math.acos in stack traces,
in which the receiver is an object with an attached toString tag. If
such a tag exists, use it to format the receiver typename to ensure that
the stack trace includes 'Math.acos' instead of 'Object.acos'.

R=yangguo@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2110683007
Cr-Commit-Position: refs/heads/master@{#37513}

This drops the %_ValueOf intrinsic, but keeps the runtime entry
%ValueOf for now, by either migrating the functionality (mostly
Debug mirror or toString/valueOf methods) to C++ or TurboFan
builtins, or switching to the %ValueOf runtime call when it's
not performance critical anyways.

The %_ValueOf intrinsic was one of the last blockers for fixing
the unsound machine operator typing in TurboFan.

R=yangguo@chromium.org
BUG=v8:5049

Review-Url: https://codereview.chromium.org/2126453002
Cr-Commit-Position: refs/heads/master@{#37512}

  port f59a2335 (r37500)

  original commit message:
  Stack trace generation requires access to the receiver; and while the
  receiver is already on the stack, we cannot determine its position
  during stack trace generation (it's stored in argv[0], and argc is only
  stored in a callee-saved register).

  This patch grants access to the receiver by pushing argc onto builtin
  exit frames as an extra argument. Compared to simply pushing the
  receiver, this requires an additional dereference during stack trace
  generation, but one fewer during builtin calls.

BUG=

Review-Url: https://codereview.chromium.org/2118413002
Cr-Commit-Position: refs/heads/master@{#37511}

BUG=

Review-Url: https://codereview.chromium.org/2106413002
Cr-Commit-Position: refs/heads/master@{#37510}

Rolling v8/build to 536d6fe8a0df34c0c412da483375d71b9b931afa

Rolling v8/buildtools to d2664782a3855d5be8cbbfd3c23b6652926de8cc

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2124673002
Cr-Commit-Position: refs/heads/master@{#37509}

  port bd0d9e7d (r37477)

  original commit message:
  This optimizes the passing of stack parameters in function calls.

  For some architectures (ia32/x64), using pushes when possible instead
  of bumping the stack and then storing parameters generates much
  smaller code, and in some cases is faster (e.g. when a push of a memory
  location can implement a memory-to-memory copy and thus elide an
  intermediate load. On others (e.g. ARM), the benefit is smaller, where
  it's only possible to elide direct stack pointer adjustment in certain cases
  or combine multiple register stores into a single instruction in other limited
  situations. On yet other platforms (ARM64, MIPS), there are no push instructions,
  and this optimization isn't used at all.

  Ideally, this mechanism would be used for both tail calls and normal calls,
  but "normal" calls are currently pretty efficient, and tail calls are very
  inefficient, so this CL sets the bar low for building a new mechanism to
  handle parameter pushing that only needs to raise the bar on tail calls for now.

  The key aspect of this change is that adjustment to the stack pointer
  for tail calls (and perhaps later real calls) is an explicit step separate from
  instruction selection and gap resolution, but aware of both, making it possible
  to safely recognize gap moves that are actually pushes.

BUG=

Review-Url: https://codereview.chromium.org/2120413002
Cr-Commit-Position: refs/heads/master@{#37508}

If incremental GC starts before imports linking, and sees a wasm
function, it won't revisit that after the imports that function are linked.
As a result, the import code objects may be GC-ed. This change
addresses this issue.

BUG=

Review-Url: https://codereview.chromium.org/2113183002
Cr-Commit-Position: refs/heads/master@{#37507}

Currently there are two logic in Ticker, one is to try to request a
pre-allocated TickSample from CpuProfiler and then initialize it, and if the
request fails, it will initialize a local TickSample. The other is it will pass
an initialized TickSample to Profiler to log into v8.log.

This patch splits Ticker into two samplers, the first one remains in log.cc to
collect samples and pass to Profiler for logging, the second one will be called
by ProfilerEventsProcessor, and only use the circular queue only.

BUG=v8:4789
LOG=N

Review-Url: https://codereview.chromium.org/2108393002
Cr-Commit-Position: refs/heads/master@{#37506}

BUG=

Review-Url: https://codereview.chromium.org/2112933002
Cr-Commit-Position: refs/heads/master@{#37505}

Implements the change proposed at https://github.com/tc39/ecma262/pull/593.

In summary, Object.getOwnPropertyDescriptors can produce results which cause
Object.defineProperties() to throw, by inserting a property with an undefined
descriptor into the result object. This change to the algorithm requires that
the descriptor only be added to the result object if it is not undefined.

BUG=v8:4725
R=littledan@chromium.org, adamk@chromium.org, jwolfe@igalia.com

Review-Url: https://codereview.chromium.org/2118613003
Cr-Commit-Position: refs/heads/master@{#37504}

TBR=jochen

BUG=none

Review-Url: https://codereview.chromium.org/2124483002
Cr-Commit-Position: refs/heads/master@{#37503}

- Remove unused flags (SweepingParallelism, SweepingMode)
- Make them runtime parameters rather then template parameters
- Deduce skip list rebuilding from the page itself

BUG=

Review-Url: https://codereview.chromium.org/2124433002
Cr-Commit-Position: refs/heads/master@{#37502}

This is compatible with what Crankshaft does, and therefore should be
safe. The runtime doesn't perform any JavaScript-observable side
effects during the stack check.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2118253002
Cr-Commit-Position: refs/heads/master@{#37501}

Stack trace generation requires access to the receiver; and while the
receiver is already on the stack, we cannot determine its position
during stack trace generation (it's stored in argv[0], and argc is only
stored in a callee-saved register).

This patch grants access to the receiver by pushing argc onto builtin
exit frames as an extra argument. Compared to simply pushing the
receiver, this requires an additional dereference during stack trace
generation, but one fewer during builtin calls.

BUG=v8:4815

Review-Url: https://codereview.chromium.org/2106883003
Cr-Commit-Position: refs/heads/master@{#37500}

Port bd0d9e7d

BUG=

Review-Url: https://codereview.chromium.org/2122643003
Cr-Commit-Position: refs/heads/master@{#37499}

LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2116203002
Cr-Commit-Position: refs/heads/master@{#37498}

[fullcode][mips][mips64][ppc][s390] Avoid trashing of a home object when doing a keyed store to a super.

BUG=chromium:625590

Review-Url: https://codereview.chromium.org/2120963002
Cr-Commit-Position: refs/heads/master@{#37497}

  port 0a0fe8fb (r37476)

  original commit message:
  Import fdlibm versions of acos, acosh, asin and asinh, which are more
  precise and produce the same result across platforms (we were using
  libm versions for asin and acos so far, where both speed and precision
  depended on the operating system so far). Introduce appropriate TurboFan
  operators for these functions and use them both for inlining and for the
  generic builtin.

  Also migrate the Math.imul and Math.fround builtins to TurboFan builtins
  to ensure that their behavior is always exactly the same as the inlined
  TurboFan version (i.e. C++ truncation semantics for double to float
  don't necessarily meet the JavaScript semantics).

  For completeness, also migrate Math.sign, which can even get some nice
  love in TurboFan.

  Drive-by-fix: Some alpha-sorting on the Math related functions, and
  cleanup the list of Math intrinsics that we have to export via the
  native context currently.

BUG=

Review-Url: https://codereview.chromium.org/2122643002
Cr-Commit-Position: refs/heads/master@{#37496}

[crankshaft] Use canonical nan_value or minus_zero_value objects instead of constant heap numbers with NaN or -0.0 values.

BUG=chromium:625547

Review-Url: https://codereview.chromium.org/2115413002
Cr-Commit-Position: refs/heads/master@{#37495}

  The CL #37448 (https://codereview.chromium.org/2105313002) exposed one hidden bug in x87 turbofan compiler's code generation.

  This CL fixed that bugs.

BUG=

Review-Url: https://codereview.chromium.org/2117003002
Cr-Commit-Position: refs/heads/master@{#37494}

The re-typer now only types a node if its inputs are all typed with the
exception of phi nodes. This works because all cycles in the graph have
to contain a phi node.

BUG=chromium:625558

Review-Url: https://codereview.chromium.org/2120243002
Cr-Commit-Position: refs/heads/master@{#37493}

BUG=chromium:474921

Review-Url: https://codereview.chromium.org/2109293004
Cr-Commit-Position: refs/heads/master@{#37492}

  port cede9ce5 (r37424)

  original commit message:

BUG=

Review-Url: https://codereview.chromium.org/2118133002
Cr-Commit-Position: refs/heads/master@{#37491}

  port 5febc27b (r37416)

  original commit message:
  Prior to this commit, calls to C++ builtins created standard exit
  frames, which are skipped when constructing JS stack traces. In order to
  show these calls on traces, we introduce a new builtin exit frame type.

  Builtin exit frames contain target and new.target on the stack and are
  not skipped during stack trace construction.

BUG=

Review-Url: https://codereview.chromium.org/2120873002
Cr-Commit-Position: refs/heads/master@{#37490}

  port c0d4bb89 (r37370)

  original commit message:
  Operand(reg) -> reg
  Operand(reg, 0) -> [reg]

BUG=

Review-Url: https://codereview.chromium.org/2119103002
Cr-Commit-Position: refs/heads/master@{#37489}

Since python3 does not use the old print statement, it may not be able
to load gdb-v8-support.py script in gdb as below:

  (gdb) source tools/gdb-v8-support.py
    File "tools/gdb-v8-support.py", line 170
      print result
                 ^
  SyntaxError: Missing parentheses in call to 'print'

This fixes print statement for both python2 and python3.

R=jochen@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2084163004
Cr-Commit-Position: refs/heads/master@{#37488}

Revert of Amends the TypedArray constructor to use the path for primitives for all (patchset #4 id:60001 of https://codereview.chromium.org/2096873002/ )

Reason for revert:
Speculative revert to unblock roll https://codereview.chromium.org/2114113002/

Original issue's description:
> Amends the TypedArray constructor to use the path for primitives for all
> types of primitives, not just undefined, booleans, numbers, and strings.
> (The missing cases were null and Symbol.) This is required by the
> specification, and there are test262 tests which we were failing due to
> this bug.
>
> BUG=v8:5124
>
> Committed: https://crrev.com/f788bd9cce19815cba746e47bb65abfe25c16208
> Committed: https://crrev.com/f772c22cd1c492aa0235a8e6012d0386146d2eb2
> Cr-Original-Commit-Position: refs/heads/master@{#37234}
> Cr-Commit-Position: refs/heads/master@{#37407}

TBR=littledan@chromium.org,bakkot@google.com
NOTREECHECKS=true
BUG=v8:5124

Review-Url: https://codereview.chromium.org/2120763002
Cr-Commit-Position: refs/heads/master@{#37487}

Rolling v8/build to 76d9f8b4fcae07fb82f28295468cf92bade935bd

Rolling v8/buildtools to db6179b29f90d28026b0cb23ef71d56ec31b8bd6

Rolling v8/tools/clang to 775e2f874b9f53f0e82c4e7c61dc29f3cdcb3379

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2117993002
Cr-Commit-Position: refs/heads/master@{#37486}

BUG=v8:4663
R=littledan@chromium.org, adamk@chromium.org

Review-Url: https://codereview.chromium.org/2116053003
Cr-Commit-Position: refs/heads/master@{#37485}