Downside: this adds all kinds of weird includes in the .cc files.

(See design doc linked in the bug.)

BUG=v8:5402

Review-Url: https://codereview.chromium.org/2622503002
Cr-Commit-Position: refs/heads/master@{#42140}

The pattern IsNull(isolate) || IsUndefined(isolate) is used in many places all
over the code base.

Review-Url: https://codereview.chromium.org/2601503002
Cr-Commit-Position: refs/heads/master@{#42138}

ToName, ToObject, and ToNumber do not need an
eager checkpoint.

BUG=

Review-Url: https://codereview.chromium.org/2623473002
Cr-Commit-Position: refs/heads/master@{#42136}

We did not associate any position to the stack check in the wasm
function prologue, hence a check failed later when trying to map the
non-existent position to the asm.js source position.

With this CL, we add a mapping to the source position table, mapping
the stack check call to byte offset 0 (which is distinct from any valid
instruction position). Also, we add another entry to the asm.js source
position sidetable, mapping byte offset 0 to the start source position
of the function body.

R=titzer@chromium.org, ahaas@chromium.org
BUG=chromium:677685

Review-Url: https://codereview.chromium.org/2609363004
Cr-Commit-Position: refs/heads/master@{#42130}

The two remaining uses of this intrinsic in debug.js and mirrors.js now
simply rely on the runtime function.

BUG=v8:5339

Review-Url: https://codereview.chromium.org/2591923003
Cr-Original-Commit-Position: refs/heads/master@{#41892}
Committed: https://chromium.googlesource.com/v8/v8/+/c9cb94a06fa7a863d24dd6760b66cecd55748abf
Review-Url: https://codereview.chromium.org/2591923003
Cr-Commit-Position: refs/heads/master@{#42128}

X87: Revert of [turbofan] Improve codegen for 8- and 16-bit memory comparisons on Intel platforms (patchset #3 id:40001 of https://codereview.chromium.org/2605863002/ ).

  port c16ca32e (r42092)

  original commit message:
  Reason for revert:
  Breaks wasm benchmark (http://crbug.com/v8/5798).

  Original issue's description:
  > [turbofan] Improve codegen for 8- and 16-bit memory comparisons on Intel platforms
  >
  > Recognize and emit in-memory comparisons of 8-bit and 16-bit values with
  > immediate values that fit.
  >
  > LOG=N
  > R=epertoso@chromium.org
  >
  > Review-Url: https://codereview.chromium.org/2605863002
  > Cr-Commit-Position: refs/heads/master@{#41971}
  > Committed: https://chromium.googlesource.com/v8/v8/+/be11812c53ff6c8ce320887bc76a3b60d8103695

BUG=

Review-Url: https://codereview.chromium.org/2622463002
Cr-Commit-Position: refs/heads/master@{#42126}

If one input to JSStrictEqual/JSNotStrictEqual is Unique (except
InternalizedString) or the hole, then we can turn that into a
direct pointer comparison, as such values are only equal to exactly
the same unique value.

BUG=v8:5267
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2611363002
Cr-Commit-Position: refs/heads/master@{#42122}

Variables requiring initialization are already forced into ignition,
so all the code supporting hole checks in full-codegen and
ast-graph-builder is dead.

R=bmeurer@chromium.org
BUG=v8:5657

Review-Url: https://codereview.chromium.org/2615033002
Cr-Commit-Position: refs/heads/master@{#42112}

This patch adds parsing of spread object property.

-- Changes ParsePropertyName to parse Token::ELLIPSIS.
-- Throws if rest is encountered by setting a pattern error.
-- Adds a new PropertyKind enum (SPREAD)
-- Adds a new ObjectLiteralProperty::kind (SPREAD)
-- Adds a new harmony-object-spread flag and protects the parser code
with it.
-- Adds a new runtime function called CopyDataProperties
-- Does not add any support for this feature in fullcodegen.
-- Ignition calls out to a runtime function CopyDataProperties to
perform spread operation.
-- Move FastAssign from builtins-objects.cc to objects.cc
-- Refactor Builtin_ObjectAssign to use SetOrCopyDataProperties

Object rest will be implemented in a follow on patch.

BUG=v8:5549

Review-Url: https://codereview.chromium.org/2606833002
Cr-Commit-Position: refs/heads/master@{#42102}

BUG=None

Review-Url: https://codereview.chromium.org/2609173005
Cr-Commit-Position: refs/heads/master@{#42094}

Revert of [turbofan] Improve codegen for 8- and 16-bit memory comparisons on Intel platforms (patchset #3 id:40001 of https://codereview.chromium.org/2605863002/ )

Reason for revert:
Breaks wasm benchmark (http://crbug.com/v8/5798).

Original issue's description:
> [turbofan] Improve codegen for 8- and 16-bit memory comparisons on Intel platforms
>
> Recognize and emit in-memory comparisons of 8-bit and 16-bit values with
> immediate values that fit.
>
> LOG=N
> R=epertoso@chromium.org
>
> Review-Url: https://codereview.chromium.org/2605863002
> Cr-Commit-Position: refs/heads/master@{#41971}
> Committed: https://chromium.googlesource.com/v8/v8/+/be11812c53ff6c8ce320887bc76a3b60d8103695

TBR=danno@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.

Review-Url: https://codereview.chromium.org/2618443003
Cr-Commit-Position: refs/heads/master@{#42092}

Add a more efficient encoding for state values that have a large number of
optimized-out inputs.

Review-Url: https://codereview.chromium.org/2509623002
Cr-Commit-Position: refs/heads/master@{#42088}

Add a feedback vector slot for computed property names in object
and class literals. Introduce new slot kind for storing
computed property names.

Change StaDataPropertyInLiteral to use the accumulator (again), so
we don't exceed Bytecodes::kMaxOperands.

We assume that most computed property names are
symbols. Therefore we should see performance
improvements, even if we deal with monomorphic ICs only.

This CL only collects feedback but does not use
it in Reduce() yet.

BUG=v8:5624

Review-Url: https://codereview.chromium.org/2587393006
Cr-Commit-Position: refs/heads/master@{#42082}

R=bmeurer@chromium.org
BUG=chromium:677757

Review-Url: https://codereview.chromium.org/2606383005
Cr-Commit-Position: refs/heads/master@{#42066}

Recognize the special

  NumberFloor(NumberDivide(lhs, rhs))

subgraph in TypedOptimization, where both lhs and rhs are in the
Unsigned32 range, and the result is a PlainNumber, and replace the
NumberFloor with a NumberToUint32 truncation.

This could be done in a cleaner way if we have a dedicated type for all
double values in the Unsigned32 range, but that would complicate the
type system quite a bit.

R=jarin@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2614663002
Cr-Commit-Position: refs/heads/master@{#42063}

BUG=v8:5267
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2612763002
Cr-Commit-Position: refs/heads/master@{#42060}

Also rule out -0 for NumberDivide if possible, and rule out NaN and -0
for NumberFloor if possible.

R=jarin@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2609373002
Cr-Commit-Position: refs/heads/master@{#42059}

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2616613002
Cr-Commit-Position: refs/heads/master@{#42058}

This CL simplifies the relation between the wasm graph builder, the
wasm decoder, and the wasm module they work on.

BUG=

Review-Url: https://codereview.chromium.org/2612643002
Cr-Commit-Position: refs/heads/master@{#42056}

Per spec change in https://github.com/tc39/ecma262/pull/724, this adds
the exception thrown when a TypedArray's array buffer is detached at
some point during iteration, after the iterator has already been
created.

BUG=v8:5388
R=littledan@chromium.org, bmeurer@chromium.org, petermarshall@chromium.org

Review-Url: https://codereview.chromium.org/2609913002
Cr-Commit-Position: refs/heads/master@{#42048}

The previous patch for this bug (https://codereview.chromium.org/2599793002/) was wrong because it changed the behavior of isCreatedPhi() in an incompatible way. The actual source of the bug is that escape analysis propagates information along cycles without considering the previous analysis value. This fix makes sure that if a previous merge cleared a field, then it stays cleared.

R=bmeurer@chromium.org

BUG=chromium:670202

Review-Url: https://codereview.chromium.org/2610703002
Cr-Commit-Position: refs/heads/master@{#42045}

Review-Url: https://codereview.chromium.org/2602413002
Cr-Commit-Position: refs/heads/master@{#42041}

BUG=v8:5428

Review-Url: https://codereview.chromium.org/2613463002
Cr-Commit-Position: refs/heads/master@{#42038}

BUG=v8:5428
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2602403002
Cr-Commit-Position: refs/heads/master@{#42036}

Call the %DateCurrentTime runtime function directly instead, which is
cheaper than calling the C++ builtin.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2612513003
Cr-Commit-Position: refs/heads/master@{#42028}

BUG=v8:5428

Review-Url: https://codereview.chromium.org/2606273002
Cr-Commit-Position: refs/heads/master@{#42027}

Changes some for loops to use node->inputs() instead of iterating over
InputCount and accessing InputAt(i). This saves some checks for
"has_inline_inputs" and so some branches.

Review-Url: https://codereview.chromium.org/2585713002
Cr-Commit-Position: refs/heads/master@{#42024}

Revert of [turbofan] fix another divergence in escape analysis (patchset #1 id:1 of https://codereview.chromium.org/2599793002/ )

Reason for revert:
Caused memory corruption.

BUG=chromium:676767

Original issue's description:
> [turbofan] fix another divergence in escape analysis
>
> This divergence bug is very similar to the one fixed in https://codereview.chromium.org/2522253002/, this time it is an oscillation between a cleared field and a new phi node. The page http://www.sears.com/clothing-shoes-jewelry-clothing-men-s-clothing-men-s-jeans/b-1325287370?Brand=LEE&filterList=Brand&sortOption=UNITS_HIGH_TO_LOW allows for a reliable reproduction.
>
> This fix makes sure that once a field that generated a phi gets cleared, it always stays cleared.
>
> BUG=chromium:670202
>
> R=bmeurer@chromium.org
>
> Review-Url: https://codereview.chromium.org/2599793002
> Cr-Commit-Position: refs/heads/master@{#41922}
> Committed: https://chromium.googlesource.com/v8/v8/+/8435cc852672c504d5899cc2765c5b895e658efe

TBR=bmeurer@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=chromium:670202

Review-Url: https://codereview.chromium.org/2611623002
Cr-Commit-Position: refs/heads/master@{#42023}

  port be11812c (r41971)

  original commit message:
  Recognize and emit in-memory comparisons of 8-bit and 16-bit values with
  immediate values that fit.

BUG=

Review-Url: https://codereview.chromium.org/2612503002
Cr-Commit-Position: refs/heads/master@{#42017}

The ControlEquivalence cannot deal with new nodes inserted by the
Scheduler due to Node splitting. Rather when the ControlEquivalence
sees such a new Node, it'll likely crash on an out-of-bounds access.

This is a speculative fix to make the crash disappear, as there's no
100% reliable repro currently.

BUG=chromium:629398
TBR=jochen@chromium.org

Review-Url: https://codereview.chromium.org/2611603002
Cr-Commit-Position: refs/heads/master@{#42016}

Hook up TurboFan with the existing field type tracking machinery to
eliminate redundant map checks on the results of LoadField operators.
The store side is already implemented in TurboFan for quite some time,
this just adds the load part.

R=jarin@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2604393002
Cr-Commit-Position: refs/heads/master@{#42015}

- Adds CodeAssembler::ConstructJS() to simplify calling JS functions as
constructors, used by NewPromiseCapability()
- Defines PromiseCapability as a special JSObject subclass, with a
non-exensible Map, and read-only non-configurable DataDescriptors which
point to its in-object fields. This allows its fields to be used by JS
builtins until there is no longer any need.

Currently, the performance benefit comes from
https://codereview.chromium.org/2567033003/, but does not appear to
regress performance in any significant way.

BUG=v8:5343
TBR=ulan@chromium.org

Review-Url: https://codereview.chromium.org/2567333002
Cr-Commit-Position: refs/heads/master@{#42014}

Review-Url: https://codereview.chromium.org/2571903004
Cr-Commit-Position: refs/heads/master@{#42013}

R=jarin@chromium.org
BUG=v8:5428

Review-Url: https://codereview.chromium.org/2611523002
Cr-Commit-Position: refs/heads/master@{#42012}

Store maps on the CheckMaps operator instead of burning inputs for
the individual maps. Use the same data structure (the ZoneHandleSet)
in the LoadElimination to track multiple maps per object.

BUG=v8:5267
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2431563002
Cr-Commit-Position: refs/heads/master@{#42010}

Add machinery to Ignition and TurboFan to collect and consume
InternalizedString feedback for abstract and strict equality
comparisons. Here we can turn the comparison into a simple
pointer equality check.

R=jarin@chromium.org
BUG=v8:5786

Review-Url: https://codereview.chromium.org/2609013002
Cr-Commit-Position: refs/heads/master@{#42008}

R=epertoso@chromium.org
BUG=5428

Review-Url: https://codereview.chromium.org/2607243002
Cr-Commit-Position: refs/heads/master@{#42003}

The following ported to builtins:
FastCloneRegExp
FastCloneShallowArray
FastCloneShallowObject

BUG=
TBR=rmcilroy@chromium.org, rossberg@chromium.org

Review-Url: https://codereview.chromium.org/2605893002
Cr-Commit-Position: refs/heads/master@{#41989}

BUG=
TBR=rmcilroy@chromium.org

Review-Url: https://codereview.chromium.org/2604833004
Cr-Commit-Position: refs/heads/master@{#41988}

BUG=
R=epertoso@chromium.org

Review-Url: https://codereview.chromium.org/2602903004
Cr-Commit-Position: refs/heads/master@{#41987}