This removes uses of JSFunction by the (proper) deoptimizer. This will be useful
when we escape analyze JSFunction away. Unfortunately, the debugger still needs
JSFunction, so escape analysis would not work yet.

Review URL: https://codereview.chromium.org/1686183003

Cr-Commit-Position: refs/heads/master@{#33891}

BUG=

Committed: https://crrev.com/5833e8e8a437cd66405784263ccc45e73470fd42
Cr-Commit-Position: refs/heads/master@{#33870}

Review URL: https://codereview.chromium.org/1683043003

Cr-Commit-Position: refs/heads/master@{#33890}

Revert of [counters] moving runtime counters to counter.h (patchset #1 id:1 of https://codereview.chromium.org/1688783005/ )

Reason for revert:
failing gc-stress tests

Original issue's description:
> Reland of [counters] moving runtime counters to counter.h (patchset #1 id:1 of https://codereview.chromium.org/1681923003/ )
>
> Reason for revert:
> This CL was not the cause for the TSAN failures, the instruction-selector backend for x64 emitted  a wrong compare which accidentally showed up with tsan + code moves.
> The instruction-selectors changes have been reverted with https://codereview.chromium.org/1693433002
>
> Original issue's description:
> > Revert of [counters] moving runtime counters to counter.h (patchset #1 id:1 of https://codereview.chromium.org/1678973002/ )
> >
> > Reason for revert:
> > [Sheriff] Breaks TSAN:
> > https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20TSAN/builds/7727
> >
> > Original issue's description:
> > > [counters] moving runtime counters to counter.h
> > >
> > > Additionally list C++ builtins as well under --runtime_call_stats.
> > > Let's try to keep all counters in one place, that makes it a bit
> > > easier to maintain and especially discard unused ones.
> > >
> > > BUG=
> > >
> > > Committed: https://crrev.com/6bc71431995d49d4ca4a2ea9c75e5add5f345225
> > > Cr-Commit-Position: refs/heads/master@{#33847}
> >
> > TBR=jarin@chromium.org,cbruni@chromium.org
> > # Skipping CQ checks because original CL landed less than 1 days ago.
> > NOPRESUBMIT=true
> > NOTREECHECKS=true
> > NOTRY=true
> > BUG=
> >
> > Committed: https://crrev.com/2d669b96639517cfc33e6fc6d4c3814587bc7366
> > Cr-Commit-Position: refs/heads/master@{#33848}
>
> TBR=jarin@chromium.org,machenbach@chromium.org
> # Not skipping CQ checks because original CL landed more than 1 days ago.
> BUG=
>
> Committed: https://crrev.com/ad943fe44ede22b90b871e1233334dff5ff545c3
> Cr-Commit-Position: refs/heads/master@{#33887}

TBR=jarin@chromium.org,machenbach@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1687313002

Cr-Commit-Position: refs/heads/master@{#33889}

This is a follow-up to https://crrev.com/1671863002, adding the
capability to print the contents of the constant pool. The expected
type of the pool is taken from command line, and it's either:

* string/int/double: assume all constants have the specified type.
  This way, we can emit a meaningful representation, e.g. a quoted
  string for type string and so on. All the constants in the pool must
  have the same type, otherwise one or more CHECK() will fail and the
  program will eventually crash.

* mixed: print the InstanceType tag instead of the actual value.
  This is the choice for those tests where the type of the constants in
  the pool is not uniform, however only a type tag is printed, not the
  actual value of the entries. SMIs are an exception, since they do not
  have an InstanceType tag, so kInstanceTypeDontCare is printed instead.

In addition to that, functions Print{ExpectedSnippet,BytecodeSequence}
have been extracted with no functional change. It's just for improving
readability, since the code is becoming quite long.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1686963002

Cr-Commit-Position: refs/heads/master@{#33888}

Reland of [counters] moving runtime counters to counter.h (patchset #1 id:1 of https://codereview.chromium.org/1681923003/ )

Reason for revert:
This CL was not the cause for the TSAN failures, the instruction-selector backend for x64 emitted  a wrong compare which accidentally showed up with tsan + code moves.
The instruction-selectors changes have been reverted with https://codereview.chromium.org/1693433002

Original issue's description:
> Revert of [counters] moving runtime counters to counter.h (patchset #1 id:1 of https://codereview.chromium.org/1678973002/ )
>
> Reason for revert:
> [Sheriff] Breaks TSAN:
> https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20TSAN/builds/7727
>
> Original issue's description:
> > [counters] moving runtime counters to counter.h
> >
> > Additionally list C++ builtins as well under --runtime_call_stats.
> > Let's try to keep all counters in one place, that makes it a bit
> > easier to maintain and especially discard unused ones.
> >
> > BUG=
> >
> > Committed: https://crrev.com/6bc71431995d49d4ca4a2ea9c75e5add5f345225
> > Cr-Commit-Position: refs/heads/master@{#33847}
>
> TBR=jarin@chromium.org,cbruni@chromium.org
> # Skipping CQ checks because original CL landed less than 1 days ago.
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=
>
> Committed: https://crrev.com/2d669b96639517cfc33e6fc6d4c3814587bc7366
> Cr-Commit-Position: refs/heads/master@{#33848}

TBR=jarin@chromium.org,machenbach@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=

Review URL: https://codereview.chromium.org/1688783005

Cr-Commit-Position: refs/heads/master@{#33887}

1) Update profiling counters in Full codegen.
2) Call Runtime::kTraceTailCall when tracing is on

test/mjsunit/es6/tail-call-simple.js is disabled for now, because Turbofan does not fully support TCO yet.

BUG=v8:4698
LOG=N

Review URL: https://codereview.chromium.org/1670133002

Cr-Commit-Position: refs/heads/master@{#33886}

This CL also removes tail call support made so far from Crankshaft.

BUG=v8:4698
LOG=N

Review URL: https://codereview.chromium.org/1683793004

Cr-Commit-Position: refs/heads/master@{#33885}

Revert of [turbofan] Fixes the code generation for branches on x64 when the condition is Word64Equal. (patchset #1 id:1 of https://codereview.chromium.org/1677503002/ )

Reason for revert:
Code like the example given in the CL description was produced, for example, by code-stub-assembler.cc.

Reverting this, and try to fix the root cause instead.

Original issue's description:
> [turbofan] Fixes the code generation for branches on x64 when the condition is Word64Equal.
>
> Before:
>
> REX.W cmpq r9,r8
> setzl r8l
> movzxbl r8,r8
> REX.W cmpq r8,0x0
> jz 185
>
> After:
>
> REX.W cmpq r9,r8
> jnz 149
>
> Committed: https://crrev.com/75cc8352d06aada2e9131fdae793299ef73fb639
> Cr-Commit-Position: refs/heads/master@{#33784}

TBR=bmeurer@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.

Review URL: https://codereview.chromium.org/1693433002

Cr-Commit-Position: refs/heads/master@{#33884}

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=mjsunit/asm-wasm
R=aseemgarg@chromium.org,titzer@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1687813003

Cr-Commit-Position: refs/heads/master@{#33883}

JS_FRAME_FUNCTION can be expressed using the STACK_SLOT translation.

Review URL: https://codereview.chromium.org/1688023003

Cr-Commit-Position: refs/heads/master@{#33882}

There are a bunch of places in our builtins where we use %_Arguments and
%_ArgumentsLength for no good reason, as arguments object and/or rest
parameter is as good and performant in these cases. Now the only uses
of %_Arguments and %_ArgumentsLength left are in string.js, which
requires dedicated investigation.

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_nosnap_dbg
R=yangguo@chromium.org

Committed: https://crrev.com/2160429fd458e3c095475e718c97f77ac90d906f
Cr-Commit-Position: refs/heads/master@{#33834}

Review URL: https://codereview.chromium.org/1678953004

Cr-Commit-Position: refs/heads/master@{#33881}

Add dedicated %LoadLookupSlot, %LoadLookupSlotInsideTypeof,
%LoadLookupSlotForCall, %StoreLookupSlot_Sloppy and
%StoreLookupSlot_Strict runtime entry points and use them
appropriately in the various compilers. This way we can
finally drop the machine operators from the JS graph level
completely in TurboFan.

Also drop the funky JSLoadDynamic operator from TurboFan,
which was by now just a small wrapper around the runtime
call to %LoadLookupSlot.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1683103002

Cr-Commit-Position: refs/heads/master@{#33880}

Rolling v8/build/gyp to 5170bfd38fe79bd5b16aa7f6c5439fb90a37ae66

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1685413002

Cr-Commit-Position: refs/heads/master@{#33879}

Port 5de27c34

Original commit message:
    Calls use registers for target, new_target and argument count.
    We don't always respect argument count. It didn't bite us in the past
    because the code paths where we clobbered it never used it, though
    in future it could be an issue.

R=mvstanton@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1687943002

Cr-Commit-Position: refs/heads/master@{#33878}

Port cfbd2561

Original commit message:

    Preparing the young generation for (real) non-contiguous backing memory, this
    change removes object masks that are used to compute containment in semi and new
    space. The masks are replaced by lookups for object tags and page headers, where
    possible.

    Details:
    - Use the fast checks (page header lookups) for containment in regular code.
    - Use the slow version that masks out the page start adress and iterates all
      pages of a space for debugging/verification.
    - The slow version works for off-heap/unmapped memory.
    - Encapsulate all checks for the old->new barrier in Heap::RecordWrite().

R=mlippautz@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=chromium:581412
LOG=N

Review URL: https://codereview.chromium.org/1687113002

Cr-Commit-Position: refs/heads/master@{#33877}

PPC: Mark null and undefined as undetectable, and use it to handle abstract equality comparison in the generic compare ic

Port 3ce9e808

Original commit message:
    Marking as undetectable makes abstract equality of null, undefined, and
    other undetectable objects easier. Supporting it in the generic compare
    IC significantly speeds up dynamic comparison between those values and
    JSReceivers by not falling back to the runtime.

R=verwaest@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1684133003

Cr-Commit-Position: refs/heads/master@{#33876}

Black allocation during scavenges will push objects on the marking deque that point to to-space. They should not be cleared.

BUG=chromium:561449
LOG=n

Review URL: https://codereview.chromium.org/1683983003

Cr-Commit-Position: refs/heads/master@{#33875}

The previous implementation used GetRawOperand(), which allows a nicely
unified handling of all scalar types, but returns an unsigned type.
Because of this, generate-bytecode-expectations couldn't properly handle
negative numbers.

This commit differentiate between different types of scalar operands and
uses the appropriate getter from i::interpreter::BytecodeArrayIterator,
thus correctly handling signed types where needed.

Two new helpers have been added to i::interpreter::Bytecodes:

 * IsImmediateOperandType()
 * IsIndexOperandType()

with the intuitive semantic.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1684113002

Cr-Commit-Position: refs/heads/master@{#33874}

Moves InterpreterAssembler out of the compiler directory and into the
interpreter directory. Makes InterpreterAssembler as subclass of
CodeStubAssembler.

As part of this change, the special bytecode dispatch linkage type
is removed and instead we use a InterfaceDispatchDescriptor and
a normal CodeStub linkage type.

Removes a bunch of duplicated logic in InterpreterAssembler and
instead uses the CodeStubAssembler logic. Refactors Interpreter
with these changes.

Modifies CodeStubAssembler to add the extra operations required
by the Interpreter (extra call types, raw memory access and some extra
binary ops). Also adds the ability for subclasses to add extra
prologue and epilogue operations around calls, which is required
for the Interpreter.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1673333004

Cr-Commit-Position: refs/heads/master@{#33873}

Currently we only support general categories for property classes.

R=erik.corry@gmail.com, erikcorry@chromium.org, littledan@chromium.org
BUG=v8:4743
LOG=N

Review URL: https://codereview.chromium.org/1685593002

Cr-Commit-Position: refs/heads/master@{#33872}

Revert of Implement symbol @@hasInstance for ES6 instanceof support. (patchset #2 id:20001 of https://codereview.chromium.org/1683043003/ )

Reason for revert:
[Sheriff] Breaks:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20nosnap%20-%20debug/builds/1382/

Original issue's description:
> Implement symbol @@hasInstance for ES6 instanceof support.
>
> BUG=
>
> Committed: https://crrev.com/5833e8e8a437cd66405784263ccc45e73470fd42
> Cr-Commit-Position: refs/heads/master@{#33870}

TBR=bmeurer@chromium.org,mvstanton@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1686123002

Cr-Commit-Position: refs/heads/master@{#33871}

BUG=

Review URL: https://codereview.chromium.org/1683043003

Cr-Commit-Position: refs/heads/master@{#33870}

The break location heavily relies on relocation info. This change
abstracts that away. Currently there is only one implementation for
this interface, for JIT code. Future changes will introduce an
implementation to iterate bytecode arrays.

R=rmcilroy@chromium.org, vogelheim@chromium.org
BUG=v8:4690
LOG=N

Review URL: https://codereview.chromium.org/1682853003

Cr-Commit-Position: refs/heads/master@{#33869}

This reduces runtime of https://github.com/kpdecker/six-speed/blob/master/tests/for-of-array/for-of-array.es6 by 40%.

BUG=

Review URL: https://codereview.chromium.org/1681143003

Cr-Commit-Position: refs/heads/master@{#33868}

[builtins] Speedup Object.keys by adding a fast path for objects without elements, interceptors, ...

This speeds up the for-of-object benchmark at
http://kpdecker.github.io/six-speed/ by >2x.

BUG=

Review URL: https://codereview.chromium.org/1682873003

Cr-Commit-Position: refs/heads/master@{#33867}

Let the world know (if it cares) that this is the kind of
silliness that JS engines have to partake in if they want
to look good on Sunspider (this should give 5% overall).

Review URL: https://codereview.chromium.org/1684093002

Cr-Commit-Position: refs/heads/master@{#33866}

Calls use registers for target, new_target and argument count.
We don't always respect argument count. It didn't bite us in the past
because the code paths where we clobbered it never used it, though
in future it could be an issue.

BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1683593003

Cr-Commit-Position: refs/heads/master@{#33865}

R=jochen@chromium.org, verwaest@chromium.org
BUG=chromium:585724
LOG=N

Review URL: https://codereview.chromium.org/1681513002

Cr-Commit-Position: refs/heads/master@{#33864}

generate-bytecode-expectations is a tool intended to work together
with test/cctest/test-bytecode-generator.cc in order to produce a
meaningful diff between testcases and the actual bytecode being emitted.

It does so by parsing and compiling Javascript to bytecode,
constructing the same data structure in the testcase and then running a
textual diff between the expected (i.e. the one encoded in the unit test)
and actual (i.e. the one built from the compiler output) representation.

This commit is a first step in this direction, achieving just the first
half of what we desire. At the moment, bytecodechecker can:

* take a code snippet from the command line and emit the expected structure.
* adhere to the same formatting rules of the test cases
  (this one is important for text diff and for copy and pasting too)

Still to do:

* parse unit tests:
    + extract code snippets
    + indent the code to match the input test case
    + allow flexibility in the input format
    + try to recognize and work around some macro magic (i.e. REPEAT_127)
* emit the representation of the constant pool and handlers vector
* run a textual diff

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1671863002

Cr-Commit-Position: refs/heads/master@{#33863}

R=littledan@chromium.org, verwaest@chromium.org
BUG=v8:4524
LOG=N

Review URL: https://codereview.chromium.org/1679123007

Cr-Commit-Position: refs/heads/master@{#33862}

Since https://codereview.chromium.org/1683643002/ null and undefined are
also marked as undetectable. If we anyway need to check for that case,
we can drop the null/undefined checks.

BUG=

Review URL: https://codereview.chromium.org/1681813004

Cr-Commit-Position: refs/heads/master@{#33861}

The field in question is only needed when the optimizing compiler is
triggered via OSR. All other paths (e.g. from bytecode stream) should
not rely on the unoptimized code being present.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1685633002

Cr-Commit-Position: refs/heads/master@{#33860}

If Array.from is passed an iterable, then it will copy the contents
to the newly created Array (or subclass). The iteration protocol here
includes calling IteratorClose if the loop is exited early due to an
exception thrown. This patch converts Array.from to use a for-of loop
rather than explicitly invoking the iteration protocol so that, when
IteratorClose is invoked on early for-of exit, then Array.from will
call IteratorClose in the appropriate case.

R=neis
LOG=Y
BUG=v8:4739

Review URL: https://codereview.chromium.org/1686433003

Cr-Commit-Position: refs/heads/master@{#33859}

Mark null and undefined as undetectable, and use it to handle abstract equality comparison in the generic compare ic

Marking as undetectable makes abstract equality of null, undefined, and
other undetectable objects easier. Supporting it in the generic compare
IC significantly speeds up dynamic comparison between those values and
JSReceivers by not falling back to the runtime.

MIPS port contributed by Balazs Kilvady <balazs.kilvady@imgtec.com>

Review URL: https://codereview.chromium.org/1683643002

Cr-Commit-Position: refs/heads/master@{#33858}

Preparing the young generation for (real) non-contiguous backing memory, this
change removes object masks that are used to compute containment in semi and new
space. The masks are replaced by lookups for object tags and page headers, where
possible.

Details:
- Use the fast checks (page header lookups) for containment in regular code.
- Use the slow version that masks out the page start adress and iterates all
  pages of a space for debugging/verification.
- The slow version works for off-heap/unmapped memory.
- Encapsulate all checks for the old->new barrier in Heap::RecordWrite().

BUG=chromium:581412
LOG=N

Review URL: https://codereview.chromium.org/1632913003

Cr-Commit-Position: refs/heads/master@{#33857}

This makes sure we can run through the TurboFan pipeline without having
to parse the source when using the bytecode stream as input. This path
is now being tested by the BytecodeGraphTester helper.

R=titzer@chromium.org,rmcilroy@chromium.org

Review URL: https://codereview.chromium.org/1679313002

Cr-Commit-Position: refs/heads/master@{#33856}

See https://github.com/tc39/ecma262/pull/331.

R=rossberg
BUG=

Review URL: https://codereview.chromium.org/1680133002

Cr-Commit-Position: refs/heads/master@{#33855}

Fix JSLoadGlobal/JSStoreGlobal, JSLoadNamed/JSStoreNamed and
JSLoadProperty/JSStoreProperty to take the current function closure
instead of the type feedback as input, and load the feedback vector
from the closure as required (in JSGenericLowering). There's still
JSLoadDynamic left to be done, and then we don't have any machine
operators in the initial JS graph left.

There'll be more refactoring on the JSGenericLowering in a follow-up
CL, which takes care of the current code duplication and also tries
to use the more efficient LoadIC/KeyedLoadIC instead of the current
LoadICInOptimizedCode/KeyedLoadICInOptimizedCode (and same for store
ICs) whenever possible.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1683043002

Cr-Commit-Position: refs/heads/master@{#33854}

Rolling v8/build/gyp to 66bbdf4c6b450d55bd9e53fd18d9628a8f328398

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1686933002

Cr-Commit-Position: refs/heads/master@{#33853}

This threads the language mode from the bytecode to the node creation
site in the bytecode graph builder. It only adapts the places where such
threading is applicable without considering strong mode. The remaining
uses of the language mode accessors are only required because of strong
mode.

R=mythria@chromium.org

Review URL: https://codereview.chromium.org/1678103004

Cr-Commit-Position: refs/heads/master@{#33852}