Instead of counting profiler ticks on the shared function info (which is
shared between native contexts), count them on the feedback vector
(which is not). This allows us to continue pushing optimization
decisions off the SFI, onto the feedback vector.

Note that a side-effect of this is that ICs don't have to walk the stack
to reset profiler ticks, as they can access the feedback vector directly
from their feedback nexus.

Change-Id: I232ae9e759fca75cd89d393148a4ff42caa2646f
Reviewed-on: https://chromium-review.googlesource.com/544888Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46411}

Add support for pcnt.df, nlzc.df, nloc.df MSA instructions in mips32 and
mips64 simulator.

Bug: 
Change-Id: I15c2e832c317ff81ce3615b7bd269e039c978e93
Reviewed-on: https://chromium-review.googlesource.com/538654
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@imgtec.com>
Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@imgtec.com>
Cr-Commit-Position: refs/heads/master@{#46410}

Change-Id: Iec7f2868e1f0d20ad9046a5bda4bc1c87f038f23
Reviewed-on: https://chromium-review.googlesource.com/558292Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Juliana Patricia Vicente Franco <jupvfranco@google.com>
Cr-Commit-Position: refs/heads/master@{#46409}

Revert of Set the current context to the function's context when entering to LAP. (patchset #14 id:540001 of https://codereview.chromium.org/2770003002/ )

Reason for revert:
Speculative: Seems to break webkit_unit_tests:
https://build.chromium.org/p/tryserver.v8/builders/v8_linux_blink_rel/builds/23247
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Mac/builds/11038

Original issue's description:
> Set the current context to the function's context when entering to LAP.
>
> In case of LAP(lazy accessor pair), the function's creation context
> must be equal to the accessor holder's creation context, so this CL
> changes the current context to the accessor holder's creation context.
>
> BUG=v8:6156
>
> Review-Url: https://codereview.chromium.org/2770003002
> Cr-Commit-Position: refs/heads/master@{#46406}
> Committed: https://chromium.googlesource.com/v8/v8/+/18e73287dc65452bc2f952fc005b2251fc32c15a

TBR=jochen@chromium.org,verwaest@chromium.org,mstarzinger@chromium.org,tebbi@google.com,yukishiino@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:6156

Review-Url: https://codereview.chromium.org/2973593002
Cr-Commit-Position: refs/heads/master@{#46408}

To be used with tuples of heap objects and sizes.

Bug: chromium:738865
Change-Id: I29d9cf98bb2097cc8e1616aaf19a251507ffbd9e
Reviewed-on: https://chromium-review.googlesource.com/559050Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46407}

In case of LAP(lazy accessor pair), the function's creation context
must be equal to the accessor holder's creation context, so this CL
changes the current context to the accessor holder's creation context.

BUG=v8:6156

Review-Url: https://codereview.chromium.org/2770003002
Cr-Commit-Position: refs/heads/master@{#46406}

R=jarin@chromium.org,bmeurer@chromium.org

Bug: 
Change-Id: Id22b6890723d0366e6f3db0bdbad40660f524b59
Reviewed-on: https://chromium-review.googlesource.com/558070Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46405}

R=jarin@chromium.org,bmeurer@chromium.org

Bug: 
Change-Id: I6f4e56f37987d2ae67eed91401b10dcc26397970
Reviewed-on: https://chromium-review.googlesource.com/558086Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46404}

This is a preliminary step before we stop swapping maps in the bootstrapper
(strict/sloppy map with writable prototype <-> readonly prototype).

Bug: v8:6459
Change-Id: I120550c10e98a234e283d79a8d408096601c92af
Reviewed-on: https://chromium-review.googlesource.com/558879Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46403}

Bug: 
Change-Id: Iea628676cd81f6917e6118657cfd60247a666b5a
Reviewed-on: https://chromium-review.googlesource.com/559329Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Maya Lekova <mslekova@google.com>
Cr-Commit-Position: refs/heads/master@{#46402}

Regexp code flushing support has been unintentionally disabled for quite a
while without any signals on our benchmarks. This CL completely removes
support.

BUG=v8:6569

Change-Id: Ic018a115c38387ff5610b34d3c09cb360e30ad3f
Reviewed-on: https://chromium-review.googlesource.com/559331Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46401}

Add Pxor, Pshuflw, Pshufb, Pextrb, Pextrw macros
Reconstruct SIMD opcodes to macros

BUG=

Review-Url: https://codereview.chromium.org/2937653002
Cr-Commit-Position: refs/heads/master@{#46400}

Did only work with full MCs. Since the majority of GCs is now
incremental and will be concurrent in future this becomes obsolete.

Bug: v8:6569
Change-Id: I28280a71dd4e779742dd4d1b3dd01087cd4f8fe0
Reviewed-on: https://chromium-review.googlesource.com/558983Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46399}

Bug: 
Change-Id: I972f075e779b4bc27e3e7aed2f8f15f1af26dddd
Reviewed-on: https://chromium-review.googlesource.com/558998Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Maya Lekova <mslekova@google.com>
Cr-Commit-Position: refs/heads/master@{#46398}

Bug: chromium:738865
Change-Id: I67b65f3006d6fe7e88854806f364d9863076b49b
Reviewed-on: https://chromium-review.googlesource.com/558969
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46397}

Instead of having the "next step" state machine logic in the compiler
dispatcher, move it to the compiler dispatcher job. This is a
prerequisite to having more generic jobs with slightly different state
sets, such as an optimizing compile job.

Bug: v8:6537
Change-Id: Ib7319222f26dbc0e2afc95573b06d813825afde3
Reviewed-on: https://chromium-review.googlesource.com/554751
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46396}

Every, Some, Reduce, ReduceRight. Added a test that should improve
when TurboFan inlines these builtins. Updated Map and Filter tests
to include a TurboFan inline test.

Bug: v8:2229
Change-Id: Ie84d414fdcccea23c734caca55a3344f9442547f
Reviewed-on: https://chromium-review.googlesource.com/558935Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46395}

Review-Url: https://codereview.chromium.org/2964633002
Cr-Commit-Position: refs/heads/master@{#46394}

v8.cpu_profiler has a long and variable warm up period. If you look in
tracing that time shows up under V8.Execute which is very misleading. By
adding a tracing category for the time spent in
CpuProfiler::StartProfiling the warm up time can be easily identified or
even filtered out.

With this tracing event the block in StartProfiling correctly described
the time spent prepare v8.cpu_profiler out from V8.Execute

Test by collecting a trace with V8.Execute and look at when a trace
starts generating v8 samples.

BUG=chromium:733853

Review-Url: https://codereview.chromium.org/2950543002
Cr-Commit-Position: refs/heads/master@{#46393}

Change-Id: I703c90cfbb91f4afc035fb32a44f33af9fe736f3
Reviewed-on: https://chromium-review.googlesource.com/548459
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46392}

Bug: chromium:738368
Change-Id: I749517391f9d5dd0827f3d37f975f6c61542d1ff
Reviewed-on: https://chromium-review.googlesource.com/558914
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46391}

This reverts commit 8840d622.

Reason for revert: This requires the infra-side to be adapted to look
for open rolls. There's no such feature in the gerrit recipe_module
or git-cl tooling yet.

Original change's description:
> [release] Make gerrit the default for all release tools
> 
> This switches also the V8->Chromium rolls to Gerrit.
> 
> NOTRY=true
> TBR=hablich@chromium.org
> 
> Bug: chromium:685318
> Change-Id: Idc168f790541f09bd2f2d7c2f72806ac9e966843
> Reviewed-on: https://chromium-review.googlesource.com/558913
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46388}

TBR=machenbach@chromium.org,hablich@chromium.org,tandrii@chromium.org

Change-Id: I597538b6165b9952b5df9cde72466b95739cf56b
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:685318
Reviewed-on: https://chromium-review.googlesource.com/558225Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46390}

The release tools used to reload CL descriptions from rietveld to consider
late edits. This makes no sense anymore with gerrit, so we drop the feature.

NOTRY=true
TBR=hablich@chromium.org

Bug: chromium:685318
Change-Id: I08231795ba3b25c0939aa2b4428973086548484d
Reviewed-on: https://chromium-review.googlesource.com/558915Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46389}

This switches also the V8->Chromium rolls to Gerrit.

NOTRY=true
TBR=hablich@chromium.org

Bug: chromium:685318
Change-Id: Idc168f790541f09bd2f2d7c2f72806ac9e966843
Reviewed-on: https://chromium-review.googlesource.com/558913Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46388}

On Loongson 3A, MADD/MSUB instructions are actually fused MADD/MSUB and
they can cause failure in some of the tests. Since this optimization is
rarely used, and not used at all on MIPS64R6, MADD/MSUB instructions
are removed from the source base.

TEST=
BUG=

Change-Id: Ifbb5508a62731bb061f332864ffd1e210e97f963
Reviewed-on: https://chromium-review.googlesource.com/558066Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@imgtec.com>
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@imgtec.com>
Cr-Commit-Position: refs/heads/master@{#46387}

Bug: chromium:738368
Change-Id: Iebbfc258be7f1997dc441ccdf12c38635901f732
Reviewed-on: https://chromium-review.googlesource.com/558911Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46386}

The test runner automatically infers certain options from the build
product if it was generated with GN.

This CL makes the code for inferring the options more generic and makes
sure that:
1) boolean options can't be set on builds where they don't make sense
(e.g. can't pass --asan in a non-asan build)
2) string options are equal to the derived option from the build
(e.g. can't test arch x64 when build is x86)

Bug: v8:5533
Change-Id: I4badf3a17a2fc23ddb9d129602aa15f12665821f
Reviewed-on: https://chromium-review.googlesource.com/552542Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46385}

- Avoid static methods.
- Instantiate the actual visitor on the stack.
- Get rid of unnecessary abstractions.

Bug: chromium:738865
Change-Id: I4115d7b88f17a7118aa9ee129eb39a28ec413696
Reviewed-on: https://chromium-review.googlesource.com/558878
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46384}

Change-Id: I1cb2eb715646366d516c26b11849955990dcda53
Reviewed-on: https://chromium-review.googlesource.com/558881Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46383}

This uploads roll-branch CLs before landing and fixes an
ambiguity bug when pushing tags.

NOTRY=true
TBR=hablich@chromium.org

Bug: chromium:738679
Change-Id: I51e03d714ec97ee2d9bca4ecaf753d66038891c1
Reviewed-on: https://chromium-review.googlesource.com/558415Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46382}

Original change's description:
> Switch tracing to use v8::TracingController
>
> BUG=v8:6511
> R=fmeawad@chromium.org
>
> Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
> Change-Id: I4961e4b61a9ddc98385ed97c3ffcbcaef2d9cba7
> Reviewed-on: https://chromium-review.googlesource.com/543144
> Commit-Queue: Jochen Eisinger <jochen@chromium.org>
> Reviewed-by: Fadi Meawad <fmeawad@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46307}

BUG=v8:6511
TBR=fmeawad@chromium.org

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng;master.tryserver.v8:v8_linux64_tsan_rel
Change-Id: Ide32b409248dfd466e7c0bae1d8ae61d6a955d98
Reviewed-on: https://chromium-review.googlesource.com/558865
Commit-Queue: Jochen Eisinger <jochen@chromium.org>
Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46381}

Bug: v8:6459
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I34d6203c7f26c54423789699e4263ce815171d3f
Reviewed-on: https://chromium-review.googlesource.com/558874Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46380}

When providing scope information (containing the value of local
variables of live stack frames), decode the local variable names of all
functions in a wasm module and store this in the WasmDebugInfo
structure.
Use these names to actually name the reported locals, instead of using
the default names "param#<d>" and "local#<d>". These names are only used
as fallbacks for locals which were not assigned a name.

R=titzer@chromium.org,kozyatinskiy@chromium.org
BUG=v8:6245

Change-Id: Ibf7d30e392248ef5590177cd8b6329239b45e018
Reviewed-on: https://chromium-review.googlesource.com/548495
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46379}

Instructions ins and ext didn't work properly when size = 32 because of
incorrect mask initialization, this CL fixes this. A test for Ins is
also added.

BUG=

Change-Id: I95cc8e13aaa2341b34ae59dae1eefb64c551b8b4
Reviewed-on: https://chromium-review.googlesource.com/558872
Commit-Queue: Miran Karić <Miran.Karic@imgtec.com>
Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@imgtec.com>
Cr-Commit-Position: refs/heads/master@{#46378}

Removes the ability of allocating dominators and folded allocations
which was tied to Crankshaft's allocation folding.

Bug: v8:6408
Change-Id: Id2e1b5445c8357ac770c88e734b6c50d5f6c5eae
Reviewed-on: https://chromium-review.googlesource.com/558093
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46377}

Commit 26c00f4a improved the names of
most FAST_* elements kinds in the enum. This patch updates the matching
Has*Elements and Is*ElementsKind method names accordingly.

- HasFastSmiElements => HasSmiElements
- IsFastSmiElementsKind => IsSmiElementsKind
- HasFastObjectElements => HasObjectElements
- IsFastObjectElementsKind => IsObjectElementsKind
- HasFastSmiOrObjectElements => HasSmiOrObjectElements
- IsFastSmiOrObjectElementsKind => IsSmiOrObjectElementsKind
- HasFastDoubleElements => HasDoubleElements
- IsFastDoubleElementsKind => IsDoubleElementsKind
- HasFastHoleyElements => HasHoleyElements
- IsFastHoleyElementsKind => IsHoleyElementsKind

Additionally, FastHoleyElementsUsage is renamed to HoleyElementsUsage.

BUG=v8:6548

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Ie8f3d01eb43e909cbc6c372d88c5fbc4dfc2ac04
Reviewed-on: https://chromium-review.googlesource.com/558356Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Mathias Bynens <mathias@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46376}

The jsapi-harness test runs the JS-API spec tests of WebAssembly, which
get fetched from github when 'gclient sync' is executed. Without
'gclient sync' the harness may executed a version of the tests which is
older than required by the harness. In this CL I add a suggestion to
the test to run 'gclient sync' which is shown when the test is failing.

R=marja@chromium.org

Change-Id: I36d03bebc4d6cc554eefd4eb376c3d309b7ee5b9
Reviewed-on: https://chromium-review.googlesource.com/558419Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46375}

(The test that catches the bug was test-bytecode-generator/LookupSlot)

BUG=v8:5516

Change-Id: I00a02c5326b2a132383a9d72b5b894fade53bbf2
Reviewed-on: https://chromium-review.googlesource.com/558864
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46374}

This sometimes caused problems with bots (for node too) because the
allocation could fail.

Bug: v8:6452
Change-Id: I346a9117eba8b6ed41566efeceaf7fb190784d76
Reviewed-on: https://chromium-review.googlesource.com/558075Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46373}

Revert of [turbofan] Extend escape analysis to reduce certain CheckMaps. (patchset #1 id:1 of https://codereview.chromium.org/2964473002/ )

Reason for revert:
Speculative revert for tiny fire on Canary (crbug.com/738781)

Original issue's description:
> [turbofan] Extend escape analysis to reduce certain CheckMaps.
>
> Enable the experimental support in escape analysis to deal with
> constant-foldable CheckMaps nodes and remove them from the effect
> chain w/o blocking the scalar replacement of the object.
>
> BUG=v8:4586,v8:5267
> R=tebbi@chromium.org
>
> Review-Url: https://codereview.chromium.org/2964473002
> Cr-Commit-Position: refs/heads/master@{#46311}
> Committed: https://chromium.googlesource.com/v8/v8/+/adf7f54e24c4b31207b4df0e30c28f7579b18f5c

TBR=tebbi@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=v8:4586,v8:5267

Review-Url: https://codereview.chromium.org/2970663002
Cr-Commit-Position: refs/heads/master@{#46372}