It's always possible to deoptimize to Ignition from TurboFan, and we
don't use Ignition for asm.js code, so there's no need to have the empty
frame state magic in the BytecodeGraphBuilder.

R=mstarzinger@chromium.org
BUG=v8:4280

Review-Url: https://codereview.chromium.org/2008243002
Cr-Commit-Position: refs/heads/master@{#36505}

Revert of "[heap] Fine-grained JSArrayBuffer tracking" (patchset #6 id:220001 of https://codereview.chromium.org/2005723005/ )

Reason for revert:
Breaking TSAN
  https://uberchromegw.corp.google.com/i/client.v8/builders/V8%20Linux64%20TSAN/builds/9741/steps/Ignition%20-%20turbofan%20%28flakes%29/logs/FixedUint32Array

Original issue's description:
> Reland of "[heap] Fine-grained JSArrayBuffer tracking"
>
> Track based on JSArrayBuffer addresses on pages instead of the attached
> backing store.
>
> Details of tracking:
> - Scavenge: New space pages are processes in bulk on the main thread
> - MC: Unswept pages are processed in bulk in parallel. All other pages
>   are processed by the sweeper concurrently.
>
> This reverts commit d2dff032.
>
> R=hpayer@chromium.org
> BUG=chromium:611688
> LOG=N
> CQ_EXTRA_TRYBOTS=tryserver.v8:v8_linux_arm64_gc_stress_dbg,v8_linux_gc_stress_dbg,v8_mac_gc_stress_dbg,v8_linux64_tsan_rel,v8_mac64_asan_rel
>
> Committed: https://crrev.com/b5704bc1e6ba74c9ca975f5d58f5b2dc60261457
> Cr-Commit-Position: refs/heads/master@{#36495}

TBR=hpayer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:611688

Review-Url: https://codereview.chromium.org/2011863002
Cr-Commit-Position: refs/heads/master@{#36504}

BUG=chromium:614291
LOG=N
R=titzer@chromium.org, bradnelson@chromium.org

Review-Url: https://codereview.chromium.org/2009823002
Cr-Commit-Position: refs/heads/master@{#36503}

Reland of [keys] Simplify KeyAccumulator (patchset #1 id:1 of https://codereview.chromium.org/2010593002/ )

Reason for revert:
relanding, fixed handle dereferencing

Original issue's description:
> Revert of [keys] Simplify KeyAccumulator (patchset #15 id:280001 of https://codereview.chromium.org/1995263002/ )
>
> Reason for revert:
> https://build.chromium.org/p/client.v8/builders/V8%20Mac%20GC%20Stress/builds/6248
>
> Original issue's description:
> > [keys] Simplify KeyAccumulator
> >
> > - Use KeyAccumulator::GetKeys directly instead of JSReceiver::GetKeys
> > - Revert KeyAccumulator to single OrderedHashSet implementation.
> > - Convert the OrderedHashSet in-place to a FixedArray
> > - IndexedInterceptor indices are no longer combined and sorted with the object indices
> >
> > BUG=
> >
> > Committed: https://crrev.com/d3324df017046bcde247a5aef6d1b59bfae5908f
> > Cr-Commit-Position: refs/heads/master@{#36485}
>
> TBR=jkummerow@chromium.org,verwaest@chromium.org,cbruni@chromium.org
> # Skipping CQ checks because original CL landed less than 1 days ago.
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=
>
> Committed: https://crrev.com/893524b53d43df63bca6cb9b7244d21771fadb0b
> Cr-Commit-Position: refs/heads/master@{#36486}

TBR=jkummerow@chromium.org,verwaest@chromium.org,machenbach@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review-Url: https://codereview.chromium.org/2014523002
Cr-Commit-Position: refs/heads/master@{#36502}

X87: [x64/ia32] Deal with the non-transitivity of InstructionSelector::CanCover() when folding loads into branches.

    port 0d22e7e4 (r36482)

    original commit message:
    Sequences like:

    1: Load[kRepWord32|kTypeInt32](<address>, ...)
    2: Word32And(1, <constant>)
    3: Word32Equal(2, <another constant>)
    4: Store[(kRepWord32 : NoWriteBarrier)](<address>, <value>)
    5: Branch[None](3, ...) -> B1, B2

    where #1 and #4 refer to the same memory location, are problematic because in VisitBranch we assume that 'InstructionSelector::CanCover()' is transitive.

    What happens is that CanCover(5, 3) is true (3 is a pure op), and so are CanCover(3, 2), CanCover(2, 1), but the effect level of 5 and 3 never gets checked because 3 is a pure op. Upon VisitBranch, we

    mov [address], <value>
    test [address], <another constant>

    With this patch, it becomes:

    mov reg, [address]
    mov [address], <value>
    test reg, <another constant>

BUG=

Review-Url: https://codereview.chromium.org/2006223004
Cr-Commit-Position: refs/heads/master@{#36501}

Add stack overflow checks to AstTraversalVisitor, and let
AstExpressionVisitor reuse traversal logic from AstTraversalVisitor.

R=yangguo@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2004363002
Cr-Commit-Position: refs/heads/master@{#36500}

R=cbruni@chromium.org

Review-Url: https://codereview.chromium.org/2010533002
Cr-Commit-Position: refs/heads/master@{#36499}

  port a6ddbef0 (r36472)

  original commit message:
  The TurboFan inliner makes use of these counts.

BUG=

Review-Url: https://codereview.chromium.org/2013453003
Cr-Commit-Position: refs/heads/master@{#36498}

This interpreter directly decodes and executes WASM binary code for
the purpose of supporting low-level debugging. It is not currently
integrated into the main WASM implementation.

R=ahaas@chromium.org,clemensh@chromium.org,rossberg@chromium.org,binji@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/1972153002
Cr-Commit-Position: refs/heads/master@{#36497}

R=hpayer@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2009793002
Cr-Commit-Position: refs/heads/master@{#36496}

Track based on JSArrayBuffer addresses on pages instead of the attached
backing store.

Details of tracking:
- Scavenge: New space pages are processes in bulk on the main thread
- MC: Unswept pages are processed in bulk in parallel. All other pages
  are processed by the sweeper concurrently.

This reverts commit d2dff032.

R=hpayer@chromium.org
BUG=chromium:611688
LOG=N
CQ_EXTRA_TRYBOTS=tryserver.v8:v8_linux_arm64_gc_stress_dbg,v8_linux_gc_stress_dbg,v8_mac_gc_stress_dbg,v8_linux64_tsan_rel,v8_mac64_asan_rel

Review-Url: https://codereview.chromium.org/2005723005
Cr-Commit-Position: refs/heads/master@{#36495}

Port a6ddbef0

Original commit message:
The TurboFan inliner makes use of these counts.

BUG=

Review-Url: https://codereview.chromium.org/2009603002
Cr-Commit-Position: refs/heads/master@{#36494}

Rolling v8/build to ac721839502afb41e44649a6513b866e0ad1c8a8

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2011753002
Cr-Commit-Position: refs/heads/master@{#36493}

Port 02c8b6f7

R=danno@chromium.org, joransiu@ca.ibm.com, bjaideep@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com
BUG=

Review-Url: https://codereview.chromium.org/2005213004
Cr-Commit-Position: refs/heads/master@{#36492}

port eac1b38d

Original Commit Message:
    This flag has been on by default for a while, along with
    FLAG_track_prototype_users which provides the prerequisite
    infrastructure. We are now sure that this is the direction
    we want to go in, so in order to simplify the code, this CL
    drops the respective flag-off code paths.

R=jkummerow@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com
BUG=

Review-Url: https://codereview.chromium.org/2004173003
Cr-Commit-Position: refs/heads/master@{#36491}

Port a6ddbef0

Original commit message:

    The TurboFan inliner makes use of these counts.

R=mvstanton@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2011573002
Cr-Commit-Position: refs/heads/master@{#36490}

BUG=v8:4483
R=littledan@chromium.org, yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2005613002
Cr-Commit-Position: refs/heads/master@{#36489}

All EVALUATE functions for unimplemented instructions will now throw an UNIMPLEMENTED error if called.

R=joransiu@ca.ibm.com,michael_dawson@ca.ibm.com,mbrandy@us.ibm.com,jyan@ca.ibm.com

BUG=

Review-Url: https://codereview.chromium.org/2005493002
Cr-Commit-Position: refs/heads/master@{#36488}

R=littledan@chromium.org

Review-Url: https://codereview.chromium.org/2007703003
Cr-Commit-Position: refs/heads/master@{#36487}

Revert of [keys] Simplify KeyAccumulator (patchset #15 id:280001 of https://codereview.chromium.org/1995263002/ )

Reason for revert:
https://build.chromium.org/p/client.v8/builders/V8%20Mac%20GC%20Stress/builds/6248

Original issue's description:
> [keys] Simplify KeyAccumulator
>
> - Use KeyAccumulator::GetKeys directly instead of JSReceiver::GetKeys
> - Revert KeyAccumulator to single OrderedHashSet implementation.
> - Convert the OrderedHashSet in-place to a FixedArray
> - IndexedInterceptor indices are no longer combined and sorted with the object indices
>
> BUG=
>
> Committed: https://crrev.com/d3324df017046bcde247a5aef6d1b59bfae5908f
> Cr-Commit-Position: refs/heads/master@{#36485}

TBR=jkummerow@chromium.org,verwaest@chromium.org,cbruni@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review-Url: https://codereview.chromium.org/2010593002
Cr-Commit-Position: refs/heads/master@{#36486}

- Use KeyAccumulator::GetKeys directly instead of JSReceiver::GetKeys
- Revert KeyAccumulator to single OrderedHashSet implementation.
- Convert the OrderedHashSet in-place to a FixedArray
- IndexedInterceptor indices are no longer combined and sorted with the object indices

BUG=

Review-Url: https://codereview.chromium.org/1995263002
Cr-Commit-Position: refs/heads/master@{#36485}

Moved globals offsets calculation to the wasm module decoder, since
this is a property of the module, not of each instance.

Qualified as "const" references to WasmModule outside of the decoder
and some test situations.

BUG=

Review-Url: https://codereview.chromium.org/2005933003
Cr-Commit-Position: refs/heads/master@{#36484}

Since we can't OSR from an function compiled with Ignition, this makes it
impossible to tier up asm.js code as it is running. As such, this CL
bypasses Ignition for asm.js code.

BUG=v8:4280
LOG=N

Review-Url: https://codereview.chromium.org/1994223002
Cr-Commit-Position: refs/heads/master@{#36483}

[x64/ia32] Deal with the non-transitivity of InstructionSelector::CanCover() when folding loads into branches.

Sequences like:

1: Load[kRepWord32|kTypeInt32](<address>, ...)
2: Word32And(1, <constant>)
3: Word32Equal(2, <another constant>)
4: Store[(kRepWord32 : NoWriteBarrier)](<address>, <value>)
5: Branch[None](3, ...) -> B1, B2

where #1 and #4 refer to the same memory location, are problematic because in VisitBranch we assume that 'InstructionSelector::CanCover()' is transitive.

What happens is that CanCover(5, 3) is true (3 is a pure op), and so are CanCover(3, 2), CanCover(2, 1), but the effect level of 5 and 3 never gets checked because 3 is a pure op. Upon VisitBranch, we ended up materializing:

mov [address], <value>
test [address], <another constant>

With this patch, it becomes:

mov reg, [address]
mov [address], <value>
test reg, <another constant>

BUG=chromium:611976

Review-Url: https://codereview.chromium.org/2008493002
Cr-Commit-Position: refs/heads/master@{#36482}

Port 02c8b6f7

R=danno@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=chromium:608675
LOG=N

Review-Url: https://codereview.chromium.org/2005753005
Cr-Commit-Position: refs/heads/master@{#36481}

This fixes the SharedFunctionInfo::num_literals field for global builtin
functions (e.g. {Object} and friends) to be accurate. The field was not
being updated by Runtime_SetCode. It also removes the dangerous and by
now obsolete JSFunction::NumberOfLiterals accessor.

R=mvstanton@chromium.org

Review-Url: https://codereview.chromium.org/2007943002
Cr-Commit-Position: refs/heads/master@{#36480}

R=ahaas@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2003383002
Cr-Commit-Position: refs/heads/master@{#36479}

R=cbruni@chromium.org

Review-Url: https://codereview.chromium.org/2004413002
Cr-Commit-Position: refs/heads/master@{#36478}

The DeoptimizeIf and DeoptimizeUnless operators should actually produce
an effect in addition to the control output.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2002253003
Cr-Commit-Position: refs/heads/master@{#36477}

BUG=v8:4280,v8:5038
LOG=N

Review-Url: https://codereview.chromium.org/2007453002
Cr-Commit-Position: refs/heads/master@{#36476}

BUG=chromium:474921
NOTRY=true

Review-Url: https://codereview.chromium.org/2011493002
Cr-Commit-Position: refs/heads/master@{#36475}

Previously we only ran these analysis passes on the outermost function,
but not on inlined functions.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2003363002
Cr-Commit-Position: refs/heads/master@{#36474}

For cross-compiler-compatibility and standards compliance %p
requires a void*, rather than any pointer type.

This was fixed in:
https://codereview.chromium.org/2001073002/

BUG=chromium:474921

Review-Url: https://codereview.chromium.org/2011483002
Cr-Commit-Position: refs/heads/master@{#36473}

The TurboFan inliner makes use of these counts.

BUG=

Review-Url: https://codereview.chromium.org/1969783002
Cr-Commit-Position: refs/heads/master@{#36472}

BUG=chromium:474921

Review-Url: https://codereview.chromium.org/2004063003
Cr-Commit-Position: refs/heads/master@{#36471}

R=franzih@chromium.org

Review-Url: https://codereview.chromium.org/2006673002
Cr-Commit-Position: refs/heads/master@{#36470}

Moved functionality of Script.{lineCount, lineFromPosition, sourceLine,
locationFromLine, and sourceSlice} into runtime functions.

R=yangguo@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2003303002
Cr-Commit-Position: refs/heads/master@{#36469}

  port 02c8b6f7 (r36463)

  original commit message:

BUG=

Review-Url: https://codereview.chromium.org/2000253004
Cr-Commit-Position: refs/heads/master@{#36468}

BUG=v8:4907

Review-Url: https://codereview.chromium.org/2006653003
Cr-Commit-Position: refs/heads/master@{#36467}

For cross-compiler-compatibility and standards compliance %p
requires a void*, rather than any pointer type.

BUG=chromium:474921

Review-Url: https://codereview.chromium.org/2001073002
Cr-Commit-Position: refs/heads/master@{#36466}