Revert of [turbofan] Fixes the code generation for branches on x64 when the condition is Word64Equal. (patchset #1 id:1 of https://codereview.chromium.org/1677503002/ )

Reason for revert:
Code like the example given in the CL description was produced, for example, by code-stub-assembler.cc.

Reverting this, and try to fix the root cause instead.

Original issue's description:
> [turbofan] Fixes the code generation for branches on x64 when the condition is Word64Equal.
>
> Before:
>
> REX.W cmpq r9,r8
> setzl r8l
> movzxbl r8,r8
> REX.W cmpq r8,0x0
> jz 185
>
> After:
>
> REX.W cmpq r9,r8
> jnz 149
>
> Committed: https://crrev.com/75cc8352d06aada2e9131fdae793299ef73fb639
> Cr-Commit-Position: refs/heads/master@{#33784}

TBR=bmeurer@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.

Review URL: https://codereview.chromium.org/1693433002

Cr-Commit-Position: refs/heads/master@{#33884}

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=mjsunit/asm-wasm
R=aseemgarg@chromium.org,titzer@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1687813003

Cr-Commit-Position: refs/heads/master@{#33883}

JS_FRAME_FUNCTION can be expressed using the STACK_SLOT translation.

Review URL: https://codereview.chromium.org/1688023003

Cr-Commit-Position: refs/heads/master@{#33882}

There are a bunch of places in our builtins where we use %_Arguments and
%_ArgumentsLength for no good reason, as arguments object and/or rest
parameter is as good and performant in these cases. Now the only uses
of %_Arguments and %_ArgumentsLength left are in string.js, which
requires dedicated investigation.

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_nosnap_dbg
R=yangguo@chromium.org

Committed: https://crrev.com/2160429fd458e3c095475e718c97f77ac90d906f
Cr-Commit-Position: refs/heads/master@{#33834}

Review URL: https://codereview.chromium.org/1678953004

Cr-Commit-Position: refs/heads/master@{#33881}

Add dedicated %LoadLookupSlot, %LoadLookupSlotInsideTypeof,
%LoadLookupSlotForCall, %StoreLookupSlot_Sloppy and
%StoreLookupSlot_Strict runtime entry points and use them
appropriately in the various compilers. This way we can
finally drop the machine operators from the JS graph level
completely in TurboFan.

Also drop the funky JSLoadDynamic operator from TurboFan,
which was by now just a small wrapper around the runtime
call to %LoadLookupSlot.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1683103002

Cr-Commit-Position: refs/heads/master@{#33880}

Rolling v8/build/gyp to 5170bfd38fe79bd5b16aa7f6c5439fb90a37ae66

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1685413002

Cr-Commit-Position: refs/heads/master@{#33879}

Port 5de27c34

Original commit message:
    Calls use registers for target, new_target and argument count.
    We don't always respect argument count. It didn't bite us in the past
    because the code paths where we clobbered it never used it, though
    in future it could be an issue.

R=mvstanton@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1687943002

Cr-Commit-Position: refs/heads/master@{#33878}

Port cfbd2561

Original commit message:

    Preparing the young generation for (real) non-contiguous backing memory, this
    change removes object masks that are used to compute containment in semi and new
    space. The masks are replaced by lookups for object tags and page headers, where
    possible.

    Details:
    - Use the fast checks (page header lookups) for containment in regular code.
    - Use the slow version that masks out the page start adress and iterates all
      pages of a space for debugging/verification.
    - The slow version works for off-heap/unmapped memory.
    - Encapsulate all checks for the old->new barrier in Heap::RecordWrite().

R=mlippautz@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=chromium:581412
LOG=N

Review URL: https://codereview.chromium.org/1687113002

Cr-Commit-Position: refs/heads/master@{#33877}

PPC: Mark null and undefined as undetectable, and use it to handle abstract equality comparison in the generic compare ic

Port 3ce9e808

Original commit message:
    Marking as undetectable makes abstract equality of null, undefined, and
    other undetectable objects easier. Supporting it in the generic compare
    IC significantly speeds up dynamic comparison between those values and
    JSReceivers by not falling back to the runtime.

R=verwaest@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1684133003

Cr-Commit-Position: refs/heads/master@{#33876}

Black allocation during scavenges will push objects on the marking deque that point to to-space. They should not be cleared.

BUG=chromium:561449
LOG=n

Review URL: https://codereview.chromium.org/1683983003

Cr-Commit-Position: refs/heads/master@{#33875}

The previous implementation used GetRawOperand(), which allows a nicely
unified handling of all scalar types, but returns an unsigned type.
Because of this, generate-bytecode-expectations couldn't properly handle
negative numbers.

This commit differentiate between different types of scalar operands and
uses the appropriate getter from i::interpreter::BytecodeArrayIterator,
thus correctly handling signed types where needed.

Two new helpers have been added to i::interpreter::Bytecodes:

 * IsImmediateOperandType()
 * IsIndexOperandType()

with the intuitive semantic.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1684113002

Cr-Commit-Position: refs/heads/master@{#33874}

Moves InterpreterAssembler out of the compiler directory and into the
interpreter directory. Makes InterpreterAssembler as subclass of
CodeStubAssembler.

As part of this change, the special bytecode dispatch linkage type
is removed and instead we use a InterfaceDispatchDescriptor and
a normal CodeStub linkage type.

Removes a bunch of duplicated logic in InterpreterAssembler and
instead uses the CodeStubAssembler logic. Refactors Interpreter
with these changes.

Modifies CodeStubAssembler to add the extra operations required
by the Interpreter (extra call types, raw memory access and some extra
binary ops). Also adds the ability for subclasses to add extra
prologue and epilogue operations around calls, which is required
for the Interpreter.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1673333004

Cr-Commit-Position: refs/heads/master@{#33873}

Currently we only support general categories for property classes.

R=erik.corry@gmail.com, erikcorry@chromium.org, littledan@chromium.org
BUG=v8:4743
LOG=N

Review URL: https://codereview.chromium.org/1685593002

Cr-Commit-Position: refs/heads/master@{#33872}

Revert of Implement symbol @@hasInstance for ES6 instanceof support. (patchset #2 id:20001 of https://codereview.chromium.org/1683043003/ )

Reason for revert:
[Sheriff] Breaks:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20nosnap%20-%20debug/builds/1382/

Original issue's description:
> Implement symbol @@hasInstance for ES6 instanceof support.
>
> BUG=
>
> Committed: https://crrev.com/5833e8e8a437cd66405784263ccc45e73470fd42
> Cr-Commit-Position: refs/heads/master@{#33870}

TBR=bmeurer@chromium.org,mvstanton@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1686123002

Cr-Commit-Position: refs/heads/master@{#33871}

BUG=

Review URL: https://codereview.chromium.org/1683043003

Cr-Commit-Position: refs/heads/master@{#33870}

The break location heavily relies on relocation info. This change
abstracts that away. Currently there is only one implementation for
this interface, for JIT code. Future changes will introduce an
implementation to iterate bytecode arrays.

R=rmcilroy@chromium.org, vogelheim@chromium.org
BUG=v8:4690
LOG=N

Review URL: https://codereview.chromium.org/1682853003

Cr-Commit-Position: refs/heads/master@{#33869}

This reduces runtime of https://github.com/kpdecker/six-speed/blob/master/tests/for-of-array/for-of-array.es6 by 40%.

BUG=

Review URL: https://codereview.chromium.org/1681143003

Cr-Commit-Position: refs/heads/master@{#33868}

[builtins] Speedup Object.keys by adding a fast path for objects without elements, interceptors, ...

This speeds up the for-of-object benchmark at
http://kpdecker.github.io/six-speed/ by >2x.

BUG=

Review URL: https://codereview.chromium.org/1682873003

Cr-Commit-Position: refs/heads/master@{#33867}

Let the world know (if it cares) that this is the kind of
silliness that JS engines have to partake in if they want
to look good on Sunspider (this should give 5% overall).

Review URL: https://codereview.chromium.org/1684093002

Cr-Commit-Position: refs/heads/master@{#33866}

Calls use registers for target, new_target and argument count.
We don't always respect argument count. It didn't bite us in the past
because the code paths where we clobbered it never used it, though
in future it could be an issue.

BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1683593003

Cr-Commit-Position: refs/heads/master@{#33865}

R=jochen@chromium.org, verwaest@chromium.org
BUG=chromium:585724
LOG=N

Review URL: https://codereview.chromium.org/1681513002

Cr-Commit-Position: refs/heads/master@{#33864}

generate-bytecode-expectations is a tool intended to work together
with test/cctest/test-bytecode-generator.cc in order to produce a
meaningful diff between testcases and the actual bytecode being emitted.

It does so by parsing and compiling Javascript to bytecode,
constructing the same data structure in the testcase and then running a
textual diff between the expected (i.e. the one encoded in the unit test)
and actual (i.e. the one built from the compiler output) representation.

This commit is a first step in this direction, achieving just the first
half of what we desire. At the moment, bytecodechecker can:

* take a code snippet from the command line and emit the expected structure.
* adhere to the same formatting rules of the test cases
  (this one is important for text diff and for copy and pasting too)

Still to do:

* parse unit tests:
    + extract code snippets
    + indent the code to match the input test case
    + allow flexibility in the input format
    + try to recognize and work around some macro magic (i.e. REPEAT_127)
* emit the representation of the constant pool and handlers vector
* run a textual diff

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1671863002

Cr-Commit-Position: refs/heads/master@{#33863}

R=littledan@chromium.org, verwaest@chromium.org
BUG=v8:4524
LOG=N

Review URL: https://codereview.chromium.org/1679123007

Cr-Commit-Position: refs/heads/master@{#33862}

Since https://codereview.chromium.org/1683643002/ null and undefined are
also marked as undetectable. If we anyway need to check for that case,
we can drop the null/undefined checks.

BUG=

Review URL: https://codereview.chromium.org/1681813004

Cr-Commit-Position: refs/heads/master@{#33861}

The field in question is only needed when the optimizing compiler is
triggered via OSR. All other paths (e.g. from bytecode stream) should
not rely on the unoptimized code being present.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1685633002

Cr-Commit-Position: refs/heads/master@{#33860}

If Array.from is passed an iterable, then it will copy the contents
to the newly created Array (or subclass). The iteration protocol here
includes calling IteratorClose if the loop is exited early due to an
exception thrown. This patch converts Array.from to use a for-of loop
rather than explicitly invoking the iteration protocol so that, when
IteratorClose is invoked on early for-of exit, then Array.from will
call IteratorClose in the appropriate case.

R=neis
LOG=Y
BUG=v8:4739

Review URL: https://codereview.chromium.org/1686433003

Cr-Commit-Position: refs/heads/master@{#33859}

Mark null and undefined as undetectable, and use it to handle abstract equality comparison in the generic compare ic

Marking as undetectable makes abstract equality of null, undefined, and
other undetectable objects easier. Supporting it in the generic compare
IC significantly speeds up dynamic comparison between those values and
JSReceivers by not falling back to the runtime.

MIPS port contributed by Balazs Kilvady <balazs.kilvady@imgtec.com>

Review URL: https://codereview.chromium.org/1683643002

Cr-Commit-Position: refs/heads/master@{#33858}

Preparing the young generation for (real) non-contiguous backing memory, this
change removes object masks that are used to compute containment in semi and new
space. The masks are replaced by lookups for object tags and page headers, where
possible.

Details:
- Use the fast checks (page header lookups) for containment in regular code.
- Use the slow version that masks out the page start adress and iterates all
  pages of a space for debugging/verification.
- The slow version works for off-heap/unmapped memory.
- Encapsulate all checks for the old->new barrier in Heap::RecordWrite().

BUG=chromium:581412
LOG=N

Review URL: https://codereview.chromium.org/1632913003

Cr-Commit-Position: refs/heads/master@{#33857}

This makes sure we can run through the TurboFan pipeline without having
to parse the source when using the bytecode stream as input. This path
is now being tested by the BytecodeGraphTester helper.

R=titzer@chromium.org,rmcilroy@chromium.org

Review URL: https://codereview.chromium.org/1679313002

Cr-Commit-Position: refs/heads/master@{#33856}

See https://github.com/tc39/ecma262/pull/331.

R=rossberg
BUG=

Review URL: https://codereview.chromium.org/1680133002

Cr-Commit-Position: refs/heads/master@{#33855}

Fix JSLoadGlobal/JSStoreGlobal, JSLoadNamed/JSStoreNamed and
JSLoadProperty/JSStoreProperty to take the current function closure
instead of the type feedback as input, and load the feedback vector
from the closure as required (in JSGenericLowering). There's still
JSLoadDynamic left to be done, and then we don't have any machine
operators in the initial JS graph left.

There'll be more refactoring on the JSGenericLowering in a follow-up
CL, which takes care of the current code duplication and also tries
to use the more efficient LoadIC/KeyedLoadIC instead of the current
LoadICInOptimizedCode/KeyedLoadICInOptimizedCode (and same for store
ICs) whenever possible.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1683043002

Cr-Commit-Position: refs/heads/master@{#33854}

Rolling v8/build/gyp to 66bbdf4c6b450d55bd9e53fd18d9628a8f328398

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1686933002

Cr-Commit-Position: refs/heads/master@{#33853}

This threads the language mode from the bytecode to the node creation
site in the bytecode graph builder. It only adapts the places where such
threading is applicable without considering strong mode. The remaining
uses of the language mode accessors are only required because of strong
mode.

R=mythria@chromium.org

Review URL: https://codereview.chromium.org/1678103004

Cr-Commit-Position: refs/heads/master@{#33852}

BUG=

Committed: https://crrev.com/4d46b510caf534d770ce19a01a11b8796304471b
Cr-Commit-Position: refs/heads/master@{#33812}

Review URL: https://codereview.chromium.org/1609233002

Cr-Commit-Position: refs/heads/master@{#33851}

Revert of [turbofan] ARM: Improve AND instruction selection (patchset #1 id:1 of https://codereview.chromium.org/1677023002/ )

Reason for revert:
Possibly causing Mozilla test failures - will investigate.

Original issue's description:
> [turbofan] ARM: Improve AND instruction selection
>
> Improve instruction selector for mask and shift operations by using cheaper
> instructions where possible, in preference to UBFX.
>
> BUG=
>
> Committed: https://crrev.com/53d9c12977f07f55b6f2a72128b8d02c4c857845
> Cr-Commit-Position: refs/heads/master@{#33843}

TBR=bmeurer@chromium.org,jarin@chromium.org,danno@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1681953003

Cr-Commit-Position: refs/heads/master@{#33850}

Instead of only sweeping a specific space, let tasks work together once they have
swept their corresponding space.

BUG=

Review URL: https://codereview.chromium.org/1678863002

Cr-Commit-Position: refs/heads/master@{#33849}

Revert of [counters] moving runtime counters to counter.h (patchset #1 id:1 of https://codereview.chromium.org/1678973002/ )

Reason for revert:
[Sheriff] Breaks TSAN:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20TSAN/builds/7727

Original issue's description:
> [counters] moving runtime counters to counter.h
>
> Additionally list C++ builtins as well under --runtime_call_stats.
> Let's try to keep all counters in one place, that makes it a bit
> easier to maintain and especially discard unused ones.
>
> BUG=
>
> Committed: https://crrev.com/6bc71431995d49d4ca4a2ea9c75e5add5f345225
> Cr-Commit-Position: refs/heads/master@{#33847}

TBR=jarin@chromium.org,cbruni@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1681923003

Cr-Commit-Position: refs/heads/master@{#33848}

Additionally list C++ builtins as well under --runtime_call_stats.
Let's try to keep all counters in one place, that makes it a bit
easier to maintain and especially discard unused ones.

BUG=

Review URL: https://codereview.chromium.org/1678973002

Cr-Commit-Position: refs/heads/master@{#33847}

R=rmcilroy@chromium.org

Review URL: https://codereview.chromium.org/1686533002

Cr-Commit-Position: refs/heads/master@{#33846}

This adds test cases for exception handlers that require a context
switch when entering the catch-block or the finally-block, triggered
through nested contexts within the try-block.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1681933002

Cr-Commit-Position: refs/heads/master@{#33845}