R=bmeurer@chromium.org
BUG=chromium:617527

Review-Url: https://codereview.chromium.org/2045153002
Cr-Commit-Position: refs/heads/master@{#36813}

The upcoming snapshot creator API will have no way to distinguish default
from custom snapshots.

R=vogelheim@chromium.org
BUG=chromium:617892

Review-Url: https://codereview.chromium.org/2040813005
Cr-Commit-Position: refs/heads/master@{#36812}

Revert "Revert of [builtins] Properly optimize TypedArray/DataView accessors. (patchset #3 id:40001 of https://codereview.chromium.org/2042013003/ )"

This reverts commit d3a43e47.

This patch also adds typed_array_fun and typed_array_protoype to the
native context. These are used in InstallTypedArray to set up the
prototype chain correctly for each typed array sub class. This removes
the need to later monkey patch them prototype chain in typedarray.js.
This mechanism is also used to get hold of the TypedArray in
typedarray.js, removing the need for a global TypedArray.

This patch updates CallRuntime.golden to account for the two extra
native runtime calls. This patch also fixes some formatting issues (by
running git cl format).

BUG=chromium:579905, chromium:593634, v8:4085, v8:5073

Review-Url: https://codereview.chromium.org/2046333002
Cr-Commit-Position: refs/heads/master@{#36811}

This removes explicit uses of the RUNTIME_ASSERT macro from some runtime
function. The implicit ones in CONVERT_FOO_ARG_CHECKED will be addressed
in a separate CL for all runtime modules at once.

R=binji@chromium.org
BUG=v8:5066

Review-Url: https://codereview.chromium.org/2034063002
Cr-Commit-Position: refs/heads/master@{#36810}

Ideally we would have a dedicated MachineRepresentation for Smis during
representation selection and use that to properly optimize ObjectIsSmi
(and other ObjectIs<Type> predicates), but that will take some time to
get that done. So in the meantime we can just do simple (local) strength
reduction on ObjectIsSmi to avoid Smi checks in the simplest cases at
least.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2047213002
Cr-Commit-Position: refs/heads/master@{#36809}

This changes the contract for the aforementioned API function to be more
permissive and allow callers to call it with less restrictions. The new
contract is:

a) For so far un-compiled functions, the compiler is free to choose the
   backend according to other decision criteria. Debug code can hence be
   provided by either Ignition or FullCodegen.
b) For compiled functions, the compiler will provide debug code within
   the same tier as existing code. For Ignition the generated code will
   be equivalent to the old one. For FullCodegen the code will contain
   debug information and debug break slots.

Concretely this fixes an issue where generator or async functions might
have been compiled with an unexpected backend, due to the fact that the
API method in question was always providing FullCodegen code.

R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2044063002
Cr-Commit-Position: refs/heads/master@{#36808}

Revert of [heap] Uncommit unused large object page memory. (patchset #13 id:230001 of https://codereview.chromium.org/2032393002/ )

Reason for revert:
Needs fixing of slot set.

Original issue's description:
> [heap] Uncommit unused large object page memory.
>
> As a first step I uncommit the memory on the main thread. Also to measure impact and stability of that optimization. In a follow-up CL, the uncommitting should be moved on the concurrent thread.
>
> BUG=
>
> Committed: https://crrev.com/d61a5c376ba51145dc4684e39d5d3a9ce75bcfa6
> Cr-Commit-Position: refs/heads/master@{#36763}

TBR=ulan@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=

Review-Url: https://codereview.chromium.org/2043263002
Cr-Commit-Position: refs/heads/master@{#36807}

Revert of [heap] Unregister shrinked large object memory from chunk map. (patchset #6 id:100001 of https://codereview.chromium.org/2046953002/ )

Reason for revert:
Revert because uncommit of lo is broken.

Original issue's description:
> [heap] Unregister shrinked large object memory from chunk map.
>
> BUG=chromium:617883
> LOG=n
>
> Committed: https://crrev.com/2b38d3121b5fd0e409cdda0071fa2e0ec2846ab2
> Cr-Commit-Position: refs/heads/master@{#36793}

TBR=ulan@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:617883

Review-Url: https://codereview.chromium.org/2046563008
Cr-Commit-Position: refs/heads/master@{#36806}

In Crankshaft we don't know reliably know that an HAdd might not turn
into a string addition later (via deoptimization), so we cannot set the
HValue::kAllowUndefinedAsNaN flag on the HAdd instruction in those
cases. It doesn't seem to affect performance if we just remove the flag
completely from the HAdd instruction, so let's stick to that approach
for now.

R=jarin@chromium.org
BUG=v8:5074

Review-Url: https://codereview.chromium.org/2048643002
Cr-Commit-Position: refs/heads/master@{#36805}

Rolling v8/build to d3b5b6bf460126a9f8b6d883749baac3cebbb449

Rolling v8/buildtools to 8dd3c8e39a48743c4eb790d9a8abe9676b617046

Rolling v8/tools/clang to db6e187140f7b870bdcaab19456193c94d7963bd

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2045883003
Cr-Commit-Position: refs/heads/master@{#36804}

Revert of [heap] Fix chunk map removal for large objects. (patchset #1 id:1 of https://codereview.chromium.org/2042123003/ )

Reason for revert:
Fails on noi18n debug build (https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20noi18n%20-%20debug/builds/8040/steps/Check/logs/unbox-double-arrays), please take a look.

Original issue's description:
> [heap] Fix chunk map removal for large objects.
>
> BUG=
>
> Committed: https://crrev.com/65dac7f8ead2eb09d417ecaaae0164699edfd510
> Cr-Commit-Position: refs/heads/master@{#36802}

TBR=mlippautz@chromium.org,hpayer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review-Url: https://codereview.chromium.org/2046283002
Cr-Commit-Position: refs/heads/master@{#36803}

BUG=

Review-Url: https://codereview.chromium.org/2042123003
Cr-Commit-Position: refs/heads/master@{#36802}

Port 8d90210a

R=yangguo@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com, bjaideep@ca.ibm.com

BUG=v8:4483
LOG=N

Review-Url: https://codereview.chromium.org/2047673003
Cr-Commit-Position: refs/heads/master@{#36801}

Committed: https://crrev.com/46a9322e88de037598cfd1090285375d97b11db2
Review-Url: https://codereview.chromium.org/2033943005
Cr-Original-Commit-Position: refs/heads/master@{#36760}
Cr-Commit-Position: refs/heads/master@{#36800}

Revert of [heap] Clear out of live range remembered set slots in large objects. (patchset #2 id:20001 of https://codereview.chromium.org/2043713006/ )

Reason for revert:
Fails arm sim:
https://build.chromium.org/p/client.v8.ports/builders/V8%20Linux%20-%20arm%20-%20sim/builds/1012

Original issue's description:
> [heap] Clear out of live range remembered set slots in large objects.
>
> BUG=chromium:617882
> LOG=n
>
> Committed: https://crrev.com/38ad63ff15d7e379423be4c57ae94ae2c9ffb4af
> Cr-Commit-Position: refs/heads/master@{#36795}

TBR=ulan@chromium.org,hpayer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:617882

Review-Url: https://codereview.chromium.org/2042403002
Cr-Commit-Position: refs/heads/master@{#36799}

backing store.

Details of tracking:
- Scavenge: New space pages are processes in bulk on the main thread
- MC: Unswept pages are processed in bulk in parallel. All other pages
  are processed by the sweeper concurrently.

BUG=chromium:611688
LOG=N
TEST=cctest/test-array-buffer-tracker/*
CQ_EXTRA_TRYBOTS=tryserver.v8:v8_linux_arm64_gc_stress_dbg,v8_linux_gc_stress_dbg,v8_mac_gc_stress_dbg,v8_linux64_tsan_rel,v8_mac64_asan_rel

Review-Url: https://codereview.chromium.org/2036643002
Cr-Commit-Position: refs/heads/master@{#36798}

TBR=verwaest@chromium.org

Review-Url: https://codereview.chromium.org/2043103002
Cr-Commit-Position: refs/heads/master@{#36797}

R=joransiu@ca.ibm.com,michael_dawson@ca.ibm.com,mbrandy@us.ibm.com,jyan@ca.ibm.com

BUG=

Review-Url: https://codereview.chromium.org/2043843002
Cr-Commit-Position: refs/heads/master@{#36796}

BUG=chromium:617882
LOG=n

Review-Url: https://codereview.chromium.org/2043713006
Cr-Commit-Position: refs/heads/master@{#36795}

PrimaryStubCache and SecondaryStubCache: resurrected outdated tests (and enabled stub cache counters in the new LoadIC).
TryProbeStubCache: decreased number of code objects created.

Review-Url: https://codereview.chromium.org/2040193002
Cr-Commit-Position: refs/heads/master@{#36794}

BUG=chromium:617883
LOG=n

Review-Url: https://codereview.chromium.org/2046953002
Cr-Commit-Position: refs/heads/master@{#36793}

Dictionary::Add() must not be called for existing keys.

Review-Url: https://codereview.chromium.org/2044003004
Cr-Commit-Position: refs/heads/master@{#36792}

Uses float registers s0-s31 for moves and swaps when rep is kFloat32.
Changes bitcast to use float registers.

LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2039843003
Cr-Commit-Position: refs/heads/master@{#36791}

In most cases we return a Smi and undefined for the other cases. Hence there
is no need to handlify the result unecessary. Additionally pass in the isolate
for the hash-symbol lookup.

BUG=

Review-Url: https://codereview.chromium.org/2044843002
Cr-Commit-Position: refs/heads/master@{#36790}

This declares v8_enable_slow_dchecks and v8_optimized_debug
as gn args. It adds support for dcheck_always_on and
debugging with v8_optimized_debug = false.

BUG=chromium:474921
NOTRY=true

Review-Url: https://codereview.chromium.org/2024833002
Cr-Commit-Position: refs/heads/master@{#36789}

BUG=v8:5015
R=jarin@chromium.org,yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2041243002
Cr-Commit-Position: refs/heads/master@{#36788}

Using the isolate to check for IsUndefined and IsTheHole is roughly at least
20% faster in the worst-case and up to a factor 2x in the best case.

BUG=

Review-Url: https://codereview.chromium.org/2031533002
Cr-Commit-Position: refs/heads/master@{#36787}

It may be that we have a feedback vector, but no literals. In this case
we can store into the OptimizedCodeMap directly instead of using a WeakCell,
because all data in the feedback vector is already held weakly.

The use of a WeakCell in the OptimizedCodeMap is only required when
there are literals which may hold maps strongly.

This is to address a performance regression caused by the creation of
a large number of WeakCells.

BUG=chromium:615831

Review-Url: https://codereview.chromium.org/2031123003
Cr-Commit-Position: refs/heads/master@{#36786}

R=jkummerow@chromium.org
BUG=chromium:595626

Review-Url: https://codereview.chromium.org/2037363002
Cr-Commit-Position: refs/heads/master@{#36785}

Port 941524f8

TEST=mjsunit/harmony/async-debug-*
BUG=

Review-Url: https://codereview.chromium.org/2045923002
Cr-Commit-Position: refs/heads/master@{#36784}

Revert of [builtins] Properly optimize TypedArray/DataView accessors. (patchset #3 id:40001 of https://codereview.chromium.org/2042013003/ )

Reason for revert:
Blink:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/7296

Original issue's description:
> [builtins] Properly optimize TypedArray/DataView accessors.
>
> The following getters were moved to the TypedArray/DataView prototype
> chain with ES2015, and hence need different treatment now:
>
> - DataView.prototype.buffer
> - DataView.prototype.byteLength
> - DataView.prototype.byteOffset
> - TypedArray.prototype.buffer
> - TypedArray.prototype.byteLength
> - TypedArray.prototype.byteOffset
> - TypedArray.prototype.length
>
> Instead of having special magic on the LoadIC in the IC system and the
> optimizing compilers, as we used to do before (and which we got rid of
> already), we just treat those as normal accessors and make them
> recognizable via the BuiltinFunctionId mechanism. This allows us to
> remove some of the additional magic from the IC subsystem, and just
> extend the BuiltinFunctionId mechanism in Crankshaft slightly to cover
> these cases too (TurboFan doesn't yet support accessors, but that will
> be fixed soonish anyways).
>
> This addresses most of the 15-20% regression we saw on the Octane
> GameBoy emulator benchmark.
>
> BUG=chromium:579905,chromium:593634,v8:4085,v8:5073
> R=yangguo@chromium.org
>
> Committed: https://crrev.com/1ef737026565ea2becc84f30cfd432e581d50c6b
> Cr-Commit-Position: refs/heads/master@{#36782}

TBR=yangguo@chromium.org,bmeurer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:579905,chromium:593634,v8:4085,v8:5073

Review-Url: https://codereview.chromium.org/2039093005
Cr-Commit-Position: refs/heads/master@{#36783}

The following getters were moved to the TypedArray/DataView prototype
chain with ES2015, and hence need different treatment now:

- DataView.prototype.buffer
- DataView.prototype.byteLength
- DataView.prototype.byteOffset
- TypedArray.prototype.buffer
- TypedArray.prototype.byteLength
- TypedArray.prototype.byteOffset
- TypedArray.prototype.length

Instead of having special magic on the LoadIC in the IC system and the
optimizing compilers, as we used to do before (and which we got rid of
already), we just treat those as normal accessors and make them
recognizable via the BuiltinFunctionId mechanism. This allows us to
remove some of the additional magic from the IC subsystem, and just
extend the BuiltinFunctionId mechanism in Crankshaft slightly to cover
these cases too (TurboFan doesn't yet support accessors, but that will
be fixed soonish anyways).

This addresses most of the 15-20% regression we saw on the Octane
GameBoy emulator benchmark.

BUG=chromium:579905,chromium:593634,v8:4085,v8:5073
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2042013003
Cr-Commit-Position: refs/heads/master@{#36782}

This avoids the inclusion of inline headers (i.e. vm-state-inl.h in this
case) in a normal header. There are three more such violations left in
the code-base after this change.

R=verwaest@chromium.org

Review-Url: https://codereview.chromium.org/2039913002
Cr-Commit-Position: refs/heads/master@{#36781}

BUG=chromium:617524, v8:5009
LOG=Y

Review-Url: https://codereview.chromium.org/2044003003
Cr-Commit-Position: refs/heads/master@{#36780}

R=ahaas@chromium.org,bradnelson@chromium.org
BUG=chromium:617884

Review-Url: https://codereview.chromium.org/2044833002
Cr-Commit-Position: refs/heads/master@{#36779}

R=littledan@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2044803003
Cr-Commit-Position: refs/heads/master@{#36778}

BUG=chromium:474921
TBR=vogelheim@chromium.org, jochen@chromium.org
NOTRY=true

Review-Url: https://codereview.chromium.org/2046683003
Cr-Commit-Position: refs/heads/master@{#36777}

Without the boundary prototypes we have to keep track of all shadowing properties
throughout the complete prototype chain. This contradicts the finding that most
objects have a rather large number of non-enumerable properties on the prototype
chain.

BUG=v8:705, v8:4905, v8:4706

Review-Url: https://codereview.chromium.org/2038043002
Cr-Commit-Position: refs/heads/master@{#36776}

This is a fix intended to be merged. Ideally messages.js should be rewritten.

R=bmeurer@chromium.org
BUG=chromium:617527

Review-Url: https://codereview.chromium.org/2044823002
Cr-Commit-Position: refs/heads/master@{#36775}

BUG=chromium:474921
TBR=vogelheim@chromium.org, jochen@chromium.org
NOTRY=true

Review-Url: https://codereview.chromium.org/2041303002
Cr-Commit-Position: refs/heads/master@{#36774}