Support inlining across bound functions in the JSCallReducer when we
specialize to the native context. This basically removes all overhead
from bound functions in TurboFan and gives another speed of 10x on my
microbenchmark.

BUG=chromium:535408, chromium:571299, v8:4629
R=jarin@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1581343002

Cr-Commit-Position: refs/heads/master@{#33283}

On Intel, xchg stalls the pipeline. We use xchg to implement swap
moves. In a separate exploration, the presence of xchg in a very hot
loop, due to a change in register allocation, lead to over 20% regression.

Simply changing that instruction with push/mov/pop (almost) eliminated
the regression.

In light of that, I removed uses of xchg. This leads to more instructions,
though. That is particularly problematic for long cycles, which, today,
we translate to successions of swaps.

I plan to address this cycle issue in a separate change. For now, the
goal is to unblock the initial work that lead here.

Review URL: https://codereview.chromium.org/1580233003

Cr-Commit-Position: refs/heads/master@{#33282}

Rolling v8/tools/clang to 24e8c1c92fe54ef8ed7651b5850c056983354a4a

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1586933002

Cr-Commit-Position: refs/heads/master@{#33281}

  port 322ffda3 (r33265)

  original commit message:
  Also migrate the Number constructor to a native builtin, using the
  same mechanism already used by the String constructor. Otherwise just
  parsing and compiling the Number constructor to optimized code already
  eats 2ms on desktop for no good reason, and the resulting optimized
  code is not even close to awesome.

  Drive-by-fix: Use correct context for the [[Construct]] case of the
  String constructor as well, and share some code with it.

BUG=

Review URL: https://codereview.chromium.org/1581313002

Cr-Commit-Position: refs/heads/master@{#33280}

When parsing a pattern element with an assignment operator that is not
Token::ASSIGN, record a pattern error to indicate the invalid assignment target.

BUG=v8:811, v8:4666
LOG=N
R=adamk@chromium.org, rossberg@chromium.org, littledan@chromium.org

Review URL: https://codereview.chromium.org/1583863003

Cr-Commit-Position: refs/heads/master@{#33279}

  port 12bcba15 (r33258)

  original commit message:
  The API functions are always in sloppy mode, so receiver is always a
  JSReceiver once the actual call trampoline runs, no need to check again
  in various places.

BUG=

Review URL: https://codereview.chromium.org/1582173002

Cr-Commit-Position: refs/heads/master@{#33278}

The bulk of these were marked simply '[PASS]', while one was marked
'[PASS, FAIL]' but seems to always pass.

BUG=v8:3305, v8:4405
LOG=n

Review URL: https://codereview.chromium.org/1584863003

Cr-Commit-Position: refs/heads/master@{#33277}

BUG=v8:3699
LOG=N
R=adamk@chromium.org, rossberg@chromium.org, littledan@chromium.org

Review URL: https://codereview.chromium.org/1582783004

Cr-Commit-Position: refs/heads/master@{#33276}

Revert of [wasm] Add tests for JS wrappers to test-run-wasm. (patchset #1 id:1 of https://codereview.chromium.org/1581643004/ )

Reason for revert:
New test failed on nosnap builder (https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap%20-%20debug/builds/4738):

Test: cctest/test-run-wasm-js/Run_CallJS_Add_jswrapped

Stderr:
abort: Sloppy function expects JSReceiver as receiver.

#
# Fatal error in ../../src/objects-inl.h, line 3221
# Check failed: !v8::internal::FLAG_enable_slow_asserts || (object->IsJSFunction()).
#

Original issue's description:
> [wasm] Add tests for JS wrappers to test-run-wasm.
>
> R=bradnelson@chromium.org, ahaas@chromium.org
> BUG=
>
> Committed: https://crrev.com/c52f5ced4e600a57c02301f2936b80f086613985
> Cr-Commit-Position: refs/heads/master@{#33274}

TBR=ahaas@chromium.org,bradnelson@chromium.org,titzer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1587763002

Cr-Commit-Position: refs/heads/master@{#33275}

R=bradnelson@chromium.org, ahaas@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1581643004

Cr-Commit-Position: refs/heads/master@{#33274}

Port 12bcba15

Original commit message:
    The API functions are always in sloppy mode, so receiver is always a
    JSReceiver once the actual call trampoline runs, no need to check again
    in various places.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1583893002

Cr-Commit-Position: refs/heads/master@{#33273}

Port 322ffda3

Original commit message:
    Also migrate the Number constructor to a native builtin, using the
    same mechanism already used by the String constructor. Otherwise just
    parsing and compiling the Number constructor to optimized code already
    eats 2ms on desktop for no good reason, and the resulting optimized
    code is not even close to awesome.

    Drive-by-fix: Use correct context for the [[Construct]] case of the
    String constructor as well, and share some code with it.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1583903002

Cr-Commit-Position: refs/heads/master@{#33272}

exception operand in a handler block. This avoids confusing
unrelated ranges, which may happen if escape analysis elides
the exception operand.

BUG=chromium:576195
LOG=N

Review URL: https://codereview.chromium.org/1579603005

Cr-Commit-Position: refs/heads/master@{#33271}

The escape analysis transformation phase visits allocation nodes
twice under some circumstances, thus reporting wrong counter values.
This CL ensures counter values are correct.

R=mstarzinger@chromium.org
BUG=v8:4586
LOG=n

Review URL: https://codereview.chromium.org/1577273002

Cr-Commit-Position: refs/heads/master@{#33270}

Removes assignment hazard scope. Reverts back to the naive scheme of
allocating a temporary for every variable load. It was decided to revert it
because the current implementation does not handle logical expressions,
ternary operators, visiting objects in named/keyed loads. Also, we wanted
to evaluate alternate approaches and choose one when we have a mechanism
to measure performance.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1576403004

Cr-Commit-Position: refs/heads/master@{#33269}

Once we use type feedback, we need to reflect the feedback in the types, propagate
the new narrower types forward and use them in the subsequent
representation inference. This CL propagates and uses the recomputed types
for Phi and Select nodes (rather than using the types from the typer).

Review URL: https://codereview.chromium.org/1580353003

Cr-Commit-Position: refs/heads/master@{#33268}

This bug improves performance of escape analysis.

* A allocation discovery phase  (EscapeAnalysis::AssignAliases)
  ensures compact representation of virtual state
* Node revisiting in EscapeStatusAnalysis has been improved
* Escape analysis no longer requires a trimmed graph

BUG=v8:4586
LOG=n

Review URL: https://codereview.chromium.org/1559123003

Cr-Commit-Position: refs/heads/master@{#33267}

Port 5091e8f2

TEST=cctest/test-assembler-mips64/jump_tables1,cctest/test-assembler-mips64/jump_tables2,cctest/test-assembler-mips64/jump_tables3,cctest/test-macro-assembler-mips/jump_tables5
BUG=

Review URL: https://codereview.chromium.org/1582533005

Cr-Commit-Position: refs/heads/master@{#33266}

Also migrate the Number constructor to a native builtin, using the
same mechanism already used by the String constructor. Otherwise just
parsing and compiling the Number constructor to optimized code already
eats 2ms on desktop for no good reason, and the resulting optimized
code is not even close to awesome.

Drive-by-fix: Use correct context for the [[Construct]] case of the
String constructor as well, and share some code with it.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1573243009

Cr-Commit-Position: refs/heads/master@{#33265}

Code copied 1:1 from chromium.

BUG=chromium:565952
LOG=n
NOTRY=true

Review URL: https://codereview.chromium.org/1580193004

Cr-Commit-Position: refs/heads/master@{#33264}

This uses the bots introduced here:
https://codereview.chromium.org/1581803003/

BUG=chromium:535160
LOG=n
NOTRY=true
NOPRESUBMIT=true
TBR=tandrii@chromium.org, kjellander@chromium.org

Review URL: https://codereview.chromium.org/1588543002

Cr-Commit-Position: refs/heads/master@{#33263}

ReportFailedAccessCheck() sometimes doesn't throw an exception (it's up
to the embedder). Pretend that OrdinaryDefineOwnProperty() succeeded in
that case. This is consistent with existing behavior of other methods:
- JSObject::DefineOwnPropertyIgnoreAttributes
- JSObject::SetPropertyWithFailedAccessCheck
- Object::SetPropertyWithAccessor

See also commit f66c3f5c.

BUG=chromium:574217
LOG=n
R=neis@chromium.org

Review URL: https://codereview.chromium.org/1580823002

Cr-Commit-Position: refs/heads/master@{#33262}

R=jarin@chromium.org
BUG=v8:4650
LOG=Y

Review URL: https://codereview.chromium.org/1574113009

Cr-Commit-Position: refs/heads/master@{#33261}

(fast_handler *has* a more specific type; the TODO is no longer applicable.)

R=epertoso@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1577233003

Cr-Commit-Position: refs/heads/master@{#33260}

R=jkummerow@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1587483003

Cr-Commit-Position: refs/heads/master@{#33259}

The API functions are always in sloppy mode, so receiver is always a
JSReceiver once the actual call trampoline runs, no need to check again
in various places.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/1575973006

Cr-Commit-Position: refs/heads/master@{#33258}

Rolling v8/tools/clang to afad7aa23b146a86be9bc335caaac5bcfa72f390

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1584673002

Cr-Commit-Position: refs/heads/master@{#33257}

TEST=asm-wasm.js
R=titzer@chromium.org,bradnelson@google.com
BUG=

Review URL: https://codereview.chromium.org/1583603002

Cr-Commit-Position: refs/heads/master@{#33256}

Review URL: https://codereview.chromium.org/1580123002

Cr-Commit-Position: refs/heads/master@{#33255}

http://tc39.github.io/ecma262/#sec-destructuring-assignment-static-semantics-early-errors
requires that DestructuringAssignmentTargets which do not match Pattern productions,
must return true for IsValidSimpleAssignmentTarget.

This change rejects parenthesized patterns with a SyntaxError.

BUG=v8:4662, v8:811
LOG=N
R=adamk@chromium.org, rossberg@chromium.org, nikolaos@chromium.org

Review URL: https://codereview.chromium.org/1585473002

Cr-Commit-Position: refs/heads/master@{#33254}

TEST=asm-wasm.js
R=titzer@chromium.org,bradnelson@google.com
BUG=

Review URL: https://codereview.chromium.org/1584573002

Cr-Commit-Position: refs/heads/master@{#33253}

Failing to do so results in out-of-date marking information, because live bytes
is not properly adjusted.

This CL adds support for right trimming ByteArray and properly DCHECKs that we
do not left trim  ByteArray (as we already do for FixedTypedArrayBase).

BUG=

Review URL: https://codereview.chromium.org/1577263003

Cr-Commit-Position: refs/heads/master@{#33252}

R=ahaas@chromium.org,bradnelson@chromium.org
LOG=Y
BUG=chromium:575167

Review URL: https://codereview.chromium.org/1577803002

Cr-Commit-Position: refs/heads/master@{#33251}

BUG=v8:4661, v8:4488
LOG=N
R=adamk@chromium.org, rossberg@chromium.org, jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1575133003

Cr-Commit-Position: refs/heads/master@{#33250}

BUG=

Review URL: https://codereview.chromium.org/1573953002

Cr-Commit-Position: refs/heads/master@{#33249}

No functional change.  This is prep for fixing test failures in wasm tests.

R=joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1583523002

Cr-Commit-Position: refs/heads/master@{#33248}

NOTRY=true
TBR=rmcilroy@chromium.org, neis@chromium.org

Review URL: https://codereview.chromium.org/1574343002

Cr-Commit-Position: refs/heads/master@{#33247}

The hash calculation was dependent on upper part of |inner_pointer| and caused non-deterministic cache miss events which in turn caused non-deterministic progress of pages sweeping (see GcSafeFindCodeForInnerPointer()).

Review URL: https://codereview.chromium.org/1582573002

Cr-Commit-Position: refs/heads/master@{#33246}

There's no need to mark these as possibly-direct-eval, since all such an
eval-tagged string will ever get passed is the array of string parts, which
will be immediately returns (since it's not a string). It will
never do a lookup in the current scope, nor (in sloppy mode) introduce
new declarations.

This patch is not intended to change behavior, but I've added tests that
demonstrate the stuff explained in the preceding paragraph.

Review URL: https://codereview.chromium.org/1580463003

Cr-Commit-Position: refs/heads/master@{#33245}

Failing chromium layout tests were marked for rebaselining.

Addition to original CL (https://codereview.chromium.org/1580693002/):
Skip some more ignition tests.

BUG=v8:3931,v8:1543
LOG=Y
R=hablich@chromium.org
CC=verwaest@chromium.org, rossberg@chromium.org,rmcilroy, oth

Review URL: https://codereview.chromium.org/1580783002

Cr-Commit-Position: refs/heads/master@{#33244}