- Adds vdup.<size> Dd/Qd, Dm[i] instruction.
- Adds vsli, vsri instructions.
- Changes VMovExtended to use these to avoid moves to core registers.

LOG=N
BUG=v8:6020

Review-Url: https://codereview.chromium.org/2868603002
Cr-Commit-Position: refs/heads/master@{#45351}

No need to return an empty map. Return a JSObject instead.

Bug: v8:5933
Change-Id: I9fb727c5e1920ba94fd3d5e7ef2a7d9d602f56d8
Reviewed-on: https://chromium-review.googlesource.com/506194Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Franziska Hinkelmann <franzih@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45350}

So continue to location can be called only for one context group id at the same time.

BUG=v8:6397

Review-Url: https://codereview.chromium.org/2882213004
Cr-Commit-Position: refs/heads/master@{#45349}

R=bjaideep@ca.ibm.com, jyan@ca.ibm.com, joransiu@ca.ibm.com

BUG=

Review-Url: https://codereview.chromium.org/2888533003
Cr-Commit-Position: refs/heads/master@{#45348}

TBR=yangguo@chromium.org

Bug: 
Change-Id: I7407b394a0e1f6a3ffdfe5a9a5a123c30ad3e5c6
Reviewed-on: https://chromium-review.googlesource.com/506196
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45347}

Generate the code (extra runtime calls) for --trace-ignition support at
compile time, based on a #define (similar to TRACE_MAPS). Then check for
--trace-ignition at run-time when deciding whether to actually print
anything. This should make --trace-ignition less painful to use.

Note that --trace-igition is disabled by default, even on debug builds.
It has to be enabled with the gn arg "v8_enable_trace_ignition=true"

As a drive-by, TRACE_MAPS is renamed to V8_TRACE_MAPS, for consistency,
and SFI unique index (needed both by --trace-ignition and --trace-maps)
is cleaned up to be behind another #define.

Change-Id: I8dd0c62d0e6b7ee9c75541d45eb729dc03acbee9
Reviewed-on: https://chromium-review.googlesource.com/506203
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45346}

Change-Id: Iadd6764c3b478b4363c95fbfc9370fd8f47b6080
Reviewed-on: https://chromium-review.googlesource.com/505493
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45345}

Since deferred return/async return/rethrow commands don't have an associated
statement, we can reuse their entries in the deferred command list.

Bug: v8:4280
Bug: v8:6218
Change-Id: Ic51fb735d4ea13ebea1d5e456ec5689c0d98a4ac
Reviewed-on: https://chromium-review.googlesource.com/506077
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45344}

BUG=v8:6379

Change-Id: Ieddf861db3e5ef0445989c25ba5ee36f47c0d1bf
Reviewed-on: https://chromium-review.googlesource.com/506155
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45343}

R=adamk@chromium.org

Bug: 
Change-Id: I47087c6a15beceb7084079dcf644de7e9ede772c
Reviewed-on: https://chromium-review.googlesource.com/505620Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45342}

Bug: v8:6218
Change-Id: I5d245ea485c93fcc03fcd95c82ae0474f31ffa5e
Reviewed-on: https://chromium-review.googlesource.com/505491
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45341}

... until after the main bulk of code generation, which will soon run on a
different thread.

R=jarin@chromium.org

Bug: v8:6048
Change-Id: I12aaaf2725e2422f588c29f50084eb77b56ad9a5
Reviewed-on: https://chromium-review.googlesource.com/505616
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45340}

Reland d8bfdb7a

Original commit message:
If alignment parameter is set, the memory returned by the
StackSlot operator will be aligned according to the parameter.

The implementation goes like this. If alignment parameter is set
we allocate a bit more memory than actually needed and so we
can move the beginning of the StackSlot in order to have it aligned.

BUG=

Review-Url: https://codereview.chromium.org/2874713003
Cr-Commit-Position: refs/heads/master@{#45339}

JSFunctions should no longer be materialized on deopt, and the code doing
the materialization doesn't keep track of clearing the optimized code slot
if the function is marked for deopt, so just remove it.

BUG=chromium:718891

Change-Id: I8a1abfd2a1b810017c06fa6f889a85b428cb9dbd
Reviewed-on: https://chromium-review.googlesource.com/498628Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45338}

Bug: v8:6218
Change-Id: I53806585ee2ba5ea5bc49748a659cceb2eeaf501
Reviewed-on: https://chromium-review.googlesource.com/506668
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45337}

Unify, simplify logic, reduce UTF8 specific handling.

Intend of this is also to have stream views.
Stream views can be used concurrently by multiple threads, but
only one thread may fetch new data from the underlying source.
This together with unified stream view creation is intended to be
used for parse tasks.

BUG=v8:6093

Change-Id: Ied8e93090c506d4735080298f0fdaeed32043915
Reviewed-on: https://chromium-review.googlesource.com/501789
Commit-Queue: Wiktor Garbacz <wiktorg@google.com>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45336}

Bug: v8:6351
Bug: v8:6366
Change-Id: I3ec9bd75031b2c6148278353461f442c1eaf60ca
Reviewed-on: https://chromium-review.googlesource.com/506015
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45335}

This is in preparation for running code generation off the main thread.

Bug: v8:6048
Change-Id: Ic1ddcbbb8995d49dfcef1ffbf135117291a00ea7
Reviewed-on: https://chromium-review.googlesource.com/505513Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45334}

... by only looking at the handle.

This is in preparation for running code generation off the main thread.

Bug: v8:6048
Change-Id: I19b105c13278a2821a0b2395033e54abf5552a43
Reviewed-on: https://chromium-review.googlesource.com/506190Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45333}

BUG=v8:6371

Change-Id: Iacb4ad572ea83ade6262272ed30d4cb684f9d8ed
Reviewed-on: https://chromium-review.googlesource.com/505107
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45332}

This change adds simd lowering support for:
I8x16Splat,I8x16ExtractLane,I8x16ReplaceLane,I8x16Neg,I8x16Shl,
I8x16ShrS,I8x16Add,I8x16AddSaturateS,I8x16Sub,I8x16SubSaturateS,
I8x16Mul,I8x16MinS,I8x16MaxS,I8x16ShrU,I8x16AddSaturateU,
I8x16SubSaturateU,I8x16MinU,I8x16MaxU,I8x16Eq,I8x16Ne,I8x16LtS,
I8x16LeS,I8x16LtU,I8x16LeU operations

BUG=

Review-Url: https://codereview.chromium.org/2867343002
Cr-Commit-Position: refs/heads/master@{#45331}

When most elements of an object are deleted, we want to normalize its
elements backing store to a dictionary in order to save space. Finding
the right time to do so should not incur a linear cost on each delete
operation. This patch changes the heuristic to an amortized-constant
approach based on a global counter and the current backing store
capacity.

BUG=chromium:542978

Change-Id: Ifdf29ab2211fdde1df9078f63be4118627d6a67e
Reviewed-on: https://chromium-review.googlesource.com/506191Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45330}

R=jarin@chromium.org

Bug: v8:6048
Change-Id: Ia80a403f647b176ef02807f6d15b3198b55234bc
Reviewed-on: https://chromium-review.googlesource.com/506013
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45329}

Now that the optimized code hangs off the feedback vector, it is possible
to check whether a function has optimized code available every time it's
called in the interpreter entry trampoline. If optimized code exists, the
interpreter entry trampoline 'self-heals' the closure to point to the
optimized code and links the closure into the optimized code list.
 
BUG=v8:6246

Change-Id: I53b095db2a75ae4824c8195faf8649d766c86118
Reviewed-on: https://chromium-review.googlesource.com/501967Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45328}

These tests already pass.

BUG=v8:5516

Change-Id: I7f4796cca98aa6c276143d83bcb018a67e0cbe55
Reviewed-on: https://chromium-review.googlesource.com/506193
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45327}

Only use recursion for objects with more than
kMinRangeForMarkingRecursion (8) pointers.

Bug: chromium:651354
Change-Id: Ic71967ef535f6a32268c7097301a313db2335bf8
Reviewed-on: https://chromium-review.googlesource.com/505615Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45326}

When turning a JSCallWithSpread into a JSCall or a JSConstructWithSpread
into a JSConstruct, we need to (manually) invoke the JSCallReducer logic
again on the changed node to make sure that optimizations that are now
possible for the JSCall or JSConstruct operator are properly applied.

BUG=v8:5932,v8:5895,v8:6344,v8:6399,v8:6400
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2882153003
Cr-Commit-Position: refs/heads/master@{#45325}

We currently grow the backing store to (old_capacity*1.5)+16 if we exceed capacity, 
but shrink the capacity to the current length when 2*length <= capacity.
For short arrays (up to length 32), this can lead to a copy on every operation when using push/pop or push/shift.

Example:
Array of length 32, capacity 32
push
Array grown to length 33, capacity 32*1.5+16 = 64
pop
Array trimmed to length 32, capacity 32 because 2*32 <= 64
...

This CL leaves additional slag space when calling pop and restricts the trimming to backing stores with at least 16 elements to prevent excessive re-trimming on short arrays.

Bug: 
Change-Id: I9dd13e5e2550c7ac819294c8e29f04c8855e02a4
Reviewed-on: https://chromium-review.googlesource.com/502911
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45324}

Depending on the input elements, we can allocate a FAST_{SMI_,DOUBLE_,}KIND
backing store.

BUG=v8:6398

Review-Url: https://codereview.chromium.org/2887653002
Cr-Commit-Position: refs/heads/master@{#45323}

NOTRY=true
TBR=jkummerow@chromium.org,bmeurer@chromium.org

Bug: chromium:718739
Change-Id: I9b80a3098bf2c8d3a294e1908f058cabe1ed758c
Reviewed-on: https://chromium-review.googlesource.com/506092Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45322}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/63fb52b..7571a8a

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: Ibd90b14f080b21f7283a09ea28366f3eafab8df4
Reviewed-on: https://chromium-review.googlesource.com/505557Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45321}

BUG=

Review-Url: https://codereview.chromium.org/2861113002
Cr-Commit-Position: refs/heads/master@{#45320}

This reverts commit 98927ea5.

Reason for revert: Breaks Mac GC Stress bot.
https://uberchromegw.corp.google.com/i/client.v8/builders/V8%20Mac%20GC%20Stress/builds/13299/steps/Mjsunit/logs/for-await-of

Original change's description:
> [ignition] Be smarter about register allocation in VisitSuspend
> 
> Split BytecodeGenerator::VisitSuspend into two pieces, one for
> building the suspension code and one for resumption (these
> are split into separate Build methods for convenience).
> Each gets its own RegisterAllocationScope, which allows us to
> reduce the register file size of the empty generator by 1.
> 
> For consistency, rename VisitGeneratorPrologue() to
> BuildGeneratorPrologue() to match the names of the two
> newly-created methods.
> 
> Bug: v8:6379
> Change-Id: I08a617a44f99706cfff09bf86fb0a25a9cd6e032
> Reviewed-on: https://chromium-review.googlesource.com/503593
> Commit-Queue: Adam Klein <adamk@chromium.org>
> Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#45318}

TBR=rmcilroy@chromium.org,adamk@chromium.org,neis@chromium.org,kozyatinskiy@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
Bug: v8:6379

Change-Id: I787fc3811c4f33a8021cf9170d43a74ed9b55d1c
Reviewed-on: https://chromium-review.googlesource.com/506548Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45319}

Split BytecodeGenerator::VisitSuspend into two pieces, one for
building the suspension code and one for resumption (these
are split into separate Build methods for convenience).
Each gets its own RegisterAllocationScope, which allows us to
reduce the register file size of the empty generator by 1.

For consistency, rename VisitGeneratorPrologue() to
BuildGeneratorPrologue() to match the names of the two
newly-created methods.

Bug: v8:6379
Change-Id: I08a617a44f99706cfff09bf86fb0a25a9cd6e032
Reviewed-on: https://chromium-review.googlesource.com/503593
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45318}

NOTRY=true

Bug: chromium:718739
Change-Id: Ie28b3848a3809473d6c8757e7a86e3a786483ef1
Reviewed-on: https://chromium-review.googlesource.com/506090Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45317}

Bug: v8:5536
Change-Id: Ia3129222e3eb67239fe05411bfb42f3eaf250357
Reviewed-on: https://chromium-review.googlesource.com/505931Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45316}

The output of disassemblers was changed to display instruction offsets as
hexadecimal numbers instead of a decimal numbers. Reflect this change in
turbolizer.

BUG=

Review-Url: https://codereview.chromium.org/2885453002
Cr-Commit-Position: refs/heads/master@{#45315}

Introduce a new SwitchSmiTable bytecode for generators, which does a
table lookup for the accumulator value in a jump table stored in the
constant array pool. This removes the if-else chains at resumable
function/loop headers.

As a drive-by, add a scoped environment saving struct to the bytecode
graph builder.

Bug: v8:6351
Bug: v8:6366
Change-Id: I63be15a8b599d6684c7df19dedb8860562678fb0
Reviewed-on: https://chromium-review.googlesource.com/500271
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45314}

This reverts commit 7ef1df85.

Reason for revert: Breaks inspector/debugger/get-possible-breakpoints-restrict-to-function: https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap%20-%20debug/builds/13191/steps/Check/logs/get-possible-breakpoi..

Original change's description:
> [builtins] port Promise.all to CSA
> 
> Introduces CodeStubAssembler helpers for common Iterator operations
> (GetIterator, IteratorStep, IteratorClose).
> 
> Moves the Promise.all resolveElement closure and it's caller to
> builtins-promise-gen.cc.
> 
> Instead of creating an internal array (and copying its elements into a result
> array), a single JSArray is allocated, and appended with BuildAppendJSArray(),
> falling back to %CreateDataProperty(), and elements are updated in the resolve
> closure the same way. This should always be unobservable.
> 
> This CL increases the size of snapshot_blob.bin on an x64.debug build by 11.44kb
> 
> BUG=v8:5343
> R=​cbruni@chromium.org, gsathysa@chromium.org, jgruber@chromium.org
> 
> Change-Id: Id69b7f76866b29caccd97f35870154c4be85f418
> Reviewed-on: https://chromium-review.googlesource.com/497974
> Commit-Queue: Caitlin Potter <caitp@igalia.com>
> Reviewed-by: Camillo Bruni <cbruni@chromium.org>
> Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#45306}

TBR=adamk@chromium.org,cbruni@chromium.org,gsathya@chromium.org,caitp@igalia.com,jgruber@chromium.org,ishell@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5343

Change-Id: I831738003643561fa628266af2bcebbb18000e55
Reviewed-on: https://chromium-review.googlesource.com/506014Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45313}

Add support for I16x8Mul, I16x8MaxS, I16x8MinS, I16x8Eq, I16x8Ne,
I16x8LtS, I16x8LeS, I16x8AddSaturateU, I16x8SubSaturateU, I16x8MaxU,
I16x8MinU, I16x8LtU, I16x8LeU, I8x16Splat, I8x16ExtractLane,
I8x16ReplaceLane, I8x16Neg, I8x16Shl, I8x16ShrS, S16x8Select,
S8x16Select for mips32 and mips64 architectures.

BUG=

Review-Url: https://codereview.chromium.org/2791213003
Cr-Commit-Position: refs/heads/master@{#45312}