This extends JSNativeContextSpecialization with support for stores to
fast object/smi element backing stores that are marked as copy-on-write.
In this case we first call the CopyFixedArray builtin to take a copy of
the elements backing store, and then store the new elements back to the
object, and finally perform the actual element store.

R=epertoso@chromium.org
BUG=v8:4470

Committed: https://crrev.com/ac98ad22f049a59c48387f1bab1590f135d219c6
Review-Url: https://codereview.chromium.org/2218703003
Cr-Original-Commit-Position: refs/heads/master@{#38370}
Cr-Commit-Position: refs/heads/master@{#38392}

If we infer loop variable bounds, we need to insert a type rename node
(sigma) to make sure that simplified lowering can choose representations
consistently.

Review-Url: https://codereview.chromium.org/2222513002
Cr-Commit-Position: refs/heads/master@{#38391}

This reduces peak zone memory usage by ~10% on codeload and ~5% on mandreel.

BUG=v8:5209

Committed: https://crrev.com/2648162dcfff622f8587cea2faa8c3af56456968
Review-Url: https://codereview.chromium.org/2209573002
Cr-Original-Commit-Position: refs/heads/master@{#38367}
Cr-Commit-Position: refs/heads/master@{#38390}

Revert of [x64] Zero/sign-extend loads to 64-bit registers. (patchset #1 id:20001 of https://codereview.chromium.org/2220483003/ )

Reason for revert:
Breaks tree:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20debug/builds/10969

Original issue's description:
> [x64] Zero/sign-extend loads to 64-bit registers.
>
> Before this change we would first load an 8/16/32-bit value from memory into a 32-bit register, then zero/sign-extend from that register to a 64-bit one. Now we replace that pattern with a single movsx/movzx.
>
> Ported from http://crrev.com/2183923003
>
> R=bmeurer@chromium.org
>
> Committed: https://crrev.com/4abecb7a27bd5fa073d0ff5fadb0c2bb248ef9f4
> Cr-Commit-Position: refs/heads/master@{#38388}

TBR=bmeurer@chromium.org,epertoso@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2221473002
Cr-Commit-Position: refs/heads/master@{#38389}

Before this change we would first load an 8/16/32-bit value from memory into a 32-bit register, then zero/sign-extend from that register to a 64-bit one. Now we replace that pattern with a single movsx/movzx.

Ported from http://crrev.com/2183923003

R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2220483003
Cr-Commit-Position: refs/heads/master@{#38388}

Original issue description:
> The lazy parser actually parses eagerly. It's called lazy because it
> parses functions that were previously lazy parsed. D'uh.
>
> BUG=v8:5215
> R=marja@chromium.org
>
> Review-Url: https://codereview.chromium.org/2220463002
> Cr-Commit-Position: refs/heads/master@{#38375}

BUG=v8:5215
TBR=marja@chromium.org

Review-Url: https://codereview.chromium.org/2218033003
Cr-Commit-Position: refs/heads/master@{#38387}

Since they are.

R=verwaest@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2216123003
Cr-Commit-Position: refs/heads/master@{#38386}

BUG=

Review-Url: https://codereview.chromium.org/2212133003
Cr-Commit-Position: refs/heads/master@{#38385}

Unskip test which failed with Intl support disabled, and avoid using Intl
objects within the test.

BUG=chromium:634273,chromium:634357,v8:5162
NOTRY=true
R=mstarzinger@chromium.org

Review-Url: https://codereview.chromium.org/2218743003
Cr-Commit-Position: refs/heads/master@{#38384}

Benedikt, do you think we could also provide these operators on mips,
maybe by expanding them to "-0.0 -x"? If mips can provide these operators,
then we could make Float64Neg and Float32Neg real operators and not just
OptionalOperators.

R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2218023002
Cr-Commit-Position: refs/heads/master@{#38383}

BUG=chromium:634776

Review-Url: https://codereview.chromium.org/2219803002
Cr-Commit-Position: refs/heads/master@{#38382}

BUG=v8:5238
NOTREECHECKS=true

Review-Url: https://codereview.chromium.org/2214283003
Cr-Commit-Position: refs/heads/master@{#38381}

Revert of Separate Scope into DeclarationScope and Scope (patchset #13 id:240001 of https://codereview.chromium.org/2209573002/ )

Reason for revert:
[Sheriff] Make leak checker unhappy:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20debug/builds/10959

Original issue's description:
> Separate Scope into DeclarationScope and Scope
>
> This reduces peak zone memory usage by ~10% on codeload and ~5% on mandreel.
>
> BUG=v8:5209
>
> Committed: https://crrev.com/2648162dcfff622f8587cea2faa8c3af56456968
> Cr-Commit-Position: refs/heads/master@{#38367}

TBR=marja@chromium.org,mstarzinger@chromium.org,ahaas@chromium.org,adamk@chromium.org,verwaest@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5209

Review-Url: https://codereview.chromium.org/2212383003
Cr-Commit-Position: refs/heads/master@{#38380}

Revert of Remove redundant ParseInfo::scope_. (patchset #4 id:60001 of https://codereview.chromium.org/2216563003/ )

Reason for revert:
Reverting to revert https://codereview.chromium.org/2209573002

Original issue's description:
> Remove redundant ParseInfo::scope_.
>
> This was always set to the literal's scope.
>
> (Additional change: mark getters as const.)
>
> R=adamk@chromium.org
> BUG=
>
> Committed: https://crrev.com/23ea0782977ed3a4dd113462af9ecbfd6ff0ce94
> Cr-Commit-Position: refs/heads/master@{#38372}

TBR=adamk@chromium.org,marja@chromium.org,neis@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review-Url: https://codereview.chromium.org/2222503002
Cr-Commit-Position: refs/heads/master@{#38379}

Revert of Hook up compiler dispatcher jobs to lazy parser. (patchset #3 id:40001 of https://codereview.chromium.org/2220463002/ )

Reason for revert:
Need to revert https://codereview.chromium.org/2216563003 - just reland rebased version

Original issue's description:
> Hook up compiler dispatcher jobs to lazy parser.
>
> The lazy parser actually parses eagerly. It's called lazy because it
> parses functions that were previously lazy parsed. D'uh.
>
> BUG=v8:5215
> R=marja@chromium.org
>
> Committed: https://crrev.com/255cc15f98507e2bba49574f4dc38c74deb0ca2c
> Cr-Commit-Position: refs/heads/master@{#38375}

TBR=marja@chromium.org,jochen@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5215

Review-Url: https://codereview.chromium.org/2211393003
Cr-Commit-Position: refs/heads/master@{#38378}

This is an experiment as far as performance is concerned. If Smi-configured
element loading directly from the dispatcher stub is fast enough, then we
can stop compiling LoadFastElementStubs (and drop the corresponding code).

Review-Url: https://codereview.chromium.org/2180273002
Cr-Commit-Position: refs/heads/master@{#38377}

Revert of [turbofan] Add support for copy-on-write element stores. (patchset #2 id:20001 of https://codereview.chromium.org/2218703003/ )

Reason for revert:
Breaks tree?

Original issue's description:
> [turbofan] Add support for copy-on-write element stores.
>
> This extends JSNativeContextSpecialization with support for stores to
> fast object/smi element backing stores that are marked as copy-on-write.
> In this case we first call the CopyFixedArray builtin to take a copy of
> the elements backing store, and then store the new elements back to the
> object, and finally perform the actual element store.
>
> R=epertoso@chromium.org
> BUG=v8:4470
>
> Committed: https://crrev.com/ac98ad22f049a59c48387f1bab1590f135d219c6
> Cr-Commit-Position: refs/heads/master@{#38370}

TBR=epertoso@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4470

Review-Url: https://codereview.chromium.org/2220513002
Cr-Commit-Position: refs/heads/master@{#38376}

The lazy parser actually parses eagerly. It's called lazy because it
parses functions that were previously lazy parsed. D'uh.

BUG=v8:5215
R=marja@chromium.org

Review-Url: https://codereview.chromium.org/2220463002
Cr-Commit-Position: refs/heads/master@{#38375}

BUG=chromium:474921
NOTRY=true

Review-Url: https://codereview.chromium.org/2209313002
Cr-Commit-Position: refs/heads/master@{#38374}

This makes test outcomes immutable. This has two benefits:
1) It's more robust. Using the |= operator by mistake
wouldn't lead to unwanted mutation.
2) It's faster as now the set reference can be copied again
when copying test cases. Test case copying happens an order
of magnitude more often than rules do apply.

BUG=v8:5238

Review-Url: https://codereview.chromium.org/2212333002
Cr-Commit-Position: refs/heads/master@{#38373}

This was always set to the literal's scope.

(Additional change: mark getters as const.)

R=adamk@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2216563003
Cr-Commit-Position: refs/heads/master@{#38372}

One caveat: the Crankshaft stub used to preserve callee-clobbered double
registers, which is contrary to any real platform ABI that we support. Since the
only current use of this stub is in Crankshaft, the instruction there now must
be marked as double-clobbering. This might result in a small performance
regression. However, when this stub is eventually used in TF-generated code, it
will be called from deferred code that can save doubles only on the rarely-taken
path... something that Crankshaft can't do.

BUG=chromium:608675

Review-Url: https://codereview.chromium.org/2206333003
Cr-Commit-Position: refs/heads/master@{#38371}

This extends JSNativeContextSpecialization with support for stores to
fast object/smi element backing stores that are marked as copy-on-write.
In this case we first call the CopyFixedArray builtin to take a copy of
the elements backing store, and then store the new elements back to the
object, and finally perform the actual element store.

R=epertoso@chromium.org
BUG=v8:4470

Review-Url: https://codereview.chromium.org/2218703003
Cr-Commit-Position: refs/heads/master@{#38370}

BUG=chromium:633537

Review-Url: https://codereview.chromium.org/2211893002
Cr-Commit-Position: refs/heads/master@{#38369}

Revert of [Interpreter] Collect type feedback for 'new' in the bytecode handler (patchset #6 id:100001 of https://codereview.chromium.org/2190293003/ )

Reason for revert:
[Sheriff] Fails on nosnap debug:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap%20-%20debug/builds/8403

Original issue's description:
> [Interpreter] Collect type feedback for 'new' in the bytecode handler
>
> Collect type feedback in the bytecode handler for 'new' bytecode. The
> earlier cl (https://codereview.chromium.org/2153433002/) was reverted
> because that implementation did not collect allocation site feedback.
> This regressed delta blue by an order of magnitude. This implementation
> includes collection of allocation site feedback.
>
> BUG=v8:4280, v8:4780
> LOG=N
>
> Committed: https://crrev.com/9d5e6129c4c7f9cbfe81a5fad2a470f219fe137c
> Cr-Commit-Position: refs/heads/master@{#38364}

TBR=bmeurer@chromium.org,rmcilroy@chromium.org,balazs.kilvady@imgtec.com,mythria@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4280, v8:4780

Review-Url: https://codereview.chromium.org/2212343002
Cr-Commit-Position: refs/heads/master@{#38368}

This reduces peak zone memory usage by ~10% on codeload and ~5% on mandreel.

BUG=v8:5209

Review-Url: https://codereview.chromium.org/2209573002
Cr-Commit-Position: refs/heads/master@{#38367}

Changes ConstantPoolArrayBuilder to do object lookups using the location
of the handles, rather than dereferencing the handles and comparing the
objects. This also updates CanonicalHandleScope when internalizing AST
nodes to ensure that duplicate objects share the same handles and so are
only added to the constant pool once.

BUG=v8:5203

Review-Url: https://codereview.chromium.org/2204243003
Cr-Commit-Position: refs/heads/master@{#38366}

It's just a refactoring to avoid introducing new floating controls in the SimplifiedLowering phase.

R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2215183003
Cr-Commit-Position: refs/heads/master@{#38365}

Collect type feedback in the bytecode handler for 'new' bytecode. The
earlier cl (https://codereview.chromium.org/2153433002/) was reverted
because that implementation did not collect allocation site feedback.
This regressed delta blue by an order of magnitude. This implementation
includes collection of allocation site feedback.

BUG=v8:4280, v8:4780
LOG=N

Review-Url: https://codereview.chromium.org/2190293003
Cr-Commit-Position: refs/heads/master@{#38364}

BUG=

Review-Url: https://codereview.chromium.org/2211963002
Cr-Commit-Position: refs/heads/master@{#38363}

BUG=v8:5238

Review-Url: https://codereview.chromium.org/2216293002
Cr-Commit-Position: refs/heads/master@{#38362}

Adding new methods to the code stub assembler and interpreter
assembler to combine loading and untagging SMIs, so that on 64-bit
architectures we can avoid loading the full 64 bits and load the
32 interesting bits directly instead.

Review-Url: https://codereview.chromium.org/2183923003
Cr-Commit-Position: refs/heads/master@{#38361}

This fixes the runtime profiler to no longer assume that seeing an
optimized frame on the stack implies the underlying function is not
being interpreted when entered normally. This no longer holds with code
generated for OSR directly from bytecode (not installed on function).

R=rmcilroy@chromium.org
TEST=mjsunit/regress/regress-crbug-632800
BUG=chromium:632800

Review-Url: https://codereview.chromium.org/2208603005
Cr-Commit-Position: refs/heads/master@{#38360}

This makes sure we prevent a tier-up for function which also have an
optimized activation of OSR code on the stack. In case the OSR code
deoptimizes, it needs the bytecode to still be around.

R=rmcilroy@chromium.org
TEST=mjsunit/regress/regress-5262
BUG=v8:5262

Review-Url: https://codereview.chromium.org/2206363004
Cr-Commit-Position: refs/heads/master@{#38359}

R=mstarzinger@chromium.org
BUG=chromium:633999

Review-Url: https://codereview.chromium.org/2215713002
Cr-Commit-Position: refs/heads/master@{#38358}

BUG=chromium:634273,chromium:634357,v8:5162
NOTRY=true
TBR=caitp

Review-Url: https://codereview.chromium.org/2211383002
Cr-Commit-Position: refs/heads/master@{#38357}

Revert of [api] Clean up scopes and precheck instantiations cache (patchset #3 id:40001 of https://codereview.chromium.org/2206773003/ )

Reason for revert:
[Sheriff] Leads to mac asan failures:
https://build.chromium.org/p/client.v8/builders/V8%20Mac64%20ASAN/builds/7835

Original issue's description:
> [api] Clean up scopes and precheck instantiations cache
>
> Make sure all the scopes used in api-natives.cc have inlineable constructors
> and destructors. Additionally directly precheck the instantiations cache before
> trying to enter the InvokeScope which sets the save_context.
>
> BUG=chromium:630217
>
> Committed: https://crrev.com/a2496b942cad524f0f3144b107936eaa9a7c9fd5
> Cr-Commit-Position: refs/heads/master@{#38346}

TBR=yangguo@chromium.org,cbruni@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:630217

Review-Url: https://codereview.chromium.org/2216903003
Cr-Commit-Position: refs/heads/master@{#38356}

We don't need to add stability dependencies on JSObject prototypes when
storing to an element, because we do the map check (and thereby guard
the elements kind) and we also properly deoptimize on holes if the array
protector is not usable.

R=verwaest@chromium.org
BUG=chromium:616709

Review-Url: https://codereview.chromium.org/2198833002
Cr-Commit-Position: refs/heads/master@{#38355}

Rolling v8/build to f0243d787961584ac95a86e7dae897b9b60ea674

Rolling v8/buildtools to 9c6ad6f5cbc2f30989edc3504ec7f9d360542512

Rolling v8/tools/clang to 0b06ba9e49a0cba97f6accd71a974c1623d69e16

Rolling v8/tools/mb to 60b89880ddfbccdc978f3c1562b2431119aea3d4

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2211333002
Cr-Commit-Position: refs/heads/master@{#38354}

The `PerformPromiseThen` spec-internal operation is used by the async functions
proposal, in order to ensure that AwaitExpressions are not observable via
usual mechanisms/hooks, such as Symbol.species.

BUG=v8:5253
R=littledan@chromium.org, adamk@chromium.org, gsathya@chromium.org, yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2209433003
Cr-Commit-Position: refs/heads/master@{#38353}