BranchIf and helpers were introduced when exporting the schedule from the RawMachineAssembler was not ensuring that the CFG was well-form. These methods, that were used to introduce blocks to ensure edge-split form, are now unnecessary.

BUG=

Review-Url: https://codereview.chromium.org/2426923002
Cr-Commit-Position: refs/heads/master@{#40402}

These intrinsics are unused now, and so we can drop all the code in
fullcodegen and Crankshaft that deals with those. TurboFan and Ignition
never tried to optimize those.

R=mstarzinger@chromium.org
BUG=v8:5049

Review-Url: https://codereview.chromium.org/2427673004
Cr-Commit-Position: refs/heads/master@{#40401}

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2413343002
Cr-Commit-Position: refs/heads/master@{#40400}

R=epertoso@chromium.org
BUG=v8:5049

Review-Url: https://codereview.chromium.org/2424403002
Cr-Commit-Position: refs/heads/master@{#40399}

MIPS64: Fix Word32Compare turbofan operator implementation when comparing signed with unsigned operand

MIPS64 doesn't support Word32 compare instructions. Instead it relies
that the values in registers are correctly sign-extended and uses
Word64 comparison instead. This behavior is correct in most cases,
but doesn't work when comparing signed with unsigned operands.
The solution proposed here tries to match a comparison of signed
with unsigned operand, and perform Word32Compare simulation only
in those cases. Unfortunately, the solution is not complete because
it might skip cases where Word32 compare simulation is needed, so
basically it is a hack.

BUG=
TEST=mjsunit/compiler/uint32

Review-Url: https://codereview.chromium.org/2391393003
Cr-Commit-Position: refs/heads/master@{#40398}

Consistently collect CallIC feedback in fullcodegen and Ignition, even
for possibly direct eval calls, that were treated specially so far, for
no apparent reason. With the upcoming SharedFunctionInfo based CallIC
feedback, we might be able to even inline certain direct eval calls, if
they manage to hit the eval cache. More importantly, this patch
simplifies the collection and dealing with CallIC feedback (and as a
side effect fixes an inconsistency with feedback for super constructor
calls).

R=mvstanton@chromium.org, mythria@chromium.org
BUG=v8:2206,v8:4280,v8:5267

Review-Url: https://codereview.chromium.org/2426693002
Cr-Commit-Position: refs/heads/master@{#40397}

When inlining JSCallConstruct in turbofan, receiver is initialized to model
the behaviour of constructor. When an implicit receiver is not required the
receiver value should be set to the hole value instead of undefined value.
When initializing the receiver via super calls, we check that the receiver
is the hole value.

BUG=chromium:653407

Review-Url: https://codereview.chromium.org/2424123002
Cr-Commit-Position: refs/heads/master@{#40396}

TBR=jochen@chromium.org

Review-Url: https://codereview.chromium.org/2426913002
Cr-Commit-Position: refs/heads/master@{#40395}

Switch off maybe-uninitialized warning as it gives often
false positives with optimizations in gcc.

NOTRY=true
TBR=bmeurer@chromium.org, zhengxing.li@intel.com, caitp@igalia.com, ahaas@chromium.org

Committed: https://crrev.com/0ef0d5b2b8cffd1e3647d79c5ba19752bbbc469c
Review-Url: https://codereview.chromium.org/2425913002
Cr-Original-Commit-Position: refs/heads/master@{#40382}
Cr-Commit-Position: refs/heads/master@{#40394}

BUG=chromium:648568

Review-Url: https://codereview.chromium.org/2428493003
Cr-Commit-Position: refs/heads/master@{#40393}

This ensures that the stack traces show up correctly in
DevTools. I will later extend it for source view.

R=kozyatinskiy@chromium.org, yangguo@chromium.org, titzer@chromium.org
BUG=chromium:613110

Review-Url: https://codereview.chromium.org/2420093002
Cr-Commit-Position: refs/heads/master@{#40392}

Unknown external references must trigger assertion failure.

Review-Url: https://codereview.chromium.org/2428463002
Cr-Commit-Position: refs/heads/master@{#40391}

  The CL #40373 (https://codereview.chromium.org/2405253006 ) caused a Gcc compilation error.

  The error message was:
  ../src/code-stub-assembler.cc: In member function ‘v8::internal::compiler::Node* v8::internal::CodeStubAssembler::CreateArrayIterator(v8::internal::compiler::Node*, v8::internal::compiler::Node*, v8::internal::compiler::Node*, v8::internal::compiler::Node*, v8::internal::IterationKind)’:
  ../src/code-stub-assembler.cc:7909:7: error: ‘kBaseMapIndex’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
     int kBaseMapIndex;
         ^
  cc1plus: all warnings being treated as errors
  make[1]: *** [/home/zxli/work/google-v8/v8/out/x87.release/obj.target/v8_base/src/code-stub-assembler.o] Error 1

  This CL fixed this issue by initalizing kBaseMapIndex to 0.

BUG=

Review-Url: https://codereview.chromium.org/2423343002
Cr-Commit-Position: refs/heads/master@{#40390}

  port 77419488 (r40377)

  original commit message:
  This slot is completely unused and always undefined anyways, so there's
  no need to maintain the slot during object construction.

BUG=

Review-Url: https://codereview.chromium.org/2425183002
Cr-Commit-Position: refs/heads/master@{#40389}

  port 3f6e0a4e (r40354)

  original commit message:
  RIP, handwritten KeyedLoadICStub, handwritten KeyedLoadIC_Megamorphic,
  and hydrogenized KeyedLoadGeneric!

BUG=

Review-Url: https://codereview.chromium.org/2430613003
Cr-Commit-Position: refs/heads/master@{#40388}

... instead of getting it from the FunctionMirror. For WASM frames
(including asm.js -> WASM), the function is either unresolved or does
not contain the script.

The added test case failed before this CL.

R=kozyatinskiy@chromium.org, yangguo@chromium.org, titzer@chromium.org
BUG=v8:4203, chromium:656622

Committed: https://crrev.com/ce32e2ffd835062d764f3c0ee6a32543417cb615
Review-Url: https://codereview.chromium.org/2415073003
Cr-Original-Commit-Position: refs/heads/master@{#40348}
Cr-Commit-Position: refs/heads/master@{#40387}

  port 87ae05c7 (r40341)

  original commit message:
  Utilize all opportunities to turn leas into adds.

BUG=

Review-Url: https://codereview.chromium.org/2429763002
Cr-Commit-Position: refs/heads/master@{#40386}

Revert of [build] Switch off warning on gcc bots. (patchset #2 id:20001 of https://codereview.chromium.org/2425913002/ )

Reason for revert:
Seems to be the wrong flag:
https://build.chromium.org/p/client.v8.ports/builders/V8%20Mips%20-%20builder/builds/4709

Original issue's description:
> [build] Switch off warning on gcc bots.
>
> Switch off maybe-uninitialized warning as it gives often
> false positives with optimizations in gcc.
>
> NOTRY=true
> TBR=bmeurer@chromium.org, zhengxing.li@intel.com, caitp@igalia.com, ahaas@chromium.org
>
> Committed: https://crrev.com/0ef0d5b2b8cffd1e3647d79c5ba19752bbbc469c
> Cr-Commit-Position: refs/heads/master@{#40382}

TBR=bmeurer@chromium.org,zhengxing.li@intel.com,caitp@igalia.com,ahaas@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2422103006
Cr-Commit-Position: refs/heads/master@{#40385}

The inlined version of Array.prototype.push returned the value that was
pushed instead of the new "length" property value.

R=jarin@chromium.org
BUG=chromium:656037

Review-Url: https://codereview.chromium.org/2425903002
Cr-Commit-Position: refs/heads/master@{#40384}

BUG=v8:5501

Review-Url: https://codereview.chromium.org/2424013002
Cr-Commit-Position: refs/heads/master@{#40383}

Switch off maybe-uninitialized warning as it gives often
false positives with optimizations in gcc.

NOTRY=true
TBR=bmeurer@chromium.org, zhengxing.li@intel.com, caitp@igalia.com, ahaas@chromium.org

Review-Url: https://codereview.chromium.org/2425913002
Cr-Commit-Position: refs/heads/master@{#40382}

This CL adds two new fast-paths for RegExp.prototype.replace in the case
that the regexp itself is an unmodified JSRegExp instance and the
replace argument is callable. Such cases call directly into runtime.

This could be improved even further by turning the relevant runtime
functions into inline TurboFan.

BUG=v8:5339

Review-Url: https://codereview.chromium.org/2415663007
Cr-Commit-Position: refs/heads/master@{#40381}

BUG=chromium:635948

Review-Url: https://codereview.chromium.org/2395763002
Cr-Commit-Position: refs/heads/master@{#40380}

In the process:
- Add ToString to the CodeStubAssembler and use it where appropriate
- Add constant-folding versions of IntPtrAdd/IntPtrSub to simplify code
  in element offset computation, especially for strings.

BUG=chromium:608675
LOG=N

Review-Url: https://codereview.chromium.org/2407813002
Cr-Commit-Position: refs/heads/master@{#40379}

EffectPhis can cause a cycle in a TurboFan graph. We delay the
processing of EffectPhis in the Int64Lowering to break these cycles. We
do the same already for Phis.

R=titzer@chromium.org
BUG=v8:5518
TEST=unittests/Int64LoweringTest.EffectPhiLoop

Review-Url: https://codereview.chromium.org/2428583002
Cr-Commit-Position: refs/heads/master@{#40378}

This slot is completely unused and always undefined anyways, so there's
no need to maintain the slot during object construction.

R=yangguo@chromium.org
BUG=v8:5049

Review-Url: https://codereview.chromium.org/2423323002
Cr-Commit-Position: refs/heads/master@{#40377}

BUG=

Review-Url: https://codereview.chromium.org/2420373002
Cr-Commit-Position: refs/heads/master@{#40376}

  movzxbl/movsxbl/movzxwl/movsxwl operations implicitly zero-extend to 64-bit on x64, So It's not necessary to generate a "movl" instruction to zero-extend.

  For example, movzxbl/movl instruction sequence occurs frequently in v8 interpreter bytecode handler.
  such as:
  kind = BYTECODE_HANDLER
  name = LdaSmi
  compiler = turbofan
  Instructions (size = 76)
  0x184870a3ce40 0 430fbe442601 movsxbl rax,[r14+r12*1+0x1]
  0x184870a3ce46 6 48c1e020 REX.W shlq rax, 32
  0x184870a3ce4a 10 498d5c2402 REX.W leaq rbx,[r12+0x2]
  0x184870a3ce4f 15 420fb61433 movzxbl rdx,[rbx+r14*1]
  0x184870a3ce54 20 8bd2 movl rdx,rdx          <---------------------- here is a redundant "movl"
  0x184870a3ce56 22 4883fa1e REX.W cmpq rdx,0x1e
  0x184870a3ce5a 26 0f8518000000 jnz 56 (0x184870a3ce78)

  This CL also referenced to CL #36038 (https://codereview.chromium.org/1950013003 ) for adding test cases.

BUG=

Review-Url: https://codereview.chromium.org/2427483002
Cr-Commit-Position: refs/heads/master@{#40375}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/5e4af51..eb8eb7a

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapul/+log/6087117..9a96d45

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clan/+log/6ba3d23..75350a8

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2424693004
Cr-Commit-Position: refs/heads/master@{#40374}

Implements the variations of CreateArrayIterator() in TFJ builtins
(ArrayPrototypeValues, ArrayPrototypeEntries and ArrayPrototypeKeys), and
provides two new Object types with numerous maps which identify certain
behaviours, which will be useful for inlining.

Removes src/js/array-iterator.js entirely

Also adds support for printing Symbol literals inserted by the Parser during
desugaring when FLAG_print_builtin_ast is set to true.

BUG=v8:5388
R=bmeurer@chromium.org, cbruni@chromium.org
TBR=ulan@chromium.org

Review-Url: https://codereview.chromium.org/2405253006
Cr-Commit-Position: refs/heads/master@{#40373}

R=cbruni@chromium.org
BUG=v8:705

Review-Url: https://codereview.chromium.org/2405003002
Cr-Commit-Position: refs/heads/master@{#40372}

fragmentation_limit_kb has type of size_t, using PRIuS instead of V8PRIdPTR.

R=mlippautz@chromium.org, ulan@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2425013002
Cr-Commit-Position: refs/heads/master@{#40371}

Prepared by:
https://codereview.chromium.org/2423083002/

BUG=chromium:656573
NOTRY=true
TBR=tandrii@chromium.org

Review-Url: https://codereview.chromium.org/2427603002
Cr-Commit-Position: refs/heads/master@{#40370}

BUG=v8:5343

Review-Url: https://codereview.chromium.org/2415023002
Cr-Commit-Position: refs/heads/master@{#40369}

BUG=v8:5526

Review-Url: https://codereview.chromium.org/2422173003
Cr-Commit-Position: refs/heads/master@{#40368}

BUG=

Review-Url: https://codereview.chromium.org/2425723002
Cr-Commit-Position: refs/heads/master@{#40367}

BUG=v8:5209

Review-Url: https://codereview.chromium.org/2428533002
Cr-Commit-Position: refs/heads/master@{#40366}

Using a global proxy (e.g. 'window.f', 'w.f' or 'this.f') is considerably slower than evaluating just 'f'. This CL aims to perform the necessary checks at compile time and inline the accesses.

This is a follow-on CL to crrev.com/2369933005:
- The initial upload is crrev.com/2369933005 + a rebase.
- The remaining issues are the fixes requested by the reviewers on that CL.

BUG=chromium:634276, chromium:654716

Committed: https://crrev.com/8f43d748272536117008aa6a1b53ea52126261c1
Review-Url: https://codereview.chromium.org/2403003002
Cr-Original-Commit-Position: refs/heads/master@{#40153}
Cr-Commit-Position: refs/heads/master@{#40365}

This makes the character escaping in the graph visualizer less generic
but correct against the JSON spec. The spec has the following definition
for valid characters within a double quoted string:

char ::
  any-Unicode-character-except-"-or-\-or-control-character
  \"
  \\
  \/
  \b
  \f
  \n
  \r
  \t
  \u four-hex-digits

R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2421313002
Cr-Commit-Position: refs/heads/master@{#40364}

We don't have an Isolate, so we cannot use it for retrieving data or
calling the embedder's OOM handler. So just crash.

BUG=5525

Review-Url: https://codereview.chromium.org/2427623002
Cr-Commit-Position: refs/heads/master@{#40363}