The heap traversal for SFI code objects when logging compiled functions
was previously accessing the abstract code of an SFI, logging its
bytecode if it exists or code object otherwise. However, there are some
(rare) cases where an SFI has both bytecode and a non-interpreter code
object -- for example, after baseline tier-up -- in which case we want
to log both, as both could be executing (at different points on the
stack).

BUG=v8:5758

Review-Url: https://codereview.chromium.org/2603333002
Cr-Commit-Position: refs/heads/master@{#42025}

Changes some for loops to use node->inputs() instead of iterating over
InputCount and accessing InputAt(i). This saves some checks for
"has_inline_inputs" and so some branches.

Review-Url: https://codereview.chromium.org/2585713002
Cr-Commit-Position: refs/heads/master@{#42024}

Revert of [turbofan] fix another divergence in escape analysis (patchset #1 id:1 of https://codereview.chromium.org/2599793002/ )

Reason for revert:
Caused memory corruption.

BUG=chromium:676767

Original issue's description:
> [turbofan] fix another divergence in escape analysis
>
> This divergence bug is very similar to the one fixed in https://codereview.chromium.org/2522253002/, this time it is an oscillation between a cleared field and a new phi node. The page http://www.sears.com/clothing-shoes-jewelry-clothing-men-s-clothing-men-s-jeans/b-1325287370?Brand=LEE&filterList=Brand&sortOption=UNITS_HIGH_TO_LOW allows for a reliable reproduction.
>
> This fix makes sure that once a field that generated a phi gets cleared, it always stays cleared.
>
> BUG=chromium:670202
>
> R=bmeurer@chromium.org
>
> Review-Url: https://codereview.chromium.org/2599793002
> Cr-Commit-Position: refs/heads/master@{#41922}
> Committed: https://chromium.googlesource.com/v8/v8/+/8435cc852672c504d5899cc2765c5b895e658efe

TBR=bmeurer@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=chromium:670202

Review-Url: https://codereview.chromium.org/2611623002
Cr-Commit-Position: refs/heads/master@{#42023}

BUG=

Review-Url: https://codereview.chromium.org/2609833003
Cr-Commit-Position: refs/heads/master@{#42022}

Don't fallback to the %StrictEqual / %Equal runtime functions for the
generic CompareIC slow path, but use the (new) StrictEqual and Equal
builtins instead. This avoids a performance cliff when mixing input
types for strict equality sites.

R=jochen@chromium.org
BUG=v8:4773

Review-Url: https://codereview.chromium.org/2609153002
Cr-Commit-Position: refs/heads/master@{#42021}

  port 05873add (r41989)

  original commit message:
  The following ported to builtins:
  FastCloneRegExp
  FastCloneShallowArray
  FastCloneShallowObject

BUG=

Review-Url: https://codereview.chromium.org/2607383002
Cr-Commit-Position: refs/heads/master@{#42020}

  port f2e8c978 (r41988)

  original commit message:

BUG=

Review-Url: https://codereview.chromium.org/2603313002
Cr-Commit-Position: refs/heads/master@{#42019}

  port 5b02a98b (r41986)

  original commit message:
  In the process, convert from a code stub into a builtin.

BUG=

Review-Url: https://codereview.chromium.org/2608203002
Cr-Commit-Position: refs/heads/master@{#42018}

  port be11812c (r41971)

  original commit message:
  Recognize and emit in-memory comparisons of 8-bit and 16-bit values with
  immediate values that fit.

BUG=

Review-Url: https://codereview.chromium.org/2612503002
Cr-Commit-Position: refs/heads/master@{#42017}

The ControlEquivalence cannot deal with new nodes inserted by the
Scheduler due to Node splitting. Rather when the ControlEquivalence
sees such a new Node, it'll likely crash on an out-of-bounds access.

This is a speculative fix to make the crash disappear, as there's no
100% reliable repro currently.

BUG=chromium:629398
TBR=jochen@chromium.org

Review-Url: https://codereview.chromium.org/2611603002
Cr-Commit-Position: refs/heads/master@{#42016}

Hook up TurboFan with the existing field type tracking machinery to
eliminate redundant map checks on the results of LoadField operators.
The store side is already implemented in TurboFan for quite some time,
this just adds the load part.

R=jarin@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2604393002
Cr-Commit-Position: refs/heads/master@{#42015}

- Adds CodeAssembler::ConstructJS() to simplify calling JS functions as
constructors, used by NewPromiseCapability()
- Defines PromiseCapability as a special JSObject subclass, with a
non-exensible Map, and read-only non-configurable DataDescriptors which
point to its in-object fields. This allows its fields to be used by JS
builtins until there is no longer any need.

Currently, the performance benefit comes from
https://codereview.chromium.org/2567033003/, but does not appear to
regress performance in any significant way.

BUG=v8:5343
TBR=ulan@chromium.org

Review-Url: https://codereview.chromium.org/2567333002
Cr-Commit-Position: refs/heads/master@{#42014}

Review-Url: https://codereview.chromium.org/2571903004
Cr-Commit-Position: refs/heads/master@{#42013}

R=jarin@chromium.org
BUG=v8:5428

Review-Url: https://codereview.chromium.org/2611523002
Cr-Commit-Position: refs/heads/master@{#42012}

We need to report cached wrappers within v8 to the embedder after each atomic
phase of v8 marking because the embedder can invalidate the wrappers in-between
v8 marking steps.

E.g., in Chrome, a conservative GC might need to wipe dead wrappables from
the wrapper tracing marking deque.

BUG=chromium:676700, chromium:468240

Review-Url: https://codereview.chromium.org/2610563002
Cr-Commit-Position: refs/heads/master@{#42011}

Store maps on the CheckMaps operator instead of burning inputs for
the individual maps. Use the same data structure (the ZoneHandleSet)
in the LoadElimination to track multiple maps per object.

BUG=v8:5267
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2431563002
Cr-Commit-Position: refs/heads/master@{#42010}

Original issue's description:
> Disable the CompilerDispatcher if we don't have idle time
>
> Since we can't do all steps on background threads, we need idle time to
> work
>
> BUG=v8:5215
> R=danno@chromium.org
>
> Review-Url: https://codereview.chromium.org/2600743002
> Cr-Commit-Position: refs/heads/master@{#41944}
> Committed: https://chromium.googlesource.com/v8/v8/+/a0d9eb346bba90aa0b32a
2d3184cbbfd6adb243e

BUG=v8:5215

Review-Url: https://codereview.chromium.org/2606233002
Cr-Commit-Position: refs/heads/master@{#42009}

Add machinery to Ignition and TurboFan to collect and consume
InternalizedString feedback for abstract and strict equality
comparisons. Here we can turn the comparison into a simple
pointer equality check.

R=jarin@chromium.org
BUG=v8:5786

Review-Url: https://codereview.chromium.org/2609013002
Cr-Commit-Position: refs/heads/master@{#42008}

R=marja@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2606223002
Cr-Commit-Position: refs/heads/master@{#42007}

R=marja@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2580833005
Cr-Commit-Position: refs/heads/master@{#42006}

When Crankshaft compiles a keyed load to arguments, it disabled
optimization unless the KEYED_LOAD_IC for the access was monomorphic.
But that's too restrictive, since it will also disable optimization
for this function when the access is on a path that was never executed
so far.

This was spotted in the Node.js core function EventEmitter.prototype.emit,
which was no longer optimizable with Crankshaft using latest V8.

R=jarin@chromium.org
BUG=v8:5790

Review-Url: https://codereview.chromium.org/2607303002
Cr-Commit-Position: refs/heads/master@{#42005}

This patch fixes OOM crash that happens for large heap where
the total size of edges exceeds 2GB, which is the hard limit
for v8::internal::List allocated using tcmalloc.

BUG=chromium:675911

Review-Url: https://codereview.chromium.org/2595003002
Cr-Commit-Position: refs/heads/master@{#42004}

R=epertoso@chromium.org
BUG=5428

Review-Url: https://codereview.chromium.org/2607243002
Cr-Commit-Position: refs/heads/master@{#42003}

Following in the footsteps of the other load/store ICs.

R=epertoso@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2608893002
Cr-Commit-Position: refs/heads/master@{#42002}

This CL is from danno@chromium.org. Moves code stubs

LoadIC
KeyedLoadICTF
StoreIC
KeyedStoreICTF
LoadICTrampoline
KeyedLoadICTrampolineTF
StoreICTrampoline
KeyedStoreICTrampolineTF

into builtins.

TBR Yang for serializer changes.

R=epertoso@chromium.org
TBR=yangguo@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2608883002
Cr-Commit-Position: refs/heads/master@{#42001}

This refactors the logic from within the FastNewObject TF_BUILTIN to a
helper method which can be reused in other assemblers. This saves the
overhead of setting up the stub and calling into it.

A wrapper method is created for functions that don't need to tail call
into the runtime.

PromiseBuiltinsAssembler and RegexpBuiltinsAssembler are refactored to
use EmitFastNewObject.

Review-Url: https://codereview.chromium.org/2607233002
Cr-Commit-Position: refs/heads/master@{#42000}

R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2602903005
Cr-Commit-Position: refs/heads/master@{#41999}

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/1e8a2ca..9ddf248

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2601373002
Cr-Commit-Position: refs/heads/master@{#41998}

R=adamk@chromium.org
BUG=v8:5343

Review-Url: https://codereview.chromium.org/2608843002
Cr-Commit-Position: refs/heads/master@{#41997}

Port 05873add
Port f2e8c978

Original commit message:

    The following ported to builtins:
    FastCloneRegExp
    FastCloneShallowArray
    FastCloneShallowObject

R=mvstanton@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2603003002
Cr-Commit-Position: refs/heads/master@{#41996}

R=adamk@chromium.org, caitp@igalia.com
BUG=v8:5343

Review-Url: https://codereview.chromium.org/2603033002
Cr-Commit-Position: refs/heads/master@{#41995}

This looks like it was leftover from strong mode; default class
constructors are always in strict mode.

R=littledan@chromium.org

Review-Url: https://codereview.chromium.org/2601123002
Cr-Commit-Position: refs/heads/master@{#41994}

Cr-Commit-Position: refs/heads/master@{#41993}

Port 5b02a98b

Original Commit Message:

    In the process, convert from a code stub into a builtin.

R=danno@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2601243003
Cr-Commit-Position: refs/heads/master@{#41992}

This patch stores the promise, resolve, reject properties of the
deferred object created by CreateInternalPromiseCapability and
NewPromiseCapability directly on the promise (if the promise hasn't
been fulfilled), otherwise they are stored on the
PromiseReactionJobInfo.

This patch removes the currently unused
CreateInternalPromiseCapability and inlines the call to create the
deferred promise object.

NewPromiseCapability is the only function that works with a deferred.

This patch results in a 8.5% improvement in benchmarks over 5 runs.

BUG=v8:5343

Review-Url: https://codereview.chromium.org/2590563003
Cr-Commit-Position: refs/heads/master@{#41991}

Cr-Commit-Position: refs/heads/master@{#41990}

The following ported to builtins:
FastCloneRegExp
FastCloneShallowArray
FastCloneShallowObject

BUG=
TBR=rmcilroy@chromium.org, rossberg@chromium.org

Review-Url: https://codereview.chromium.org/2605893002
Cr-Commit-Position: refs/heads/master@{#41989}

BUG=
TBR=rmcilroy@chromium.org

Review-Url: https://codereview.chromium.org/2604833004
Cr-Commit-Position: refs/heads/master@{#41988}

BUG=
R=epertoso@chromium.org

Review-Url: https://codereview.chromium.org/2602903004
Cr-Commit-Position: refs/heads/master@{#41987}

In the process, convert from a code stub into a builtin.

Review-Url: https://codereview.chromium.org/2606733002
Cr-Commit-Position: refs/heads/master@{#41986}