BUG=chromium:736567

Review-Url: https://codereview.chromium.org/2962503002
Cr-Commit-Position: refs/heads/master@{#46216}

This removes specialized support for materializing arguments objects.
For TurboFan we use the generic escape analysis mechanism when such
objects are materialized already, only Crankshaft used this deprecated
mechanism.

R=jarin@chromium.org
BUG=v8:6408

Change-Id: Ibed52a028752e667b05a60fa7cf0275a6a372897
Reviewed-on: https://chromium-review.googlesource.com/548595Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46215}

Port c15b3ffc and
6a99238b to arm64.

This reduces the snapshot size for arm64 by about 5.5%.

BUG=

Review-Url: https://codereview.chromium.org/2937413002
Cr-Commit-Position: refs/heads/master@{#46214}

- Allow disabling filtering of objects
- Allow disabling visitation of map pointer
- Strongly suggest to compiler to inline visitation.

Bug: v8:736641
Change-Id: I1894eaf86b4fd368b66d75b8deca1c9ab273059d
Reviewed-on: https://chromium-review.googlesource.com/547716
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46213}

R=danno@chromium.org
BUG=v8:6408

Change-Id: I6613557e474f415293feb164a30c15485d81ff2c
Reviewed-on: https://chromium-review.googlesource.com/547717Reviewed-by: Daniel Clifford <danno@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46212}

Bug: chromium:734314
Change-Id: I4e1bd1264c2c4088ce9fdcdbe3b9e233faa516df
Reviewed-on: https://chromium-review.googlesource.com/544990Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46211}

The only difference between GetNextUncompiledFunctionId +
CompileAndSchedule and FetchAndExecuteCompilationUnit is that
FetchAndExecuteCompilationUnit potentially calls a callback if
it detects that no finishing task is executing. With this CL
I replace the two functions again with
FetchAndExecuteCompilationUnit. I add a flag so that no callback
is called when the flag is not set. If no callback is called,
FetchAndExecuteCompilationUnit behaves exactly the same
as the other two functions together.

R=clemensh@chromium.org

Change-Id: I17318381eec2d17b13d0902984f2620b909c7ea0
Reviewed-on: https://chromium-review.googlesource.com/544954Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46210}

If the data to be stored in a BitVector is small enough (less than the
pointer size), it can be stored directly on the BitVector instead of the
pointer. This patch makes the data field of the BitVector a union
between a pointer and uintptr_t, and uses the latter is the data length
is 0.

Change-Id: I24c1920f2c16373c883cf69b123bf59812fef28e
Reviewed-on: https://chromium-review.googlesource.com/541307
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46209}

Change-Id: Ie0d3be6c36d13b073df2e59890ef6c714c529011
Reviewed-on: https://chromium-review.googlesource.com/548055Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46208}

BUG=chromium:694255

Change-Id: Ie4f14e62afa63339c586c3872d6acfa2bf4833d8
Reviewed-on: https://chromium-review.googlesource.com/545717Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46207}

This is mainly to enable optimization of case-insensitive maps, where
we see the pattern

if (m.has(key.toLowerCase())) { return m.get(key.toLowerCase()) } ...

Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng
Change-Id: I8c78a185401c51e8a53ae2932a158eaafa169495
Reviewed-on: https://chromium-review.googlesource.com/547057
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46206}

There were only two uses. Replace them by [[noreturn]] directly.

R=jarin@chromium.org
BUG=v8:6474

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I965f74f5b3493cfef9efd698f24bf00216442fd8
Reviewed-on: https://chromium-review.googlesource.com/544845Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46205}

Previously any object with maps INTERNALIZED_STRING_TYPE or
ONE_BYTE_INTERNALIZED_STRING_TYPE would be typed as kInternalizedString.
This meant that non-empty constants weren't typed as such. This causes the
following issues:
  - StringConcat couldn't be typed lowered to inline cons string allocation
    if there were string constants after the first two operands, since these
    constants would be typed as possibly empty (even if known not to be).
  - When inlining, a heap constant could end up becoming the input to a
    ToPrimitiveToString operand. If the ToPrimitiveToString is speculatively
    lowered to a CheckNonEmpty, then the verifier would fail since the
    typer can't deal well with intersecting a bitset type (NonEmpty) with
    a HeapConstantType - the end result type would be (None | HeapConstant..)
    but the HeapConstantType would retain it's LUB of kInternalizedSeqString,
    (which includes the EmptyString type) and so the verifier would fail
    since the output of CheckNonEmpty would still include the EmptyString.

To address this, when typing an actual object, check for the empty
string and return EmptyString if it is, otherwise type as normal but
remove the EmptyString bit since we know it's non-empty.

BUG=v8:6243

Change-Id: I2b34ca24e9b488199dce0d2c092d2701c2b22791
Reviewed-on: https://chromium-review.googlesource.com/544988Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46204}

R=mstarzinger@chromium.org

Bug: 
Change-Id: Ica169da6e095abb79967687ae9a18db5c833f72e
Reviewed-on: https://chromium-review.googlesource.com/546356Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46203}

R=jarin@chromium.org
BUG=v8:6408

Change-Id: Ic3337c072d1d2bb93f5b65f23e4888f65a55874f
Reviewed-on: https://chromium-review.googlesource.com/541220
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46202}

Bug: 
Change-Id: I483903e0a62363098370aeae154bbc6c52318741
Reviewed-on: https://chromium-review.googlesource.com/547956
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46201}

This is a regression test that will ensure that follow-up CLs that will
touch native function definitions will not brake anything.

Bug: v8:6459
Change-Id: Iceafd38462f2d9de14e119b6aa48be2b9bff1d33
Reviewed-on: https://chromium-review.googlesource.com/545935Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46200}

NOTRY=true
TBR=ulan@chromium.org

Bug: chromium:735951
Change-Id: Ic5cf6692988ede915aabdc1c44eea52b42bf7f45
Reviewed-on: https://chromium-review.googlesource.com/547426Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46199}

https://codereview.chromium.org/2957523002 deprecated using the gold
plugin on the chromium side.

TBR=mstarzinger@chromium.org
NOTRY=true

Bug: v8:6524
Change-Id: Id82ac677c9c858725cc89ec7a87a8917fb29a451
Reviewed-on: https://chromium-review.googlesource.com/547058Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46198}

Bug: v8:6488
Change-Id: Icc1e8a71f32592f670f262eb588976c07af41a22
Reviewed-on: https://chromium-review.googlesource.com/541283Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46197}

This reverts commit ee0e295d.

Suspect for http://crbug.com/736676
Another dcheck fails, starting after the reverted CL, e.g.:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064%20%28dbg%29/builds/8666

BUG=chromium:736676,v8:6361
TBR=kschimpf@chromium.org,mtrofin@chromium.org
NOTRY=true
NOPRESUBMIT=true

Change-Id: I160b996a07d77f90a96864f3ae84f861f495ed42
Reviewed-on: https://chromium-review.googlesource.com/547425Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46196}

Revert of Make some functions that are hit during renderer startup available for inlining (patchset #3 id:40001 of https://codereview.chromium.org/2950993002/ )

Reason for revert:
Blocks roll:
https://codereview.chromium.org/2954833002/

E.g.:
https://build.chromium.org/p/tryserver.chromium.mac/builders/mac_chromium_compile_dbg_ng/builds/449680
https://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_compile_dbg_ng/builds/324953

Please include those chromium trybots on reland. Maybe missing symbol export?

Original issue's description:
> Make some functions that are hit during renderer startup available for inlining
>
> This is towards closing the perf gap between the MSVC build (which uses link-
> time optimization) and Clang (where LTO isn't ready on Windows yet). We did
> a study (see bug) to see which non-inlined functions are hit a lot during render
> start-up, and which would be inlined during LTO. This should benefit performance
> in all builds which currently don't use LTO (Android, Linux, Mac) as well as
> the Win/Clang build.
>
> The binary size of chrome_child.dll increases by 2KB with this.
>
> BUG=chromium:728324
>
> Review-Url: https://codereview.chromium.org/2950993002
> Cr-Commit-Position: refs/heads/master@{#46191}
> Committed: https://chromium.googlesource.com/v8/v8/+/d00d52be1fce9c1bf5558c8b26bf984efd09e65b

TBR=jochen@chromium.org,mstarzinger@chromium.org,rmcilroy@chromium.org,vogelheim@chromium.org,marja@chromium.org,mlippautz@chromium.org,thakis@chromium.org,hans@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=chromium:728324
NOTRY=true
NOPRESUBMIT=true

Review-Url: https://codereview.chromium.org/2955793002
Cr-Commit-Position: refs/heads/master@{#46195}

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/28f796f..d4f2d77

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: Iddd29943ce0e5ed59b957106313e235c32d56e3d
Reviewed-on: https://chromium-review.googlesource.com/547096Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46194}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/a4ae1b7..564be75

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/buildtools/+log/38477c2..7f2cacb

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/e810453..28f796f

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/9bb118e..ad52f33

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: I9e0e4ebca5fcf782b11bf8e4c4348b46e3f90c80
Reviewed-on: https://chromium-review.googlesource.com/547296Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46193}

Port a42473ab

Original Commit Message:

    These are no longer being used.

R=mvstanton@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, bjaideep@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:6408
LOG=N

Review-Url: https://codereview.chromium.org/2949103005
Cr-Commit-Position: refs/heads/master@{#46192}

This is towards closing the perf gap between the MSVC build (which uses link-
time optimization) and Clang (where LTO isn't ready on Windows yet). We did
a study (see bug) to see which non-inlined functions are hit a lot during render
start-up, and which would be inlined during LTO. This should benefit performance
in all builds which currently don't use LTO (Android, Linux, Mac) as well as
the Win/Clang build.

The binary size of chrome_child.dll increases by 2KB with this.

BUG=chromium:728324

Review-Url: https://codereview.chromium.org/2950993002
Cr-Commit-Position: refs/heads/master@{#46191}

This is a fix to https://codereview.chromium.org/2929853003 that got
reverted. The DCHECK checked to see that it was not in a background
thread. While this is a property we want for v8, it is also used
by blink, and blink violates this property.

Therefore, this CL removes the DCHECK for now.

BUG=v8:6361

Review-Url: https://codereview.chromium.org/2961443002
Cr-Commit-Position: refs/heads/master@{#46190}

Port 21701297

Original Commit Message:

    Add a new JSConstructWithArrayLike operator that is backed by the
    ConstructWithArrayLike builtin (similar to what was done before
    for the JSCallWithArrayLike operator), and use that operator to
    optimize Reflect.construct inlining in TurboFan. This is handled
    uniformly with JSConstructWithSpread in the JSCallReducer.

    Also add missing test coverage for Reflect.construct in optimized
    code, especially for some interesting corner cases.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:4587,v8:5269
LOG=N

Change-Id: Idaf247317036ddec74b9aa3addd2e7d75b65bfaf
Reviewed-on: https://chromium-review.googlesource.com/546716
Commit-Queue: Jaideep Bajwa <bjaideep@ca.ibm.com>
Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#46189}

Port 767ce788

Original Commit Message:

    Add a new JSCallWithArrayLike operator that is backed by the
    CallWithArrayLike builtin, and use that operator for both
    Function.prototype.apply and Reflect.apply inlining. Also unify
    the handling of JSCallWithArrayLike and JSCallWithSpread in
    the JSCallReducer to reduce the copy&paste overhead.

    Function.prototype.apply in optimized code, especially for some
    corner cases, which was missing so far.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:4587,v8:5269
LOG=N

Change-Id: I930845df7e87b8962588cc79f6069477865fa086
Reviewed-on: https://chromium-review.googlesource.com/546735Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Jaideep Bajwa <bjaideep@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#46188}

Port a971a64d

Original Commit Message:

    We can remove a lot of native code and rely on CallOrConstructVarargs
    to do the stack manipulation for us.

    This will also take advantage of the fast-path for double arrays in
    CallOrConstructDoubleVarargs.

    We can also remove Runtime_SpreadIterableFixed because it isn't used
    anymore. We just call directly into spread_iterable from CSA.

R=petermarshall@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: Idad830c9aace4151db866c9f863158cd7525e881
Reviewed-on: https://chromium-review.googlesource.com/546575Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Jaideep Bajwa <bjaideep@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#46187}

Each frame within an optimized frame needs to be re-verified as being
subject to debugging. The specific crash from the linked bug was caused
by the fact that non-user JS frames don't necessarily have an associated
script. We'd ignore that and attempt to call
Script::GetPositionInfo() on the Undefined constant.

BUG=chromium:732408

Change-Id: Ib2982890529623d150092fa57e26fcb237fef59f
Reviewed-on: https://chromium-review.googlesource.com/545895Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46186}

When executing a script that does import("foo"), "foo" should be
relative to the script's directory, not relative to the current working
directory of the d8 process.

R=gsathya@chromium.org

Bug: v8:5785
Change-Id: Id6ceccb242905bd6b54b07038ece60b93d92e4a0
Reviewed-on: https://chromium-review.googlesource.com/546375
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46185}

In bits.h, instead of relying on C++ overloading for 32/64 bits integers
(which can be ambiguous when the input isn't the exact type typedef-ed
by uint64_t or uint32_t), use templates and std::enable_if to switch
between integers of different sizes.

This means that we can get rid of an awkward sizeof check in
bit-vector.cc, which was necessary to compile on Mac.

Change-Id: Id0eaf0f855cdbd2dc4d7bc1c481037fcd9b73953
Reviewed-on: https://chromium-review.googlesource.com/543480
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46184}

Move bytecode array writing logic into the array builder, allowing us to
remove the bytecode array writer and bytecode node, and convert runtime
operand writing to compile-time bytecode operand writing using the
information statically known at compile time.

Bug: v8:6474
Change-Id: I210cd9897fd41293745614e4a253c7c251dfffc9
Reviewed-on: https://chromium-review.googlesource.com/533055
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46183}

BUG=chromium:694255

Change-Id: I80657c5ec11fb36766a79af8584c1f1e3afaa497
Reviewed-on: https://chromium-review.googlesource.com/545595
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46182}

Bug: chromium:662388
Change-Id: Ia50889a6f4313270f1aadd19cc3f91eb25989c96
Reviewed-on: https://chromium-review.googlesource.com/544882
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46181}

Bug: 
Change-Id: Ice0781822308ba44934abbe5802585a70e744eb0
Reviewed-on: https://chromium-review.googlesource.com/544994
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46180}

Bug: v8:126
Change-Id: I13d42f0dccb0899f0aad572d33501e856073db9d
Reviewed-on: https://chromium-review.googlesource.com/544968
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46179}

This prepares ground for switching mark-compactor to use
Worklist data-structure instead of the existing marking deque.

BUG=chromium:694255

Change-Id: I0ac4c563018a9619962fb4bf388b5f3cceffb86d
Reviewed-on: https://chromium-review.googlesource.com/544933Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46178}

Bug: 
Change-Id: I0415b3946e6efd97c3b2fb770fda7dba265ee8cd
Reviewed-on: https://chromium-review.googlesource.com/545000Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46177}