[runtime] Speed up allocating instances in the runtime by having a quick-check for inobject slack tracking.

This speeds up
https://github.com/kpdecker/six-speed/blob/master/tests/object-assign/object-assign.es5
by over 5%.

Review URL: https://codereview.chromium.org/1690923002

Cr-Commit-Position: refs/heads/master@{#33917}

[runtime/heap] Introduce CopyFixedArrayUpTo to match CopyFixedArrayAndGrow, copying to a smaller array.

This allows the helper to avoid write barriers while copying, speeding up Object.keys by 5-10%.

BUG=

Review URL: https://codereview.chromium.org/1690953002

Cr-Commit-Position: refs/heads/master@{#33916}

Several minor cleanups to error handling in expression parsing:
  - Remove duplication of binding and assignment error reporting.
  - RecordBindingPatternError calls are changed to shorter BindingPatternUnexpectedToken
    calls where possible.
  - No-op error recording calls are removed.

Review URL: https://codereview.chromium.org/1688833004

Cr-Commit-Position: refs/heads/master@{#33915}

This fact is depended upon by, at least, Parser::ParseLazy, and quite
likely by other code. There was already code in %FunctionSetName
enforcing this invariant. This patch adds similar code to
Factory::NewSharedFunctionInfo().

BUG=v8:4659
LOG=n

Review URL: https://codereview.chromium.org/1686193003

Cr-Commit-Position: refs/heads/master@{#33914}

BUG=

Review URL: https://codereview.chromium.org/1691763002

Cr-Commit-Position: refs/heads/master@{#33913}

Fixes a register-clobbering problem. The Branch() instruction can overwrite the 'at' register, so it can't be used as scratch in Allocate(). Added DCHECK to avoid this in the future.

BUG=

Review URL: https://codereview.chromium.org/1687173006

Cr-Commit-Position: refs/heads/master@{#33912}

Instead of doing a full function body traversal we collect return expressions and mark them after function parsing.

And since we rewrite do-expressions so that the result is explicitly assigned to a result variable the statements marking will never hit so I removed it from the AST.

BUG=v8:4698
LOG=N

Review URL: https://codereview.chromium.org/1693523002

Cr-Commit-Position: refs/heads/master@{#33911}

Landing this again, excluding arm as it fail and arm64
out of caution that other wasm arm64 tests are also disabled.

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=mjsunit/asm-wasm
R=titzer@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1694493002

Cr-Commit-Position: refs/heads/master@{#33910}

Apparently, this BytecodeArrayIterator method was missed during the
previous refactor. No other (collateral) change was done.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1691433002

Cr-Commit-Position: refs/heads/master@{#33909}

- Remove unused methods that we should never actually use like SetArea() or
  set_size().
- Live bytes are now reported with --trace-live-bytes and not gc-verbose.

BUG=chromium:581076
LOG=N

Review URL: https://codereview.chromium.org/1686413002

Cr-Commit-Position: refs/heads/master@{#33908}

This replaces the bytecode in question with a runtime call within the
bytecode stream. The tradeoff is to safe one bytecode opcode for more
expensive encoding of lookup slot deletion.

R=rmcilroy@chromium.org

Review URL: https://codereview.chromium.org/1690913002

Cr-Commit-Position: refs/heads/master@{#33907}

This change correctly sets the {CatchPrediction} field in exception
handler tables for bytecode and optimized code. It also adds tests
independent of promise handling for this prediction, to ensure all our
backends are in sync on their prediction.

R=rmcilroy@chromium.org,yangguo@chromium.org
TEST=mjsunit/compiler/debug-catch-prediction
BUG=v8:4674
LOG=n

Review URL: https://codereview.chromium.org/1690973002

Cr-Commit-Position: refs/heads/master@{#33906}

Revert of Enable asm-wasm mjsunit tests. (patchset #1 id:1 of https://codereview.chromium.org/1687813003/ )

Reason for revert:
[Sheriff] Breaks chromebooks with arm:
https://build.chromium.org/p/client.v8/builders/V8%20Arm/builds/4397

You can reland, but please keep it skipped for arm.

Original issue's description:
> Enable asm-wasm mjsunit tests.
>
> BUG= https://code.google.com/p/v8/issues/detail?id=4203
> TEST=mjsunit/asm-wasm
> R=aseemgarg@chromium.org,titzer@chromium.org
> LOG=N
>
> Committed: https://crrev.com/46728d4d9576585bceaa66b8362755c29d3e54bd
> Cr-Commit-Position: refs/heads/master@{#33883}

TBR=aseemgarg@chromium.org,titzer@chromium.org,bradnelson@google.com,bradnelson@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG= https://code.google.com/p/v8/issues/detail?id=4203

Review URL: https://codereview.chromium.org/1689113003

Cr-Commit-Position: refs/heads/master@{#33905}

R=rmcilroy@chromium.org, vogelheim@chromium.org
BUG=v8:4690
LOG=N

Review URL: https://codereview.chromium.org/1682853004

Cr-Commit-Position: refs/heads/master@{#33904}

Cr-Commit-Position: refs/heads/master@{#33903}

Revert of [regexp] ship unicode regexps. (patchset #1 id:1 of https://codereview.chromium.org/1689113002/ )

Reason for revert:
[Sheriff] Speculative revert for gc stress failures:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20gc%20stress/builds/1726

Blamelists are screwed up currently...

Original issue's description:
> [regexp] ship unicode regexps.
>
> R=rossberg@chromium.org
> BUG=v8:2952
> LOG=N
>
> Committed: https://crrev.com/3a2fbc3a4ed2802b52659df2209b930200d63b29
> Cr-Commit-Position: refs/heads/master@{#33899}

TBR=rossberg@chromium.org,yangguo@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:2952

Review URL: https://codereview.chromium.org/1688803005

Cr-Commit-Position: refs/heads/master@{#33902}

By keeping track of the stack of counters we can properly subtract the
subcounter times and properly measure the own-time spent in each runtime
function. This is useful to get more details for builtins like HandleApiCall
which are typical top-level entries for chome which previously prevent
measurements of sub-calls to builtins/runtime functions.

BUG=

Review URL: https://codereview.chromium.org/1681943002

Cr-Commit-Position: refs/heads/master@{#33901}

Revert of [Interpreter] Rename GetCountOperand to GetRegisterCountOperand. (patchset #1 id:20001 of https://codereview.chromium.org/1691433002/ )

Reason for revert:
[Sheriff] Breaks the tree:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20builder/builds/13892

Blamelists are wrong because of overloaded master. The trybots on this CL might have been outdated by the time of commit... Please rebase and retry.

Original issue's description:
> [Interpreter] Rename GetCountOperand to GetRegisterCountOperand.
>
> Apparently, this BytecodeArrayIterator method was missed during the
> previous refactor. No other (collateral) change was done.
>
> BUG=v8:4280
> LOG=N
>
> Committed: https://crrev.com/3781ca79f5c48b55d7f0bf6df370ec11515a1466
> Cr-Commit-Position: refs/heads/master@{#33897}

TBR=oth@chromium.org,rmcilroy@chromium.org,mstarzinger@chromium.org,ssanfilippo@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4280

Review URL: https://codereview.chromium.org/1690963002

Cr-Commit-Position: refs/heads/master@{#33900}

R=rossberg@chromium.org
BUG=v8:2952
LOG=N

Review URL: https://codereview.chromium.org/1689113002

Cr-Commit-Position: refs/heads/master@{#33899}

This changes "d8" to no longer report exceptions as being "caught" when
it comes to the catch prediction mechanism in our debugger. This treats
scripts as being truly top-level when it comes to exception handling and
will allow us to properly test the catch prediction mechanism using just
mjsunit tests alone.

R=yangguo@chromium.org
BUG=v8:4674
LOG=n

Review URL: https://codereview.chromium.org/1691723002

Cr-Commit-Position: refs/heads/master@{#33898}

Apparently, this BytecodeArrayIterator method was missed during the
previous refactor. No other (collateral) change was done.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1691433002

Cr-Commit-Position: refs/heads/master@{#33897}

Initial fix was simply wrong.

R=verwaest@chromium.org
BUG=v8:4524
LOG=N

Review URL: https://codereview.chromium.org/1688163003

Cr-Commit-Position: refs/heads/master@{#33896}

In the case of a simple fast-mode receiver without fancy properties, we
can just walk over the descriptor array to find all its initial property
names. As long as the map stays the same, we can also use that
descriptor array to figure out how to handle the properties.

This speeds up
https://github.com/kpdecker/six-speed/tree/master/tests/object-assign by
~2x.

BUG=

Review URL: https://codereview.chromium.org/1688953004

Cr-Commit-Position: refs/heads/master@{#33895}

Saves and restores the dispatch pointer during calls to enable the debugger to
switch the dispatch table used by a function during it's execution.

Also moves the accumulator and context nodes to be Variables so that they will
be properly merged across branches.

BUG=v8:4280,v8:4690
LOG=N

Review URL: https://codereview.chromium.org/1684073002

Cr-Commit-Position: refs/heads/master@{#33894}

Additionally list C++ builtins as well under --runtime_call_stats.
Let's try to keep all counters in one place, that makes it a bit
easier to maintain and especially discard unused ones.

BUG=

Committed: https://crrev.com/6bc71431995d49d4ca4a2ea9c75e5add5f345225
Cr-Commit-Position: refs/heads/master@{#33847}

Review URL: https://codereview.chromium.org/1678973002

Cr-Commit-Position: refs/heads/master@{#33893}

See http://tc39.github.io/ecma262/#prod-RegExpUnicodeEscapeSequence

R=erik.corry@gmail.com, erikcorry@chromium.org
BUG=v8:2952
LOG=N

Review URL: https://codereview.chromium.org/1681893002

Cr-Commit-Position: refs/heads/master@{#33892}

This removes uses of JSFunction by the (proper) deoptimizer. This will be useful
when we escape analyze JSFunction away. Unfortunately, the debugger still needs
JSFunction, so escape analysis would not work yet.

Review URL: https://codereview.chromium.org/1686183003

Cr-Commit-Position: refs/heads/master@{#33891}

BUG=

Committed: https://crrev.com/5833e8e8a437cd66405784263ccc45e73470fd42
Cr-Commit-Position: refs/heads/master@{#33870}

Review URL: https://codereview.chromium.org/1683043003

Cr-Commit-Position: refs/heads/master@{#33890}

Revert of [counters] moving runtime counters to counter.h (patchset #1 id:1 of https://codereview.chromium.org/1688783005/ )

Reason for revert:
failing gc-stress tests

Original issue's description:
> Reland of [counters] moving runtime counters to counter.h (patchset #1 id:1 of https://codereview.chromium.org/1681923003/ )
>
> Reason for revert:
> This CL was not the cause for the TSAN failures, the instruction-selector backend for x64 emitted  a wrong compare which accidentally showed up with tsan + code moves.
> The instruction-selectors changes have been reverted with https://codereview.chromium.org/1693433002
>
> Original issue's description:
> > Revert of [counters] moving runtime counters to counter.h (patchset #1 id:1 of https://codereview.chromium.org/1678973002/ )
> >
> > Reason for revert:
> > [Sheriff] Breaks TSAN:
> > https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20TSAN/builds/7727
> >
> > Original issue's description:
> > > [counters] moving runtime counters to counter.h
> > >
> > > Additionally list C++ builtins as well under --runtime_call_stats.
> > > Let's try to keep all counters in one place, that makes it a bit
> > > easier to maintain and especially discard unused ones.
> > >
> > > BUG=
> > >
> > > Committed: https://crrev.com/6bc71431995d49d4ca4a2ea9c75e5add5f345225
> > > Cr-Commit-Position: refs/heads/master@{#33847}
> >
> > TBR=jarin@chromium.org,cbruni@chromium.org
> > # Skipping CQ checks because original CL landed less than 1 days ago.
> > NOPRESUBMIT=true
> > NOTREECHECKS=true
> > NOTRY=true
> > BUG=
> >
> > Committed: https://crrev.com/2d669b96639517cfc33e6fc6d4c3814587bc7366
> > Cr-Commit-Position: refs/heads/master@{#33848}
>
> TBR=jarin@chromium.org,machenbach@chromium.org
> # Not skipping CQ checks because original CL landed more than 1 days ago.
> BUG=
>
> Committed: https://crrev.com/ad943fe44ede22b90b871e1233334dff5ff545c3
> Cr-Commit-Position: refs/heads/master@{#33887}

TBR=jarin@chromium.org,machenbach@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1687313002

Cr-Commit-Position: refs/heads/master@{#33889}

This is a follow-up to https://crrev.com/1671863002, adding the
capability to print the contents of the constant pool. The expected
type of the pool is taken from command line, and it's either:

* string/int/double: assume all constants have the specified type.
  This way, we can emit a meaningful representation, e.g. a quoted
  string for type string and so on. All the constants in the pool must
  have the same type, otherwise one or more CHECK() will fail and the
  program will eventually crash.

* mixed: print the InstanceType tag instead of the actual value.
  This is the choice for those tests where the type of the constants in
  the pool is not uniform, however only a type tag is printed, not the
  actual value of the entries. SMIs are an exception, since they do not
  have an InstanceType tag, so kInstanceTypeDontCare is printed instead.

In addition to that, functions Print{ExpectedSnippet,BytecodeSequence}
have been extracted with no functional change. It's just for improving
readability, since the code is becoming quite long.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1686963002

Cr-Commit-Position: refs/heads/master@{#33888}

Reland of [counters] moving runtime counters to counter.h (patchset #1 id:1 of https://codereview.chromium.org/1681923003/ )

Reason for revert:
This CL was not the cause for the TSAN failures, the instruction-selector backend for x64 emitted  a wrong compare which accidentally showed up with tsan + code moves.
The instruction-selectors changes have been reverted with https://codereview.chromium.org/1693433002

Original issue's description:
> Revert of [counters] moving runtime counters to counter.h (patchset #1 id:1 of https://codereview.chromium.org/1678973002/ )
>
> Reason for revert:
> [Sheriff] Breaks TSAN:
> https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20TSAN/builds/7727
>
> Original issue's description:
> > [counters] moving runtime counters to counter.h
> >
> > Additionally list C++ builtins as well under --runtime_call_stats.
> > Let's try to keep all counters in one place, that makes it a bit
> > easier to maintain and especially discard unused ones.
> >
> > BUG=
> >
> > Committed: https://crrev.com/6bc71431995d49d4ca4a2ea9c75e5add5f345225
> > Cr-Commit-Position: refs/heads/master@{#33847}
>
> TBR=jarin@chromium.org,cbruni@chromium.org
> # Skipping CQ checks because original CL landed less than 1 days ago.
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=
>
> Committed: https://crrev.com/2d669b96639517cfc33e6fc6d4c3814587bc7366
> Cr-Commit-Position: refs/heads/master@{#33848}

TBR=jarin@chromium.org,machenbach@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=

Review URL: https://codereview.chromium.org/1688783005

Cr-Commit-Position: refs/heads/master@{#33887}

1) Update profiling counters in Full codegen.
2) Call Runtime::kTraceTailCall when tracing is on

test/mjsunit/es6/tail-call-simple.js is disabled for now, because Turbofan does not fully support TCO yet.

BUG=v8:4698
LOG=N

Review URL: https://codereview.chromium.org/1670133002

Cr-Commit-Position: refs/heads/master@{#33886}

This CL also removes tail call support made so far from Crankshaft.

BUG=v8:4698
LOG=N

Review URL: https://codereview.chromium.org/1683793004

Cr-Commit-Position: refs/heads/master@{#33885}

Revert of [turbofan] Fixes the code generation for branches on x64 when the condition is Word64Equal. (patchset #1 id:1 of https://codereview.chromium.org/1677503002/ )

Reason for revert:
Code like the example given in the CL description was produced, for example, by code-stub-assembler.cc.

Reverting this, and try to fix the root cause instead.

Original issue's description:
> [turbofan] Fixes the code generation for branches on x64 when the condition is Word64Equal.
>
> Before:
>
> REX.W cmpq r9,r8
> setzl r8l
> movzxbl r8,r8
> REX.W cmpq r8,0x0
> jz 185
>
> After:
>
> REX.W cmpq r9,r8
> jnz 149
>
> Committed: https://crrev.com/75cc8352d06aada2e9131fdae793299ef73fb639
> Cr-Commit-Position: refs/heads/master@{#33784}

TBR=bmeurer@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.

Review URL: https://codereview.chromium.org/1693433002

Cr-Commit-Position: refs/heads/master@{#33884}

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=mjsunit/asm-wasm
R=aseemgarg@chromium.org,titzer@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1687813003

Cr-Commit-Position: refs/heads/master@{#33883}

JS_FRAME_FUNCTION can be expressed using the STACK_SLOT translation.

Review URL: https://codereview.chromium.org/1688023003

Cr-Commit-Position: refs/heads/master@{#33882}

There are a bunch of places in our builtins where we use %_Arguments and
%_ArgumentsLength for no good reason, as arguments object and/or rest
parameter is as good and performant in these cases. Now the only uses
of %_Arguments and %_ArgumentsLength left are in string.js, which
requires dedicated investigation.

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_nosnap_dbg
R=yangguo@chromium.org

Committed: https://crrev.com/2160429fd458e3c095475e718c97f77ac90d906f
Cr-Commit-Position: refs/heads/master@{#33834}

Review URL: https://codereview.chromium.org/1678953004

Cr-Commit-Position: refs/heads/master@{#33881}

Add dedicated %LoadLookupSlot, %LoadLookupSlotInsideTypeof,
%LoadLookupSlotForCall, %StoreLookupSlot_Sloppy and
%StoreLookupSlot_Strict runtime entry points and use them
appropriately in the various compilers. This way we can
finally drop the machine operators from the JS graph level
completely in TurboFan.

Also drop the funky JSLoadDynamic operator from TurboFan,
which was by now just a small wrapper around the runtime
call to %LoadLookupSlot.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1683103002

Cr-Commit-Position: refs/heads/master@{#33880}

Rolling v8/build/gyp to 5170bfd38fe79bd5b16aa7f6c5439fb90a37ae66

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1685413002

Cr-Commit-Position: refs/heads/master@{#33879}

Port 5de27c34

Original commit message:
    Calls use registers for target, new_target and argument count.
    We don't always respect argument count. It didn't bite us in the past
    because the code paths where we clobbered it never used it, though
    in future it could be an issue.

R=mvstanton@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1687943002

Cr-Commit-Position: refs/heads/master@{#33878}