NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true

Review-Url: https://codereview.chromium.org/2231083002
Cr-Commit-Position: refs/heads/master@{#38546}

Revert of [turbofan] Reduces x << y ^ x >>> (32 - y) to x ror (32 - y). (patchset #1 id:1 of https://codereview.chromium.org/2199323003/ )

Reason for revert:
It may or may not have caused a regression in kraken-crypto-ccm.

Original issue's description:
> [turbofan] Reduces x << y ^ x >>> (32 - y) to x ror (32 - y).
>
> The MachineOperatorReducer was only reducing word32 expressions of the type x << y | x >>> (32 - y) (and variants) to the equivalent Word32Ror. This CL applies the same pattern-matching logic to Word32Xor.
>
> BUG=
>
> Committed: https://crrev.com/a86397d890d3caa01a947e2a6e71beb1f58e6e6b
> Cr-Commit-Position: refs/heads/master@{#38284}

TBR=bmeurer@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
NOPRESUBMIT=true
BUG=

Review-Url: https://codereview.chromium.org/2230213002
Cr-Commit-Position: refs/heads/master@{#38545}

Also convert CodeView to a class and fix a host of selection
bugs in the process, as well as move the logic and data to
"enrich" location with one type of location data with location
data known globally to the whole graph in the selection broker.

Review-Url: https://codereview.chromium.org/2230083004
Cr-Commit-Position: refs/heads/master@{#38544}

Introduces code stubs to collect type feedback for the Add, Mul, Div and Mod operations in the interpreter, and modifies the BytecodeGraphBuilder to make use of it.

BUG=v8:5273
LOG=N

Review-Url: https://codereview.chromium.org/2224343002
Cr-Commit-Position: refs/heads/master@{#38543}

Creates ScopeInfos during the ast-numbering phase so that they
are already created during bytecode generation so that they don't
need to be allocated during concurrent bytecode generation.

BUG=v8:5203

Review-Url: https://codereview.chromium.org/2223283002
Cr-Commit-Position: refs/heads/master@{#38542}

This adds assertions to generator support functions that distinguish
between old-style and new-style generators which make sure only one
of those styles is actually used. Even though normal functions can soon
be mixed (bytecode and baseline code at the same time), generator
functions are still exclusively in only one tier.

R=neis@chromium.org
BUG=v8:5265

Review-Url: https://codereview.chromium.org/2233863002
Cr-Commit-Position: refs/heads/master@{#38541}

This adds the --ignition-preserve-bytecode flag which will preserve any
existing bytecode, even if a tier-up to baseline code is performed. This
is preparatory work in order to allow mixed stacks where bytecode and
baseline code can be active at the same time.

It also adds a {HasBaselineCode} predicate symmetric to the existing
{HasBytecodeArray} predicate. Both predicates are independent and any
combination of answers is valid.

Further adaptation of the rest of the runtime will be done step-wise in
follow-up changes.

R=yangguo@chromium.org
BUG=v8:5265

Review-Url: https://codereview.chromium.org/2224923003
Cr-Commit-Position: refs/heads/master@{#38540}

This is just reformatting, no change in behavior.

Review-Url: https://codereview.chromium.org/2228023002
Cr-Commit-Position: refs/heads/master@{#38539}

BUG=v8:1569

Review-Url: https://codereview.chromium.org/2223893004
Cr-Commit-Position: refs/heads/master@{#38538}

Revert of [heap] Switch to 500k pages (patchset #24 id:780001 of https://codereview.chromium.org/2013713003/ )

Reason for revert:
Failures on waterfall:

e.g. http://build.chromium.org/p/client.v8/builders/V8%20Linux64%20TSAN/builds/11134

Original issue's description:
> [heap] Switch to 500k pages
>
> - Decrease regular heap object size to 300k, keeping the same ration (60%)
>   between this limit and page size.
>
> In a follow up, we can now get rid of the new space border page while
> keeping the 1M minimum new space size.
>
> Some results (v8.infinite_scroll; 3 runs):
> - evacuate.avg: +15.3% (1.4->1.2)
> - evacuate.max: +24.4% (2.4->1.8)
>
> BUG=chromium:581412
> LOG=N
> R=hpayer@chromium.org, ulan@chromium.org, yangguo@chromium.org
>
> Committed: https://crrev.com/ffe5c670e1559d11e7b252e15fec38765e7dbe4f
> Cr-Commit-Position: refs/heads/master@{#38533}

TBR=hpayer@chromium.org,ulan@chromium.org,yangguo@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:581412

Review-Url: https://codereview.chromium.org/2229403003
Cr-Commit-Position: refs/heads/master@{#38537}

This makes strings_ and values_ in AstValueFactory a linked list through the AstString and AstValue objects. Additionally the CL computes whether strings are convertible to array indexes directly using the AstString's hash + literal bytes just as Name does, rather than indirecting over name if available.

BUG=

Review-Url: https://codereview.chromium.org/2225423002
Cr-Commit-Position: refs/heads/master@{#38536}

LoadInternalField performs some redundant checks in the context of
fast accessors.
This improves the speedup from 20% to 60% for next/previousSibling in
the Dromaeo DOM traversal benchmarks.

BUG=chromium:508898

Review-Url: https://codereview.chromium.org/2186593002
Cr-Commit-Position: refs/heads/master@{#38535}

Now it actually collects free variables of the target function, rather than any reference to a non-stack-allocated variable in any of the inner scopes.

BUG=

Review-Url: https://codereview.chromium.org/2229373002
Cr-Commit-Position: refs/heads/master@{#38534}

- Decrease regular heap object size to 300k, keeping the same ration (60%)
  between this limit and page size.

In a follow up, we can now get rid of the new space border page while
keeping the 1M minimum new space size.

Some results (v8.infinite_scroll; 3 runs):
- evacuate.avg: +15.3% (1.4->1.2)
- evacuate.max: +24.4% (2.4->1.8)

BUG=chromium:581412
LOG=N
R=hpayer@chromium.org, ulan@chromium.org, yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2013713003
Cr-Commit-Position: refs/heads/master@{#38533}

BUG=v8:1569

Review-Url: https://codereview.chromium.org/2224333002
Cr-Commit-Position: refs/heads/master@{#38532}

This adds an IfSuccess control use in three places:

- in the lowering of isinstance,
- in wasm BuildTrapCode,
- in wasm BuildJavaScriptToNumber,
- WasmGrowMemory is marked as kNoThrow.

BUG=

Review-Url: https://codereview.chromium.org/2226163004
Cr-Commit-Position: refs/heads/master@{#38531}

The scopes of suspended generators can now be accessed through GeneratorMirror
(similar to FrameMirror).

BUG=v8:5235

Review-Url: https://codereview.chromium.org/2228393002
Cr-Commit-Position: refs/heads/master@{#38530}

BUG=

Review-Url: https://codereview.chromium.org/2224973002
Cr-Commit-Position: refs/heads/master@{#38529}

This makes break point info independent from the code kind being executed.

BUG=v8:5265

Review-Url: https://codereview.chromium.org/2230143002
Cr-Commit-Position: refs/heads/master@{#38528}

BUG=

Review-Url: https://codereview.chromium.org/2227733003
Cr-Commit-Position: refs/heads/master@{#38527}

Updates a number of AST operations to avoid dereferencing handles
such that they can safely be called off-thread. Also adds a
HandleDereferenceMode argument to some operations where handles are
compared. If handle dereferencing is allowed, the handles are compared
directly, if not then their locations are compared (which relies on the
handles being created in a CanonicalHandleScope).

BUG=v8:5203
TBR=adamk@chromium.org

Review-Url: https://codereview.chromium.org/2223523002
Cr-Commit-Position: refs/heads/master@{#38526}

We now deopt when the lhs of a mod is negative and the rhs is 1 too (previously, we erroneusly returned 0 instead of -0).

BUG=v8:5278
R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2233713002
Cr-Commit-Position: refs/heads/master@{#38525}

Port f8938e50

Original commit message:

    This CL changes the semantics of FloatXXSub to match the semantics of
    the semantics of FloatXXSubPreserveNan. Therefore there is no need
    anymore for the FloatXXSubPreserveNan operators.

    The optimizations in VisitFloatXXSub which are removed in this CL have
    already been moved to machine-operator-reducer.cc in
    https://codereview.chromium.org/2226663002

R=ahaas@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2228973002
Cr-Commit-Position: refs/heads/master@{#38524}

Also eliminate redundant CheckBounds node during SimplifiedLowering if
we can prove that the index is within the [0.0, length[ range.

R=epertoso@chromium.org

Review-Url: https://codereview.chromium.org/2229343002
Cr-Commit-Position: refs/heads/master@{#38523}

Reduce the Scanner API, in order to make subsequent rework easier.

R=marja@chromium.org
BUG=v8:4947

Review-Url: https://codereview.chromium.org/2192883002
Cr-Commit-Position: refs/heads/master@{#38522}

Revert of [debugger] reapply break points after clearing one shots. (patchset #1 id:1 of https://codereview.chromium.org/2221333002/ )

Reason for revert:
Found better solution.

Original issue's description:
> [debugger] reapply break points after clearing one shots.
>
> On the debug info, we have a list of existing break points.  When we
> step in the debugger, we flood the function with one-shot break points.
> Afterwards, we clear these one-shots by clearing all break locations.
>
> Previously, while clearing break locations, we would skip ones that have
> actual break points. Now we clear all break locations, and then reapply
> break points. This is necessary for the next step, when we encode break
> point info by source position, and not code offset. Encoding by code
> offset would mean that break points are dependent on the code kind we
> use.
>
> R=jgruber@chromium.org
> BUG=v8:5265
>
> Committed: https://crrev.com/808981a22ee19461bbe981ab33b58792d991533e
> Cr-Commit-Position: refs/heads/master@{#38492}

TBR=jgruber@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5265

Review-Url: https://codereview.chromium.org/2231653003
Cr-Commit-Position: refs/heads/master@{#38521}

Review-Url: https://codereview.chromium.org/2234523002
Cr-Commit-Position: refs/heads/master@{#38520}

BUG=

Review-Url: https://codereview.chromium.org/2226223002
Cr-Commit-Position: refs/heads/master@{#38519}

Review-Url: https://codereview.chromium.org/2234703002
Cr-Commit-Position: refs/heads/master@{#38518}

Renaming context confuses specialization passes. (And looking through
loop exit renames does not help because we insert Phis for SSA.)

BUG=chromium:635808

Review-Url: https://codereview.chromium.org/2221363002
Cr-Commit-Position: refs/heads/master@{#38517}

We only need these external v8 APIs to expose serialization externally,
so bypassed having an internal layer for now.

BUG=v8:5072

Review-Url: https://codereview.chromium.org/2228073002
Cr-Commit-Position: refs/heads/master@{#38516}

R=hpayer@chromium.org
BUG=chromium:612816,chromium:634900

Review-Url: https://codereview.chromium.org/2229583003
Cr-Commit-Position: refs/heads/master@{#38515}

For holey/growing keyed stores, we need to check that there are no
setters in the prototype chain and protect against changes to that
via code dependencies.

R=verwaest@chromium.org
BUG=v8:5275,v8:5276

Review-Url: https://codereview.chromium.org/2231683002
Cr-Commit-Position: refs/heads/master@{#38514}

Implement Bovc and Bnvc instruction macros in macro assembler.

The change 6f920d7d revealed an issue with AddBranchOvf for mips R6.
All branching instructions other than BOVC and BNVC are handled by Branch macro, which assures
correct handling of long and short branches. As a consequence, AddBranchOvf for R6 was working correctly
only before trampoline was emitted, but the case of long branch was not handled at all. Implemented
instruction macros enable proper handling of BOVC and BNVC in cases when long branching is needed.

TEST=test/intl/general/case-mapping.js

BUG=

Review-Url: https://codereview.chromium.org/2225323002
Cr-Commit-Position: refs/heads/master@{#38513}

This introduces initial support to handle keyed load access to
String primitives. This is accomplished via the existing operators
StringCharCodeAt and StringFromCharCode, which we already use to
optimize String.prototype.charCodeAt and String.fromCharCode.

R=yangguo@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2232483002
Cr-Commit-Position: refs/heads/master@{#38512}

Rolling v8/build to e1fa1d72e5795ddcaff4ded5b083b1b08e52023a

Rolling v8/third_party/WebKit/Source/platform/inspector_protocol to eaa4c48e31e9f79fb6c4b665dc789dac0f0fb125

Rolling v8/third_party/icu to 53ce631655a61aaaa42b43b4d64abe23e9b8d71f

Rolling v8/tools/mb to d4f0973ff21ab990fed45c3803731c77197d65c8

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2234653002
Cr-Commit-Position: refs/heads/master@{#38511}

Currently we have V8 RuntimeCallStats that is independently from tracing when
running d8 with flag --runtime_call_stats. This patch embeds V8 runtime call
stats into tracing, by having a global table of runtime call counters each
isolate, resetting the table each time we enter a top level trace event, and
dumping the table for each top level trace event. This will make trace file more
compat, as well as enable runtime call stats in tracing system.

This patch adds ~5% overhead to V8 when the category is enabled, we measure the
overhead by running a script when category is enabled.

BUG=v8:5089

Committed: https://crrev.com/d014866173eaa2b548c566217b2c94b1d49385fa
Committed: https://crrev.com/1ca3b73bba4a7253ca8eeef39321d70e7d414331
Committed: https://crrev.com/3f936a5b17754783e92d2146eaf66c88a78ee45b
Review-Url: https://codereview.chromium.org/2187693002
Cr-Original-Original-Original-Commit-Position: refs/heads/master@{#38270}
Cr-Original-Original-Commit-Position: refs/heads/master@{#38314}
Cr-Original-Commit-Position: refs/heads/master@{#38403}
Cr-Commit-Position: refs/heads/master@{#38510}

It can now deal with multiple objects at the same time (but no
aliasing), and it propagates store information upwards across effect
chain splits.

R=jarin
BUG=

Review-Url: https://codereview.chromium.org/2159303002
Cr-Commit-Position: refs/heads/master@{#38509}

BUG=v8:5209

Review-Url: https://codereview.chromium.org/2220363004
Cr-Commit-Position: refs/heads/master@{#38508}

This avoids direct scope() accesses and allows us to redirect it over ScopeState.

BUG=v8:5209

Review-Url: https://codereview.chromium.org/2226243002
Cr-Commit-Position: refs/heads/master@{#38507}