Refactor EmitUnOp to be templatized in the type and the emit function,
similar to EmitBinOp. This simplified adding f32 and f64 unops.

R=ahaas@chromium.org

Bug: v8:6600
Change-Id: Iaab473a3bbcc45673ff6190d6b56244c48bfa5a6
Reviewed-on: https://chromium-review.googlesource.com/937201
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51568}

TBR=yangguo@chromium.org

Bug: v8:6666
Change-Id: I70ba2ecbc259431b571a2e5611494dd7725f2aa6
Reviewed-on: https://chromium-review.googlesource.com/937302Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51567}

I loosened the DCHECKs here but I think they are still fundamentally
safe: `length` must be <= the actual length of the source (so that
there are actually enough elements to copy), and `length` must also be
<= the destination length, minus the offset (so there is enough space
to copy the elements into).

Bug: chromium:816317
Change-Id: Ice00ac60f4884363f6065ffee71f6ab1d1b32dbc
Reviewed-on: https://chromium-review.googlesource.com/937209Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51566}

BUG=v8:5402,v8:7310

Change-Id: Ic3ee7d2dec0403e7831f51735365c26caadc6a7b
Reviewed-on: https://chromium-review.googlesource.com/934136
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51565}

This reverts commit e7f9fb4a.

Reason for revert: msvc compile error: https://build.chromium.org/p/client.v8/builders/V8%20Win64%20-%20msvc/builds/1573

Original change's description:
> [Assembler][x64] Make Operand immutable
> 
> This CL removes all setters from the Operand and removes the friendship
> relation between Assembler and Operand. All data fields of the Operand
> are set exactly once in the constructor, the Operand is immutable
> afterwards.
> In order to construct the data of an Operand easily, the OperandBuilder
> is introduced. After building an Operand, the data is copied to the
> const field of the Operand.
> 
> R=​mstarzinger@chromium.org
> 
> Bug: v8:7310
> Change-Id: I1628052b8a0c47cbfbc3645dfdac5a0e9705977b
> Reviewed-on: https://chromium-review.googlesource.com/936741
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#51563}

TBR=mstarzinger@chromium.org,clemensh@chromium.org

Change-Id: I8ae40de35e81765549f93ffe58f1b12286de6333
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7310
Reviewed-on: https://chromium-review.googlesource.com/936627Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51564}

This CL removes all setters from the Operand and removes the friendship
relation between Assembler and Operand. All data fields of the Operand
are set exactly once in the constructor, the Operand is immutable
afterwards.
In order to construct the data of an Operand easily, the OperandBuilder
is introduced. After building an Operand, the data is copied to the
const field of the Operand.

R=mstarzinger@chromium.org

Bug: v8:7310
Change-Id: I1628052b8a0c47cbfbc3645dfdac5a0e9705977b
Reviewed-on: https://chromium-review.googlesource.com/936741Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51563}

With this, `Builtins::IsBuiltinId(code->builtin_index())` turns into
`Builtins::IsBuiltin(code)`.

Bug: v8:6666
Change-Id: Id731299cf5eb3f213933d3a9b3ae78d9bb95e757
Reviewed-on: https://chromium-review.googlesource.com/937205
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51562}

There's two considerations involving off-heap code and safepoint
tables.

1. Since the safepoint table is embedded within the instructions area
of code objects, we need to ensure that the actual instruction size
(i.e.  safepoint_table_offset if a code object has safepoints) is
large enough for the off-heap trampoline.

2. The pc-relative calculation in SafepointTable::FindEntry must be
able to handle off-heap pcs.

Bug: v8:6666
Change-Id: I92a5ecc49d0a78755b89c3c5774523afb21cd724
Reviewed-on: https://chromium-review.googlesource.com/934242Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51561}

Change-Id: I9185b17c73ad4486b81538a8ce2f84271b820919
Reviewed-on: https://chromium-review.googlesource.com/936763Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#51560}

The key -> value edge is shown as "<index> / WeakMap", where <index> is
the index of the edge in the key.

Bug: chromium:778739, chromium:749502
Change-Id: I657051695f2a171372788dbb777543a55a35d554
Reviewed-on: https://chromium-review.googlesource.com/926524
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Alexei Filippov <alph@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51559}

R=jgruber@chromium.org

Bug: v8:5530
Change-Id: I1680beaa665b6937df2e26d20cb69cc8577a21a9
Reviewed-on: https://chromium-review.googlesource.com/937203Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51558}

TBR=jgruber@chromium.org
NOTREECHECKS=true
NOTRY=true

Change-Id: Id5d81f863fa6d14ac86d49b6516e577c2da7a999
Reviewed-on: https://chromium-review.googlesource.com/936543Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51557}

This CL changes the builtin
  StringSubstring(string, start, end)
to take start and end as untagged IntPtr values.

Bug: v8:7250, v8:7340

Change-Id: I39700d087da903f076a6ca163a8f880d31eea3a0
Reviewed-on: https://chromium-review.googlesource.com/923961
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51556}

The Operand class is small enough to be efficiently passed by value.
This saves binary size and performance because the Operand does not need
to be emitted to the caller's frame and loaded in the callee.
Binary saving is 37kB in release mode on ia32.

R=mstarzinger@chromium.org

Bug: v8:7310
Change-Id: Ibc103622ec216725c762c2ba4bb96451c99db556
Reviewed-on: https://chromium-review.googlesource.com/934264
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51555}

Snapshots don't yet work in 64-bit win/cross builds, so disable them
until they do.

No behavior change in builds that aren't 64-bit win/cross builds.

Bug: chromium:803591
Change-Id: I7a04c7e01a58a95a2bfb78c7d2593c7c5c5041cf
Reviewed-on: https://chromium-review.googlesource.com/936668Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Nico Weber <thakis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51554}

This adds support for poisoning the stack pointer and implicit register
arguments like the context register and the function register in the
prologue of generated code with JavaScript linkage. The speculation
poison is computed similarly to the interpreter by matching expected
with actual code start addresses.

R=jarin@chromium.org,rmcilroy@chromium.org
BUG=chromium:798964

Change-Id: I5fa48844745459cf7b3d00c407a7b835f61c857b
Reviewed-on: https://chromium-review.googlesource.com/919167
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51553}

R=herhut@chromium.org, jgruber@chromium.org

Bug: v8:7310, v8:5510
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel
Change-Id: Icefd10b6cc210e5bb2684d18b091179ead387326
Reviewed-on: https://chromium-review.googlesource.com/934445
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51552}

Currently we didn't always consistently use the String feedback on
JSAdd, but only if JSTypedLowering would already figure out statically
that one of the inputs is already a String. That leads to some odd
performance cliffs, as highlighted in the referenced bug.

This CL fixes the JSTypedLowering::ReduceJSAdd to always bake in the
String feedback. This improves the relevant performance tests from the
bug from

  console.timeEnd: Runtime join3, 967.512000
  console.timeEnd: Runtime join, 1004.599000
  console.timeEnd: Runtime join3, 1124.764000
  console.timeEnd: Runtime join, 966.164000
  console.timeEnd: Runtime join3, 1145.296000
  console.timeEnd: Runtime join, 966.176000
  console.timeEnd: Runtime join3, 1145.272000
  console.timeEnd: Runtime join, 931.266000

to

  console.timeEnd: Runtime join3, 903.050000
  console.timeEnd: Runtime join, 856.509000
  console.timeEnd: Runtime join3, 945.144000
  console.timeEnd: Runtime join, 840.038000
  console.timeEnd: Runtime join3, 927.965000
  console.timeEnd: Runtime join, 841.263000
  console.timeEnd: Runtime join3, 929.342000
  console.timeEnd: Runtime join, 858.143000

which corresponds to an 8-18% improvement.

Bug: v8:7415
Change-Id: I62e008298e4ee0864885b37817c91d055acf2a09
Reviewed-on: https://chromium-review.googlesource.com/936643Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51551}

Removing includes which are not needed and also not indirectly pulled in.

BUG=v8:7490, v8:7310

Change-Id: I219ba92c3281c3c245cc6c5574c85c2d51a217a9
Reviewed-on: https://chromium-review.googlesource.com/934722Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51550}

Bug: v8:7310
Change-Id: Ib9c40bababbb688305be7bea262a4348805a1f18
Reviewed-on: https://chromium-review.googlesource.com/936762Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51549}

The CreateClosureMode introduced with 2ece046c is still not 100%
fail-safe and doesn't scale. What we really need instead, especially
when we might start removing the SharedFunctionInfo::code field
eventually, is to tell the JSCreateClosure node which code object to
use. So instead of adding magic around it, let's just pass it to the
node.

Bug: v8:2206, v8:7253, v8:7310
Change-Id: Iedb6ae468a763643617975f47d96854d1aeafbe9
Reviewed-on: https://chromium-review.googlesource.com/937121Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51548}

We use JSCreateClosure to also constructs closures for builtins, i.e.
for the callbacks created by the Promise constructor. For these builtins
we cannot set code to CompileLazy builtin, but need to use the code from
the SharedFunctionInfo. The explicit mode tells the lowering what it
should do (instead of relying on SharedFunctionInfo::native(), which is
not the right bit).

Bug: v8:2206, v8:7253, v8:7310
Change-Id: Ic956814e137c57b36ebb5d7b4d964dde5ee51a0d
Reviewed-on: https://chromium-review.googlesource.com/930964
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51547}

This reverts commit 3c62f7ae.
(and commit 4939463c)

The goal of this revert is to contrast the effect on perf bots of
landing it vs reverting it to more easily attribute its impact.

R=hpayer@chromium.org

Bug: chromium:812178
Change-Id: I7c977b1b0b587f787263272400d87f6aae7af634
Reviewed-on: https://chromium-review.googlesource.com/936761
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51546}

This implements the full set of f32 comparisons (f32.eq, f32.ne,
f32.lt, f32.gt, f32.le, f32.ge) on ia32 and x64.

R=titzer@chromium.org

Bug: v8:6600
Change-Id: I2be786431d01b4ed540b70f3e4a27c19b7d2649e
Reviewed-on: https://chromium-review.googlesource.com/928982Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51545}

This is a follow-up to https://chromium-review.googlesource.com/904164
now that I've realized raw TRACE_EVENTs work in v8 (initially thought
had to go through heap()->tracer()).

After adding events to EvacuatePage(), the subitem event for evacuation tasks
became redundant. Since this results in a better output this CL applies
this approach to all paralell work items.

Not using TRACE_BACKGROUND_GC also avoids polluting logs with subitems
when using v8's tracing flags.

R=mlippautz@chromium.org

Bug: chromium:651354
Change-Id: I62efbde69da2a0a9bd255e34093d64924e339974
Reviewed-on: https://chromium-review.googlesource.com/934263
Commit-Queue: Gabriel Charette <gab@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51544}

I think those are safe to keep and add useful information to highlight
the type of evacuate copy step being performed.

This is a prerequisite for https://chromium-review.googlesource.com/c/v8/v8/+/934263
as it will drop tracing individual work items and will
leave it to top-level item trace events like these to
highlight individual work item's work.

Will reland after reverting them all however to confirm the re-adding
these doesn't cause regressions as the fine grain trace events
initially did.

R=hpayer@chromium.org

Bug: chromium:813824
Change-Id: I8e53b880ce0aeae08afa7a2c0f36a455f645bcfa
Reviewed-on: https://chromium-review.googlesource.com/934248Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Gabriel Charette <gab@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51543}

TBR=yangguo@chromium.org
NOTRY=true

Bug: chromium:813833
Change-Id: If9694bebc6576549feb00cbf035c4a5e92a70976
Reviewed-on: https://chromium-review.googlesource.com/936442Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51542}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/787ae8b..b1d6c28

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/13a8b37..8a42ad3

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/7e69312..b3d3f59

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: I7bf829336fd7ded9b95573fc9b95c4988d36d8f6
Reviewed-on: https://chromium-review.googlesource.com/936226
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51541}

Change lowering for Store to use input replacement type.

Change-Id: Ic1fbbb37a3cc938fca7015d838933284bae6068e
Reviewed-on: https://chromium-review.googlesource.com/903266
Commit-Queue: Jing Bao <jing.bao@intel.com>
Reviewed-by: Aseem Garg <aseemgarg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51540}

Fuzzers after switching to ToT mjsunit.js, which accesses
Date.prototype, while for correctness fuzzing it's mocked out as a
proxy.

This makes the proxy return the property correctly.

TBR=yangguo@chromium.org
NOTRY=true

Bug: chromium:813833
Change-Id: Ic4b6412063f42c4e75905fbd568b7f81bc54daff
Reviewed-on: https://chromium-review.googlesource.com/936046
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51539}

TBR=yangguo@chromium.org
NOTRY=true

Bug: chromium:813833
Change-Id: I8f687d27981a54234c37ba2e4b22060696f6dee7
Reviewed-on: https://chromium-review.googlesource.com/936006Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51538}

This patch removes one unnecessary sub instruction in ComputeCodeStartAddress for SpeculationPoison generation at the beginning of each bytecode handler.

leaq rbx,[rip+0x0]      => leaq rbx,[rip+0xfffffff9]
subq rbx,0x7            => To be removed
movq r9,0x0
cmpq rcx,rbx
movq rbx,0xffffffff
cmovzq r9,rbx


Change-Id: I7648ae27d4039488d1fc0f4c25477a5cb889bd6d
Reviewed-on: https://chromium-review.googlesource.com/933593Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Shiyu Zhang <shiyu.zhang@intel.com>
Cr-Commit-Position: refs/heads/master@{#51537}

Previously the API allowed the embedder to re fulfill a non pending
promise. This was changed as part of
c0412961.

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I53dc028fecdcc6ab05c05cfc7795e89519ed9633
Reviewed-on: https://chromium-review.googlesource.com/932968
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51536}

`CodeStubAssembler::ToInteger_Inline` performs a `TaggedIsSmi` check,
and calls `ToInteger` with the appropriate truncation mode if the
input is not a Smi.

When we already know we’re dealing with something that’s not a Smi,
this check is redundant, and we can use
`CallBuiltin(Builtins::kToInteger*)` directly.

Bug: v8:7310
Change-Id: If538e39bcb738014bd03f10edd0051dac72b7ea3
Reviewed-on: https://chromium-review.googlesource.com/934901
Commit-Queue: Mathias Bynens <mathias@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51535}

Since we only need to store 18 different function kinds,
the bitfield approach was wasting space (requiring 11 bits).

This patch replaces the bitfield with a regular enum, and
updates all the FunctionKind predicates to use comparisons
instead of bitwise ops.

For the small amount of builtin code that depended upon being
able to do masking to determine whether something is a class
constructor, we still store two extra bits on FunctionKind,
which are computed when the SFI is initialized.

If this approach causes performance regressions (i.e., if it
turns out that other code was implicitly depending on masking
for fast checks), we can revert this or address it in
other ways (e.g., by doing similar caching of repeated checks
in the caller).

This is a reland of 42667bab.

Bug: v8:7310
Change-Id: I2ec54289ea687399c61d75b7aff2d849861a64f2
Reviewed-on: https://chromium-review.googlesource.com/934864Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51534}

Change-Id: Ic9eaaa2af0106fea85a85599d404b2b304b3db2d
Reviewed-on: https://chromium-review.googlesource.com/930338Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Eric Holk <eholk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51533}

Currently, atomic operations assume the default to be 32-bit
operations, fix opcode names for differentiation between 32/64-bit
operations.

Bug: v8:6532
Change-Id: Idc7df4e191f54b125271b067891e0a1df07008a4
Reviewed-on: https://chromium-review.googlesource.com/924333Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51532}

NOTRY=true

Bug: v8:7492
Change-Id: Ie25281f8efa30d14574c7b53b4ab8a22d1344535
Reviewed-on: https://chromium-review.googlesource.com/934847Reviewed-by: Fadi Meawad <fmeawad@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51531}

See https://crbug.com/v8/5193#c26

TBR=yangguo@chromium.org
NOTRY=true

Bug: v8:5193
Change-Id: I10f4c57c54b5bf596641a0e4c492bd652941b28e
Reviewed-on: https://chromium-review.googlesource.com/934845Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51530}

This adds printing on failures to compare output when correctness fuzzing.

TBR=yangguo@chromium.org
NOTRY=true

Bug: chromium:813833
Change-Id: I0280561392f6614960608db4e93341552c716142
Reviewed-on: https://chromium-review.googlesource.com/934843
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51529}