This change introduces a liveness analyzer for local variables in frame states.

The main idea is to use the AstGraphBuilder::Environment class to build the control flow graph, and record local variable loads, stores and checkpoints in the CFG basic blocks (LivenessAnalyzerBlock class).

After the graph building finishes, we run a simple data flow analysis over the CFG to figure out liveness of each local variable at each checkpoint. Finally, we run a pass over all the checkpoints and replace dead local variables in the frame states with the 'undefined' value.

Performance numbers for Embenchen are below.

----------- box2d.js
Current --turbo-deoptimization: EmbenchenBox2d(RunTime): 11265 ms.
d8-master --turbo-deoptimization: EmbenchenBox2d(RunTime): 11768 ms.
d8-master: EmbenchenBox2d(RunTime): 10996 ms.
----------- bullet.js
Current --turbo-deoptimization: EmbenchenBullet(RunTime): 17049 ms.
d8-master --turbo-deoptimization: EmbenchenBullet(RunTime): 17384 ms.
d8-master: EmbenchenBullet(RunTime): 16153 ms.
----------- copy.js
Current --turbo-deoptimization: EmbenchenCopy(RunTime): 4877 ms.
d8-master --turbo-deoptimization: EmbenchenCopy(RunTime): 4938 ms.
d8-master: EmbenchenCopy(RunTime): 4940 ms.
----------- corrections.js
Current --turbo-deoptimization: EmbenchenCorrections(RunTime): 7068 ms.
d8-master --turbo-deoptimization: EmbenchenCorrections(RunTime): 6718 ms.
d8-master: EmbenchenCorrections(RunTime): 6858 ms.
----------- fannkuch.js
Current --turbo-deoptimization: EmbenchenFannkuch(RunTime): 4167 ms.
d8-master --turbo-deoptimization: EmbenchenFannkuch(RunTime): 4608 ms.
d8-master: EmbenchenFannkuch(RunTime): 4149 ms.
----------- fasta.js
Current --turbo-deoptimization: EmbenchenFasta(RunTime): 9981 ms.
d8-master --turbo-deoptimization: EmbenchenFasta(RunTime): 9848 ms.
d8-master: EmbenchenFasta(RunTime): 9640 ms.
----------- lua_binarytrees.js
Current --turbo-deoptimization: EmbenchenLuaBinaryTrees(RunTime): 11571 ms.
d8-master --turbo-deoptimization: EmbenchenLuaBinaryTrees(RunTime): 13089 ms.
d8-master: EmbenchenLuaBinaryTrees(RunTime): 10957 ms.
----------- memops.js
Current --turbo-deoptimization: EmbenchenMemOps(RunTime): 7766 ms.
d8-master --turbo-deoptimization: EmbenchenMemOps(RunTime): 7346 ms.
d8-master: EmbenchenMemOps(RunTime): 7738 ms.
----------- primes.js
Current --turbo-deoptimization: EmbenchenPrimes(RunTime): 7459 ms.
d8-master --turbo-deoptimization: EmbenchenPrimes(RunTime): 7453 ms.
d8-master: EmbenchenPrimes(RunTime): 7451 ms.
----------- skinning.js
Current --turbo-deoptimization: EmbenchenSkinning(RunTime): 15564 ms.
d8-master --turbo-deoptimization: EmbenchenSkinning(RunTime): 15611 ms.
d8-master: EmbenchenSkinning(RunTime): 15583 ms.
----------- zlib.js
Current --turbo-deoptimization: EmbenchenZLib(RunTime): 10825 ms.
d8-master --turbo-deoptimization: EmbenchenZLib(RunTime): 11180 ms.
d8-master: EmbenchenZLib(RunTime): 10823 ms.

BUG=

Review URL: https://codereview.chromium.org/949743002

Cr-Commit-Position: refs/heads/master@{#27232}

the third part of the patch https://codereview.chromium.org/1012633002

this patch
1) moves DeoptInfo builder code to platform independent file lithium-codegen.cc
2) adds inlining_id property to HEnterInlined so we can use it on lithium level.

BUG=chromium:452067
LOG=n

Review URL: https://codereview.chromium.org/1011733005

Cr-Commit-Position: refs/heads/master@{#27231}

R=vogelheim@chromium.org

Review URL: https://codereview.chromium.org/1008923003

Cr-Commit-Position: refs/heads/master@{#27230}

R=svenpanne@chromium.org
BUG=v8:3929
LOG=n

Review URL: https://codereview.chromium.org/1017663002

Cr-Commit-Position: refs/heads/master@{#27229}

Rolling v8/build/gyp to d174d75bf69c682cb62af9187879e01513b35e52

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1014683004

Cr-Commit-Position: refs/heads/master@{#27228}

Improve the code generated for construction of a 64-bit floating point
number from two 32-bit integers.

Previously, this moved FP->core, inserted, then moved core->FP for each
half. Now, we construct the double in an X register and move core->FP.
Typically, the temporary register aliases the input register, so the
sequence improves from six to two instructions.

Patch from Martyn Capewell <m.m.capewell@googlemail.com>.

BUG=

Review URL: https://codereview.chromium.org/1008003004

Cr-Commit-Position: refs/heads/master@{#27227}

Tiny cleanup on the way...

Review URL: https://codereview.chromium.org/1007283006

Cr-Commit-Position: refs/heads/master@{#27226}

The feature itself is still behind a flag.

BUG=v8:3862
R=hpayer@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1014503003

Cr-Commit-Position: refs/heads/master@{#27225}

CpuProfiler: replace FLAG_hydrogen_track_positions with is_tracking_positions method on CompilationInfo

this is the second part of https://codereview.chromium.org/1012633002.

almost mechanical change.
I'd like to enable positions tracking when cpu profiler is working.
But I'll switch it on for cpu-profiler in another patch.

BUG=chromium:452067
LOG=n

Review URL: https://codereview.chromium.org/995183005

Cr-Commit-Position: refs/heads/master@{#27224}

BUG=chromium:467481
LOG=Y

Review URL: https://codereview.chromium.org/1009933002

Cr-Commit-Position: refs/heads/master@{#27223}

Instead of the current approach of storing flat vectors in frame states (and possibly reusing the last vector in AST graph builder), this change list builds a tree for the values and tries to reuse the nodes for different frame states. At the moment, we only use this for the local variable part of frame state, but nothing prevents us from using this for all parts.

This change provides two new classes: one for creating the tree (StateValuesCache) and one for iterating the trees (StateValuesAccess).

BUG=

Review URL: https://codereview.chromium.org/1008213002

Cr-Commit-Position: refs/heads/master@{#27222}

this is the first part of https://codereview.chromium.org/1012633002.
mechanical change.

The motivation: the original patch needs to use List of List but list is not copiable.

BUG=chromium:452067
LOG=n

Review URL: https://codereview.chromium.org/1011733002

Cr-Commit-Position: refs/heads/master@{#27221}

The per-isolate compilation cache is a lot faster still than
the serialized code cache. Promote code to compilation cache
after deserialization.

R=vogelheim@chromium.org
BUG=chromium:399580
LOG=N

Review URL: https://codereview.chromium.org/1008363002

Cr-Commit-Position: refs/heads/master@{#27220}

Fix the resulting warnings by renaming things apart.

BUG=v8:3947
LOG=n

Review URL: https://codereview.chromium.org/1009373002

Cr-Commit-Position: refs/heads/master@{#27219}

Also, include the time for building object groups in the tracing scope
for the overapproximation.

BUG=v8:3862
R=hpayer@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1012593004

Cr-Commit-Position: refs/heads/master@{#27218}

Store buffer does not contain stale pointers anymore. Hence, sweeper threads and store buffer processing does not collide.

BUG=

Review URL: https://codereview.chromium.org/1007273002

Cr-Commit-Position: refs/heads/master@{#27217}

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/1011613003

Cr-Commit-Position: refs/heads/master@{#27216}

Revert of Remove kind field from StackHandler. (patchset #4 id:60001 of https://codereview.chromium.org/1002203002/)

Reason for revert:
Layout test failure in inspector/sources/debugger/debugger-pause-on-promise-rejection.html

Original issue's description:
> Remove kind field from StackHandler.
>
> This makes the Isolate::Throw logic not depend on a prediction of
> whether an exception is caught or uncaught. Such a prediction is
> inherently undecidable because a finally block can decide between
> consuming or re-throwing an exception depending on arbitray control
> flow.
>
> There still is a conservative prediction mechanism in place that
> components like the debugger or tracing can use for reporting.
>
> With this change we can get rid of the StackHandler::kind field, a
> pre-requisite to do table-based lookups of exception handlers.
>
> R=yangguo@chromium.org
>
> Committed: https://crrev.com/96f79568a926966ebcf0685bf9adc947f4e1fbff
> Cr-Commit-Position: refs/heads/master@{#27210}

TBR=yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1009903002

Cr-Commit-Position: refs/heads/master@{#27215}

BUG=

Review URL: https://codereview.chromium.org/1009323002

Cr-Commit-Position: refs/heads/master@{#27214}

BUG=

Review URL: https://codereview.chromium.org/1007613005

Cr-Commit-Position: refs/heads/master@{#27213}

The CL enables the same instructions are selected for Word32 and Word64 compare
operations which is possible due to a fact 32-bit inputs and produced values
are always sign-extended.

TEST=
BUG=

Review URL: https://codereview.chromium.org/1005123002

Cr-Commit-Position: refs/heads/master@{#27212}

BUG=chromium:462908
LOG=NO

Review URL: https://codereview.chromium.org/1010713002

Cr-Commit-Position: refs/heads/master@{#27211}

This makes the Isolate::Throw logic not depend on a prediction of
whether an exception is caught or uncaught. Such a prediction is
inherently undecidable because a finally block can decide between
consuming or re-throwing an exception depending on arbitray control
flow.

There still is a conservative prediction mechanism in place that
components like the debugger or tracing can use for reporting.

With this change we can get rid of the StackHandler::kind field, a
pre-requisite to do table-based lookups of exception handlers.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1002203002

Cr-Commit-Position: refs/heads/master@{#27210}

R=dpranke@chromium.org
TBR=machenbach@chromium.org
BUG=
LOG=n

Review URL: https://codereview.chromium.org/1004113003

Cr-Commit-Position: refs/heads/master@{#27209}

BUG=chromium:465651
LOG=Y

Review URL: https://codereview.chromium.org/997583004

Cr-Commit-Position: refs/heads/master@{#27208}

Revert of Reland of Remove slots that point to unboxed doubles from the StoreBuffer/SlotsBuffer. (patchset #3 id:40001 of https://codereview.chromium.org/988363002/)

Reason for revert:
Increased rate of Chrome crashes. Requires further investigation.

Original issue's description:
> Reland of Remove slots that point to unboxed doubles from the StoreBuffer/SlotsBuffer.
>
> The problem is that tagged slot could become a double slot after migrating of an object to another map with "shifted" fields (for example as a result of generalizing immutable data property to a data field).
> This CL also adds useful machinery that helps triggering incremental write barriers.
>
> BUG=chromium:454297, chromium:465273
> LOG=Y
>
> Committed: https://crrev.com/6d0677d845c47ab9fa297de61d0e3d8e5480a02a
> Cr-Commit-Position: refs/heads/master@{#27141}

TBR=hpayer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:454297, chromium:465273

Review URL: https://codereview.chromium.org/1004623003

Cr-Commit-Position: refs/heads/master@{#27207}

	modified:   test/mjsunit/mjsunit.status

R=danno@chromium.org, svenpanne@chromium.org

BUG=

Review URL: https://codereview.chromium.org/997773003

Cr-Commit-Position: refs/heads/master@{#27206}

BUG=chromium:339474
LOG=Y

Review URL: https://codereview.chromium.org/1002263004

Cr-Commit-Position: refs/heads/master@{#27205}

Enable code dependent on the newly provided common code support for
encoded internal references.

	modified:   src/ppc/code-stubs-ppc.cc
	modified:   test/cctest/cctest.status

R=danno@chromium.org, svenpanne@chromium.org

BUG=

Review URL: https://codereview.chromium.org/1008963002

Cr-Commit-Position: refs/heads/master@{#27204}

TBR=vogelheim@chromium.org

Review URL: https://codereview.chromium.org/1013603002

Cr-Commit-Position: refs/heads/master@{#27203}

R=danno@chromium.org, svenpanne@chromium.org

BUG=

Review URL: https://codereview.chromium.org/1006913002

Cr-Commit-Position: refs/heads/master@{#27202}

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/1001063003

Cr-Commit-Position: refs/heads/master@{#27201}

Rolling v8/tools/clang to 37246cb63b9720d6fe74b473210291007e49297b

TBR=jochen@chromium.org
BUG=chromium:466099
LOG=n

Review URL: https://codereview.chromium.org/1005333002

Cr-Commit-Position: refs/heads/master@{#27200}

Cr-Commit-Position: refs/heads/master@{#27199}

Cr-Commit-Position: refs/heads/master@{#27198}

Also clean up left alone release branch in the chromium
checkout of the v8rel script.

TBR=tandrii@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1003383003

Cr-Commit-Position: refs/heads/master@{#27197}

Remembering the current branch is a relic from the past
where no work-dir checkout was used. Now this doesn't give
much benefit and screws up the script if it was left in
a bad state (e.g. after a master restart).

TBR=tandrii@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1002383002

Cr-Commit-Position: refs/heads/master@{#27196}

Cr-Commit-Position: refs/heads/master@{#27195}

Cr-Commit-Position: refs/heads/master@{#27194}

Cr-Commit-Position: refs/heads/master@{#27193}