This replace HeapType with a dedicated class that implements just what we need for field type tracking. In the next CL, I plan to remove FieldType::Iterator because FieldType can iterate over at most one map.

The ultimate plan is to get rid of templates in types.(h|cc) and remove type-inl.h.

TBR=rossberg@chromium.org

Review URL: https://codereview.chromium.org/1636013002

Cr-Commit-Position: refs/heads/master@{#33521}

Revert of Type Feedback Vector lives in the closure (patchset #12 id:260001 of https://codereview.chromium.org/1563213002/ )

Reason for revert:
FAilure on win32 bot, need to investigate webkit failures.

Original issue's description:
> Type Feedback Vector lives in the closure
>
> We get less "pollution" of type feedback if we have one vector per native
> context, rather than one for the whole system. This CL moves the vector
> appropriately.
>
> We rely more heavily on the Optimized Code Map in the SharedFunctionInfo. The
> vector actually lives in the first slot of the literals array (indeed there is
> great commonality between those arrays, they can be thought of as the same
> thing). So we make greater effort to ensure there is a valid literals array
> after compilation.
>
> This meant, for performance reasons, that we needed to extend
> FastNewClosureStub to support creating closures with literals. And ultimately,
> it drove us to move the optimized code map lookup out of FastNewClosureStub
> and into the compile lazy builtin.
>
> The heap change is trivial so I TBR Hannes for it...
>
> TBR=hpayer@chromium.org
>
> BUG=
>
> Committed: https://crrev.com/a5200f7ed4d11c6b882fa667da7a1864226544b4
> Cr-Commit-Position: refs/heads/master@{#33518}

TBR=bmeurer@chromium.org,akos.palfi@imgtec.com
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1632993003

Cr-Commit-Position: refs/heads/master@{#33520}

Add S390 specific atomic ops implementation + associated build
toolchain updates.

R=danno@chromium.org,svenpanne@chromium.org,michael_dawson@ca.ibm.com,jyan@ca.ibm.com,mtbrandyberry@ca.ibm.com

BUG=

Review URL: https://codereview.chromium.org/1601223003

Cr-Commit-Position: refs/heads/master@{#33519}

We get less "pollution" of type feedback if we have one vector per native
context, rather than one for the whole system. This CL moves the vector
appropriately.

We rely more heavily on the Optimized Code Map in the SharedFunctionInfo. The
vector actually lives in the first slot of the literals array (indeed there is
great commonality between those arrays, they can be thought of as the same
thing). So we make greater effort to ensure there is a valid literals array
after compilation.

This meant, for performance reasons, that we needed to extend
FastNewClosureStub to support creating closures with literals. And ultimately,
it drove us to move the optimized code map lookup out of FastNewClosureStub
and into the compile lazy builtin.

The heap change is trivial so I TBR Hannes for it...

TBR=hpayer@chromium.org

BUG=

Review URL: https://codereview.chromium.org/1563213002

Cr-Commit-Position: refs/heads/master@{#33518}

BUG=v8:4280
LOG=N
TBR=machenbach@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1633133002

Cr-Commit-Position: refs/heads/master@{#33517}

This increases the size of register operands to be 16-bit.

Not all bytecodes have wide register variants, so when they are
needed a register translator will copy them into a small area
reserved at the top of the 8-bit register range and these registers
are supplied as arguments to the bytecode with 8-bit operands.

This is non-intrusive for typical bytecode where the number of
registers is less than 120. For bytecodes with wide register
operands (above the window) their index needs to be translated
to avoid the reserved translation window.

Enables splay.js to run in Octane and a handful of mjsunit tests.

BUG=v8:4280,v8:4675
LOG=NO

Review URL: https://codereview.chromium.org/1613163002

Cr-Commit-Position: refs/heads/master@{#33516}

- Remove semispace target capacity: It's unused and adds some unneeded
  complexity

- Enforcing decl order for SemiSpace
- Move forward declarations in spaces.h to top
- Add all members to default constructor

BUG=chromium:581076
LOG=N

Review URL: https://codereview.chromium.org/1631713002

Cr-Commit-Position: refs/heads/master@{#33515}

This CL disables a test that takes too long in debug mode when
escape analysis is enabled in turbofan.

R=machenbach@chromium.org
BUG=v8:4586
LOG=n
NOTRY=true

Review URL: https://codereview.chromium.org/1636593004

Cr-Commit-Position: refs/heads/master@{#33514}

This fixes the translation of 'throw' bytecodes to TurboFan graphs. The
correct runtime function is being used now, also the frame states are
attached to the correct nodes now.

R=mythria@chromium.org
TEST=cctest/test-run-jsexceptions/ThrowMessageIndirectly
BUG=v8:4674
LOG=n

Review URL: https://codereview.chromium.org/1636033002

Cr-Commit-Position: refs/heads/master@{#33513}

Rename IntepreterExceptionEntryHandler builtin to InterpreterEnterBytecodeDispatch
and use it as the return address when building interpreter frames during deopt.
This ensures that we restart execution of the outer frame at the correct
bytecode.

BUG=v8:4280,v8:4678
LOG=N

Review URL: https://codereview.chromium.org/1633633002

Cr-Commit-Position: refs/heads/master@{#33512}

BUG=chromium:577261
R=machenbach@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1635963003

Cr-Commit-Position: refs/heads/master@{#33511}

Adds support for calling native function literals. Moves the logic for building
the native function's SharedFunctionInfo out of full-codegen into compiler.cc
to allow it to be shared between fullcodegen and Ignition.

BUG=v8:4686
LOG=N

Review URL: https://codereview.chromium.org/1635553002

Cr-Commit-Position: refs/heads/master@{#33510}

This CL implements PrepareForTailCall() mentioned in ES6 spec for full codegen, Crankshaft and Turbofan.
When debugger is active tail calls are disabled.

Tail calling can be enabled by --harmony-tailcalls flag.

BUG=v8:4698
LOG=Y
TBR=rossberg@chromium.org

Review URL: https://codereview.chromium.org/1609893003

Cr-Commit-Position: refs/heads/master@{#33509}

BUG=chromium:577261
R=machenbach@chromium.org,jarin@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1604203002

Cr-Commit-Position: refs/heads/master@{#33508}

This simplifies the lookup mechanism used for range-based exception
handler tables. Those tables are well nested and we can assume that
results get increasingly narrow the later they appear in the table.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1639743002

Cr-Commit-Position: refs/heads/master@{#33507}

BUG=
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/1634513002

Cr-Commit-Position: refs/heads/master@{#33506}

Debugging helper. Centralized the logic for printing blocks from
InstructionSequence.

A clean(-er) design would be to define an operator<< on a
PrintableInstructionBlock. However, we've discussed moving off those
operators, so it seemed unnecessary to complicate the change.

BUG=

Review URL: https://codereview.chromium.org/1632803003

Cr-Commit-Position: refs/heads/master@{#33505}

SpiderMonkey switched to 2, test262 tests for 2, and 2 is a reasonable, natural
value.

R=yangguo

Review URL: https://codereview.chromium.org/1616233002

Cr-Commit-Position: refs/heads/master@{#33504}

This patch makes Array.prototype.concat support subclassing Arrays
and constructing instances properly with Symbol.species. It is
guarded by the --harmony-species flag.

R=cbruni
LOG=Y
BUG=v8:4093

Review URL: https://codereview.chromium.org/1577043002

Cr-Commit-Position: refs/heads/master@{#33503}

Rolling v8/tools/clang to c09d5840c4a88def889a3e66fe7f1a71655fa06d

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1632793005

Cr-Commit-Position: refs/heads/master@{#33502}

This patch is a workaround to the performance regression caused by
implementing the ES2015 TypedArray prototype chain: Include a
per-TypedArray-subclass length getter so that the superclass getter does
not become polymorphic. The patch appears to fix a regression in the
Gameboy Octane benchmark.

BUG=chromium:579905
R=adamk
LOG=Y

Review URL: https://codereview.chromium.org/1624383003

Cr-Commit-Position: refs/heads/master@{#33501}

Port 433e8848

Add DCHECK()s for BUILTIN_CALL, BUILTIN_CALL_PAIR to simulators.

BUG=

Review URL: https://codereview.chromium.org/1630783002

Cr-Commit-Position: refs/heads/master@{#33500}

This CL enables escape analysis. We expect performance feedback
and a lot of clusterfuzz bugs.

R=mstarzinger@chromium.org
BUG=v8:4586
LOG=n

Review URL: https://codereview.chromium.org/1587013002

Cr-Commit-Position: refs/heads/master@{#33499}

* Add caching to handling of dangling loads
* Add two unittests for load elimination on escaped objects

BUG=v8:4586
LOG=n

Review URL: https://codereview.chromium.org/1619103004

Cr-Commit-Position: refs/heads/master@{#33498}

BUG=chromium:580506
LOG=N

Review URL: https://codereview.chromium.org/1631673002

Cr-Commit-Position: refs/heads/master@{#33497}

Fix additional cases where the AIX compiler reports that a variable
may be used uninitialized.

R=danno@chromium.org, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1628483003

Cr-Commit-Position: refs/heads/master@{#33496}

This fixes corner cases where the start offsets of exception handler
regions within the handler table fall together. This assumption was
based on full-codegen code and no longer holds with the interpreter.
The tables however are still well nested and code has been added to
verify that in debug mode.

R=rmcilroy@chromium.org
BUG=v8:4674
LOG=n

Review URL: https://codereview.chromium.org/1633573002

Cr-Commit-Position: refs/heads/master@{#33495}

The current support for try-catch in the interpreter can handle most of
the cases appearing in our test suite. Also the flag in question did not
detect try-finally constructs. This removes the flag and instead extends
the test expectations.

R=rmcilroy@chromium.org
BUG=v8:4674
LOG=n

Review URL: https://codereview.chromium.org/1631593003

Cr-Commit-Position: refs/heads/master@{#33494}

BUG=

Review URL: https://codereview.chromium.org/1632643002

Cr-Commit-Position: refs/heads/master@{#33493}

If it's Smi::FromInt(0), the NULL check would trigger. Instead, use the
handle-zap value to mean "not set".

BUG=v8:3647,chromium:580651
R=vogelheim@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/1628173002

Cr-Commit-Position: refs/heads/master@{#33492}

This CL reduces the memory overhead of escape analysis
by introducing a "copy on demand" strategy for virtual states
and virtual objects.

BUG=v8:4586
LOG=n

Review URL: https://codereview.chromium.org/1606613002

Cr-Commit-Position: refs/heads/master@{#33491}

- Completely rely on the concurrent sweeping state for SweepingCompleted()
- Rename the state accordingly.

CQ_EXTRA_TRYBOTS=tryserver.v8:v8_linux_arm64_gc_stress_dbg,v8_linux_gc_stress_dbg,v8_mac_gc_stress_dbg,v8_linux64_asan_rel,v8_linux64_tsan_rel,v8_mac64_asan_rel
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/1614953002

Cr-Commit-Position: refs/heads/master@{#33490}

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1627943003

Cr-Commit-Position: refs/heads/master@{#33489}

See https://github.com/tc39/ecma262/issues/128

R=erik.corry@gmail.com, littledan@chromium.org
BUG=v8:2952
LOG=N

Review URL: https://codereview.chromium.org/1608693003

Cr-Commit-Position: refs/heads/master@{#33488}

Cleanup %ForInPrepare runtime entry, and unify common logic with
%ForInEnumerate (renamed from %GetPropertyNamesFast). Also introduce
a TupleType to properly type JSForInPrepare and its projections w/o
special hacks in the Typer. And fix %ForInNext and JSForInNext to be
consistent with fullcodegen again (after the proxy refactorings last
quarter).

R=jarin@chromium.org
BUG=v8:3650
LOG=n

Review URL: https://codereview.chromium.org/1631583002

Cr-Commit-Position: refs/heads/master@{#33487}

This CL implements loop assignment analysis, a pass over a loop's body
to record local variables that are assigned. This pre-pass is similar
to that done on the JavaScript AST for the same reason: avoid introducing
too many phis at loop headers when building a graph.

R=bradnelson@chromium.org,ahaas@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1617723003

Cr-Commit-Position: refs/heads/master@{#33486}

R=mstarzinger@chromium.org,rossberg@chromium.org,bmeurer@chromium.org,hpayer@chromium.org,jochen@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1600873002

Cr-Commit-Position: refs/heads/master@{#33485}

A recent ES2015 semantics web compatibility fix changed a WebKit
test from a syntax error to a known failure without a syntax
error. This confused the fuzzer infrastructure. This patch updates
the test expectations to the expected output, based on what the
new semantics provide.

R=machenbach,adamk
BUG=v8:4693
LOG=N

Review URL: https://codereview.chromium.org/1628013003

Cr-Commit-Position: refs/heads/master@{#33484}

  port a0878333(r33460)

  original commit message:
  We already had hand-written optimized code for %_ToName in fullcodegen,
  but the optimizing compilers always went to the runtime for %_ToName,
  which is pretty bad for many of our builtins. So this CL moves the
  existing native code to a ToNameStub (similar to the existing
  ToStringStub), and uses the ToNameStub consistently in all compilers to
  actually implement %_ToName.

BUG=

Review URL: https://codereview.chromium.org/1622793006

Cr-Commit-Position: refs/heads/master@{#33483}

  port ca51c204(r33463)

  original commit message:
  This fixes the broken return address when the exception handler within
  interpreted bytecode is being entered via stack unwinding. The address
  in question will never actually be taken, but our stack walker uses this
  address to determine whether a frame is interpreted.

BUG=

Review URL: https://codereview.chromium.org/1632453002

Cr-Commit-Position: refs/heads/master@{#33482}