Add NumberAbs operator to implement an inline version of Math.abs, that
can be optimized and eliminated. We don't use any speculation here, but
for now stick to the information we can infer (this way we avoid the
inherent deopt loops that Crankshaft has around Math.abs).

CQ_INCLUDE_TRYBOTS=tryserver.blink:linux_blink_rel
R=jarin@chromium.org
BUG=v8:5086

Review-Url: https://codereview.chromium.org/2096403002
Cr-Commit-Position: refs/heads/master@{#37306}

We now spread the word32 truncation even if the inputs can be minus zero
as long as the result is not minus zero.

Review-Url: https://codereview.chromium.org/2078423002
Cr-Commit-Position: refs/heads/master@{#37102}

Review-Url: https://codereview.chromium.org/2080093002
Cr-Commit-Position: refs/heads/master@{#37080}

We expect that the majority of malloc'd memory held by V8 is allocated
in Zone objects. Introduce an Allocator class that is used by Zones to
manage memory, and allows for querying the current usage.

BUG=none
R=titzer@chromium.org,bmeurer@chromium.org,jarin@chromium.org
LOG=n
TBR=rossberg@chromium.org

Review URL: https://codereview.chromium.org/1847543002

Cr-Commit-Position: refs/heads/master@{#35196}

This moves the JSCreate related functionality from JSTypedLowering into
a dedicated JSCreateLowering reducer. This is in preparation of landing
the support for optimized literals in TurboFan, which would blow up
JSTypedLowering quite seriously otherwise.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1678833002

Cr-Commit-Position: refs/heads/master@{#33813}

Shifts of integer values are in some contexts collapsed by the parser into single literal AST nodes, rather than a direct representation of the parse tree. Confirming this behavior in tests.

Integer TypedArrays are assumed to load and store "intish" values rather than more fine-grained type information. Reducing the precision of the typing information to match the spec and simplify the wasm generator.

The asm spec requires load and store values of various "float?", "floatish", "double?" and "intish" types to ensure undefined values are not visible and that float32 rounding occurs at the right time. More closely matching this.

Adding additional testing around unsigned / signed comparisons, loads and stores.

Adding addition debug mode printing when asserting about types fail.

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=test-asm-validator, wasm side tests
R=titzer@chromium.org,aseemgarg@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1471073003

Cr-Commit-Position: refs/heads/master@{#32419}

For a * b with only truncated word32 uses (or result known to be in
signed32 range), we can use Int32Mul if we know for sure that the
intermediate result is inside the safe integer range, and a and b are
in signed32 range.

Drive-by-fix: Also use TypeCache in SimplifiedLowering.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1478953002

Cr-Commit-Position: refs/heads/master@{#32330}

Add support for using inline allocations for arrays in lowering of
JSCreateArray when target equals new.target.  Currently we are only
concerend with the straight-forward Array() and Array(length) cases,
but at some point TurboFan should also be able to support the more
complex initializing cases.

R=mvstanton@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1465203002

Cr-Commit-Position: refs/heads/master@{#32191}

The current typing-asm mishandles the relationship between
unsigned numbers and int. Restructuring and using type shortcuts
that approximate asm types.

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=test-asm-validator
R=titzer@chromium.org,aseemgarg@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1447133002

Cr-Commit-Position: refs/heads/master@{#32057}

TurboFan didn't fully support the relevant ES6 type conversion
intrinsics like %_ToNumber, %_ToLength, %_ToName, %_ToString and
%_ToInteger until now, we always went to the runtime instead.  These
intrinsics are now well supported in TurboFan, and we are even able to
generate quite decent code in some cases.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1428243003

Cr-Commit-Position: refs/heads/master@{#31820}

We don't need to distinguish between signed and unsigned integral
representations in the big boy type system. It actually even hurts
in some cases. The representation is only about the way the values
are mapped to bits in memory/registers, but the interpretation of
the bits is specified by the semantic dimension.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1416953006

Cr-Commit-Position: refs/heads/master@{#31771}

Only cast to integer with xor (closer to the spec which allows only ~~).
Check type matching on the bitwise operations.
Prevent mixing of types with the arthimetic operations.

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=test-asm-validator
R=titzer@chromium.org,aseemgarg@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1405383007

Cr-Commit-Position: refs/heads/master@{#31764}

Add support for stores that transition to writable data fields,
based on the BeginRegion/FinishRegion mechanism for atomic regions
in the scheduler.

This is early work and still a bit rough around the edges, and similar
to regular stores, we don't support transitioning stores to double
fields yet.

R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1406153010

Cr-Commit-Position: refs/heads/master@{#31645}

Rename ZoneTypeCache to TypeCache and use a single shared (immutable)
instance consistently to cache the most commonly used types. Also serves
as a chokepoint for defining those types, so we don't repeat the
definition (and possible bugs) in various places.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1409763004

Cr-Commit-Position: refs/heads/master@{#31631}

Currently we (mostly) infer FunctionType for JSFunction constants, and
match the FunctionType in the typing rule for JSCallFunction. This has
several drawbacks for JavaScript, especially we don't have Constant
types for global functions (i.e. String, Object, Reflect and friends).
Plus the FunctionType magic doesn't actually buy us anything. So this
changes the typing rule for HeapConstant constant to actually infer
Constant types for JSFunction objects and moves the recognition of
builtin functions to the typing rule for JSCallFunction.

Also adapts the specialized lowering in JSTypedLowering to Constant
functions instead of FunctionType, which has the additional advantage
that we can do the receiver wrapping/converting based on the (known)
SharedFunctionInfo.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1420093005

Cr-Commit-Position: refs/heads/master@{#31553}

The zone type cache would be handy inside the asm.js typer.
Pulling it out into a seperate inlinable header to allow sharing.

BUG=https://code.google.com/p/v8/issues/detail?id=4203
TEST=None
R=andreas@chromium.org,titzer@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1307093006

Cr-Commit-Position: refs/heads/master@{#30398}