Right now running the Map and Set builtins with I+TF would tank
seriously because these builtins are still built on top of a
couple of classic intrinsics that TurboFan doesn't understand.
Middle-term the idea is to replace the Map and Set builtins with
a CodeStubAssembler based solution, but for that might not be
ready in time, so adding support for a couple of the critical
intrinsics to mitigate the tankage a bit, namely

 - %_JSCollectionGetTable,
 - %_TheHole, and
 - %_StringGetRawHashField.

Together these double the score on most of the existing performance
tests for collections.

R=yangguo@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2647733002
Cr-Commit-Position: refs/heads/master@{#42521}

- builtins-ic.cc takes the place of the AccessorAssembler shim
- AccessorAssemblerImpl can then be renamed
- some cleanup in code-factory.cc
- drop old _TF name suffixes
- fix Generate##Name##Impl in TF_BUILTIN macro

Review-Url: https://codereview.chromium.org/2647493002
Cr-Commit-Position: refs/heads/master@{#42520}

Make wasm code generation (including deserialization) aware of
allow_codegen_callback - if one were set by the host - akin to what we
do for `eval`.

This allows web pages that opt out of unsafe-eval to also opt out of
wasm scenarios.

BUG=v8:5869

Review-Url: https://codereview.chromium.org/2646713002
Cr-Commit-Position: refs/heads/master@{#42519}

Review-Url: https://codereview.chromium.org/2645673004
Cr-Commit-Position: refs/heads/master@{#42518}

GC performance issues need to be addressed first.

TBR=bmeurer@chromium.org, mstarzinger@chromium.org, yangguo@chromium.org
BUG=v8:5456

Review-Url: https://codereview.chromium.org/2642743002
Cr-Original-Commit-Position: refs/heads/master@{#42495}
Committed: https://chromium.googlesource.com/v8/v8/+/7803aa1ffb2f835c5f317ed2a097390d53e52567
Review-Url: https://codereview.chromium.org/2642743002
Cr-Commit-Position: refs/heads/master@{#42517}

This uses the aforementioned helper within the {FastAccessorAssembler}.
It was made available as a helper function now that several users create
code objects following {kCallJSFunction} linkage via the {CodeAssembler}.

R=vogelheim@chromium.org

Review-Url: https://codereview.chromium.org/2644033003
Cr-Commit-Position: refs/heads/master@{#42516}

Review-Url: https://codereview.chromium.org/2644743003
Cr-Commit-Position: refs/heads/master@{#42515}

Revert of [wasm] Fix I32ReinterpretF32 and I64ReinterpretF64 on ia32. (patchset #3 id:40001 of https://codereview.chromium.org/2639353002/ )

Reason for revert:
compilation problems on mips

Original issue's description:
> [wasm] Fix I32ReinterpretF32 and I64ReinterpretF64 on ia32.
>
> On ia32 return statements in C++ automatically convert signalling NaNs
> to quiet NaNs, even when bit_cast is used. This CL removes all uses of
> bit_cast<float> and bit_cast<double> in the wasm compiler and wasm
> interpreter.
>
> R=titzer@chromium.org, clemensh@chromium.org
>
> Review-Url: https://codereview.chromium.org/2639353002
> Cr-Commit-Position: refs/heads/master@{#42512}
> Committed: https://chromium.googlesource.com/v8/v8/+/7739affa5b57e0d28674d476f63de60d71728fb6

TBR=clemensh@chromium.org,titzer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2645693003
Cr-Commit-Position: refs/heads/master@{#42514}

Also update a call in cctest to check the result.

BUG=chromium:681843

Review-Url: https://codereview.chromium.org/2647573003
Cr-Commit-Position: refs/heads/master@{#42513}

On ia32 return statements in C++ automatically convert signalling NaNs
to quiet NaNs, even when bit_cast is used. This CL removes all uses of
bit_cast<float> and bit_cast<double> in the wasm compiler and wasm
interpreter.

R=titzer@chromium.org, clemensh@chromium.org

Review-Url: https://codereview.chromium.org/2639353002
Cr-Commit-Position: refs/heads/master@{#42512}

This API does not allow reporting failure, but we should crash rather than have
the caller get an ArrayBuffer that isn't properly set up.

BUG=chromium:681843

Review-Url: https://codereview.chromium.org/2641953002
Cr-Commit-Position: refs/heads/master@{#42511}

BUG=chromium:681843

Review-Url: https://codereview.chromium.org/2645673002
Cr-Commit-Position: refs/heads/master@{#42510}

Broke after https://codereview.chromium.org/2621983002

BUG=chromium:581766

Review-Url: https://codereview.chromium.org/2644113002
Cr-Commit-Position: refs/heads/master@{#42509}

BUG=v8:5639

Review-Url: https://codereview.chromium.org/2638073002
Cr-Commit-Position: refs/heads/master@{#42508}

Issue was fixed in 38088853, re-enabling test.

BUG=v8:5829
NOTRY=true

Review-Url: https://codereview.chromium.org/2643043002
Cr-Commit-Position: refs/heads/master@{#42507}

BUG=679724

Review-Url: https://codereview.chromium.org/2631063003
Cr-Commit-Position: refs/heads/master@{#42506}

Document that frame summaries are bottom-to-top, i.e. caller before
callee, rename FrameSummary::GetFirst to FrameSummary::GetBottom and
introduce FrameSummary::GetTop.
For debugged JavaScript frames, it does not really matter which of the
functions we call, so I replaced a few GetFirst by GetTop instead of
GetBottom because it matches the semantics more closely.

This CL also reverts part of http://crrev.com/2621953002 by changing
BreakLocation::FromFrame back to accept a DebugInfo and a
JavaScriptFrame. We don't plan to create BreakLocations for wasm.

R=yangguo@chromium.org
BUG=v8:5822

Review-Url: https://codereview.chromium.org/2647433002
Cr-Commit-Position: refs/heads/master@{#42505}

TBR=machenbach@chromium.org, vogelheim@chromium.org
NOTRY=true

Review-Url: https://codereview.chromium.org/2641003003 .
Cr-Commit-Position: refs/heads/master@{#42504}

using newly introduced ThinStrings, which store a pointer to the actual,
internalized string they represent.

BUG=v8:4520

(Previously landed as #42168 / af51befe)
(Previously landed as #42193 / 4c699e34)
(Previously landed as #42235 / ec45e6ed)

Review-Url: https://codereview.chromium.org/2549773002
Cr-Commit-Position: refs/heads/master@{#42503}

R=rossberg@chromium.org
BUG=chromium:682659

Review-Url: https://codereview.chromium.org/2638383004
Cr-Commit-Position: refs/heads/master@{#42502}

Properly recognize and optimize typeof in a strict/abstract equality
comparison with the string literal "object" to a check for Null or a
check of the map for Receiver instance type and non-callable.

Drive-by-fix: Also optimize typeof o === "function" somewhat, now that
we have the new types for Callable and NonCallable.

R=jarin@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2646763003
Cr-Commit-Position: refs/heads/master@{#42501}

Instead of doing the dance via JSStrictEqual for comparisons with null,
undefined or the hole, we can just go to ReferenceEqual directly. Also
avoid the Select(x, false, true) dance for negation and use BooleanNot
directly.

R=mstarzinger@chromium.org

Review-Url: https://codereview.chromium.org/2646763004
Cr-Commit-Position: refs/heads/master@{#42500}

R=rossberg@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2640953002
Cr-Commit-Position: refs/heads/master@{#42499}

BUG=

Review-Url: https://codereview.chromium.org/2644843002
Cr-Commit-Position: refs/heads/master@{#42498}

Currently PropertyConstness is still in sync with PropertyLocation.

BUG=v8:5495

Review-Url: https://codereview.chromium.org/2591233002
Cr-Commit-Position: refs/heads/master@{#42497}

Revert of Revert [TypeFeedbackVector] Root literal arrays in function literal slots (patchset #2 id:20001 of https://codereview.chromium.org/2642743002/ )

Reason for revert:
Breaks nosnap:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap/builds/13802

Original issue's description:
> Revert [TypeFeedbackVector] Root literal arrays in function literal slots
>
> GC performance issues need to be addressed first.
>
> TBR=bmeurer@chromium.org, mstarzinger@chromium.org, yangguo@chromium.org
> BUG=v8:5456
>
> Review-Url: https://codereview.chromium.org/2642743002
> Cr-Commit-Position: refs/heads/master@{#42495}
> Committed: https://chromium.googlesource.com/v8/v8/+/7803aa1ffb2f835c5f317ed2a097390d53e52567

TBR=mvstanton@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5456

Review-Url: https://codereview.chromium.org/2642933003
Cr-Commit-Position: refs/heads/master@{#42496}

GC performance issues need to be addressed first.

TBR=bmeurer@chromium.org, mstarzinger@chromium.org, yangguo@chromium.org
BUG=v8:5456

Review-Url: https://codereview.chromium.org/2642743002
Cr-Commit-Position: refs/heads/master@{#42495}

Especially support constant-folding typeof for detectable and
undetectable receivers.

BUG=v8:5267,v8:5270
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2646743002
Cr-Commit-Position: refs/heads/master@{#42494}

This makes sure 32-bit constants that are used as {MachineType::Uint32}
by the deoptimization translation are also interpreted as such when the
literals are collected.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-681983
BUG=chromium:681983

Review-Url: https://codereview.chromium.org/2646463002
Cr-Commit-Position: refs/heads/master@{#42493}

Just desugar directly into the runtime call instead.

BUG=v8:5639

Review-Url: https://codereview.chromium.org/2633353002
Cr-Commit-Position: refs/heads/master@{#42492}

Revert of [test] Speculatively remove local-tests from archive (patchset #2 id:20001 of https://codereview.chromium.org/2643983002/ )

Reason for revert:
Breaks all windows bots:
https://build.chromium.org/p/client.v8/builders/V8%20Win32%20-%20debug/builds/6811

Original issue's description:
> [test] Remove local-tests from test262 archive and add to .isolate
>
> This might help fix the bots, which are broken in e.g.,
> https://build.chromium.org/p/tryserver.v8/builders/v8_mac_rel_ng_triggered/builds/14011
>
> The archive was added in order to transmit test262 tests more rapidly.
> It doesn't serve much of a purpose for local-tests. I naively added
> local-tests there out of symmetry. However, the BUILD.gn file does not
> regenerate an archive when files are only deleted and not added or
> changed. Since the performance concern is not present for the small
> volume of local-tests, this patch reverts to the more normal mechanism
> for sending over dependencies, with test262.isolate.
>
> R=adamk
>
> Review-Url: https://codereview.chromium.org/2643983002
> Cr-Commit-Position: refs/heads/master@{#42485}
> Committed: https://chromium.googlesource.com/v8/v8/+/9f545ea96f18b7036ac6ec43e359d63f41c3686a

TBR=adamk@chromium.org,littledan@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2640223003
Cr-Commit-Position: refs/heads/master@{#42491}

Since the script origin is part of the key used in the compilation
cache, this ensures that the cache never confuses a module with a
non-module script.

BUG=v8:1569,v8:5685

Review-Url: https://codereview.chromium.org/2611643002
Cr-Commit-Position: refs/heads/master@{#42490}

When StringAdd builtin is used to concatenate two primitive values,
we know that the operation might throw, but cannot trigger any other
observable side effect, so it shouldn't flush the LoadElimination state.

R=jarin@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2645523002
Cr-Commit-Position: refs/heads/master@{#42489}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/c94e6d2..70270c1

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/3a41cc3..7a4c8c9

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2644793002
Cr-Commit-Position: refs/heads/master@{#42488}

Intl constructors are specified to prohibit structurally invalid
subtags. BCP 47 defines itself to be case-insensitive. Firefox does
throw on case-insensitive duplicates, following the specifications.
This patch makes V8 do the same. There is some small compatibility
risk, but the case is fairly niche, so I hope it does not cause
much breakage.

BUG=v8:4215

Review-Url: https://codereview.chromium.org/2639333003
Cr-Commit-Position: refs/heads/master@{#42487}

The IA32AddPair and IA32SubPair instructions were using an input register as a
temporary value, which led to registers sometimes being clobbered when they
shouldn't have been. This led to problems, for example, in calling printf to
format doubles:

printf("%f", 1.2345) => 0.61725 (on x86)

BUG= https://bugs.chromium.org/p/v8/issues/detail?id=5800

Review-Url: https://codereview.chromium.org/2637583002
Cr-Commit-Position: refs/heads/master@{#42486}

This might help fix the bots, which are broken in e.g.,
https://build.chromium.org/p/tryserver.v8/builders/v8_mac_rel_ng_triggered/builds/14011

The archive was added in order to transmit test262 tests more rapidly.
It doesn't serve much of a purpose for local-tests. I naively added
local-tests there out of symmetry. However, the BUILD.gn file does not
regenerate an archive when files are only deleted and not added or
changed. Since the performance concern is not present for the small
volume of local-tests, this patch reverts to the more normal mechanism
for sending over dependencies, with test262.isolate.

R=adamk

Review-Url: https://codereview.chromium.org/2643983002
Cr-Commit-Position: refs/heads/master@{#42485}

This reverts the following commits to fix a Node.js regression:
* 5529430d "[compiler] Consistently use Ignition+TurboFan for lexical variables."
* 78691367 "[compiler] Improve let+const decision in AstNumbering."

R=adamk@chromium.org, bmeurer@chromium.org, hablich@chromium.org
BUG=
NOTRY=true

Review-Url: https://codereview.chromium.org/2647523002
Cr-Commit-Position: refs/heads/master@{#42484}

Inspector is moved to per-event-type callbacks instead of general v8::debug::SetDebugEventListener. It allows to:
- remove any usage of v8::Debug::EventDetails in debug-interface,
- avoid redundant JS call on each event to get properties of event objects,
- introduce better pure C++ API for these events later.

BUG=v8:5510
R=yangguo@chromium.org,jgruber@chromium.org,dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2622253004
Cr-Commit-Position: refs/heads/master@{#42483}

Port 0b8200c7

R=petermarshall@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:5659
LOG=N

Review-Url: https://codereview.chromium.org/2645683002
Cr-Commit-Position: refs/heads/master@{#42482}