The EscapeStatusAnalysis didn't know anything about the simplified
operator ConvertTaggedHoleToUndefined, thus leading to a crash. We
now just handled it by pretending that any allocation that goes into
such a node escapes.

BUG=chromium:669451
R=tebbi@chromium.org

Review-Url: https://codereview.chromium.org/2533263002
Cr-Commit-Position: refs/heads/master@{#41359}

This removes reservation of unused {BailoutId} numbers for all class
literals. These language constructs are by now solely funneled through
bytecode and specific ids for deoptimization are no longer needed.

R=rmcilroy@chromium.org
BUG=v8:5657

Review-Url: https://codereview.chromium.org/2535223002
Cr-Commit-Position: refs/heads/master@{#41358}

This removes support for iterator loops (i.e. for-of loop constructs)
from the {FullCodeGenerator}. Consequently optimized code containing
such constructs must use the {BytecodeGraphBuilder} and can no longer
use the {AstGraphBuilder} for graph building.

R=bmeurer@chromium.org
BUG=v8:5657

Review-Url: https://codereview.chromium.org/2534883004
Cr-Commit-Position: refs/heads/master@{#41357}

Adds a bytecode_age field to BytecodeArray objects. This is incremented each
time the bytecode array is marked by GC, and reset to zero if the bytecode
is executed.

This is used to enable the CompilationCache for interpreted functions,
where Interpreted entries are evicted once the bytecode becomes old.

BUG=chromium:666275,v8:4680

Review-Url: https://codereview.chromium.org/2534763003
Cr-Commit-Position: refs/heads/master@{#41356}

Replaces the graph-based liveness analyzer in the bytecode graph builder
with an initial bytecode-based liveness analysis pass, which is added to
the existing loop extent analysis.

Now the StateValues in the graph have their inputs initialised to
optimized_out, rather than being modified after the graph is built.

Review-Url: https://codereview.chromium.org/2523893003
Cr-Commit-Position: refs/heads/master@{#41355}

MarkingParity was used to avoid performing an operation on an object if it was
marked multiple times. We no longer mark things multiple times, so this concept
is no longer required.

BUG=chromium:666275

Review-Url: https://codereview.chromium.org/2529173002
Cr-Commit-Position: refs/heads/master@{#41354}

BUG=v8:5664

Review-Url: https://codereview.chromium.org/2536153002
Cr-Commit-Position: refs/heads/master@{#41353}

For bound functions on the right-hand side of instanceof we can
constant-fold to the actual [[BoundTargetFunction]], actually
instance OrdinaryHasInstance. Move the Function.prototype[@@hasInstance]
reduction up to the JSCallReducer to allow this optimization to become
effective (and also enable other optimizations).

BUG=v8:5267
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2537763002
Cr-Commit-Position: refs/heads/master@{#41352}

BUG=chromium:668748

Review-Url: https://codereview.chromium.org/2534123002
Cr-Commit-Position: refs/heads/master@{#41351}

This reverts commit 810fcb28.

BUG=chromium:648568, chromium:669270

Review-Url: https://codereview.chromium.org/2530383003
Cr-Commit-Position: refs/heads/master@{#41350}

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/buildtools/+log/39b1db2..991f459

Rolling v8/third_party/android_tools: https://chromium.googlesource.com/android_tools/+log/25d57ea..811a2c3

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapul/+log/6962f5c..3950931

Rolling v8/third_party/icu: https://chromium.googlesource.com/chromium/deps/icu/+log/c1a2371..dda089a

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clan/+log/75350a8..4d70bef

Rolling v8/tools/swarming_client: https://chromium.googlesource.com/external/swarming.clien/+log/380e326..ebc8dab

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2538723002
Cr-Commit-Position: refs/heads/master@{#41349}

This ensures the deoptimization triggered due to materialization of
objects by the {TranslatedState} works in conjunction with OSR. The
optimized code used for OSR is not installed on the function, hence
needs to be specified explicitly when requesting deoptimization for
specific stack frames.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-668795
BUG=chromium:668795

Review-Url: https://codereview.chromium.org/2534143002
Cr-Commit-Position: refs/heads/master@{#41348}

This also ports some build overrides including:
https://codereview.chromium.org/2512043002/

BUG=chromium:659726

Review-Url: https://codereview.chromium.org/2532043002
Cr-Commit-Position: refs/heads/master@{#41347}

Revert of [ignition/turbo] Perform liveness analysis on the bytecodes (patchset #17 id:320001 of https://codereview.chromium.org/2523893003/ )

Reason for revert:
Breaks the build:

https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20shared/builds/14886

Original issue's description:
> [ignition/turbo] Perform liveness analysis on the bytecodes
>
> Replaces the graph-based liveness analyzer in the bytecode graph builder
> with an initial bytecode-based liveness analysis pass, which is added to
> the existing loop extent analysis.
>
> Now the StateValues in the graph have their inputs initialised to
> optimized_out, rather than being modified after the graph is built.
>
> Committed: https://crrev.com/1852300954c216c29cf93444430681d213e87925
> Cr-Commit-Position: refs/heads/master@{#41344}

TBR=jarin@chromium.org,rmcilroy@chromium.org,yangguo@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2541443002
Cr-Commit-Position: refs/heads/master@{#41346}

This introduces three new types OtherCallable, CallableProxy (and OtherProxy),
and BoundFunction to make it possible to express Callable in the Type system.
It also forces all undetectable receivers to be Callable, which matches the
use case for undetectable, namely document.all (guarded by proper checks and
tests).

It also uses these new types to properly optimize instanceof (indirectly via
OrdinaryHasInstance) based on the type of the constructor and the object. So
we are able to constant-fold certain instanceof expressions based on types
and completely avoid the builtin call.

R=jarin@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2535753004
Cr-Commit-Position: refs/heads/master@{#41345}

Replaces the graph-based liveness analyzer in the bytecode graph builder
with an initial bytecode-based liveness analysis pass, which is added to
the existing loop extent analysis.

Now the StateValues in the graph have their inputs initialised to
optimized_out, rather than being modified after the graph is built.

Review-Url: https://codereview.chromium.org/2523893003
Cr-Commit-Position: refs/heads/master@{#41344}

FunctionTemplateInfo::SetPrototypeProviderTemplate adds support for sharing
prototypes between several function templates. This is used to properly set up
Image.prototype and HTMLImageElement.protoype which should be equal according
to the spec.

BUG=chromium:2969

Review-Url: https://codereview.chromium.org/2531653002
Cr-Commit-Position: refs/heads/master@{#41343}

Revert of [heap] Reland: Use store buffer for writes coming from mutator. (patchset #1 id:1 of https://codereview.chromium.org/2529293004/ )

Reason for revert:
Suspect for tsan failures:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20TSAN/builds/12915

Original issue's description:
> [heap] Reland: Use store buffer for writes coming from mutator.
>
> This reverts commit 061c2ab2.
>
> BUG=chromium:648568, chromium:669270
>
> Committed: https://crrev.com/fa2fdf275197185d9bca9d5e72c16a60722c3893
> Cr-Commit-Position: refs/heads/master@{#41341}

TBR=mlippautz@chromium.org,hpayer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:648568, chromium:669270

Review-Url: https://codereview.chromium.org/2534803004
Cr-Commit-Position: refs/heads/master@{#41342}

This reverts commit 061c2ab2.

BUG=chromium:648568, chromium:669270

Review-Url: https://codereview.chromium.org/2529293004
Cr-Commit-Position: refs/heads/master@{#41341}

BUG=v8:5683
NOTRY=true
R=machenbach@chromium.org

Review-Url: https://codereview.chromium.org/2541433002
Cr-Commit-Position: refs/heads/master@{#41340}

The range-based exception handler table is by now only used for bytecode
arrays. The semantics of the interpreter are that bytecode offsets point
to the beginning of the currently executing bytecode instruction. Uses
hence need to compensate for lookups based on a "retrun address". This
change removes the need for such off-by-one compensations by changing
lookup semantics to be based on "current instruction" offsets.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2534893002
Cr-Commit-Position: refs/heads/master@{#41339}

Microbenchmarks show a 4x improvement on the fast path and 2.5x improvement on
the slow path when compared to the CPP builtin implementation.

Compared to the old JS implementation, the fast path is 20% faster and the slow
path 35% slower.

BUG=v8:5339,v8:5562

Review-Url: https://codereview.chromium.org/2527963002
Cr-Commit-Position: refs/heads/master@{#41338}

Revert of [ic] Use validity cells to protect keyed element stores against object's prototype chain modificati… (patchset #2 id:40001 of https://codereview.chromium.org/2534613002/ )

Reason for revert:
Layout test crashes:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/11691

Original issue's description:
> [ic] Use validity cells to protect keyed element stores against object's prototype chain modifications.
>
> ... instead of clearing of all the KeyedStoreICs which didn't always work.
>
> BUG=chromium:662907, v8:5561
> TBR=verwaest@chromium.org, bmeurer@chromium.org
>
> Committed: https://crrev.com/a39522f44f7e0be4686831688917e9675255dcaf
> Cr-Commit-Position: refs/heads/master@{#41332}

TBR=jkummerow@chromium.org,ishell@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:662907, v8:5561

Review-Url: https://codereview.chromium.org/2538693002
Cr-Commit-Position: refs/heads/master@{#41337}

If the prototype's map is not marked as fast, it is made fast after
setup, breaking current RegExp fast path checks.

BUG=v8:5339

Review-Url: https://codereview.chromium.org/2537483002
Cr-Commit-Position: refs/heads/master@{#41336}

BUG=none

Review-Url: https://codereview.chromium.org/2540463003
Cr-Commit-Position: refs/heads/master@{#41335}

V8 internally uses conversions.h to convert number to string, we can use these methods too instead of slow std::stringstream with std::locale.

BUG=chromium:661497,v8:5551
R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2534013002
Cr-Commit-Position: refs/heads/master@{#41334}

TypedArrays need specific checks before calling OrdinaryDefineOwnProperty.

BUG=v8:5328

Review-Url: https://codereview.chromium.org/2431223005
Cr-Commit-Position: refs/heads/master@{#41333}

[ic] Use validity cells to protect keyed element stores against object's prototype chain modifications.

... instead of clearing of all the KeyedStoreICs which didn't always work.

BUG=chromium:662907, v8:5561
TBR=verwaest@chromium.org, bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2534613002
Cr-Commit-Position: refs/heads/master@{#41332}

Due to a typo in runtime-i18n.js, 'ç'(U+00E7) was not uppercased while
'÷'(U+00F7) was incorrectly uppercased to '×'(U+00D7).

Add a comprehensive test for Latin-1 supplemental block (U+00A0 ~ U+00FF).
(they're special-cased for speed-up and needs to have a test for the range.).

TEST=intl/general/case-mapping
BUG=v8:5681

Review-Url: https://codereview.chromium.org/2533033003
Cr-Commit-Position: refs/heads/master@{#41331}

BUG=chromium:666046

Review-Url: https://codereview.chromium.org/2539503002
Cr-Commit-Position: refs/heads/master@{#41330}

R=jochen@chromium.org

Review-Url: https://codereview.chromium.org/2473153004
Cr-Commit-Position: refs/heads/master@{#41329}

BUG=chromium:648568

Review-Url: https://codereview.chromium.org/2537533002
Cr-Commit-Position: refs/heads/master@{#41328}

BUG=chromium:666046

Review-Url: https://codereview.chromium.org/2539493002
Cr-Commit-Position: refs/heads/master@{#41327}

BUG=

Review-Url: https://codereview.chromium.org/2537523002
Cr-Commit-Position: refs/heads/master@{#41326}

BUG=

Review-Url: https://codereview.chromium.org/2537453003
Cr-Commit-Position: refs/heads/master@{#41325}

Revert of [turbofan] Utilize String comparison feedback. (patchset #1 id:1 of https://codereview.chromium.org/2523463002/ )

Reason for revert:
Seems to regress speedometer on Ignition and doesn't cause any improvements elsewhere.

BUG=chromium:668651

Original issue's description:
> [turbofan] Utilize String comparison feedback.
>
> Make use of the previously introduced String feedback for compare
> operations in TurboFan.
>
> R=jarin@chromium.org
> BUG=v8:5267,v8:5400
>
> Committed: https://crrev.com/5d4253ecfb6ddcbbd7eb5654e728efa9559284a2
> Cr-Commit-Position: refs/heads/master@{#41163}

TBR=jarin@chromium.org,bmeurer@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=v8:5267,v8:5400

Review-Url: https://codereview.chromium.org/2531183003
Cr-Commit-Position: refs/heads/master@{#41324}

This removes the supporting function to perform a range-lookup in the
exception handler table for unoptimized code. Such tables are by now
guaranteed to be empty, the deoptimizer cannot encounter this case.

R=jarin@chromium.org

Committed: https://crrev.com/1f27ed9d7da78904e0418364c6394f913eabbe70
Review-Url: https://codereview.chromium.org/2529343003
Cr-Original-Commit-Position: refs/heads/master@{#41318}
Cr-Commit-Position: refs/heads/master@{#41323}

  The reason:
  The CL #41255 (https://codereview.chromium.org/2520363002 ) reimplemnt the Number.prototype.toString and the added number-tostring test cases failed at x87.

  Similar to many previos fixing CLs, i.e.: CL #37371 (https://codereview.chromium.org/2111493002 ), the root reason is:
  The Gcc compiler and it's dependent C++ libraris on linux platform use x87 in extended 80-bit double precision by default.
  So the reimplemented DoubleToRadixCString() will generate extended 80-bit double precision result which isn't the expected standard 64-bit double precision
  value.

  Although modifying DoubleToRadixCString() function to manually do the 80-bit <--> 64-bit conversion for each double/float computation step can fix this issue,
  but it wll drop the DoubleToRadixCString() function's performance of other architectures.

  This CL put the failed number-tostring test cases into number-tostring-big-integer.js and disables it for x87.

BUG=

Review-Url: https://codereview.chromium.org/2532073002
Cr-Commit-Position: refs/heads/master@{#41322}

Removed a redundant check: If completion is not normal, then #iterator cannot be undefined.

Review-Url: https://codereview.chromium.org/2533803002
Cr-Commit-Position: refs/heads/master@{#41321}

BUG=chromium:663410

Review-Url: https://codereview.chromium.org/2533463002
Cr-Commit-Position: refs/heads/master@{#41320}