port 40f34541 (r36181)

  original commit message:
  The previous approach taken by FastNew[Sloppy,Strict,Rest]ArgumentsStub
  looked at the function slot in order to skip stub frames
  and find the JS frame. However, stub frames do not have a
  function slot (in fact their fixed frame ends one slot
  before the JS frame's function slot). Therefore, if this
  location in the stub frame happens to have the function
  object the create arguments stubs won't skip this frame
  correctly.

  Replace this approach with one where the stub is
  specialized to either skip a frame if required (since
  there will only ever be one extra frame on Ignition
  the loop approach isn't necessary).

BUG=

Review-Url: https://codereview.chromium.org/1976483002
Cr-Commit-Position: refs/heads/master@{#36197}

We now have all the required eager bailout points in place, so we can
remove the defensive programming in JSNativeContextSpecialization.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/1973773003
Cr-Commit-Position: refs/heads/master@{#36196}

R=jgruber@chromium.org,kozyatinskiy@chromium.org
BUG=chromium:590256
LOG=N

Review-Url: https://codereview.chromium.org/1961963002
Cr-Commit-Position: refs/heads/master@{#36195}

We got the condition wrong and actually deoptimized when the typed array
was not neutered. This fixes the deopt loop in Math.random and actually
many programs that use typed arrays.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/1970123002
Cr-Commit-Position: refs/heads/master@{#36194}

It is likely that CrOS and other distros will want to be
able to build the v8 snapshot with a custom toolchain.

This CL makes snapshot_toolchain a declared build arg, and
renames it to v8_snapshot_toolchain to minimize the risk
of a name collision.

R=machenbach@chromium.org, jochen@chromium.org
BUG=608596

Review-Url: https://codereview.chromium.org/1969693002
Cr-Commit-Position: refs/heads/master@{#36193}

Rolling v8/build to eeaf94824520078abaa924c17562d31dd531b04d

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/1968363003
Cr-Commit-Position: refs/heads/master@{#36192}

TBR=adamk@chromium.org

Review-Url: https://codereview.chromium.org/1969263002
Cr-Commit-Position: refs/heads/master@{#36191}

This patch removes the following properties, as their use count is
very low, they are V8-only, and not on a standards track.
- v8Parse
- resolved
- pattern

v8BreakIterator is left in as it has significantly more usage.

BUG=v8:3785
R=adamk,jshin@chromium.org

Review-Url: https://codereview.chromium.org/1968893002
Cr-Commit-Position: refs/heads/master@{#36190}

Revert of Implement CPU time for OS X and POSIX. (patchset #10 id:180001 of https://codereview.chromium.org/1959103004/ )

Reason for revert:
Buildbot is failing on Mac release build.

Original issue's description:
> Implement CPU time for OS X and POSIX.
>
> V8 tracing controller uses 2 clocks: wall clock and cpu clock. This patch
> implements CPU time for OS X and POSIX to provide more accurate
> accounting of CPU time used by each thread.
>
> BUG=v8:4984
> LOG=n
>
> Committed: https://crrev.com/025f3d262bab2748362374f1b90ac723a9655ee4
> Cr-Commit-Position: refs/heads/master@{#36188}

TBR=jochen@chromium.org,bmeurer@chromium.org,fmeawad@chromium.org,rsesek@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4984

Review-Url: https://codereview.chromium.org/1966173003
Cr-Commit-Position: refs/heads/master@{#36189}

V8 tracing controller uses 2 clocks: wall clock and cpu clock. This patch
implements CPU time for OS X and POSIX to provide more accurate
accounting of CPU time used by each thread.

BUG=v8:4984
LOG=n

Review-Url: https://codereview.chromium.org/1959103004
Cr-Commit-Position: refs/heads/master@{#36188}

When I18N is enabled, use ICU's case conversion API and transliteration
API [1] to implement String.prototype.to{Upper,Lower}Case and
String.prototype.toLocale{Upper,Lower}Case.

* ICU-based case conversion was implemented in runtime-i18n.cc/i18n.js
* The above 4 functions are overridden with those in i18n.js when
  --icu_case_mapping flag is turned on. To control the override by the flag,
  they're overriden in icu-case-mapping.js

Previously, toLocale{U,L}Case just called to{U,L}Case so that they didn't
support locale-sensitive case conversion for Turkic languages (az, tr),
Greek (el) and Lithuanian (lt).

Before ICU APIs for the most general case are called, a fast-path for Latin-1
is tried. It's taken from Blink and adopted as necessary. This fast path
is always tried for to{U,L}Case. For toLocale{U,L}Case, it's only taken
when a locale (explicitly specified or default) is not in {az, el, lt, tr}.

With these changes, a build with --icu_case_mapping=true passes a bunch
of tests in test262/intl402/Strings/* and intl/* that failed before.

Handling of pure ASCII strings (aligned at word boundary) are not as fast
as Unibrow's implementation that uses word-by-word case conversion. OTOH,
Latin-1 input handling is faster than Unibrow. General Unicode input
handling is slower but more accurate.

See https://docs.google.com/spreadsheets/d/1KJCJxKc1FxFXjwmYqABS0_2cNdPetvnd8gY8_HGSbrg/edit?usp=sharing for the benchmark.

This CL started with http://crrev.com/1544023002#ps200001 by littledan@,
but has changed significantly since.

[1] See why transliteration API is needed for uppercasing in Greek.
    http://bugs.icu-project.org/trac/ticket/10582

R=yangguo
BUG=v8:4476,v8:4477
LOG=Y
TEST=test262/{built-ins,intl402}/Strings/*, webkit/fast/js/*, mjsunit/string-case,
     intl/general/case*

Review-Url: https://codereview.chromium.org/1812673005
Cr-Commit-Position: refs/heads/master@{#36187}

Port 40f34541

Original commit message:

    The previous approach taken by FastNew[Sloppy,Strict,Rest]ArgumentsStub
    looked at the function slot in order to skip stub frames
    and find the JS frame. However, stub frames do not have a
    function slot (in fact their fixed frame ends one slot
    before the JS frame's function slot). Therefore, if this
    location in the stub frame happens to have the function
    object the create arguments stubs won't skip this frame
    correctly.

    Replace this approach with one where the stub is
    specialized to either skip a frame if required (since
    there will only ever be one extra frame on Ignition
    the loop approach isn't necessary).

R=rmcilroy@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=v8:4928
LOG=N

Review-Url: https://codereview.chromium.org/1966263002
Cr-Commit-Position: refs/heads/master@{#36186}

Port 6e15433d

R=hpayer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=chromium:580959
LOG=N

Review-Url: https://codereview.chromium.org/1970563004
Cr-Commit-Position: refs/heads/master@{#36185}

Port 61f5fbbb

Original commit message:

      The new allocation folding implementation avoids fragmentation between folded allocation.
      As a consequence, our heap will always be iterable i.e. we do not have to perform a
      garbage collection before iterating the heap.

R=hpayer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=chromium:580959
LOG=N

Review-Url: https://codereview.chromium.org/1970633002
Cr-Commit-Position: refs/heads/master@{#36184}

BUG=chromium:609761
LOG=NO

Review-Url: https://codereview.chromium.org/1964143004
Cr-Commit-Position: refs/heads/master@{#36183}

Revert of [wasm] Implement parallel compilation. (patchset #6 id:100001 of https://codereview.chromium.org/1961973002/ )

Reason for revert:
The ThreadSanitizer finds data races.

Original issue's description:
> [wasm] Implement parallel compilation.
>
> With this CL it is possible to compile a wasm module with multiple
> threads in parallel. Parallel compilation works as follows:
>
> 1)   The main thread allocates a compilation unit for each wasm function.
> 2)   The main thread spawns WasmCompilationTasks which run on the
>      background threads.
> 3.a) The background threads and the main thread pick one compilation unit
>      at a time and execute the parallel phase of the compilation unit.
>      After finishing the execution of the parallel phase, the compilation
>      unit is stored in a result queue.
> 3.b) If the result queue contains a compilation unit, the main thread
>      dequeues it and finishes its compilation.
> 4)   After the execution of the parallel phase of all compilation units has
>      started, the main thread waits for all WasmCompilationTasks to finish.
> 5)   The main thread finalizes the compilation of the module.
>
> I'm going to add some additional tests before committing this CL.
>
> R=titzer@chromium.org, bmeurer@chromium.org, mlippautz@chromium.org, mstarzinger@chromium.org
>
> Committed: https://crrev.com/17215438659d8ff2d7d55f95226bf8a1477ccd79
> Cr-Commit-Position: refs/heads/master@{#36178}

TBR=bmeurer@chromium.org,mlippautz@chromium.org,mstarzinger@chromium.org,titzer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/1965243003
Cr-Commit-Position: refs/heads/master@{#36182}

The previous approach taken by FastNew[Sloppy,Strict,Rest]ArgumentsStub
looked at the function slot in order to skip stub frames
and find the JS frame. However, stub frames do not have a
function slot (in fact their fixed frame ends one slot
before the JS frame's function slot). Therefore, if this
location in the stub frame happens to have the function
object the create arguments stubs won't skip this frame
correctly.

Replace this approach with one where the stub is
specialized to either skip a frame if required (since
there will only ever be one extra frame on Ignition
the loop approach isn't necessary).

BUG=v8:4928
LOG=N
CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_nosnap_dbg

Review-Url: https://codereview.chromium.org/1949023003
Cr-Commit-Position: refs/heads/master@{#36181}

This code was used exclusively by its own unit test and can be safely removed.

BUG=v8:4947
LOG=N

Review-Url: https://codereview.chromium.org/1965373002
Cr-Commit-Position: refs/heads/master@{#36180}

When instantiating a subclassed API function, the instance cache is avoided. There is currently no direct API yet to instantiate a Template while passing in a new.target. It probably makes sense to extend ObjectTemplate::NewInstance to accept a new.target, in line with Reflect.construct.

BUG=v8:3330, v8:5001

Review-Url: https://codereview.chromium.org/1972613002
Cr-Commit-Position: refs/heads/master@{#36179}

With this CL it is possible to compile a wasm module with multiple
threads in parallel. Parallel compilation works as follows:

1)   The main thread allocates a compilation unit for each wasm function.
2)   The main thread spawns WasmCompilationTasks which run on the
     background threads.
3.a) The background threads and the main thread pick one compilation unit
     at a time and execute the parallel phase of the compilation unit.
     After finishing the execution of the parallel phase, the compilation
     unit is stored in a result queue.
3.b) If the result queue contains a compilation unit, the main thread
     dequeues it and finishes its compilation.
4)   After the execution of the parallel phase of all compilation units has
     started, the main thread waits for all WasmCompilationTasks to finish.
5)   The main thread finalizes the compilation of the module.

I'm going to add some additional tests before committing this CL.

R=titzer@chromium.org, bmeurer@chromium.org, mlippautz@chromium.org, mstarzinger@chromium.org

Review-Url: https://codereview.chromium.org/1961973002
Cr-Commit-Position: refs/heads/master@{#36178}

This passes the inlining_id of deoptimization points via the relocation
info instead of via a side-channel to the CPU profiler. This is one step
towards deprecating the side-channel in question and avoid the need for
performing a lookup of the return address of the deopt point.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/1956693002
Cr-Commit-Position: refs/heads/master@{#36177}

[runtime] Record runtime call stats for Map::TransitionTo*Property, Map::SetPrototype and property deletion to separate buckets.

Review-Url: https://codereview.chromium.org/1973473002
Cr-Commit-Position: refs/heads/master@{#36176}

Now we are able to distinguish different kind of misses based on which handler/stub did we actually use.

Review-Url: https://codereview.chromium.org/1969733002
Cr-Commit-Position: refs/heads/master@{#36175}

R=ahaas@chromium.org,mstarzinger@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/1970543003
Cr-Commit-Position: refs/heads/master@{#36174}

BUG=

Review-Url: https://codereview.chromium.org/1964453002
Cr-Commit-Position: refs/heads/master@{#36173}

This allows benchmarking without --single-process and correctly
gathering --runtime-call-stats numbers.

Add optional parameter to %GetAndResetRuntimeCallStats

-  Without any parameter, it returns a string with the runtime call
   statistics (as before).
-  With one string parameter, it appends the statistics to the file with
   that file name.
-  With one integer parameter (which must be 1=stdout or 2=stderr), it
   prints the statistics to the output with of that file descriptor.

The injected script is automatically generated.
Also, callstats.py does not have a hardwired DEFAULT_SITES anymore.

R=cbruni@chromium.org
BUG=
LOG=N

Review-Url: https://codereview.chromium.org/1966193002
Cr-Commit-Position: refs/heads/master@{#36172}

Prints source position information alongside bytecode.

BUG=v8:4280
LOG=N

Review-Url: https://codereview.chromium.org/1963663002
Cr-Commit-Position: refs/heads/master@{#36171}

This makes sure that targets depending on v8_libplatform
apply the required config.

BUG=chromium:474921
NOTRY=true

Review-Url: https://codereview.chromium.org/1962423003
Cr-Commit-Position: refs/heads/master@{#36170}

R=ahaas@chromium.org,bradnelson@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/1968943002
Cr-Commit-Position: refs/heads/master@{#36169}

BUG=chromium:609134
R=verwaest@chromium.org

Review-Url: https://codereview.chromium.org/1966853004
Cr-Commit-Position: refs/heads/master@{#36168}

The type feedback for load and store ICs might be polluted because of
different/conflicting call sites, but yet we can utilize some of the
static information that is available in the graph to determine the
effective receiver map, or at least filter out impossible receiver maps
from the feedback by looking at the transition trees.

This is similar to what Crankshaft does in ComputeReceiverTypes, but
more general and less hacky.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/1972563002
Cr-Commit-Position: refs/heads/master@{#36167}

BUG=chromium:474921
NOTRY=true

Review-Url: https://codereview.chromium.org/1966933003
Cr-Commit-Position: refs/heads/master@{#36166}

Revert of [debugger] Prevent shared function info duplicates (patchset #1 id:1 of https://codereview.chromium.org/1958153004/ )

Reason for revert:
[Sheriff] Speculative revert for https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/6700

Yang can tell you how to do the blink rebase dance if it was this CL.

Original issue's description:
> [debugger] Prevent shared function info duplicates
>
> Clear the list of shared function infos attached to a script before
> compiling for live edit in order to avoid duplicates. This was lost in
> 058deb27.
>
> R=yangguo@chromium.org
> BUG=
>
> Committed: https://crrev.com/592432977e6213364c243c396060c7b64687ddc3
> Cr-Commit-Position: refs/heads/master@{#36155}

TBR=yangguo@chromium.org,jgruber@google.com
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review-Url: https://codereview.chromium.org/1973433002
Cr-Commit-Position: refs/heads/master@{#36165}

R=ahaas@chromium.org,bradnelson@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/1971693002
Cr-Commit-Position: refs/heads/master@{#36164}

BUG=chromium:580959
LOG=n

Review-Url: https://codereview.chromium.org/1972553002
Cr-Commit-Position: refs/heads/master@{#36163}

... by
1) avoiding accessing RuntimeCallStats instance,
2) avoiding calculating address of a counter field,
3) and using statically known pointer to a member counter instead.

And in addition some code cleanup.

BUG=chromium:596055
LOG=N

Review-Url: https://codereview.chromium.org/1965133002
Cr-Commit-Position: refs/heads/master@{#36162}

By now the runtime entry function in question is a duplicate of the
existing Runtime_ToFastProperties function. This just gets rid of the
duplication.

R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/1963973003
Cr-Commit-Position: refs/heads/master@{#36161}

R=jgruber@chromium.org
BUG=chromium:609046
LOG=N

Review-Url: https://codereview.chromium.org/1957303002
Cr-Commit-Position: refs/heads/master@{#36160}

X87: [turbofan] Take the immediate size in account when narrowing ia32/x64 word comparison operators.

  port 2da70f85 (r36136)

  original commit message:
  Trying to re-land http://crrev.com/1948453002 after fixing assembler-x64.cc in http://crrev.com/1962563003.

  Before this patch, we would emit a cmp or test with a memory operand only if both of the operands in the IR were loads.
  Now if either of them is a load and the other one is an immediate, we can use a memory operand if the load representation machine size is wide enough to represent the latter.

BUG=

Review-Url: https://codereview.chromium.org/1967913003
Cr-Commit-Position: refs/heads/master@{#36159}

  port 61f5fbbb (r36133)

  original commit message:
  The new allocation folding implementation avoids fragmentation between folded allocation. As a consequence, our heap will always be iterable i.e. we do not have to perform a garbage collection
  before iterating the heap.

BUG=

Review-Url: https://codereview.chromium.org/1969553003
Cr-Commit-Position: refs/heads/master@{#36158}