Moved globals offsets calculation to the wasm module decoder, since
this is a property of the module, not of each instance.

Qualified as "const" references to WasmModule outside of the decoder
and some test situations.

BUG=

Review-Url: https://codereview.chromium.org/2005933003
Cr-Commit-Position: refs/heads/master@{#36484}

[x64/ia32] Deal with the non-transitivity of InstructionSelector::CanCover() when folding loads into branches.

Sequences like:

1: Load[kRepWord32|kTypeInt32](<address>, ...)
2: Word32And(1, <constant>)
3: Word32Equal(2, <another constant>)
4: Store[(kRepWord32 : NoWriteBarrier)](<address>, <value>)
5: Branch[None](3, ...) -> B1, B2

where #1 and #4 refer to the same memory location, are problematic because in VisitBranch we assume that 'InstructionSelector::CanCover()' is transitive.

What happens is that CanCover(5, 3) is true (3 is a pure op), and so are CanCover(3, 2), CanCover(2, 1), but the effect level of 5 and 3 never gets checked because 3 is a pure op. Upon VisitBranch, we ended up materializing:

mov [address], <value>
test [address], <another constant>

With this patch, it becomes:

mov reg, [address]
mov [address], <value>
test reg, <another constant>

BUG=chromium:611976

Review-Url: https://codereview.chromium.org/2008493002
Cr-Commit-Position: refs/heads/master@{#36482}

The DeoptimizeIf and DeoptimizeUnless operators should actually produce
an effect in addition to the control output.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2002253003
Cr-Commit-Position: refs/heads/master@{#36477}

Previously we only ran these analysis passes on the outermost function,
but not on inlined functions.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2003363002
Cr-Commit-Position: refs/heads/master@{#36474}

BUG=chromium:608675
LOG=n

Review-Url: https://codereview.chromium.org/1987183002
Cr-Commit-Position: refs/heads/master@{#36463}

X87: Revert of [turbofan] Take the immediate size in account when narrowing ia32/x64 word comparison operators. (patchset #1 id:1 of https://codereview.chromium.org/1968453002/ ).

  port 767c34df (r36413)

  original commit message:
  Reason for revert:
  Breaks a KCS demo:

  BUG=chromium:611976

  Original issue's description:
  > [turbofan] Take the immediate size in account when narrowing ia32/x64 word comparison operators.
  >
  > Trying to re-land http://crrev.com/1948453002 after fixing assembler-x64.cc in http://crrev.com/1962563003.
  >
  > Before this patch, we would emit a cmp or test with a memory operand only if both of the operands in the IR were loads. Now if either of them is a load and the other one is an immediate, we can use
  >
  > Committed: https://crrev.com/2da70f853d7f680d491c37c72d5ef04a85497ba9
  > Cr-Commit-Position: refs/heads/master@{#36136}

Review-Url: https://codereview.chromium.org/2003273002
Cr-Commit-Position: refs/heads/master@{#36456}

BUG=chromium:612412
LOG=N

Review-Url: https://codereview.chromium.org/1999783004
Cr-Commit-Position: refs/heads/master@{#36448}

Previously, split-edge blocks inserted into CodeStubAssembler schedules
inherited the "deferredness" of their predecessor block. This tended to inline
newly inserted blocks that preceeded deferred code inline with non-deferred
code. The stack frame elider sometimes inserted stack construction into these
blocks, code which was actually was only needed in the deferred case.

This CL marks inserted split edge blocks with the deferredness of their
successors, e.g. they are defererred if their predecessor is deferrred. This
moves stack building code that logically belongs to deferred code into the
deferred code area rather than inlining it in non-deferred code.

Review-Url: https://codereview.chromium.org/2003663002
Cr-Commit-Position: refs/heads/master@{#36446}

Also use the inlined version of CreateIterResultObject in Ignition's VisitYield.

BUG=v8:4907
TBR=littledan@chromium.org

Review-Url: https://codereview.chromium.org/2006613002
Cr-Commit-Position: refs/heads/master@{#36444}

Instead of changing existing nodes in a very fragile (and in one case expensive)
way, just create new ones instead.

Also properly chain effects, which was not done quite right before.

BUG=v8:4907

Review-Url: https://codereview.chromium.org/1997373002
Cr-Commit-Position: refs/heads/master@{#36442}

This makes escape analysis skip analyzing the code entry field within
JSFunction objects. Said field is an untagged pointer field and hence
cannot be tracked by an ObjectState node.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-613494
BUG=chromium:613494

Review-Url: https://codereview.chromium.org/1997353002
Cr-Commit-Position: refs/heads/master@{#36436}

This unifies the calculation of virtual offsets within the escape
analysis pass to go through common helpers. It also switches to safer
accessors for getting FieldAccess and ElementAccess parameters.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2000733002
Cr-Commit-Position: refs/heads/master@{#36423}

combination of LoadByte/Shift/Or and StoreByte/Shift/And.

BUG=

Review-Url: https://codereview.chromium.org/1928513002
Cr-Commit-Position: refs/heads/master@{#36422}

Revert of [turbofan] Take the immediate size in account when narrowing ia32/x64 word comparison operators. (patchset #1 id:1 of https://codereview.chromium.org/1968453002/ )

Reason for revert:
Breaks a KCS demo:

BUG=chromium:611976

Original issue's description:
> [turbofan] Take the immediate size in account when narrowing ia32/x64 word comparison operators.
>
> Trying to re-land http://crrev.com/1948453002 after fixing assembler-x64.cc in http://crrev.com/1962563003.
>
> Before this patch, we would emit a cmp or test with a memory operand only if both of the operands in the IR were loads. Now if either of them is a load and the other one is an immediate, we can use a memory operand if the load representation machine size is wide enough to represent the latter.
>
> Committed: https://crrev.com/2da70f853d7f680d491c37c72d5ef04a85497ba9
> Cr-Commit-Position: refs/heads/master@{#36136}

TBR=bmeurer@chromium.org,epertoso@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.

Review-Url: https://codereview.chromium.org/1995303003
Cr-Commit-Position: refs/heads/master@{#36413}

For now we treat simplified ObjectIsFoo operators as escaping uses when
it comes to escape analysis. Eventually we want to handle them in the
associated reducer, just like we do with ObjectIsSmi.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2002573002
Cr-Commit-Position: refs/heads/master@{#36404}

Also change parser to insert %_GeneratorClose instead of %GeneratorClose.
Full-codegen generators will fall back to the runtime function.

BUG=v8:4907

Review-Url: https://codereview.chromium.org/1993073003
Cr-Commit-Position: refs/heads/master@{#36401}

Introduce three new JS operators in Turbofan:
- JSGeneratorStore is used in implementing Ignition's SuspendGenerator bytecode.
- JSGeneratorRestoreContinuation and JSGeneratorRestoreRegister are used in
  implementing Ignition's ResumeGenerator bytecode.

Remove the runtime functions that were used to implement these bytecodes before.

BUG=v8:4907

Review-Url: https://codereview.chromium.org/1991203002
Cr-Commit-Position: refs/heads/master@{#36395}

Review-Url: https://codereview.chromium.org/1998103002
Cr-Commit-Position: refs/heads/master@{#36391}

  port 78b1585f (r36355)

  original commit message:

BUG=

Review-Url: https://codereview.chromium.org/1998013002
Cr-Commit-Position: refs/heads/master@{#36388}

In ES2015, the "byteLength" and "byteOffset" properties of DataViews are
getters on the prototype, so the previously-used strategy of special-casing
them using only the receiver map is invalid.

A future CL will need to use the same strategy which will be taken for
TypedArray "length", "byteLength", and "byteOffset": adding a prototype
chain check.

BUG=v8:5018, chromium:593634

Review-Url: https://codereview.chromium.org/1984043002
Cr-Commit-Position: refs/heads/master@{#36382}

This patch is a follow up to https://codereview.chromium.org/1972103002/
adding support for the `Operand_R_LSL_I` addressing mode to loads and
stores for ARM.

Just as the ARM64 implementation, the shift + load/store pattern is only
really relevant to the interpreter. For this reason, this patch does not
add support for the other addressing modes (`R_LSR_I`, `R_ASR_I` and
`R_ROR_I`) as I haven't seen those pattern being generated. Additionally,
the optimization is restricted 32 bit loads and stores.

kind = BYTECODE_HANDLER
name = Star
compiler = turbofan
Instructions (size = 40)
0x22a5f860     0  e2851001       add r1, r5, #1
0x22a5f864     4  e19610d1       ldrsb r1, [r6, +r1]
0x22a5f868     8  e1a0200b       mov r2, fp
0x22a5f86c    12  e7820101       str r0, [r2, +r1, lsl #2]
                                 ^^^^^^^^^^^^^^^^^^^^^^^^^
0x22a5f870    16  e2855002       add r5, r5, #2
0x22a5f874    20  e7d61005       ldrb r1, [r6, +r5]
0x22a5f878    24  e7981101       ldr r1, [r8, +r1, lsl #2]
                                 ^^^^^^^^^^^^^^^^^^^^^^^^^
0x22a5f87c    28  e12fff11       bx r1

BUG=

Review-Url: https://codereview.chromium.org/1974263002
Cr-Commit-Position: refs/heads/master@{#36381}

The MLS instruction is available in all ARMv7 devices, and in no ARMv6
devices, aside from the usual ARMv6T2 caveat. We don't need a separate
feature flag for it.

BUG=

Review-Url: https://codereview.chromium.org/1988133004
Cr-Commit-Position: refs/heads/master@{#36378}

port 78b1585f

R=danno@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com
BUG=

Review-Url: https://codereview.chromium.org/1993273002
Cr-Commit-Position: refs/heads/master@{#36376}

Removed wrapper functions.

BUG=

Review-Url: https://codereview.chromium.org/1994963002
Cr-Commit-Position: refs/heads/master@{#36372}

Previously, CodeStubAssembler macros performing FixedArray element accesses had
to compute offsets to elements explicitly with a fair amount of duplicated
code. Furthermore, any peephole optimizations that could produce better code--
like recognizing constant indices or combining array index computation with Smi
untagging--were also duplicated.

This change factors the code to compute FixedArray index offsets into a common
routine in the CodeStubAssembler that applies standard peephole optimizations to
all accesses. In order to do this, it also introduces limited introspection into
the up-until-now opaque Node* type exported from code-assembler.h, allowing
Nodes to be queried whether they are constant and extracting their constant
value in that case.

Review-Url: https://codereview.chromium.org/1989363004
Cr-Commit-Position: refs/heads/master@{#36370}

Review-Url: https://codereview.chromium.org/1995543003
Cr-Commit-Position: refs/heads/master@{#36355}

This is a pure refactoring that removes unnecessary wrapper methods from
the EscapeAnalysis class. This completely removes the notion of "Alias"
from the interface.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/1989243002
Cr-Commit-Position: refs/heads/master@{#36325}

This promotes the escape analysis from an experimental feature to be a
fully supported feature. The main goal is to unleach ClusterFuzz on the
implementation so that we can stabilize it.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/1989833002
Cr-Commit-Position: refs/heads/master@{#36324}

This is pure refactoring that moves many internal details of the escape
analysis from the header into the compilation unit. The goal of this is
to simplify the interface for readability.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/1991723003
Cr-Commit-Position: refs/heads/master@{#36322}

R=bmeurer@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/1981323002
Cr-Commit-Position: refs/heads/master@{#36312}

Remove dead code to optimize Int64Constants as branch/select conditions,
because we either have tagged booleans or bits represented as word32.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/1994533002
Cr-Commit-Position: refs/heads/master@{#36308}

One of the Arm OutOfLineRecordWrite was missing initialiation of must_save_lr

Review-Url: https://codereview.chromium.org/1988623003
Cr-Commit-Position: refs/heads/master@{#36307}

The type guard should never be used after the effect/control
linearization pass, so making it a simplified operator better
expresses the intended use. Also this way none of the common
operators actually has any dependency on the type system.

Drive-by-fix: Properly print the type parameter to a TypeGuard operator.

BUG=chromium:612142
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/1994503002
Cr-Commit-Position: refs/heads/master@{#36304}

These guards are useless anyways once you make it throw the
effect/control linearizer because all memory operations and
calls are connected to the control and/or effect chain anyways
afterwards.

Drive-by-fix: Fail in the InstructionSelector if we ever see
a Guard node.

R=jarin@chromium.org
BUG=chromium:612142

Review-Url: https://codereview.chromium.org/1980383002
Cr-Commit-Position: refs/heads/master@{#36302}

This operator will be used to carry eager frame states, and is hooked up
to the effect chain with a control dependency to avoid hosting out of
control structures.

R=jarin@chromium.org
BUG=v8:5021

Review-Url: https://codereview.chromium.org/1993593002
Cr-Commit-Position: refs/heads/master@{#36301}

Makes LogicalNot bytecode not do the ToBoolean operation, and add support in the
peephole optimizer to choose between the appropriate bytecode depending upon
whether the previous bytecode emitted a boolean or not.

BUG=v8:4280
LOG=N

Review-Url: https://codereview.chromium.org/1985033002
Cr-Commit-Position: refs/heads/master@{#36295}

This makes escape analysis treat all guard nodes in the graph as an
escaping use. We eventually want to properly handle guard nodes, this
just serves as a temporary workaround to get things going.

R=bmeurer@chromium.org
BUG=v8:602595
LOG=n

Review-Url: https://codereview.chromium.org/1972323004
Cr-Commit-Position: refs/heads/master@{#36286}

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/1984203002
Cr-Commit-Position: refs/heads/master@{#36285}

This adds back the instanceof operator support in the backends and
introduces a @@hasInstance protector cell on the isolate that guards the
fast path for the InstanceOfStub. This way we recover the ~10%
regression on Octane EarleyBoyer in Crankshaft and greatly improve
TurboFan and Ignition performance of instanceof.

R=ishell@chromium.org
TBR=hpayer@chromium.org,rossberg@chromium.org
BUG=chromium:597249, v8:4447
LOG=n

Review-Url: https://codereview.chromium.org/1980483003
Cr-Commit-Position: refs/heads/master@{#36275}

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/1973323002
Cr-Commit-Position: refs/heads/master@{#36274}