Use compare-negate instruction if the right-hand input to a compare is a
negate operation.

BUG=

Review URL: https://codereview.chromium.org/1410123009

Cr-Commit-Position: refs/heads/master@{#31866}

IC::GetSharedFunctionInfo get's the JS frame which called the IC. When the
function is running in the interpreter, there is a Bytecode handler stub
frame between the IC and the JS frame. Modify IC::GetSharedFunctionInfo to
handle this.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1420283020

Cr-Commit-Position: refs/heads/master@{#31865}

Adds a blacklist of tests which are currently unsupported or broken in Ignition to
the mjsunit and test262 test status.

Also removes --ignition-script-filter flag, and adds a
--ignition_fallback_on_eval_and_catch flag which fallsback to fullcodegen for
functions which call eval or contain a catch block.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1420963009

Cr-Commit-Position: refs/heads/master@{#31864}

This allows testing the configuration where --harmony-default-parameters
is passed without --harmony-destructuring.

R=rossberg@chromium.org
BUG=v8:2160
LOG=n

Review URL: https://codereview.chromium.org/1410023015

Cr-Commit-Position: refs/heads/master@{#31863}

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1419273008

Cr-Commit-Position: refs/heads/master@{#31862}

R=ulan@chromium.org

Review URL: https://codereview.chromium.org/1408003012

Cr-Commit-Position: refs/heads/master@{#31861}

Now that the VisitCode visitor is actually marking through to inlined
code objects (as opposed to the VisitJSFunction visitor), we can make
this helper method private again.

R=ulan@chromium.org

Review URL: https://codereview.chromium.org/1422853008

Cr-Commit-Position: refs/heads/master@{#31860}

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1406253008

Cr-Commit-Position: refs/heads/master@{#31859}

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1413463009

Cr-Commit-Position: refs/heads/master@{#31858}

This fixes a corner case where optimized code could still be reachable
through the optimized code map, even though unoptimized code for any
inlined function might have long been flushed.

R=ulan@chromium.org
TEST=cctest/test-heap/Regress513496
BUG=chromium:513496
LOG=n

Review URL: https://codereview.chromium.org/1415683011

Cr-Commit-Position: refs/heads/master@{#31857}

We forgot to add the number of arguments parameter in
JSFrameSpecialization, which was added before the context.

R=jarin@chromium.org
BUG=chromium:552304
LOG=n

Review URL: https://codereview.chromium.org/1429233004

Cr-Commit-Position: refs/heads/master@{#31856}

Revert of [turbofan] Enable general purpose inlining. (patchset #2 id:20001 of https://codereview.chromium.org/1416873007/ )

Reason for revert:
As discussed with Benedikt: Disable --turbo-inlining again because it tanks Jetstream.

Original issue's description:
> [turbofan] Enable general purpose inlining.
>
> R=bmeurer@chromium.org,hablich@chromium.org
> BUG=v8:4493
> LOG=n
>
> Committed: https://crrev.com/161a0462fb0e79f155f3ea085ba774dad99539cb
> Cr-Commit-Position: refs/heads/master@{#31634}

TBR=bmeurer@chromium.org,mstarzinger@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4493

Review URL: https://codereview.chromium.org/1409153008

Cr-Commit-Position: refs/heads/master@{#31855}

Adds a test that the receiver for sloppy mode functions is replaced with
the global proxy when called with an undefined receiever.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1410113008

Cr-Commit-Position: refs/heads/master@{#31854}

if that is responsible for memory regression in UMA.

Related CLs: crrev.com/1420363004, crrev.com/1423453003

TBR=hpayer@chromium.org
BUG=chromium:552305
LOG=NO

Review URL: https://codereview.chromium.org/1420283021

Cr-Commit-Position: refs/heads/master@{#31853}

This avoids the need to clear optimized code maps within the GC by just
preventing entries being added in the first place, whenever a snapshot
is being constructed. The main goal here is to simplify the logic in the
already complex visitor for our shared function info objects.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1411513005

Cr-Commit-Position: refs/heads/master@{#31852}

This will be used as a data source for an
UMA histogram.

LOG=N
BUG=chromium:546603
R=jochen@chromium.org,yangguo@chromium.org

Review URL: https://codereview.chromium.org/1413503007

Cr-Commit-Position: refs/heads/master@{#31851}

This change does not change how the BufferedRawMachineAssemblerTester is
used in tests, but it makes its construction in other constructors (e.g.
in the WasmRunner) cleaner.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1414203009

Cr-Commit-Position: refs/heads/master@{#31850}

  port 4ab1b05d (r31826).

  original commit message:
  Depends on https://codereview.chromium.org/1407373007/
  After that CL, all receiver conversion is handled by the call builtin.

BUG=

Review URL: https://codereview.chromium.org/1419563006

Cr-Commit-Position: refs/heads/master@{#31849}

  port 44c44521 (r31823).

  original commit message:
  This fixes receiver conversion since the Call builtin does it correctly.

BUG=

Review URL: https://codereview.chromium.org/1416673009

Cr-Commit-Position: refs/heads/master@{#31848}

Use 64-bit load of receiver in 4ab1b05d.

BUG=

Review URL: https://codereview.chromium.org/1412693003

Cr-Commit-Position: refs/heads/master@{#31847}

It was originally shipped in https://crrev.com/eef2b9b09723ba1dae3ec0172341e93e9030ada0,
but was reverted due to poor interaction with Blink.

That interaction seems to be fixed thanks to changes to the V8 API
and to @@toStringTag handling on access-checked objects.

BUG=v8:3502
LOG=y
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.v8:v8_linux_nosnap_rel;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1406293011

Cr-Commit-Position: refs/heads/master@{#31846}

On MIPS arch, all memory accesses (including halfword)
must be aligned to their native size or an alignment exception occurs.
The kernel will fix this up, but with performance penalty.

TEST=test-bytecode-generator/CallRuntime
BUG=

Review URL: https://codereview.chromium.org/1423373004

Cr-Commit-Position: refs/heads/master@{#31845}

Since enabling destructuring already implies enabling default parameters,
there's not a good way to separate these two. Luckily, they're both
feature-complete (save for destructuring assignment).

This causes us to pass an additional 24 test262 tests.

BUG=v8:811, v8:2160
LOG=y

Review URL: https://codereview.chromium.org/1407393009

Cr-Commit-Position: refs/heads/master@{#31844}

The previous code had a mix of breaks, early returns, and switch/case/if
with fallthrough. Now the pattern is to either return for known errors
or break to the bottom of the switch for unhandled tokens.

Also cleaned up random other stuff in the function: removed unnecessary
local vars, shortened position-fetching calls.

Review URL: https://codereview.chromium.org/1412313009

Cr-Commit-Position: refs/heads/master@{#31843}

http://crrev.com/80a1e004f4ef619b54a2d87bf2108719a8411860 was reverted
due to a Blink test failure. That test has been marked as failing on
the Blink side in https://chromium.googlesource.com/chromium/src/+/ac11c6df133.

BUG=v8:811
LOG=y
TBR=rossberg@chromium.org
CQ_INCLUDE_TRYBOTS=tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1409093005

Cr-Commit-Position: refs/heads/master@{#31842}

This patch adds UseCounters for the various language modes. This may
be useful for helping us to prioritize future optimization and
language design decisions.

R=adamk
CC=seththompson
BUG=none

Review URL: https://codereview.chromium.org/1429173002

Cr-Commit-Position: refs/heads/master@{#31841}

Revert of Revert "Revert of [es6] Implement destructuring binding in try/catch" (patchset #2 id:20001 of https://codereview.chromium.org/1411323008/ )

Reason for revert:
[Sheriff] Breaks a layout test:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/2750

Please request rebase upstream first if intended.

Original issue's description:
> Revert "Revert of [es6] Implement destructuring binding in try/catch"
>
> Reland try/catch destructuring with a fix for the MemorySanitizer failure:
> initialization_pos needs to be initialized in the DeclarationDescriptor.
>
> This is a one line fix to http://crrev.com/a316db995e6e4253664920652ed4e5a38b2caeba
>
> BUG=v8:811
> LOG=y
>
> Committed: https://crrev.com/80a1e004f4ef619b54a2d87bf2108719a8411860
> Cr-Commit-Position: refs/heads/master@{#31834}

TBR=littledan@chromium.org,rossberg@chromium.org,adamk@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:811

Review URL: https://codereview.chromium.org/1421193006

Cr-Commit-Position: refs/heads/master@{#31840}

LOG=N
BUG=v8:4428

Review URL: https://codereview.chromium.org/1425293007

Cr-Commit-Position: refs/heads/master@{#31839}

R=bmeurer@chromium.org

Committed: https://crrev.com/5a1e42c039ac3379ebe1e7e34fb8163e1ec1493e
Cr-Commit-Position: refs/heads/master@{#31791}

Committed: https://crrev.com/bf5c9af92ac0a5b7f020ac968d3d42ed06aa6144
Cr-Commit-Position: refs/heads/master@{#31805}

Review URL: https://codereview.chromium.org/1428203003

Cr-Commit-Position: refs/heads/master@{#31838}

Revert of [heap] Separate out optimized code map processing. (patchset #2 id:20001 of https://codereview.chromium.org/1421903012/ )

Reason for revert:
Causes GC-Stress failures.

Original issue's description:
> [heap] Separate out optimized code map processing.
>
> This separates the post-processing step for optimized code maps out of
> the CodeFlusher. It uses the complete SharedFunctionInfo::Iterator to
> visit all candidates instead of gathering candidates during marking.
>
> Gathering candidates during marking no longer makes sense, now that the
> majority of SharedFunctionInfo objects will hold such an optimized code
> map. Also it reduces complexity of the implementation. Also conflating
> this mechanism with "code flushing" was confusing.
>
> This reverts commit b6644e84.
>
> R=ulan@chromium.org
>
> Committed: https://crrev.com/bb7a5eb2d89bae25f2b5ecb9515669f0ac73c111
> Cr-Commit-Position: refs/heads/master@{#31836}

TBR=ulan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1412063012

Cr-Commit-Position: refs/heads/master@{#31837}

This separates the post-processing step for optimized code maps out of
the CodeFlusher. It uses the complete SharedFunctionInfo::Iterator to
visit all candidates instead of gathering candidates during marking.

Gathering candidates during marking no longer makes sense, now that the
majority of SharedFunctionInfo objects will hold such an optimized code
map. Also it reduces complexity of the implementation. Also conflating
this mechanism with "code flushing" was confusing.

This reverts commit b6644e84.

R=ulan@chromium.org

Review URL: https://codereview.chromium.org/1421903012

Cr-Commit-Position: refs/heads/master@{#31836}

The new GN rule will enable removal of code which copies natives_blob.bin and
snapshot_blob.bin in Android GN code (for instance "copy_content_shell_assets").

BUG=547162
LOG=Y

Review URL: https://codereview.chromium.org/1412333005

Cr-Commit-Position: refs/heads/master@{#31835}

Reland try/catch destructuring with a fix for the MemorySanitizer failure:
initialization_pos needs to be initialized in the DeclarationDescriptor.

This is a one line fix to http://crrev.com/a316db995e6e4253664920652ed4e5a38b2caeba

BUG=v8:811
LOG=y

Review URL: https://codereview.chromium.org/1411323008

Cr-Commit-Position: refs/heads/master@{#31834}

We are creating a lot of tags. The result is that git 'packs'
some of them. Our parsers in the release script cannot handle
this.

R=machenbach@chromium.org
LONG=N
NOTRY=true

Review URL: https://codereview.chromium.org/1403293009

Cr-Commit-Position: refs/heads/master@{#31833}

Revert of [heap] Separate out optimized code map processing. (patchset #3 id:40001 of https://codereview.chromium.org/1426953006/ )

Reason for revert:
Breaks build: https://uberchromegw.corp.google.com/i/client.v8/builders/V8%20Linux%20-%20nosnap%20-%20debug/builds/3565

Original issue's description:
> [heap] Separate out optimized code map processing.
>
> This separates the post-processing step for optimized code maps out of
> the CodeFlusher. It uses the complete SharedFunctionInfo::Iterator to
> visit all candidates instead of gathering candidates during marking.
>
> Gathering candidates during marking no longer makes sense, now that the
> majority of SharedFunctionInfo objects will hold such an optimized code
> map. Also it reduces complexity of the implementation. Also conflating
> this mechanism with "code flushing" was confusing.
>
> R=ulan@chromium.org
>
> Committed: https://crrev.com/8ad6168d197dd167235c9d342ec7ce37b0daa88b
> Cr-Commit-Position: refs/heads/master@{#31830}

TBR=ulan@chromium.org,yangguo@chromium.org,mvstanton@chromium.org,mstarzinger@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1434503003

Cr-Commit-Position: refs/heads/master@{#31832}

Port ab840259

Also:
- Fix big-endian compiler hints BYTE_OFFSET macro.
- Clean up PPC code access to compiler hints -- which required some new
  SharedFunctionInfo fields to encapsulate kCompilerHintsSmiTagSize.

Original commit message:
    The current implementation of classes throws the TypeError at the wrong
    point, after activating a new context when directly calling a class
    constructor. According to the spec, the TypeError has to be thrown
    in the caller context.

R=bmeurer@chromium.org, cbruni@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
LOG=N
BUG=v8:4428

Review URL: https://codereview.chromium.org/1423713014

Cr-Commit-Position: refs/heads/master@{#31831}

This separates the post-processing step for optimized code maps out of
the CodeFlusher. It uses the complete SharedFunctionInfo::Iterator to
visit all candidates instead of gathering candidates during marking.

Gathering candidates during marking no longer makes sense, now that the
majority of SharedFunctionInfo objects will hold such an optimized code
map. Also it reduces complexity of the implementation. Also conflating
this mechanism with "code flushing" was confusing.

R=ulan@chromium.org

Review URL: https://codereview.chromium.org/1426953006

Cr-Commit-Position: refs/heads/master@{#31830}

Review URL: https://codereview.chromium.org/1416243009

Cr-Commit-Position: refs/heads/master@{#31829}

These intrinsics are completely unused and there doesn't seem to an
actual use case for it in the future.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1418663011

Cr-Commit-Position: refs/heads/master@{#31828}

This inserts a new bit set type Function, which is used to represent
JSFunctions, and uses that type in typed lowering to optimize calls
to use the CallFunction builtin directly. Also allows for better typing
of the typeof operator, which can infern "function" for JSFunctions
properly.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1410343016

Cr-Commit-Position: refs/heads/master@{#31827}