Modify the Bytecode Register Optimizer to be an independent component
rather than part of the BytecodePipeline. This means the BytecodeArrayBuilder
can explicitly call it with register operands when outputting a bytecode
and the Bytecode Register Optimizer doesn't need to work out which operands
are register operands. This also means we don't need to build BytecodeNodes
for Ldar / Star / Mov bytecodes unless they are actually emitted by the
optimizer.

This change also modifies the way the BytecodeArrayBuilder converts
operands to make use of the OperandTypes specified in bytecodes.h.
This avoids having to individually convert operands to their raw output
value before calling Output(...).

BUG=v8:4280

Review-Url: https://codereview.chromium.org/2393683004
Cr-Commit-Position: refs/heads/master@{#40543}

Now we
- always set .result to undefined before a visited loop and switch since we can't know whether they will set a value,
- only visit finally if it can break/continue; and only store/restore .result in that case

BUG=

Review-Url: https://codereview.chromium.org/2427253003
Cr-Commit-Position: refs/heads/master@{#40542}

CL https://codereview.chromium.org/2177273002 changed FastNewFunctionContextStub
to take a number of slots parameter and in-doing so removed the maximum slot
count for FastNewFunctionContextStub. This made it possible to create a
closure which is larger than kMaxRegularHeapObjectSize and so can't be
allocated by FastNewFunctionContextStub.

Reintroduce FastNewFunctionContextStub::kMaxSlots (but make the limit much
larger) to ensure we call the runtime for contexts which need to be
allocated in the LO space.

BUG=chromium:655573

Review-Url: https://codereview.chromium.org/2445703002
Cr-Commit-Position: refs/heads/master@{#40541}

R=jochen@chromium.org
BUG=chromium:656854

Review-Url: https://codereview.chromium.org/2427933002
Cr-Commit-Position: refs/heads/master@{#40540}

Revert of Reland "[heap] Start sweeper tasks after evacuation. (patchset #2 id:20001 of https://chromiumcoder… (patchset #1 id:1 of https://chromiumcodereview.appspot.com/2437873004/ )

Reason for revert:
Canary crashes crbug.com/658718

Original issue's description:
> Reland "[heap] Start sweeper tasks after evacuation. (patchset #2 id:20001 of https://chromiumcodereview.appspot.com/2428043002/ )"
>
> The performance regression in crbug.com/657776 was not caused by this CL.
>
> This reverts commit 4490a760.
>
> BUG=

TBR=mlippautz@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=

Review-Url: https://codereview.chromium.org/2446583003
Cr-Commit-Position: refs/heads/master@{#40539}

Port 231c8ac0

Original commit message:
  Loads already used source position elimination to avoid unnecessary hole checks,
  but for reasons unknown stores did not. This CL corrects that, making full-codegen's
  hole elimination equivalent to ignition's.

  Also introduced a HoleCheckMode enum class to avoid more bool flags and updated
  VariableProxy and BytecodeGenerator appropriately.

R=adamk@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, bjaideep@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com
BUG=

Review-Url: https://codereview.chromium.org/2449473002
Cr-Commit-Position: refs/heads/master@{#40538}

R=littledan@chromium.org,adamk@chromium.org
BUG=v8:1569

Review-Url: https://codereview.chromium.org/2440103002
Cr-Commit-Position: refs/heads/master@{#40537}

If at instantiation we get an existing ArrayBuffer, set it non
neuterable, because we embed the backing memory address in wasm code.

With this fix, all tests pass if validate-asm is set to default=true.

R=titzer@chromium.org
BUG=v8:4203

Review-Url: https://codereview.chromium.org/2441353003
Cr-Commit-Position: refs/heads/master@{#40536}

Swaping the order when loading surrogate pairs on big endian
platform. This fixes testcase string-iterator.js on big
endian.

BUG=
R=bmeurer@chromium.org, mstarzinger@chromium.org, jkummerow@chromium.org

Review-Url: https://codereview.chromium.org/2431223010
Cr-Commit-Position: refs/heads/master@{#40535}

Revert of [compiler] Prepare for partially shipping Ignition. (patchset #1 id:1 of https://codereview.chromium.org/2443573002/ )

Reason for revert:
Causes regressions: https://bugs.chromium.org/p/chromium/issues/detail?id=658711

Original issue's description:
> [compiler] Prepare for partially shipping Ignition.
>
> This prepares the code-base so that Ignition can be enabled on a certain
> subset of compilations without setting the {FLAG_ignition} flag (which
> enables Ignition on all compilations). We should not check the flag in
> question explicitly anywhere outside of the compiler heuristics.
>
> R=mvstanton@chromium.org

BUG=chromium:658711
TBR=mvstanton@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.

Review-Url: https://codereview.chromium.org/2448443002
Cr-Commit-Position: refs/heads/master@{#40534}

I committed https://codereview.chromium.org/2447643002 prematurely, this
is a cleanup.

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2444863002
Cr-Commit-Position: refs/heads/master@{#40533}

This results in a speedup of around 2x. RegExpExec is also ported in
this CL.

BUG=v8:5339

Review-Url: https://codereview.chromium.org/2441993002
Cr-Commit-Position: refs/heads/master@{#40532}

This ensures that both --trace-codegen as well as --print-ast work for
Ignition and print traces for generated bytecode as well. Here we do
consider "bytecode" to be "code" as well for tracing purposes.

R=rmcilroy@chromium.org

Review-Url: https://codereview.chromium.org/2443003003
Cr-Commit-Position: refs/heads/master@{#40531}

Depending on the inputs the fuzzer creates multiple functions. These
functions can have signatures with an int32 return value and up to three
parameters of type int32, int64, float32, or float64.

R=titzer@chromium.org, clemensh@chromium.org

Review-Url: https://codereview.chromium.org/2447643002
Cr-Commit-Position: refs/heads/master@{#40530}

This will have additional use sites in TurboFan soon once RegExpExec is ported.

BUG=v8:5339

Review-Url: https://codereview.chromium.org/2440893003
Cr-Commit-Position: refs/heads/master@{#40529}

R=machenbach@chromium.org

Review-Url: https://codereview.chromium.org/2424313004
Cr-Commit-Position: refs/heads/master@{#40528}

  port 231c8ac0 (r40522)

  original commit message:
  Loads already used source position elimination to avoid unnecessary hole checks,
  but for reasons unknown stores did not. This CL corrects that, making full-codegen's
  hole elimination equivalent to ignition's.

  Also introduced a HoleCheckMode enum class to avoid more bool flags and updated
  VariableProxy and BytecodeGenerator appropriately.

BUG=

Review-Url: https://codereview.chromium.org/2444823002
Cr-Commit-Position: refs/heads/master@{#40527}

The test ensures that in RegExp.prototype[@@split], exec is neither
accessed too early nor too often.

BUG=v8:5339,v8:5434

Review-Url: https://codereview.chromium.org/2440413002
Cr-Commit-Position: refs/heads/master@{#40526}

We need to check the KeyedLoadIC state to guard against potential
deoptimization loops due to out-of-bounds accesses, because the IC
system uses the MEGAMORPHIC state to also signal that there was an
out-of-bounds access already.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2443893002
Cr-Commit-Position: refs/heads/master@{#40525}

BUG=

Review-Url: https://codereview.chromium.org/2438553003
Review-Url: https://codereview.chromium.org/2438553003
Cr-Original-Original-Commit-Position: refs/heads/master@{#40503}
Cr-Original-Commit-Position: refs/heads/master@{#40511}
Cr-Commit-Position: refs/heads/master@{#40524}

This patch moves management of marking deque backing store into the
MarkingDeque class, which will simplify unmapping of backing store in
concurrent task.

BUG=

Review-Url: https://codereview.chromium.org/2439063002
Cr-Commit-Position: refs/heads/master@{#40523}

Loads already used source position elimination to avoid unnecessary hole checks,
but for reasons unknown stores did not. This CL corrects that, making full-codegen's
hole elimination equivalent to ignition's.

Also introduced a HoleCheckMode enum class to avoid more bool flags and updated
VariableProxy and BytecodeGenerator appropriately.

Review-Url: https://codereview.chromium.org/2441543005
Cr-Commit-Position: refs/heads/master@{#40522}

When accessing elements of a compile-time constant String, we don't need
to check the receiver, and we can constant-fold the loading of the
length.

R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2442243002
Cr-Commit-Position: refs/heads/master@{#40521}

  port 4a31323e (r40506)

  original commit message:
  The current method of marking functions for optimization, which replaces
  the JSFunction's code object with one that triggers optimization, would
  never allow unnamed functions to be optimized. This is an issue for a
  style of programming which heavily relies on passing around closures.

  This patch sets a bit on the SharedFunctionInfo when a JSFunction is
  marked. When another JSFunction referring to the same SharedFunctionInfo
  is lazily compiled, it immediately triggers a non-concurrent optimize.

BUG=

Review-Url: https://codereview.chromium.org/2439393002
Cr-Commit-Position: refs/heads/master@{#40520}

When lowering JSToLength, we cannot just smash arbitrary bounds on the
Select nodes, as that will confuse the representation selection later.
Instead properly rename the input using NumberMax and NumberMin.

R=jarin@chromium.org
BUG=chromium:657478

Review-Url: https://codereview.chromium.org/2440333002
Cr-Commit-Position: refs/heads/master@{#40519}

When lowering loads of "length" on compile-time constant strings,
generate constant length instead of a load.

R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2442233002
Cr-Commit-Position: refs/heads/master@{#40518}

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapul/+log/b7d8fe8..6962f5c

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://chromiumcodereview.appspot.com/2442173002
Cr-Commit-Position: refs/heads/master@{#40517}

Since the public API for deserialization is now just DeserializeOrCompile,
we can trickle down the wire bytes to the deserialization logic, and
avoid the need for duplicating the wire bytes when serializing.

BUG=chromium:657316

Review-Url: https://chromiumcodereview.appspot.com/2433273002
Cr-Commit-Position: refs/heads/master@{#40516}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/ee7e988..a3b623a

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapul/+log/147f2cf..b7d8fe8

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://chromiumcodereview.appspot.com/2445563002
Cr-Commit-Position: refs/heads/master@{#40515}

BUG=chromium:657786

Review-Url: https://chromiumcodereview.appspot.com/2436423003
Cr-Commit-Position: refs/heads/master@{#40514}

R=bradnelson@chromium.org
BUG=

Review-Url: https://chromiumcodereview.appspot.com/2436953004
Cr-Commit-Position: refs/heads/master@{#40513}

Revert of [ic] Support data handlers that represent simple field stores. (patchset #2 id:40001 of https://codereview.chromium.org/2438553003/ )

Reason for revert:
http://build.chromium.org/p/client.v8/builders/V8%20Mac%20GC%20Stress/builds/9306 "V8 Mac GC Stress"

Original issue's description:
> [ic] Support data handlers that represent simple field stores.
>
> BUG=
>
> Review-Url: https://codereview.chromium.org/2438553003
> Cr-Commit-Position: refs/heads/master@{#40503}

TBR=jkummerow@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review-Url: https://chromiumcodereview.appspot.com/2442523003
Cr-Commit-Position: refs/heads/master@{#40512}

BUG=

Review-Url: https://codereview.chromium.org/2438553003
Review-Url: https://chromiumcodereview.appspot.com/2438553003
Cr-Original-Commit-Position: refs/heads/master@{#40503}
Cr-Commit-Position: refs/heads/master@{#40511}

- Add hole check if needed.
- Preserve the accumulator so that the result is the rhs.

R=adamk@chromium.org
BUG=v8:1569,v8:5547

Review-Url: https://chromiumcodereview.appspot.com/2438653003
Cr-Commit-Position: refs/heads/master@{#40510}

Up until now, the TFJ macro would take 'argc + 1' for the implicitly
passed receiver. Decrease the cognitive load by making it take the
explicit argc.

BUG=

Review-Url: https://chromiumcodereview.appspot.com/2439013003
Cr-Commit-Position: refs/heads/master@{#40509}

R=adamk@chromium.org
BUG=v8:1569

Review-Url: https://chromiumcodereview.appspot.com/2442723002
Cr-Commit-Position: refs/heads/master@{#40508}

This prepares the code-base so that Ignition can be enabled on a certain
subset of compilations without setting the {FLAG_ignition} flag (which
enables Ignition on all compilations). We should not check the flag in
question explicitly anywhere outside of the compiler heuristics.

R=mvstanton@chromium.org

Review-Url: https://chromiumcodereview.appspot.com/2443573002
Cr-Commit-Position: refs/heads/master@{#40507}

The current method of marking functions for optimization, which replaces
the JSFunction's code object with one that triggers optimization, would
never allow unnamed functions to be optimized. This is an issue for a
style of programming which heavily relies on passing around closures.

This patch sets a bit on the SharedFunctionInfo when a JSFunction is
marked. When another JSFunction referring to the same SharedFunctionInfo
is lazily compiled, it immediately triggers a non-concurrent optimize.

BUG=v8:5512

Review-Url: https://chromiumcodereview.appspot.com/2437043002
Cr-Commit-Position: refs/heads/master@{#40506}

Revert of [ic] Support data handlers that represent simple field stores. (patchset #1 id:20001 of https://chromiumcodereview.appspot.com/2438553003/ )

Reason for revert:
http://build.chromium.org/p/client.v8/builders/V8%20Mac%20GC%20Stress/builds/9299

Original issue's description:
> [ic] Support data handlers that represent simple field stores.
>
> BUG=

TBR=jkummerow@chromium.org,ishell@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review-Url: https://chromiumcodereview.appspot.com/2439053002
Cr-Commit-Position: refs/heads/master@{#40505}

This adds a fast-path for calls to RegExp.prototype[@@replace] for cases in
which the given regexp is unmodified and global, and the given replace argument
is callable.

The fast-path implementation itself is almost identical to the original JS
implementation except that it currently does not reuse result_array.

SunSpider/unpack-code relies heavily on this codepath.

BUG=v8:5339

Review-Url: https://chromiumcodereview.appspot.com/2433923003
Cr-Commit-Position: refs/heads/master@{#40504}