This CL adds a new header src/debug/interface-types.h, moves the
definition of Location from the debug-interface.h to this new header,
and adds a new definition for the WasmDisassembly types.
This allows to use the types in other implementation files or headers
without having to include the entire debug-interface.h, reducing build
dependencies and compile time (especially for incremental builds).

The WasmDisassembly type replaces the old
std::pair<std::string, std::vector<std::tuple<...>>>, which was a bit
hard to unravel.

R=yangguo@chromium.org, kozyatinskiy@chromium.org, titzer@chromium.org

Review-Url: https://codereview.chromium.org/2529383002
Cr-Commit-Position: refs/heads/master@{#41488}

Short living closures are very common in Node.js. This benchmark tracks progress
as we move the optimizations that are currently only behind
--mark_shared_functions_for_tier_up to the default settings.

BUG=v8:5512

Committed: https://crrev.com/f277da2a00cfd27d44a33a70213a65bd82d0bc95
Review-Url: https://codereview.chromium.org/2525053002
Cr-Original-Commit-Position: refs/heads/master@{#41246}
Cr-Commit-Position: refs/heads/master@{#41487}

R=bmeurer@chromium.org

BUG=

Review-Url: https://codereview.chromium.org/2549093002
Cr-Commit-Position: refs/heads/master@{#41486}

This allows us to optimise the bytecode liveness analysis to jump
directly to previously seen indices. The analysis is optimised to store
a stack of loop ends (JumpLoop bytecode indices), and iterate through
these indices directly rather than looping through the bytecode array to
find them.

Review-Url: https://codereview.chromium.org/2536653003
Cr-Commit-Position: refs/heads/master@{#41485}

Don't unconditionally assume that Tagged->Word32 changes are always
truncating independent of the type of the input. Work-around the
remaining issues with for-in by properly renaming the index if it's
not already of appropriate type (happens with generators or OSR).

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2545393002
Cr-Commit-Position: refs/heads/master@{#41484}

1) CSA::Select() receives lambdas for generating true/false values.
   The representation parameter made mandatory.
2) CSA::Select[Type]Constant() methods receive true/false nodes directly.
   These methods are intended to be used for generating "selects" when
   true/false values are already computed.

BUG=

Review-Url: https://codereview.chromium.org/2550683003
Cr-Commit-Position: refs/heads/master@{#41483}

The changes are:
1) Pass lambdas as const references to avoid unnecessary copying.
2) Remove CodeStubAssembler* parameter from loop bodies and let the lambdas
   capture the right assembler instead. It makes the loop body code look
   uniform with the surrounding code and unblocks splitting of a CSA
   into different classes.

BUG=

Review-Url: https://codereview.chromium.org/2535753012
Cr-Commit-Position: refs/heads/master@{#41482}

Review-Url: https://codereview.chromium.org/2521313002
Cr-Commit-Position: refs/heads/master@{#41481}

Now that the BASE_EMBEDDED macro is gone, this should be safe.

Originally removed in: https://codereview.chromium.org/2532103004/

Review-Url: https://codereview.chromium.org/2545723002
Cr-Commit-Position: refs/heads/master@{#41480}

This reverts commit aea4f1a7.

Reason: performance regression on benchmarks (crbug.com/671118).

BUG=chromium:671118,chromium:613518
TBR=hpayer@chromium.org

Review-Url: https://codereview.chromium.org/2549053002
Cr-Commit-Position: refs/heads/master@{#41479}

This removes support for accessing super properties (load, store & call)
from the {FullCodeGenerator}. Consequently optimized code containing
such constructs must use the {BytecodeGraphBuilder} and can no longer
use the {AstGraphBuilder} for graph building.

R=bmeurer@chromium.org
BUG=v8:5657

Review-Url: https://codereview.chromium.org/2544123004
Cr-Commit-Position: refs/heads/master@{#41478}

R=clemensh@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2551463002
Cr-Commit-Position: refs/heads/master@{#41477}

This was somehow missing so far. With this CL, we can disassembly all
functions on AngryBots.

R=titzer@chromium.org, rossberg@chromium.org
BUG=chromium:659715

Review-Url: https://codereview.chromium.org/2552643002
Cr-Commit-Position: refs/heads/master@{#41476}

The bot will be renamed in a follow up, when the infra side is renamed.

TBR=zhengxing.li@intel.com, vogelheim@chromium.org
NOTRY=true

Review-Url: https://codereview.chromium.org/2549033002
Cr-Commit-Position: refs/heads/master@{#41475}

Port of d4f01b8a

BUG=

Review-Url: https://codereview.chromium.org/2550503003
Cr-Commit-Position: refs/heads/master@{#41474}

That ADD builtin is gone for a long time.

R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2547423002
Cr-Commit-Position: refs/heads/master@{#41473}

When enforcing Ignition+TurboFan for a function literal during
AstNumbering, make sure to print the bailout reason with --trace-opt
to make it easier to figure out what caused the bailout.

BUG=chromium:670691
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2550093002
Cr-Commit-Position: refs/heads/master@{#41472}

The current Array.prototype.sort implementation is pretty sensitive to
compiler changes, i.e. switching to I+TF completely, so refactor it a
bit so that it can stay with FCG+CS for now.

Middle-term the Array builtins need to be refactored to TurboFan
builtins anyways.

BUG=chromium:670691,v8:5666
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2553523002
Cr-Commit-Position: refs/heads/master@{#41471}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/83f770a..0676437

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/d48a09f..7f925e3

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2551003002
Cr-Commit-Position: refs/heads/master@{#41470}

Review-Url: https://codereview.chromium.org/2546113002
Cr-Commit-Position: refs/heads/master@{#41469}

Add support to lower the %_DebugIsActive intrinsic during
JSIntrinsicLowering instead of always going to the runtime
for this.

This addresses part of the Bluebird regression caused by
sending let and const to TurboFan and Ignition.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2550043002
Cr-Commit-Position: refs/heads/master@{#41468}

This should recover part of the Bluebird regression caused by
sending let/const to TurboFan+Ignition.

R=gsathya@chromium.org

Review-Url: https://codereview.chromium.org/2552583002
Cr-Commit-Position: refs/heads/master@{#41467}

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/ca719be..627b0d9

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2545293002
Cr-Commit-Position: refs/heads/master@{#41466}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/a8dd8be..83f770a

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/36566dd..ca719be

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/f4b896b..d48a09f

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2550913002
Cr-Commit-Position: refs/heads/master@{#41465}

In the current implementation, WasmInstanceWrapper is allocated after the imports for the instance are processed, and before the InstanceFinalizer callback is associated with the instance. This raises the possibility of triggering a gc in the middle of the instantiate flow which is incorrect.

BUG=5707

R=titzer@chromium.org, petermarshall@chromium.org

Review-Url: https://codereview.chromium.org/2544273002
Cr-Commit-Position: refs/heads/master@{#41464}

Several cleanups to the output of the debug-only --print-scopes flag:
  - Function name variable only printed once
  - Only print headers for sections of variables that are non-empty
  - Assume Variables stored in Scope::variables_ are never null

R=verwaest@chromium.org

Review-Url: https://codereview.chromium.org/2544063004
Cr-Commit-Position: refs/heads/master@{#41463}

BUG=chromium:665398

Review-Url: https://codereview.chromium.org/2549653002
Cr-Commit-Position: refs/heads/master@{#41462}

Revert of [typedarrays] remove invalid optimization in NAMEConstructor() (patchset #1 id:1 of https://codereview.chromium.org/2544503002/ )

Reason for revert:
Speculative revert for causing timeouts on Win Debug gpu fyi bot

Nothing else looks even remotely relevant in the list of changes.
Will reland if this doesn't fix the issues.

BUG=670396

Original issue's description:
> [typedarrays] remove invalid optimization in NAMEConstructor()
>
> Before, we were treating objects with the builtin ArrayValues iterator
> method as array-like, where the iterator would iterate through to the
> full length of the object.
>
> This optimization was not sound, because it does not ensure that the
> next method hasn't been modified. Even if it hasn't been modified,
> it's entirely possible to be modified during iteration. Thus, this
> optimization has been removed due to its observability.
>
> BUG=v8:5699
> R=littledan@chromium.org, cbruni@chromium.org
>
> Committed: https://crrev.com/77df8c67d9609ada3b7d79e8e6d33f198bbad5a1
> Cr-Commit-Position: refs/heads/master@{#41394}

TBR=cbruni@chromium.org,littledan@chromium.org,caitp@igalia.com
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=v8:5699

Review-Url: https://codereview.chromium.org/2548583003
Cr-Commit-Position: refs/heads/master@{#41461}

BUG=670470
R=dpranke@chromium.org

Review-Url: https://codereview.chromium.org/2544053002
Cr-Commit-Position: refs/heads/master@{#41460}

BUG=chromium:613518

Review-Url: https://codereview.chromium.org/2407153002
Cr-Commit-Position: refs/heads/master@{#41459}

... even when a receiver is not an object.

BUG=v8:5697

Review-Url: https://codereview.chromium.org/2548753003
Cr-Commit-Position: refs/heads/master@{#41458}

TBR=machenbach@chromium.org
BUG=v8:5666

Review-Url: https://codereview.chromium.org/2542843008
Cr-Commit-Position: refs/heads/master@{#41457}

BUG=v8:5708

Review-Url: https://codereview.chromium.org/2548813002
Cr-Commit-Position: refs/heads/master@{#41456}

Turbofan uses 64-bit load followed by 32 bit arithmetic shift when
loading higher 32 bits of 64-bit value. We simplify this
by loading higher 32 bits directly.

BUG=

Review-Url: https://codereview.chromium.org/2532333003
Cr-Commit-Position: refs/heads/master@{#41455}

R=machenbach@chromium.org,jarin@chromium.org
BUG=v8:5710

Review-Url: https://codereview.chromium.org/2551433002
Cr-Commit-Position: refs/heads/master@{#41454}

BUG=v8:4947

Review-Url: https://codereview.chromium.org/2547493002
Cr-Commit-Position: refs/heads/master@{#41453}

This apparently gradually fell out of use after the more general
Token::IsIdentifer was introduced, and whoever left last forgot to
turn out the lights.

The only remaining use was in an assertion in DeclareLabel, but
meanwhile DeclareLabel is only called if IsIdentifier. I added re-formulated assertions, just in case.

R=verwaest@chromium.org
BUG=v8:4947

Review-Url: https://codereview.chromium.org/2549493002
Cr-Commit-Position: refs/heads/master@{#41452}

This enables {FLAG_debug_code} by default in debug builds. The advantage
is that generated code contained within the snapshot will contain such
debug code. Before we would only get coverage for these pieces with the
no-snapshot builds, which have a meager coverage. One can still pass the
inverse --no-debug-code flag to ensure generated code remains readable
within debug builds as well.

R=machenbach@chromium.org

Review-Url: https://codereview.chromium.org/2528913002
Cr-Commit-Position: refs/heads/master@{#41451}

Since we don't pass references to this constant to the DCHECKs any more
(see http://crrev.com/2524093002), the constant can now be initialized
in the header, reducing code size and increasing performance.

Before the mentioned change in CHECK/DCHECK, this caused link errors.

R=ishell@chromium.org
CC=jgruber@chromium.org
BUG=v8:5684

Review-Url: https://codereview.chromium.org/2541533002
Cr-Commit-Position: refs/heads/master@{#41450}

[ic] Use validity cells to protect keyed element stores against object's prototype chain modifications.

... instead of clearing of all the KeyedStoreICs which didn't always work.

BUG=chromium:662907, chromium:669411, v8:5561
TBR=verwaest@chromium.org, bmeurer@chromium.org

Committed: https://crrev.com/a39522f44f7e0be4686831688917e9675255dcaf
Review-Url: https://codereview.chromium.org/2534613002
Cr-Original-Commit-Position: refs/heads/master@{#41332}
Cr-Commit-Position: refs/heads/master@{#41449}