The scavenger should never consider mark bits for promotion/copy as this creates
weird livetimes at the start of incremental marking. E.g. consider an object
marked black by the marker at the start of incremental marking. A scavenge would
promote it to the old generation although it could --and for short-living
objects actually does-- become unreachable during marking

Also, keeping this invariant significantly simplifies young generation mark
compacting as we can compare against the scavenging decision without keeping
different sets of markbits.

BUG=chromium:651354
R=hpayer@chromium.org

Review-Url: https://codereview.chromium.org/2397713002
Cr-Commit-Position: refs/heads/master@{#40026}

... because the latter automatically respects the desired calling convention.

BUG=v8:5408

Review-Url: https://codereview.chromium.org/2398683004
Cr-Commit-Position: refs/heads/master@{#40025}

because ownership over it is not obviously clear
and leads to errors.

Review-Url: https://codereview.chromium.org/2366283003
Cr-Commit-Position: refs/heads/master@{#40024}

... because the latter automatically respects the desired calling convention.

BUG=v8:5408

Review-Url: https://codereview.chromium.org/2396023002
Cr-Commit-Position: refs/heads/master@{#40023}

Emit code like this

  cmpq reg, [kRootRegister + offset]

when selecting instructions for comparisons with immortal, immovable
roots. This reduces register pressure as we don't need to load those
roots into registers first.

R=jarin@chromium.org
TBR=hpayer@chromium.org

Review-Url: https://codereview.chromium.org/2396923003
Cr-Commit-Position: refs/heads/master@{#40022}

Reland of "[turbofan] Osr value typing + dynamic type checks on entry. (patchset #5 id:80001 of https://codereview.chromium.org/2384113002/ )"

Fixes:

- Remove OsrGuards on frame specialization (for asm.js).
- Handle the rename in the walk for native context.
- Fix LoadContext effect wiring for Osr context chains.

Review-Url: https://codereview.chromium.org/2388303006
Cr-Commit-Position: refs/heads/master@{#40021}

Specifically an attempt to address a 3.5% regression on the total load
time on cnn introduced by https://codereview.chromium.org/2113673002.

Non-refactoring effect of this CL is to reduce the number of branches in
CodeStubAssembler-generated loops iterating over FixedArrays from
two to one.

LOG=N
BUG=v8:5423

Review-Url: https://codereview.chromium.org/2380953002
Cr-Commit-Position: refs/heads/master@{#40020}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/475d5b3..67604e1

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/buildtools/+log/5fd6695..39b1db2

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2397993002
Cr-Commit-Position: refs/heads/master@{#40019}

When we create native promises as part of PromiseThen, we don't have
to create resolving closures. The closure will only ever be called
once from PromiseHandle, therefore we don't need the alreadyResolved
check.

This results in a 21.76% improvement in the bluebird benchmark
over 5 runs.

BUG=v8:5046

Review-Url: https://codereview.chromium.org/2396763002
Cr-Commit-Position: refs/heads/master@{#40018}

Port 7a82be3d

Original commit message:

    The duplicated enum values are only used by the FastNewClosureStub,
    so inline them there, with the help of one new constant (kFunctionKindShift)
    in SharedFunctionInfo.

R=adamk@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, bjaideep@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com
BUG=

Review-Url: https://codereview.chromium.org/2391343003
Cr-Commit-Position: refs/heads/master@{#40017}

v8::Integer::Value() method returns int64 but all scriptIds are 32 bit based. We can safely cast int64 into int here to make compilers happy.

R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2394973002
Cr-Commit-Position: refs/heads/master@{#40016}

Adds string type feedback to Ignition's AddWithFeedback code stub, for now only
adding a special case for when both lhs and rhs are strings. This improves
octane's splay by >100%.

BUG=v8:5400

Committed: https://crrev.com/fb4ae2239d37adaf0321165034050316914de708
Committed: https://crrev.com/bf1a94f1b269914856a8c8763fd282367f066c67
Review-Url: https://codereview.chromium.org/2392533002
Cr-Original-Original-Commit-Position: refs/heads/master@{#39987}
Cr-Original-Commit-Position: refs/heads/master@{#39996}
Cr-Commit-Position: refs/heads/master@{#40015}

On PPC64 linux the OS page size is 64KB, therefore when the
snapshot is created the serialized heap already has LO_SPACE
allocated(the allocation goes beyond the 1st page of
CODE_SPACE and hence LO_SPACE is allocated).
I've updated the testcase to check if the delta
of the LO_SPACE is zero.

R=mlippautz@chromium.org, ulan@chromium.org, vogelheim@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2394893002
Cr-Commit-Position: refs/heads/master@{#40014}

Allow fround to take values without dots for globals (the spec allows this
subtly).

Drop over-restrictive assert preventing floating point globals from working.

BUG=v8:4203
R=jpp@chromium.org,aseemgarg@chromium.org

Review-Url: https://codereview.chromium.org/2397823003
Cr-Commit-Position: refs/heads/master@{#40013}

GCC on S390 31-bit treats size_t as 'long unsigned int', which
is incompatible with %d format specifier that expects an 'int'.
Using the appropriate macro (PRIuS) instead.

R=mlippautz@chromium.org, hpayer@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2398703002
Cr-Commit-Position: refs/heads/master@{#40012}

Review-Url: https://codereview.chromium.org/2376613003
Cr-Commit-Position: refs/heads/master@{#40011}

NOTRY=true
NOTREECHECKS=true
NOPRESUBMIT=true
TBR=hablich@chromium.org

Review-Url: https://codereview.chromium.org/2392463007
Cr-Commit-Position: refs/heads/master@{#40010}

Revert of Reland "Turn libbase into a component" (patchset #1 id:1 of https://codereview.chromium.org/2395553002/ )

Reason for revert:
Speculative revert due to very strange-looking win/dbg failures
which reference SignedDivisionByConstant:

https://build.chromium.org/p/client.v8/builders/V8%20Win64%20-%20debug/builds/12736

Original issue's description:
> Reland "Turn libbase into a component"
>
> Original issue's description:
> > Turn libbase into a component
> >
> > This is a precondition for turning libplatform into a component
> >
> > BUG=v8:5412
> > R=jgruber@chromium.org,machenbach@chromium.org
> > CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_chromium_compile_
> dbg_ng;master.tryserver.chromium.android:android_clang_dbg_recipe
> >
> > Committed: https://crrev.com/614e615775f732d71b5ee94ed29737d8de687104
> > Cr-Commit-Position: refs/heads/master@{#39950}
>
> BUG=v8:5412
> TBR=jgruber@chromium.org,machenbach@chromium.org
> CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_chromium_compile_dbg_ng;master.tryserver.chromium.android:android_clang_dbg_recipe;master.tryserver.chromium.mac:mac_chromium_compile_dbg_ng
>
> Committed: https://crrev.com/17cb51254cafa932025e9980b60f89f756d411cb
> Cr-Commit-Position: refs/heads/master@{#39969}

TBR=jgruber@chromium.org,machenbach@chromium.org,jochen@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5412

Review-Url: https://codereview.chromium.org/2396933002
Cr-Commit-Position: refs/heads/master@{#40009}

Reland https://codereview.chromium.org/2373983004/, reverted in
4e5a4d93.

Reason: CL is not responsible for Win32 Debug failures (see https://build.chromium.org/p/client.v8/builders/V8%20Win32%20-%20debug/builds/5031)

------------------------------------------------------------------------------

Implement the logic for StringIterator.prototype.next in the JSBuiltinReducer in order to allow inlining when the receiver is a JS_STRING_ITERATOR_TYPE map, built ontop of the SimplifiedOperators StringCharCodeAt and the newly added StringFromCodePoint.

Also introduces a new StringFromCodePoint simplified op which may be useful for other String builtins, such as String.fromCodePoint()

BUG=v8:5388
TBR=bmeurer@chromium.org, mstarzinger@chromium.org

Review-Url: https://codereview.chromium.org/2394823003
Cr-Commit-Position: refs/heads/master@{#40008}

BUG=chromium:496666
R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2391323002
Cr-Commit-Position: refs/heads/master@{#40007}

An attempt to fix memory regression (r38047) caused another regression
because custom capacity chosen for names dictionary implied reallocations
during initialization in some cases.

BUG=chromium:625894,chromium:632231

Review-Url: https://codereview.chromium.org/2394873002
Cr-Commit-Position: refs/heads/master@{#40006}

The duplicated enum values are only used by the FastNewClosureStub,
so inline them there, with the help of one new constant (kFunctionKindShift)
in SharedFunctionInfo.

Review-Url: https://codereview.chromium.org/2390043003
Cr-Commit-Position: refs/heads/master@{#40005}

R=jochen@chromium.org
BUG=chromium:651333, v8:4947

Review-Url: https://codereview.chromium.org/2391273002
Cr-Commit-Position: refs/heads/master@{#40004}

BUG=chromium:635948
R=dgozman@chromium.org,machenbach@chromium.org

Review-Url: https://codereview.chromium.org/2389133004
Cr-Commit-Position: refs/heads/master@{#40003}

BUG=v8:4280

Review-Url: https://codereview.chromium.org/2384123002
Cr-Commit-Position: refs/heads/master@{#40002}

Also get rid of useless kMaybeReg type.

BUG=v8:4280

Review-Url: https://codereview.chromium.org/2382273002
Cr-Commit-Position: refs/heads/master@{#40001}

Revert of [interpreter] Add string type feedback to add (patchset #3 id:40001 of https://codereview.chromium.org/2392533002/ )

Reason for revert:
Broke the tree again, for no obvious reason :/

Original issue's description:
> [interpreter] Add string type feedback to add
>
> Adds string type feedback to Ignition's AddWithFeedback code stub, for now only
> adding a special case for when both lhs and rhs are strings. This improves
> octane's splay by >100%.
>
> BUG=v8:5400
>
> Committed: https://crrev.com/fb4ae2239d37adaf0321165034050316914de708
> Committed: https://crrev.com/bf1a94f1b269914856a8c8763fd282367f066c67
> Cr-Original-Commit-Position: refs/heads/master@{#39987}
> Cr-Commit-Position: refs/heads/master@{#39996}

TBR=rmcilroy@chromium.org,mythria@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5400

Review-Url: https://codereview.chromium.org/2393193002
Cr-Commit-Position: refs/heads/master@{#40000}

This change to run-perf.sh ensures that command line arguments are
prepended rather than appended to the passed in command. This is to
ensure that the arguments to d8 aren't accidentally passed through to
the js instead, as would be in the case:

tools/run-perf.sh d8 main.js -- --js-arg

A real-life example is passing --predictable to Octane's run.js

Review-Url: https://codereview.chromium.org/2391193003
Cr-Commit-Position: refs/heads/master@{#39999}

BUG=chromium:635948
R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2384373002
Cr-Commit-Position: refs/heads/master@{#39998}

... by passing a field offset as a runtime parameter.

This CL also introduces a StoreMapStub - a special case of a store transition
that used to be handled by old StoreTransitionStub.

BUG=chromium:648545

Review-Url: https://codereview.chromium.org/2397573004
Cr-Commit-Position: refs/heads/master@{#39997}

Adds string type feedback to Ignition's AddWithFeedback code stub, for now only
adding a special case for when both lhs and rhs are strings. This improves
octane's splay by >100%.

BUG=v8:5400

Committed: https://crrev.com/fb4ae2239d37adaf0321165034050316914de708
Review-Url: https://codereview.chromium.org/2392533002
Cr-Original-Commit-Position: refs/heads/master@{#39987}
Cr-Commit-Position: refs/heads/master@{#39996}

Revert of [turbofan] inline %StringIteratorPrototype%.next in JSBuiltinReducer. (patchset #12 id:210001 of https://codereview.chromium.org/2373983004/ )

Reason for revert:
[Sheriff] Speculative revert for win dbg: https://build.chromium.org/p/client.v8/builders/V8%20Win32%20-%20debug/builds/5029

Or we have an infra problem. Manual build before seems fine:
https://build.chromium.org/p/client.v8/builders/V8%20Win32%20-%20debug/builds/5030

Original issue's description:
> [turbofan] inline %StringIteratorPrototype%.next in JSBuiltinReducer.
>
> Implement the logic for StringIterator.prototype.next in the JSBuiltinReducer in order to allow inlining when the receiver is a JS_STRING_ITERATOR_TYPE map, built ontop of the SimplifiedOperators StringCharCodeAt and the newly added StringFromCodePoint.
>
> Also introduces a new StringFromCodePoint simplified op which may be useful for other String builtins, such as String.fromCodePoint()
>
> BUG=v8:5388
> R=bmeurer@chromium.org, mstarzinger@chromium.org
>
> Committed: https://crrev.com/aed32e0f22353527993de8bceaf246fc744558f5
> Cr-Commit-Position: refs/heads/master@{#39994}

TBR=bmeurer@chromium.org,mvstanton@chromium.org,caitp@igalia.com
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5388

Review-Url: https://codereview.chromium.org/2397753003
Cr-Commit-Position: refs/heads/master@{#39995}

Implement the logic for StringIterator.prototype.next in the JSBuiltinReducer in order to allow inlining when the receiver is a JS_STRING_ITERATOR_TYPE map, built ontop of the SimplifiedOperators StringCharCodeAt and the newly added StringFromCodePoint.

Also introduces a new StringFromCodePoint simplified op which may be useful for other String builtins, such as String.fromCodePoint()

BUG=v8:5388
R=bmeurer@chromium.org, mstarzinger@chromium.org

Review-Url: https://codereview.chromium.org/2373983004
Cr-Commit-Position: refs/heads/master@{#39994}

Properly fold external reference access into memory operands whenever
possible, i.e. for accessing the allocation top/limit, similar to what
we do in Crankshaft and hand-written native code. This only works when
the serializer is disabled, i.e. doesn't apply to the stubs in the
snapshot (for now). This reduces register pressure especially around
allocations where we'd currently need two registers to hold both the
allocation top and limit pointers in registers (on x64).

R=epertoso@chromium.org

Review-Url: https://codereview.chromium.org/2398603002
Cr-Commit-Position: refs/heads/master@{#39993}

This makes sure we run the module tests against all variants using
Ignition as the first compilation tier. It will henceforth extend the
test coverage to the BytecodeGraphBuilder as well.

R=neis@chromium.org

Review-Url: https://codereview.chromium.org/2397733002
Cr-Commit-Position: refs/heads/master@{#39992}

Revert of [interpreter] Add string type feedback to add (patchset #3 id:40001 of https://codereview.chromium.org/2392533002/ )

Reason for revert:
Fails unittests on win32 debug:
https://build.chromium.org/p/client.v8/builders/V8%20Win32%20-%20debug/builds/5026

Original issue's description:
> [interpreter] Add string type feedback to add
>
> Adds string type feedback to Ignition's AddWithFeedback code stub, for now only
> adding a special case for when both lhs and rhs are strings. This improves
> octane's splay by >100%.
>
> BUG=v8:5400
>
> Committed: https://crrev.com/fb4ae2239d37adaf0321165034050316914de708
> Cr-Commit-Position: refs/heads/master@{#39987}

TBR=rmcilroy@chromium.org,mythria@chromium.org,leszeks@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5400

Review-Url: https://codereview.chromium.org/2395743004
Cr-Commit-Position: refs/heads/master@{#39991}

Reland of [heap] Simplify marking of JSFunction and SFI (patchset #1 id:1 of https://codereview.chromium.org/2389963007/ )

Reason for revert:
Wrong culprit as this was already broken before.

Original issue's description:
> Revert of [heap] Simplify marking of JSFunction and SFI (patchset #3 id:40001 of https://codereview.chromium.org/2389183002/ )
>
> Reason for revert:
> Broke GCStress.
>
> Original issue's description:
> > [heap] Simplify marking of JSFunction and SFI
> >
> > BUG=chromium:651828
> >
> > Committed: https://crrev.com/4d45ed4597d537cf9624cb6683dc4bd646d11242
> > Cr-Commit-Position: refs/heads/master@{#39975}
>
> TBR=hpayer@chromium.org,mlippautz@chromium.org
> # Skipping CQ checks because original CL landed less than 1 days ago.
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=chromium:651828
>
> Committed: https://crrev.com/5295d7a463cbcc78a4b694a7fb84af8e8e400303
> Cr-Commit-Position: refs/heads/master@{#39983}

TBR=hpayer@chromium.org,epertoso@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:651828

Review-Url: https://codereview.chromium.org/2390373004
Cr-Commit-Position: refs/heads/master@{#39990}

BUG=v8:5451
NOTRY=true
TBR=titzer@chromium.org, ahaas@chromium.org, rmcilroy@chromium.org

Review-Url: https://codereview.chromium.org/2389703006
Cr-Commit-Position: refs/heads/master@{#39989}

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2395743003
Cr-Commit-Position: refs/heads/master@{#39988}

Adds string type feedback to Ignition's AddWithFeedback code stub, for now only
adding a special case for when both lhs and rhs are strings. This improves
octane's splay by >100%.

BUG=v8:5400

Review-Url: https://codereview.chromium.org/2392533002
Cr-Commit-Position: refs/heads/master@{#39987}