Bug: chromium:720477
Change-Id: I090168c575c41b7038af5dfba6cd8973d1154c51
Reviewed-on: https://chromium-review.googlesource.com/501790Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45241}

BUG=chromium:651354

Review-Url: https://codereview.chromium.org/2872063003
Cr-Commit-Position: refs/heads/master@{#45235}

Since the feedback vector is itself a native context structure, why
not store optimized code for a function in there rather than in
a map from native context to code? This allows us to get rid of
the optimized code map in the SharedFunctionInfo, saving a pointer,
and making lookup of any optimized code quicker.

Original patch by Michael Stanton <mvstanton@chromium.org>

BUG=v8:6246,chromium:718891
TBR=yangguo@chromium.org,ulan@chromium.org

Change-Id: I3bb9ec0cfff32e667cca0e1403f964f33a6958a6
Reviewed-on: https://chromium-review.googlesource.com/500134Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45234}

[turbofan] [builtins] Unify construct builtins for JS functions and classes and add inlining and deoptimizer support

BUG=v8:6180
R=mstarzinger@chromium.org

Change-Id: Iac5782a0f6b0ff92293421656d907073cfc3f5dd
Reviewed-on: https://chromium-review.googlesource.com/489525
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45232}

When black allocation is turned on at deserialization time, then
slots in deserialized objects have to be visited by the incremental
marker. For spaces with reservations, this has always been done; for
large object space with its special handling, this patch adds it.

Additionally, we must ensure that no incremental steps that might
cause incremental marking to finish are performed while there is an
AlwaysAllocateScope around.

BUG=chromium:718859

Review-Url: https://codereview.chromium.org/2868103002
Cr-Commit-Position: refs/heads/master@{#45231}

BUG=chromium:694255

Review-Url: https://codereview.chromium.org/2872263002
Cr-Commit-Position: refs/heads/master@{#45230}

This reverts commit 8f89e286.

Review-Url: https://codereview.chromium.org/2876503002
Cr-Commit-Position: refs/heads/master@{#45229}

Revert of [heap] Verify remembered set for objects in the old generation. (patchset #3 id:40001 of https://codereview.chromium.org/2868053002/ )

Reason for revert:
buildbot failures

Original issue's description:
> [heap] Verify remembered set for objects in the old generation.
>
> Review-Url: https://codereview.chromium.org/2868053002
> Cr-Commit-Position: refs/heads/master@{#45225}
> Committed: https://chromium.googlesource.com/v8/v8/+/755a809ee5f91f5f63d5f056af37090960be002c

TBR=mlippautz@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2870413002
Cr-Commit-Position: refs/heads/master@{#45227}

Review-Url: https://codereview.chromium.org/2868053002
Cr-Commit-Position: refs/heads/master@{#45225}

BUG=chromium:651354

Review-Url: https://codereview.chromium.org/2855143003
Cr-Commit-Position: refs/heads/master@{#45223}

BUG=chromium:651354

Review-Url: https://codereview.chromium.org/2870683003
Cr-Commit-Position: refs/heads/master@{#45184}

This patch also makes concurrent marking visitor loads atomic.

BUG=chromium:694255

Review-Url: https://codereview.chromium.org/2872443003
Cr-Commit-Position: refs/heads/master@{#45179}

This reverts commit 662aa425.

Reason for revert: Crashing on Canary
BUG=chromium:718891

Original change's description:
> Reland: [TypeFeedbackVector] Store optimized code in the vector
> 
> Since the feedback vector is itself a native context structure, why
> not store optimized code for a function in there rather than in
> a map from native context to code? This allows us to get rid of
> the optimized code map in the SharedFunctionInfo, saving a pointer,
> and making lookup of any optimized code quicker.
> 
> Original patch by Michael Stanton <mvstanton@chromium.org>
> 
> BUG=v8:6246
> TBR=yangguo@chromium.org,ulan@chromium.org
> 
> Change-Id: Ic83e4011148164ef080c63215a0c77f1dfb7f327
> Reviewed-on: https://chromium-review.googlesource.com/494487
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#45084}

TBR=ulan@chromium.org,rmcilroy@chromium.org,yangguo@chromium.org,jarin@chromium.org
# Not skipping CQ checks because original CL landed > 1 day ago.
BUG=v8:6246

Change-Id: Idab648d6fe260862c2a0e35366df19dcecf13a82
Reviewed-on: https://chromium-review.googlesource.com/498633Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45174}

BUG=chromium:651354

Review-Url: https://codereview.chromium.org/2871543002
Cr-Commit-Position: refs/heads/master@{#45159}

The concurrent marker now colors objects grey and black using
the atomic markbit operations.

The heap visitor is changed in two ways:
1) It iterates the map pointer of each object.
2) It guards object visitation with a predicate, which is overridden
in the concurrent marker with the result of GreyToBlack transition.

BUG=chromium:694255
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_chromium_rel_ng

Review-Url: https://codereview.chromium.org/2866473003
Cr-Commit-Position: refs/heads/master@{#45144}

Currently the VisitObject function iterates the object and then colors
it black. This does not work well with concurrent marking. The function
should instead first try to mark the object black and iterate its body
only if the color transition succeeds.

BUG=chromium:694255
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_chromium_rel_ng

Review-Url: https://codereview.chromium.org/2863933002
Cr-Commit-Position: refs/heads/master@{#45139}

concurrent marking is enabled.

This patch adds kAtomicity flag to IncrementalMarking that is set
depending on the concurrent marking compile time flag.

BUG=chromium:694255
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_chromium_rel_ng

Review-Url: https://codereview.chromium.org/2858343003
Cr-Commit-Position: refs/heads/master@{#45138}

Now non-atomic color transition operations return a boolean indicating
whether the transition succeeded or not.

This allows to replace color check and transition operations with a
single transition operation. For example:

if (IsWhite(object)) {
  WhiteToBlack(object);
  Foo();
}

becomes

if (WhiteToBlack(object)) {
  Foo();
}

BUG=chromium:694255
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_chromium_rel_ng

Review-Url: https://codereview.chromium.org/2863703004
Cr-Commit-Position: refs/heads/master@{#45136}

BUG=chromium:718484

Review-Url: https://codereview.chromium.org/2863943002
Cr-Commit-Position: refs/heads/master@{#45128}

Revert of [heap] Reland "Make non-atomic markbit operations consistent with atomic ones." (patchset #2 id:20001 of https://codereview.chromium.org/2860323003/ )

Reason for revert:
box2d failures on buildbot

Original issue's description:
> [heap] Reland "Make non-atomic markbit operations consistent with atomic ones."
>
> Now non-atomic color transition operations return a boolean indicating
> whether the transition succeeded or not.
>
> This allows to replace color check and transition operations with a
> single transition operation. For example:
>
> if (IsWhite(object)) {
>   WhiteToBlack(object);
>   Foo();
> }
>
> becomes
>
> if (WhiteToBlack(object)) {
>   Foo();
> }
>
> BUG=chromium:694255
>
> CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_chromium_rel_ng
>
> Review-Url: https://codereview.chromium.org/2860323003
> Cr-Commit-Position: refs/heads/master@{#45123}
> Committed: https://chromium.googlesource.com/v8/v8/+/c0a65cd295301f334e2bbfcce46a937cd708beec

TBR=mlippautz@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:694255

Review-Url: https://codereview.chromium.org/2863953002
Cr-Commit-Position: refs/heads/master@{#45127}

Now non-atomic color transition operations return a boolean indicating
whether the transition succeeded or not.

This allows to replace color check and transition operations with a
single transition operation. For example:

if (IsWhite(object)) {
  WhiteToBlack(object);
  Foo();
}

becomes

if (WhiteToBlack(object)) {
  Foo();
}

BUG=chromium:694255

CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_chromium_rel_ng

Review-Url: https://codereview.chromium.org/2860323003
Cr-Commit-Position: refs/heads/master@{#45123}

Revert "[heap] Make non-atomic markbit operations consistent with atomic ones."

This reverts commit dd37366f

Revert "[heap] Use atomic marking operations in incremental marking if"

This reverts commit 1f2c3596

Revert "[heap] Prepare IncrementalMarking::VisitObject for concurrent marking."

This reverts commit 00d1e2cf

Revert "[heap] Use shared markbits in the concurrent marker."

This reverts commit b0db0541

https://codereview.chromium.org/2857713002 blocks the current roll:
https://codereview.chromium.org/2857423002/

Doesn't revert cleanly.

NOTRY=true
TBR=ulan@chromium.org

Bug: chromium:694255
Change-Id: Iada35af5c2529cd9e604802700604b16cc30aa2d
Reviewed-on: https://chromium-review.googlesource.com/497387Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45118}

The concurrent marker now colors objects grey and black using
the atomic markbit operations.

The heap visitor is changed in two ways:
1) It iterates the map pointer of each object.
2) It guards object visitation with a predicate, which is overridden
in the concurrent marker with the result of GreyToBlack transition.

BUG=chromium:694255

Review-Url: https://codereview.chromium.org/2855003004
Cr-Commit-Position: refs/heads/master@{#45099}

Currently the VisitObject function iterates the object and then colors
it black. This does not work well with concurrent marking. The function
should instead first try to mark the object black and iterate its body
only if the color transition succeeds.

BUG=chromium:694255

Review-Url: https://codereview.chromium.org/2853323003
Cr-Commit-Position: refs/heads/master@{#45095}

These wrappers wouldn't be found by the marker otherwise and are only
reported upon the next marking step or GC which potentially is already
too late; the embedder could've reclaimed those objects already.

BUG=chromium:717480

Review-Url: https://codereview.chromium.org/2860753003
Cr-Commit-Position: refs/heads/master@{#45094}

concurrent marking is enabled.

This patch adds kAtomicity flag to IncrementalMarking that is set
depending on the concurrent marking compile time flag.

BUG=chromium:694255

Review-Url: https://codereview.chromium.org/2857743002
Cr-Commit-Position: refs/heads/master@{#45091}

Now non-atomic color transition operations return a boolean indicating
whether the transition succeeded or not.

This allows to replace color check and transition operations with a
single transition operation. For example:

if (IsWhite(object)) {
  WhiteToBlack(object);
  Foo();
}

becomes

if (WhiteToBlack(object)) {
  Foo();
}

BUG=chromium:694255

Review-Url: https://codereview.chromium.org/2857713002
Cr-Commit-Position: refs/heads/master@{#45085}

Since the feedback vector is itself a native context structure, why
not store optimized code for a function in there rather than in
a map from native context to code? This allows us to get rid of
the optimized code map in the SharedFunctionInfo, saving a pointer,
and making lookup of any optimized code quicker.

Original patch by Michael Stanton <mvstanton@chromium.org>

BUG=v8:6246
TBR=yangguo@chromium.org,ulan@chromium.org

Change-Id: Ic83e4011148164ef080c63215a0c77f1dfb7f327
Reviewed-on: https://chromium-review.googlesource.com/494487Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45084}

BUG=v8:6343

Review-Url: https://codereview.chromium.org/2860043002
Cr-Commit-Position: refs/heads/master@{#45079}

BUG=v8:6343

Review-Url: https://codereview.chromium.org/2857213003
Cr-Commit-Position: refs/heads/master@{#45077}

In the spirit of the full MC, we evacuate and update pointers in parallel for
the young generation.

The collectors are connected during incremental marking when mark bits are
transferred from the young generation bitmap to the old generation bitmap.

The evacuation phase cannot (yet) move pages and relies completely on copying
objects.

BUG=chromium:651354

Review-Url: https://codereview.chromium.org/2796233003
Cr-Commit-Position: refs/heads/master@{#45074}

BUG=v8:6343

Review-Url: https://codereview.chromium.org/2861763002
Cr-Commit-Position: refs/heads/master@{#45073}

BUG=chromium:718013

Review-Url: https://codereview.chromium.org/2862533003
Cr-Commit-Position: refs/heads/master@{#45067}

There is no point in doing black allocation here as we then have to
iterate the objects for various reasons. The marker does the same work
but can be moved outside of the atomic pause.

BUG=chromium:581412

Review-Url: https://codereview.chromium.org/2862563002
Cr-Commit-Position: refs/heads/master@{#45063}

BUG=chromium:714207

Review-Url: https://codereview.chromium.org/2857003002
Cr-Commit-Position: refs/heads/master@{#45055}

We can use FinalizeIncrementalMarking instead since the only caller of
TryFinalizeIdleIncrementalMarking is IdleNotification, for which staying
within idle deadline is not critical.

This also fixes a bug caused by inconsistent code duplication in
finalization condition in the two functions.

BUG=v8:6325,chromium:715457

Review-Url: https://codereview.chromium.org/2851743002
Cr-Commit-Position: refs/heads/master@{#45054}

This patch adds a concurrent marking deque that exposes the same interface
for the main thread as the existing marking deque.

The matching interface makes the concurrent marking deque a drop-in
replacement for the sequential marking deque without any change in
mark-compactor and incremental marker.

BUG=chromium:694255

Review-Url: https://codereview.chromium.org/2810893002
Cr-Commit-Position: refs/heads/master@{#45042}

The existing formula returns non-sense when the old top is greater than
the current top.

BUG=chromium:694255

Review-Url: https://codereview.chromium.org/2850373003
Cr-Commit-Position: refs/heads/master@{#45037}

This introduces MarkingDeque::Update function that accepts a callback
and updates marking deque elements using the callback.

BUG=chromium:694255

Review-Url: https://codereview.chromium.org/2854063002
Cr-Commit-Position: refs/heads/master@{#45032}

BUG=chromium:694255

Review-Url: https://codereview.chromium.org/2852953004
Cr-Commit-Position: refs/heads/master@{#45030}