[runtime] Remove premature optimization from ToPrimitive.

The !IS_SPEC_OBJECT(x) check implies both IS_STRING(x) and
IS_SIMD_VALUE(x), and generates shorter/better code.  So we
can safely remove the redundant checks.

R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/1278873007

Cr-Commit-Position: refs/heads/master@{#30081}

[runtime] Simplify TO_INT32/TO_UINT32 abstract operations.

No need to provide TO_INT32/TO_UINT32 functions for every native
context, as they can be implemented in terms of TO_NUMBER more easily
and efficiently.

Also remove the obsolete TO_BOOLEAN_FUN_INDEX from the native contexts.

Review URL: https://codereview.chromium.org/1275013004

Cr-Commit-Position: refs/heads/master@{#30080}

Fasterify JSObject::UnregisterPrototypeUser

When a (prototype) map registers as a user of its own prototype, it now remembers the index in that prototype's registry where it is listed.
This remembered index is used on un-registration to find the right slot to clear without walking the entire registry.
Compaction of the registry must update all entries' remembered indices.

BUG=chromium:517778,chromium:517406
LOG=n
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1276353004

Cr-Commit-Position: refs/heads/master@{#30079}

Fasterify ICSlotCache

Use a hash map instead of a list for faster lookups.

BUG=chromium:517406
LOG=n
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1279763006

Cr-Commit-Position: refs/heads/master@{#30078}

Update V8 DEPS.

Rolling v8/tools/clang to c956d7970bf6637cb34f17ff64c375b6591d5940

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1276023003

Cr-Commit-Position: refs/heads/master@{#30077}

[IC] Make SeededNumberDictionary::UpdateMaxNumberKey prototype aware

Only walk the heap clearing KeyedStoreICs when the dictionary in question belongs to an object that's used as a prototype.
This is a temporary mitigation until we have a way to clear such ICs without having to walk the heap.

BUG=v8:4335
LOG=y
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1275363002

Cr-Commit-Position: refs/heads/master@{#30076}

Group lexical context variables for faster look up.

Currently, looking up a lexical context variable requires looking up
the variable name and then checking its mode. This can be a bottleneck
in Runtime_DeclareGlobals, even when no lexical context variables are
declared.

R=rossberg@chromium.org
BUG=crbug:517778
LOG=N

Review URL: https://codereview.chromium.org/1281883002

Cr-Commit-Position: refs/heads/master@{#30075}

[es6] Fix parsing of expressions in patterns

Fixes the use of eval calls in strict parameter lists in particular.

R=adamk@chromium.org
BUG=v8:811
LOG=N

Review URL: https://codereview.chromium.org/1276273002

Cr-Commit-Position: refs/heads/master@{#30074}

MIPS: Fix mina_maxa for proper NaN handling.

Also clean up variable naming in min_max and other tests. Fix class_fmt in mips64 assembler test for proper NaN checking

Review URL: https://codereview.chromium.org/1276813004

Cr-Commit-Position: refs/heads/master@{#30073}

Reland "Test262 roll"

Reland patch originally reviewed at https://codereview.chromium.org/1268553003/

This new patch marks a test [PASS, FAIL] since it passes on some platforms.

Review URL: https://codereview.chromium.org/1273883005

Cr-Commit-Position: refs/heads/master@{#30072}

[heap] Remove unused support for heap iterator size function.

R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/1281903002

Cr-Commit-Position: refs/heads/master@{#30071}

Speed up tests for optimized code sharing.

Note that this tests performed unnecessary many iterations which led to
long runtimes in debug mode and also caused flaky GCs during that would
cause the optimized code map to be flushed and violated assumptions.

R=yangguo@chromium.org
BUG=v8:4363
LOG=N

Review URL: https://codereview.chromium.org/1280973002

Cr-Commit-Position: refs/heads/master@{#30070}

Regression test for crbug 517455

Was fixed by https://chromium.googlesource.com/v8/v8/+/826f8da55fb868a365d047a4a653eb8ff2bfc14e

R=mstarzinger@chromium.org
BUG=517455
LOG=N

Review URL: https://codereview.chromium.org/1280953002

Cr-Commit-Position: refs/heads/master@{#30069}

[heap] Remove unused IntrusiveMarking class.

R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/1278113004

Cr-Commit-Position: refs/heads/master@{#30068}

[GC] Align behavior of JSProxy with JSObject when embedded in optimized code

With --harmony-proxies enabled, embedded pointers in optimized code can point to
a JSProxy (via a cell). Since JSProxy can morph into JSObject we need to align
the expectations of weak vs strong refs.

With this patch we also treat JSPRoxy as weak ref (like JSObject) and therefore
properly record a dependency on it, so that once the cell pointing to it becomes
unreachable we deoptimize the corresponding code.

BUG=v8:4359
LOG=N

Review URL: https://codereview.chromium.org/1270393003

Cr-Commit-Position: refs/heads/master@{#30067}

[heap] Make the Marking class all static.

R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/1269313003

Cr-Commit-Position: refs/heads/master@{#30066}

[turbofan] Remove kInterpreterDispatch CallDescriptor kind in favor of flag.

Rationale: The {kind} of a call descriptor describes what the {target} being
called is--i.e. a JSFunction, code object, or address. That kind materially
dictates the instruction(s) generated for an outgoing call.

The other flags on a call descriptor should describe specific properties
(like whether a roots register is valid or not) so that backend logic doesn't
have to switch over the kind, but is informed directly of what it wants to
know.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1268273003

Cr-Commit-Position: refs/heads/master@{#30065}

[es6] Use strict arguments objects for destructured parameters

Plus some renaming for consistency.

R=adamk@chromium.org
BUG=v8:811
LOG=N

Review URL: https://codereview.chromium.org/1278783002

Cr-Commit-Position: refs/heads/master@{#30064}

[turbofan] Remove architecture-specific linkage files and LinkageTraits. Use macro-assembler-defined constants.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1272883003

Cr-Commit-Position: refs/heads/master@{#30063}

Make sure that memory reducer makes progress in incremental marking
even if there are no idle notifications.

BUG=chromium:515873
LOG=NO

Review URL: https://codereview.chromium.org/1274633003

Cr-Commit-Position: refs/heads/master@{#30062}

[heap] Rename IncrementalMarking::Abort to Stop.

R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/1279043002

Cr-Commit-Position: refs/heads/master@{#30061}

Use conservative estimate for GC speed instead of bailing out when computing
mutator utilization.

This makes GC heuristics more robust for small applications that trigger
scavenges but do not trigger full GC.

BUG=

Review URL: https://codereview.chromium.org/1280703002

Cr-Commit-Position: refs/heads/master@{#30060}

Sample allocation rate in memory reducer.

Otherwise, if there is no GC and no idle notification,
memory reducer will use old allocation rate.

BUG=chromium:515873
LOG=NO

Review URL: https://codereview.chromium.org/1280623002

Cr-Commit-Position: refs/heads/master@{#30059}

Port cfi configuration from chromium.

BUG=chromium:515782
LOG=n

Review URL: https://codereview.chromium.org/1267773004

Cr-Commit-Position: refs/heads/master@{#30058}

[test] Return variant and random seed on failures.

BUG=chromium:511215
LOG=n

Review URL: https://codereview.chromium.org/1276853002

Cr-Commit-Position: refs/heads/master@{#30057}

Update binutils version.

BUG=chromium:515782
LOG=n

Review URL: https://codereview.chromium.org/1273403002

Cr-Commit-Position: refs/heads/master@{#30056}

Revert of Test262 roll (patchset #9 id:160001 of https://codereview.chromium.org/1268553003/ )

Reason for revert:
[Sheriff] Lacks one test expectation for
http://build.chromium.org/p/client.v8/builders/V8%20Linux64/builds/4573
http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim/builds/4516

64 bits only?

Original issue's description:
> Update to latest test262 from 2015-07-31
>
> Committed: https://crrev.com/722ad6923887d367f14588f5ccd6697b8684bd28
> Cr-Commit-Position: refs/heads/master@{#30052}

TBR=adamk@chromium.org,littledan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1280903002

Cr-Commit-Position: refs/heads/master@{#30055}

Update V8 DEPS.

Rolling v8/third_party/icu to bbb24c53b4f46025e87a5973c39fa722c8757595

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1276153002

Cr-Commit-Position: refs/heads/master@{#30054}

Rename "extras exports" to "extras binding"

R=yangguo@chromium.org, jochen@chromium.org
BUG=507133
LOG=Y

Review URL: https://codereview.chromium.org/1275683002

Cr-Commit-Position: refs/heads/master@{#30053}

Update to latest test262 from 2015-07-31

Review URL: https://codereview.chromium.org/1268553003

Cr-Commit-Position: refs/heads/master@{#30052}

V8: Add SIMD functions for Phase 1.

Float32x4:
  abs, neg, sqrt, reciprocalApproximation, reciprocalSqrtApproximation, add, sub, mul, div,
  min, max, minNum, maxNum, lessThan, lessThanOrEqual, greaterThan, greaterThanOrEqual,
  equal, notEqual, select, swizzle, shuffle, fromInt32x4, fromInt32x4Bits, fromInt16x8Bits,
  fromInt8x16Bits.

Int32x4:
  neg, add, sub, mul, min, max, and, or, xor, not, shiftLeftByScalar, shiftRightLogicalByScalar,
  shiftRightArithmeticByScalar, lessThan, lessThanOrEqual, greaterThan, greaterThanOrEqual,
  equal, notEqual, select, swizzle, shuffle, fromFloat32x4, fromFloat32x4Bits, fromInt16x8Bits,
  fromInt8x16Bits.

Int16x8:
  neg, add, sub, mul, min, max, and, or, xor, not, shiftLeftByScalar, shiftRightLogicalByScalar,
  shiftRightArithmeticByScalar, lessThan, lessThanOrEqual, greaterThan, greaterThanOrEqual,
  equal, notEqual, select, swizzle, shuffle, fromFloat32x4Bits, fromInt32x4Bits, fromInt8x16Bits.

Int8x16:
  neg, add, sub, mul, min, max, and, or, xor, not, shiftLeftByScalar, shiftRightLogicalByScalar,
  shiftRightArithmeticByScalar, lessThan, lessThanOrEqual, greaterThan, greaterThanOrEqual,
  equal, notEqual, select, swizzle, shuffle, fromFloat32x4Bits, fromInt32x4Bits, fromInt16x8Bitss.

Bool32x4, Bool16x8, Bool8x16:
  and, or, not, anyTrue, allTrue, select, swizzle, shuffle.

I might have forgotten a few.

LOG=N
BUG=v8:4124

Review URL: https://codereview.chromium.org/1230343003

Cr-Commit-Position: refs/heads/master@{#30051}

Stand-alone deferred block splitting. This continues 1256313003.

BUG=

Review URL: https://codereview.chromium.org/1271703002

Cr-Commit-Position: refs/heads/master@{#30050}

Partially revert https://crrev.com/7e53749df0a10f475404e86ef0ca8df02bb79e7a

This fixes memory regression caused by not reducing new-space size.

BUG=chromium:517468
LOG=NO

Review URL: https://codereview.chromium.org/1273083002

Cr-Commit-Position: refs/heads/master@{#30049}

Whitespace change to test infra-runner change.

Cr-Commit-Position: refs/heads/master@{#30048}

Fix stale entries in optimized code map.

This fixes a corner-case where extending an optimized code map left
stale entries in the abandoned copy. This can cause havoc not only in
the heap verifier but also in the GC, because stale entries have not
been recorded when being trated weakly.

Note that this also pre-tenures all optimized code maps into old-space
because their lifetime is coupled to the SharedFunctionInfo anyways.

R=hpayer@chromium.org
TEST=cctest/test-heap/Regress514122
BUG=chromium:514122
LOG=N

Review URL: https://codereview.chromium.org/1277873002

Cr-Commit-Position: refs/heads/master@{#30047}

Helpful checks.cc file is being helpful.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1276843004

Cr-Commit-Position: refs/heads/master@{#30046}

[test] Make test filters platform-independent.

Use the same path separator for test cases on the cmd-line
on all platforms as in testcase.GetLabel, which is used to
report failures.

BUG=chromium:511215
LOG=n
NOTRY=true

Review URL: https://codereview.chromium.org/1281453003

Cr-Commit-Position: refs/heads/master@{#30045}

When allocation rate is low and we are close to the new space limit, we should perform a scavenge during idle time.

BUG=chromium:517395
LOG=n

Review URL: https://codereview.chromium.org/1272573006

Cr-Commit-Position: refs/heads/master@{#30044}

[GC] Check for incremental marking when a GC is triggered on reaching the external allocation limit

We missed a check whether we can actually do incremental marking when starting
it on reaching the external allocation limit.

BUG=chromium:517195
LOG=N

Review URL: https://codereview.chromium.org/1274983002

Cr-Commit-Position: refs/heads/master@{#30043}

Fix Array.prototype.concat for arguments object with getter.

R=adamk@chromium.org
BUG=chromium:516775
LOG=N

Review URL: https://codereview.chromium.org/1270403002

Cr-Commit-Position: refs/heads/master@{#30042}

Fix idle step marking after 9d7ebc.

Idle notification should force marking to make progress.

BUG=

Review URL: https://codereview.chromium.org/1275573002

Cr-Commit-Position: refs/heads/master@{#30041}

Fix off-by-one in Array.concat's max index check

The maximum valid index is strictly smaller than the maximum valid length.

BUG=chromium:516592
LOG=y
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1278703003

Cr-Commit-Position: refs/heads/master@{#30040}

When working on the register allocator, I often need to introspect the various components of the model - e.g. InstructionSequence, Instruction, LiveRange, etc. A pretty printer would help. While we have a suite of operator<< defined for these types, turns out that using them at debug time is close to impossible - gdb has poor (or convoluted) support for instantiating structures (e.g. OFStream, PrintableInstructionSequence, etc), and calling operator<< with pass-by-reference semantics.

I explored gdb macros, but hit an issue quite early with instantiating and initializing an OFStream - "virtual baseclass botch".

Currently, I have a side-file that I include (and then remove before publishing CLs), which defines wrappers to the above operator<< APIs, but this is becoming quite awkward, and I believe the functionality to be quite useful to anyone working in this (regalloc) area, so it's worth having something better than local side-files. The gdb path seems overly-twisted for the problem at hand, and I've noticed elsewhere (e.g. Object) the presence of Print APIs - hence this change.

BUG=

Review URL: https://codereview.chromium.org/1280483002

Cr-Commit-Position: refs/heads/master@{#30039}

Delete --harmony-computed-property-names flag

It was shipped in V8 4.4.

Review URL: https://codereview.chromium.org/1273543002

Cr-Commit-Position: refs/heads/master@{#30038}

Try turning object-observe test back on in gc-stress

Also remove obsolete reference to harmony/object-observe in deopt fuzzer
skip section.

BUG=chromium:478788
LOG=n
TBR=vogelheim@chromium.org

Review URL: https://codereview.chromium.org/1272193004 .

Cr-Commit-Position: refs/heads/master@{#30037}

[futex] Avoid accumulation errors in futex wait timeout

The code previously used a relative timeout and accumulated wait times to see
if the timeout was exceeded. Now we convert the timeout into an absolute time,
and always compare the current time against that.

BUG=v8:4357
R=machenbach@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1272733002

Cr-Commit-Position: refs/heads/master@{#30036}

Delete --harmony-unicode flag

It was shipped in V8 4.4.

Review URL: https://codereview.chromium.org/1271073002

Cr-Commit-Position: refs/heads/master@{#30035}

[es6] Remove Scanner and Parser flags for harmony_modules

These flags weren't doing any real work, since the decision of whether some
source code is a script or module is made outside the parser (currently,
by the V8 API).

The only behavior change in this patch is to always parse 'import' and
'export' as their Token values, which changes the error message from
"Unexpected reserved word" to "Unexpected token import" (which doesn't
seem particularly harmful).

Review URL: https://codereview.chromium.org/1262913003

Cr-Commit-Position: refs/heads/master@{#30034}

[strong] Refactor out separate strong runtime call for class objects

BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1270393002

Cr-Commit-Position: refs/heads/master@{#30033}

[strong] dot prototypes of strong class literals should be strong objects

BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1270423003

Cr-Commit-Position: refs/heads/master@{#30032}

Retire StringTracker.

BUG=

Review URL: https://codereview.chromium.org/1269343002

Cr-Commit-Position: refs/heads/master@{#30031}

Ensure `String.prototype.normalize.length` is `0`

TEST=test/intl/string/normalization
BUG=v8:4303
LOG=N

Review URL: https://codereview.chromium.org/1274653002

Cr-Commit-Position: refs/heads/master@{#30030}

Introduce object visitor to estimate the size of a native context.

This is only an estimate since it counts objects that could be shared,
for example strings, cow arrays, heap numbers, etc.

It however ignores objects that could be shared, but may only be used
by the context to be measured, for example shared function infos,
script objects, scope infos, etc.

R=jochen@chromium.org

Review URL: https://codereview.chromium.org/1268333004

Cr-Commit-Position: refs/heads/master@{#30029}

[GC] Change behavior when reaching external allocation limit

With the recent changes to the incremental marking API we can now kick off
incremental marking while respecting callback flags.

Performance neutral for smoothness.image_decoding_cases on N9 (read: does not
crash) as long as we synchronously process phantom callbacks
(kGCCallbackFlagForced).

OORT single run:
  "marksweep": {
    "count": 5,
    "pause_min": 7.5,
    "pause_max": 158.8,
    "pause_avg": 97.52000000000001,
    "pause_gt_10ms": 4
  }
  --- vs ---
  "marksweep": {
    "count": 5,
    "pause_min": 16.2,
    "pause_max": 22.1,
    "pause_avg": 19.32,
    "pause_gt_10ms": 5
  }

The number of actual full GCs varies. The improvement manifests in reduced
maximum and average pauses.

BUG=chromium:515795
LOG=N

Review URL: https://codereview.chromium.org/1271253002

Cr-Commit-Position: refs/heads/master@{#30028}

Sweep map space concurrently.

BUG=chromium:507211
LOG=n

Review URL: https://codereview.chromium.org/1226773003

Cr-Commit-Position: refs/heads/master@{#30027}

Remove serializer-specific hash table size heuristic.

The heuristic can cause weird behavior when bootstrapping.
The memory savings is not worth this hassle.

Committed: https://crrev.com/fc80f29a582b758d14aae864232624ca45e47ddc
Cr-Commit-Position: refs/heads/master@{#30019}

Review URL: https://codereview.chromium.org/1265983006

Cr-Commit-Position: refs/heads/master@{#30026}

[es6] Implement proper TDZ for parameters

Previously, examples like (({a = x}, x) => {})({}, 0) did not throw a ReferenceError like they should. This CL

- Splits up DeclareFormalParameters such that the formals can be recorded first and declared later.

- Declaration then takes the complete parameter list into account. If it is not simple, temporaries are introduced for all parameters.

- BuildParameterInitializationBlock desugars all parameters from non-simple lists into let-bindings.

- Refactored Pre/ParserFormalParameters, so that the arity information is no longer duplicated in Parser.

- Rest is currently handled specially, until rest-via-destructuring has landed.

R=adamk@chromium.org, littledan@chromium.org
BUG=v8:811
LOG=N

Review URL: https://codereview.chromium.org/1259283002

Cr-Commit-Position: refs/heads/master@{#30025}

Revert of Remove serializer-specific hash table size heuristic. (patchset #1 id:1 of https://codereview.chromium.org/1265983006/ )

Reason for revert:
This still breaks: https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/builds/1296/steps/Mjsunit/logs/load-proxy

Test: mjsunit/strong/load-proxy
Flags: --stress-opt --always-opt
Command: out/Debug/d8 --test --random-seed=2021532800 --stress-opt --always-opt --nohard-abort --nodead-code-elimination --nofold-constants --enable-slow-asserts --debug-code --verify-heap --harmony-proxies --strong-mode test/mjsunit/strong/load-proxy.js --gc-interval=500 --stress-compaction --concurrent-recompilation-queue-length=64 --concurrent-recompilation-delay=500 --concurrent-recompilation

Run #1
Exit code: -11
Result: CRASH
Expected outcomes: PASS
Duration: 00:00:553

Run #2
Exit code: -11
Result: CRASH
Expected outcomes: PASS
Duration: 00:00:520

Run #3
Exit code: -11
Result: CRASH
Expected outcomes: PASS
Duration: 00:00:572

Original issue's description:
> Remove serializer-specific hash table size heuristic.
>
> The heuristic can cause weird behavior when bootstrapping.
> The memory savings is not worth this hassle.
>
> Committed: https://crrev.com/fc80f29a582b758d14aae864232624ca45e47ddc
> Cr-Commit-Position: refs/heads/master@{#30019}

TBR=ulan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1268413002

Cr-Commit-Position: refs/heads/master@{#30024}

Cleanup unnecessary duplication of runtime functions.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1269323003

Cr-Commit-Position: refs/heads/master@{#30023}

Revert of Revert part of "Remove serializer-specific hash table size heuristic." (patchset #1 id:1 of https://codereview.chromium.org/1272123002/ )

Reason for revert:
Did not fix issue it was intended to fix.

Original issue's description:
> Revert part of "Remove serializer-specific hash table size heuristic."
>
> TBR=machenbach@chromium.org
> NOTRY=true
> NOTREECHECKS=true
>
> Committed: https://crrev.com/68e5ae5282f3ba787c27ffa6e92fed6e5ff725e4
> Cr-Commit-Position: refs/heads/master@{#30021}

TBR=machenbach@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1276443002

Cr-Commit-Position: refs/heads/master@{#30022}

Revert part of "Remove serializer-specific hash table size heuristic."

TBR=machenbach@chromium.org
NOTRY=true
NOTREECHECKS=true

Review URL: https://codereview.chromium.org/1272123002

Cr-Commit-Position: refs/heads/master@{#30021}

Fully deprecate FixedArray::CopySize method.

R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/1256283003

Cr-Commit-Position: refs/heads/master@{#30020}

Remove serializer-specific hash table size heuristic.

The heuristic can cause weird behavior when bootstrapping.
The memory savings is not worth this hassle.

Review URL: https://codereview.chromium.org/1265983006

Cr-Commit-Position: refs/heads/master@{#30019}

Update V8 DEPS.

Rolling v8/tools/clang to c9a343c6a8065127989a05fe2a3fc76c26ad8102

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1274553002

Cr-Commit-Position: refs/heads/master@{#30018}

Add a --harmony-object-observe runtime flag (on by default)

To avoid tanking context startup performance, only the actual installation of the
JS-exposed API is flag-guarded. The remainder of the implementation still
resides in the snapshot.

Review URL: https://codereview.chromium.org/1257063003

Cr-Commit-Position: refs/heads/master@{#30017}

[d8 Workers] Throw when calling Worker constructor without new

BUG=4399
R=jarin@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1260813008

Cr-Commit-Position: refs/heads/master@{#30016}

Retire ShortCircuitConsString.

BUG=

Review URL: https://codereview.chromium.org/1267313002

Cr-Commit-Position: refs/heads/master@{#30015}

Reland: GC: Refactor public incremental marking interface in heap

Combines:
* https://codereview.chromium.org/1273483002/
* https://codereview.chromium.org/1266793003/

This reverts commit 0215fb56f4c75b054116632039edbff0d7f40373.

BUG=

Review URL: https://codereview.chromium.org/1265273002

Cr-Commit-Position: refs/heads/master@{#30014}

Ship --harmony-new-target

BUG=v8:3887
LOG=y

Review URL: https://codereview.chromium.org/1267773009

Cr-Commit-Position: refs/heads/master@{#30013}

Introduce safe interface to "copy and grow" FixedArray.

This introduces a CopyFixedArrayAndGrow method on Factory that takes
the "grow amount" instead of the "new size" as an argument. The new
interface is safer because it allows for mutations by the GC that
potentially trim the source array.

This also fixes a bug in SharedFunctionInfo::AddToOptimizedCodeMap
where the aformentioned scenario led to unused entries within the
optimized code map.

Note that FixedArray::CopySize is hereby deprecated because it is
considered unsafe and should no longer be used.

R=hpayer@chromium.org
TEST=mjsunit/regress/regress-crbug-513507
BUG=chromium:513507
LOG=n

Review URL: https://codereview.chromium.org/1255173006

Cr-Commit-Position: refs/heads/master@{#30012}

Revert of GC: Refactor public incremental marking interface in heap (patchset #6 id:100001 of https://codereview.chromium.org/1273483002/ )

Reason for revert:
Fails on the MSAN builder:

http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/builds/3580/steps/Check/logs/RegExpInterruption

Likely due to lack of initialization of IncrementalMarking::gc_callback_flags_.

Original issue's description:
> GC: Refactor incremental marking interface from heap
>
> BUG=
>
> Committed: https://crrev.com/c9fcaeb336919ce4b76fded8c8059457e9820250
> Cr-Commit-Position: refs/heads/master@{#30009}

TBR=ulan@chromium.org,hpayer@chromium.org,mlippautz@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1271823006

Cr-Commit-Position: refs/heads/master@{#30011}

[es6] new.target should not be shadowable in a with scope

BUG=v8:3887
LOG=n

Review URL: https://codereview.chromium.org/1259183005

Cr-Commit-Position: refs/heads/master@{#30010}

GC: Refactor incremental marking interface from heap

BUG=

Review URL: https://codereview.chromium.org/1273483002

Cr-Commit-Position: refs/heads/master@{#30009}

Revert d5419b for regressing v8.top_25_smooth benchmark.

BUG=chromium:516425
LOG=NO

Review URL: https://codereview.chromium.org/1271973002

Cr-Commit-Position: refs/heads/master@{#30008}

Change RecordSlot interface. Make it more robust by replacing anchor slot with actual object.

BUG=

Review URL: https://codereview.chromium.org/1259613006

Cr-Commit-Position: refs/heads/master@{#30007}

Fix another instance of the previous build issue

TBR=yangguo@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1264233005

Cr-Commit-Position: refs/heads/master@{#30006}

Setting up the stage for heuristics that preprocess live ranges before register allocation, and are independent of register allocation - e.g. the deferred blocks heuristic, or the split at call sites heuristic.

Added a separate flag for this, since we intend to enable it for the linear allocator as well. Currently, the option is "on" for greedy, as a point in time to enable its testing (through the greedy allocator bots).

BUG=

Review URL: https://codereview.chromium.org/1256313003

Cr-Commit-Position: refs/heads/master@{#30005}

Rename IsSimdObject assembly intrinsic.
Change IS_SIMD_OBJECT to IS_SIMD_VALUE, and IsSimdObject to IsSimdValue.

R=rossberg
LOG=N
BUG=v8:4124

Review URL: https://codereview.chromium.org/1253103006

Cr-Commit-Position: refs/heads/master@{#30004}

Avoid data race when writing Shell::options.script_executed.

The race occurred when Workers were used. Since Workers call
Shell::ExecuteString from a different thread, TSAN (correctly) flags
this as a racy write. Solution would be to either synchronize the writes,
or to 'lift' the write higher up in the call stack and only write the flag
from the main thread. This implements this latter solution.

These methods call Shell::ExecuteString, but do *not* set script_executed:
- ExecuteInThread: Can only occur is JS has already been executed.
- Shell::Load: Callback for JS; so JS has already been executed when
               we get there.
- Shell::RunShell: Interactive shell. We no longer need script_executed once
                   we're here.

BUG=v8:4330
LOG=N

Review URL: https://codereview.chromium.org/1258303004

Cr-Commit-Position: refs/heads/master@{#30003}

[es6] Refactor FormalParameter

Store arity in FormalParameters; store name (instead of var) and is_rest flag in individual parameters. Ensure that the arity is always maintained consistently.

This is preparation for more parameter destructuring adjustments. In particular, a follow-up CL will separate parameter recording from declaring the variables.

R=adamk@chromium.org, littledan@chromium.org
BUG=v8:811
LOG=N

Review URL: https://codereview.chromium.org/1259013003

Cr-Commit-Position: refs/heads/master@{#30002}

Fix build error (missing cast to void*)

TBR=yangguo@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1263043004

Cr-Commit-Position: refs/heads/master@{#30001}

Revert of Remove serializer-specific hash table size heuristic. (patchset #1 id:1 of https://codereview.chromium.org/1265983006/ )

Reason for revert:
https://chromegw.corp.google.com/i/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20gc%20stress/builds/3088/steps/Mjsunit/logs/load-proxy

Original issue's description:
> Remove serializer-specific hash table size heuristic.
>
> The heuristic can cause weird behavior when bootstrapping.
> The memory savings is not worth this hassle.
>
> Committed: https://crrev.com/a246e296c6366dcd0a2d8aa0df973d57093178f6
> Cr-Commit-Position: refs/heads/master@{#29992}

TBR=ulan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1257873006

Cr-Commit-Position: refs/heads/master@{#30000}

[turbofan] Handle void returns in instruction selector.

R=jarin@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1269183002

Cr-Commit-Position: refs/heads/master@{#29999}

Correct handling of temporaries as parameters.

They need to be properly recorded in the scope's temps set, otherwise allocation doesn't know about them and can break. (Not observable right now, but necessary for follow-up changes to parameter destructuring.)

Also, print temporary variables in a useful manner.

R=adamk@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1263563002

Cr-Commit-Position: refs/heads/master@{#29998}

Remove some outdated/unused declarations.

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1265243003

Cr-Commit-Position: refs/heads/master@{#29997}

Perform full GC in background idle notification.

BUG=chromium:515873
LOG=NO

Review URL: https://codereview.chromium.org/1263373002

Cr-Commit-Position: refs/heads/master@{#29996}

Debugger: refactor ScopeIterator, FrameInspector and DebugEvaluate.

This is a pure refactor and does not change functionality.

R=ulan@chromium.org

Review URL: https://codereview.chromium.org/1264993002

Cr-Commit-Position: refs/heads/master@{#29995}

Use conservative heap growing factor for background tab.

BUG=chromium:515873
LOG=NO

Review URL: https://codereview.chromium.org/1257833005

Cr-Commit-Position: refs/heads/master@{#29994}

MIPS: Fix reg use in SIMD.js Add the other SIMD Phase 1 types.

Port 7b9670b63b486ba3b6f8a569552d307282dbccfd

Only fails in debug builds.

TEST=mjsunit/harmony/simd
BUG=

Review URL: https://codereview.chromium.org/1264103005

Cr-Commit-Position: refs/heads/master@{#29993}

Remove serializer-specific hash table size heuristic.

The heuristic can cause weird behavior when bootstrapping.
The memory savings is not worth this hassle.

Review URL: https://codereview.chromium.org/1265983006

Cr-Commit-Position: refs/heads/master@{#29992}

AdjustLiveBytes and friends takes a heap object pointer instead of an address.

That makes going to the page safe. Addresses can be in arbitrary locations of an object, e.g. in a large object but not on the first 1M page.
BUG=

Review URL: https://codereview.chromium.org/1256203004

Cr-Commit-Position: refs/heads/master@{#29991}

Update V8 DEPS.

Rolling v8/buildtools to 565d04e8741429fb1b4f26d102f2c6c3b849edeb

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1267173003

Cr-Commit-Position: refs/heads/master@{#29990}

remove recursion from NewSpace::AllocateRaw*

The recursion between AllocateRaw* and SlowAllocateRaw makes incremental
stepping very complicated. This patch removes the recursion. Follow-on
patches will improve accounting of allocations done by incremental mark.

See: https://codereview.chromium.org/1252053003/#msg5

BUG=
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/1265443003

Cr-Commit-Position: refs/heads/master@{#29989}

[Interpreter] Consistency fixes.

Change minimum BytecodeArray frame size to zero now return value is in
the accumulator.

Fix inconsistent checks in bytecode-array-builder.cc.

Simplify bytecode disassembly by adding Bytecodes::Decode to
disassemble one bytecode and operands.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1259193004

Cr-Commit-Position: refs/heads/master@{#29988}

Grow heap slowly after running memory reducer.

BUG=

Review URL: https://codereview.chromium.org/1261373006

Cr-Commit-Position: refs/heads/master@{#29987}

GC: Refactor incremental marking steps w/ deadline into a separate call

BUG=

Review URL: https://codereview.chromium.org/1270873002

Cr-Commit-Position: refs/heads/master@{#29986}

Remove JSFunctionResultCache.

There is only one use case for it: String.prototype.search converts a
string argument into a RegExp. The cache is used to avoid repeating that
conversion. However, this does not make the added complexity worthwhile.

Review URL: https://codereview.chromium.org/1267493006

Cr-Commit-Position: refs/heads/master@{#29985}

Enable gdb-jit for PPC64 on Linux (both big-endian and little-endian).

R=danno@chromium.org, mbrandy@us.ibm.com, michael_dawson@ca.ibm.com

BUG=

Review URL: https://codereview.chromium.org/1252913007

Cr-Commit-Position: refs/heads/master@{#29984}

Remove high promotion mode

High promotion mode limits new space size in the case where many objects (high
rate) are promoted.  The result is frequent scavenger runs with low pause times. The
approach conflicts with pretenuring which requires a larger new space size to
collect enough feedback to be usable.

Ultimately the goal is to have pretenuring catch allocation sites that have high
promotion rates.

Revert "Bring back high promotion mode to shrink young generation size when scavenging latency is high."

This reverts commit 37be1d5e9e0a34abe6ba1612b9825e59f28a52d8.

Revert "GC. Delay/avoid entering high promotion mode"

This reverts commit a5221d0779d0839055c764b88f412a0793d959b3.

BUG=chromium:499507,chromium:506910
LOG=n

Review URL: https://codereview.chromium.org/1247723003

Cr-Commit-Position: refs/heads/master@{#29983}

[d8 worker] Fix regression when serializing very large arraybuffer

BUG=chromium:514081
R=jarin@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1264723002

Cr-Commit-Position: refs/heads/master@{#29982}