[strong] Refactor out separate strong runtime call for class objects

BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1270393002

Cr-Commit-Position: refs/heads/master@{#30033}

[strong] dot prototypes of strong class literals should be strong objects

BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1270423003

Cr-Commit-Position: refs/heads/master@{#30032}

Retire StringTracker.

BUG=

Review URL: https://codereview.chromium.org/1269343002

Cr-Commit-Position: refs/heads/master@{#30031}

Ensure `String.prototype.normalize.length` is `0`

TEST=test/intl/string/normalization
BUG=v8:4303
LOG=N

Review URL: https://codereview.chromium.org/1274653002

Cr-Commit-Position: refs/heads/master@{#30030}

Introduce object visitor to estimate the size of a native context.

This is only an estimate since it counts objects that could be shared,
for example strings, cow arrays, heap numbers, etc.

It however ignores objects that could be shared, but may only be used
by the context to be measured, for example shared function infos,
script objects, scope infos, etc.

R=jochen@chromium.org

Review URL: https://codereview.chromium.org/1268333004

Cr-Commit-Position: refs/heads/master@{#30029}

[GC] Change behavior when reaching external allocation limit

With the recent changes to the incremental marking API we can now kick off
incremental marking while respecting callback flags.

Performance neutral for smoothness.image_decoding_cases on N9 (read: does not
crash) as long as we synchronously process phantom callbacks
(kGCCallbackFlagForced).

OORT single run:
  "marksweep": {
    "count": 5,
    "pause_min": 7.5,
    "pause_max": 158.8,
    "pause_avg": 97.52000000000001,
    "pause_gt_10ms": 4
  }
  --- vs ---
  "marksweep": {
    "count": 5,
    "pause_min": 16.2,
    "pause_max": 22.1,
    "pause_avg": 19.32,
    "pause_gt_10ms": 5
  }

The number of actual full GCs varies. The improvement manifests in reduced
maximum and average pauses.

BUG=chromium:515795
LOG=N

Review URL: https://codereview.chromium.org/1271253002

Cr-Commit-Position: refs/heads/master@{#30028}

Sweep map space concurrently.

BUG=chromium:507211
LOG=n

Review URL: https://codereview.chromium.org/1226773003

Cr-Commit-Position: refs/heads/master@{#30027}

Remove serializer-specific hash table size heuristic.

The heuristic can cause weird behavior when bootstrapping.
The memory savings is not worth this hassle.

Committed: https://crrev.com/fc80f29a582b758d14aae864232624ca45e47ddc
Cr-Commit-Position: refs/heads/master@{#30019}

Review URL: https://codereview.chromium.org/1265983006

Cr-Commit-Position: refs/heads/master@{#30026}

[es6] Implement proper TDZ for parameters

Previously, examples like (({a = x}, x) => {})({}, 0) did not throw a ReferenceError like they should. This CL

- Splits up DeclareFormalParameters such that the formals can be recorded first and declared later.

- Declaration then takes the complete parameter list into account. If it is not simple, temporaries are introduced for all parameters.

- BuildParameterInitializationBlock desugars all parameters from non-simple lists into let-bindings.

- Refactored Pre/ParserFormalParameters, so that the arity information is no longer duplicated in Parser.

- Rest is currently handled specially, until rest-via-destructuring has landed.

R=adamk@chromium.org, littledan@chromium.org
BUG=v8:811
LOG=N

Review URL: https://codereview.chromium.org/1259283002

Cr-Commit-Position: refs/heads/master@{#30025}

Revert of Remove serializer-specific hash table size heuristic. (patchset #1 id:1 of https://codereview.chromium.org/1265983006/ )

Reason for revert:
This still breaks: https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/builds/1296/steps/Mjsunit/logs/load-proxy

Test: mjsunit/strong/load-proxy
Flags: --stress-opt --always-opt
Command: out/Debug/d8 --test --random-seed=2021532800 --stress-opt --always-opt --nohard-abort --nodead-code-elimination --nofold-constants --enable-slow-asserts --debug-code --verify-heap --harmony-proxies --strong-mode test/mjsunit/strong/load-proxy.js --gc-interval=500 --stress-compaction --concurrent-recompilation-queue-length=64 --concurrent-recompilation-delay=500 --concurrent-recompilation

Run #1
Exit code: -11
Result: CRASH
Expected outcomes: PASS
Duration: 00:00:553

Run #2
Exit code: -11
Result: CRASH
Expected outcomes: PASS
Duration: 00:00:520

Run #3
Exit code: -11
Result: CRASH
Expected outcomes: PASS
Duration: 00:00:572

Original issue's description:
> Remove serializer-specific hash table size heuristic.
>
> The heuristic can cause weird behavior when bootstrapping.
> The memory savings is not worth this hassle.
>
> Committed: https://crrev.com/fc80f29a582b758d14aae864232624ca45e47ddc
> Cr-Commit-Position: refs/heads/master@{#30019}

TBR=ulan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1268413002

Cr-Commit-Position: refs/heads/master@{#30024}

Cleanup unnecessary duplication of runtime functions.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1269323003

Cr-Commit-Position: refs/heads/master@{#30023}

Revert of Revert part of "Remove serializer-specific hash table size heuristic." (patchset #1 id:1 of https://codereview.chromium.org/1272123002/ )

Reason for revert:
Did not fix issue it was intended to fix.

Original issue's description:
> Revert part of "Remove serializer-specific hash table size heuristic."
>
> TBR=machenbach@chromium.org
> NOTRY=true
> NOTREECHECKS=true
>
> Committed: https://crrev.com/68e5ae5282f3ba787c27ffa6e92fed6e5ff725e4
> Cr-Commit-Position: refs/heads/master@{#30021}

TBR=machenbach@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1276443002

Cr-Commit-Position: refs/heads/master@{#30022}

Revert part of "Remove serializer-specific hash table size heuristic."

TBR=machenbach@chromium.org
NOTRY=true
NOTREECHECKS=true

Review URL: https://codereview.chromium.org/1272123002

Cr-Commit-Position: refs/heads/master@{#30021}

Fully deprecate FixedArray::CopySize method.

R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/1256283003

Cr-Commit-Position: refs/heads/master@{#30020}

Remove serializer-specific hash table size heuristic.

The heuristic can cause weird behavior when bootstrapping.
The memory savings is not worth this hassle.

Review URL: https://codereview.chromium.org/1265983006

Cr-Commit-Position: refs/heads/master@{#30019}

Update V8 DEPS.

Rolling v8/tools/clang to c9a343c6a8065127989a05fe2a3fc76c26ad8102

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1274553002

Cr-Commit-Position: refs/heads/master@{#30018}

Add a --harmony-object-observe runtime flag (on by default)

To avoid tanking context startup performance, only the actual installation of the
JS-exposed API is flag-guarded. The remainder of the implementation still
resides in the snapshot.

Review URL: https://codereview.chromium.org/1257063003

Cr-Commit-Position: refs/heads/master@{#30017}

[d8 Workers] Throw when calling Worker constructor without new

BUG=4399
R=jarin@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1260813008

Cr-Commit-Position: refs/heads/master@{#30016}

Retire ShortCircuitConsString.

BUG=

Review URL: https://codereview.chromium.org/1267313002

Cr-Commit-Position: refs/heads/master@{#30015}

Reland: GC: Refactor public incremental marking interface in heap

Combines:
* https://codereview.chromium.org/1273483002/
* https://codereview.chromium.org/1266793003/

This reverts commit 0215fb56f4c75b054116632039edbff0d7f40373.

BUG=

Review URL: https://codereview.chromium.org/1265273002

Cr-Commit-Position: refs/heads/master@{#30014}

Ship --harmony-new-target

BUG=v8:3887
LOG=y

Review URL: https://codereview.chromium.org/1267773009

Cr-Commit-Position: refs/heads/master@{#30013}

Introduce safe interface to "copy and grow" FixedArray.

This introduces a CopyFixedArrayAndGrow method on Factory that takes
the "grow amount" instead of the "new size" as an argument. The new
interface is safer because it allows for mutations by the GC that
potentially trim the source array.

This also fixes a bug in SharedFunctionInfo::AddToOptimizedCodeMap
where the aformentioned scenario led to unused entries within the
optimized code map.

Note that FixedArray::CopySize is hereby deprecated because it is
considered unsafe and should no longer be used.

R=hpayer@chromium.org
TEST=mjsunit/regress/regress-crbug-513507
BUG=chromium:513507
LOG=n

Review URL: https://codereview.chromium.org/1255173006

Cr-Commit-Position: refs/heads/master@{#30012}

Revert of GC: Refactor public incremental marking interface in heap (patchset #6 id:100001 of https://codereview.chromium.org/1273483002/ )

Reason for revert:
Fails on the MSAN builder:

http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/builds/3580/steps/Check/logs/RegExpInterruption

Likely due to lack of initialization of IncrementalMarking::gc_callback_flags_.

Original issue's description:
> GC: Refactor incremental marking interface from heap
>
> BUG=
>
> Committed: https://crrev.com/c9fcaeb336919ce4b76fded8c8059457e9820250
> Cr-Commit-Position: refs/heads/master@{#30009}

TBR=ulan@chromium.org,hpayer@chromium.org,mlippautz@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1271823006

Cr-Commit-Position: refs/heads/master@{#30011}

[es6] new.target should not be shadowable in a with scope

BUG=v8:3887
LOG=n

Review URL: https://codereview.chromium.org/1259183005

Cr-Commit-Position: refs/heads/master@{#30010}

GC: Refactor incremental marking interface from heap

BUG=

Review URL: https://codereview.chromium.org/1273483002

Cr-Commit-Position: refs/heads/master@{#30009}

Revert d5419b for regressing v8.top_25_smooth benchmark.

BUG=chromium:516425
LOG=NO

Review URL: https://codereview.chromium.org/1271973002

Cr-Commit-Position: refs/heads/master@{#30008}

Change RecordSlot interface. Make it more robust by replacing anchor slot with actual object.

BUG=

Review URL: https://codereview.chromium.org/1259613006

Cr-Commit-Position: refs/heads/master@{#30007}

Fix another instance of the previous build issue

TBR=yangguo@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1264233005

Cr-Commit-Position: refs/heads/master@{#30006}

Setting up the stage for heuristics that preprocess live ranges before register allocation, and are independent of register allocation - e.g. the deferred blocks heuristic, or the split at call sites heuristic.

Added a separate flag for this, since we intend to enable it for the linear allocator as well. Currently, the option is "on" for greedy, as a point in time to enable its testing (through the greedy allocator bots).

BUG=

Review URL: https://codereview.chromium.org/1256313003

Cr-Commit-Position: refs/heads/master@{#30005}

Rename IsSimdObject assembly intrinsic.
Change IS_SIMD_OBJECT to IS_SIMD_VALUE, and IsSimdObject to IsSimdValue.

R=rossberg
LOG=N
BUG=v8:4124

Review URL: https://codereview.chromium.org/1253103006

Cr-Commit-Position: refs/heads/master@{#30004}

Avoid data race when writing Shell::options.script_executed.

The race occurred when Workers were used. Since Workers call
Shell::ExecuteString from a different thread, TSAN (correctly) flags
this as a racy write. Solution would be to either synchronize the writes,
or to 'lift' the write higher up in the call stack and only write the flag
from the main thread. This implements this latter solution.

These methods call Shell::ExecuteString, but do *not* set script_executed:
- ExecuteInThread: Can only occur is JS has already been executed.
- Shell::Load: Callback for JS; so JS has already been executed when
               we get there.
- Shell::RunShell: Interactive shell. We no longer need script_executed once
                   we're here.

BUG=v8:4330
LOG=N

Review URL: https://codereview.chromium.org/1258303004

Cr-Commit-Position: refs/heads/master@{#30003}

[es6] Refactor FormalParameter

Store arity in FormalParameters; store name (instead of var) and is_rest flag in individual parameters. Ensure that the arity is always maintained consistently.

This is preparation for more parameter destructuring adjustments. In particular, a follow-up CL will separate parameter recording from declaring the variables.

R=adamk@chromium.org, littledan@chromium.org
BUG=v8:811
LOG=N

Review URL: https://codereview.chromium.org/1259013003

Cr-Commit-Position: refs/heads/master@{#30002}

Fix build error (missing cast to void*)

TBR=yangguo@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1263043004

Cr-Commit-Position: refs/heads/master@{#30001}

Revert of Remove serializer-specific hash table size heuristic. (patchset #1 id:1 of https://codereview.chromium.org/1265983006/ )

Reason for revert:
https://chromegw.corp.google.com/i/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20gc%20stress/builds/3088/steps/Mjsunit/logs/load-proxy

Original issue's description:
> Remove serializer-specific hash table size heuristic.
>
> The heuristic can cause weird behavior when bootstrapping.
> The memory savings is not worth this hassle.
>
> Committed: https://crrev.com/a246e296c6366dcd0a2d8aa0df973d57093178f6
> Cr-Commit-Position: refs/heads/master@{#29992}

TBR=ulan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1257873006

Cr-Commit-Position: refs/heads/master@{#30000}

[turbofan] Handle void returns in instruction selector.

R=jarin@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1269183002

Cr-Commit-Position: refs/heads/master@{#29999}

Correct handling of temporaries as parameters.

They need to be properly recorded in the scope's temps set, otherwise allocation doesn't know about them and can break. (Not observable right now, but necessary for follow-up changes to parameter destructuring.)

Also, print temporary variables in a useful manner.

R=adamk@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1263563002

Cr-Commit-Position: refs/heads/master@{#29998}

Remove some outdated/unused declarations.

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1265243003

Cr-Commit-Position: refs/heads/master@{#29997}

Perform full GC in background idle notification.

BUG=chromium:515873
LOG=NO

Review URL: https://codereview.chromium.org/1263373002

Cr-Commit-Position: refs/heads/master@{#29996}

Debugger: refactor ScopeIterator, FrameInspector and DebugEvaluate.

This is a pure refactor and does not change functionality.

R=ulan@chromium.org

Review URL: https://codereview.chromium.org/1264993002

Cr-Commit-Position: refs/heads/master@{#29995}

Use conservative heap growing factor for background tab.

BUG=chromium:515873
LOG=NO

Review URL: https://codereview.chromium.org/1257833005

Cr-Commit-Position: refs/heads/master@{#29994}

MIPS: Fix reg use in SIMD.js Add the other SIMD Phase 1 types.

Port 7b9670b63b486ba3b6f8a569552d307282dbccfd

Only fails in debug builds.

TEST=mjsunit/harmony/simd
BUG=

Review URL: https://codereview.chromium.org/1264103005

Cr-Commit-Position: refs/heads/master@{#29993}

Remove serializer-specific hash table size heuristic.

The heuristic can cause weird behavior when bootstrapping.
The memory savings is not worth this hassle.

Review URL: https://codereview.chromium.org/1265983006

Cr-Commit-Position: refs/heads/master@{#29992}

AdjustLiveBytes and friends takes a heap object pointer instead of an address.

That makes going to the page safe. Addresses can be in arbitrary locations of an object, e.g. in a large object but not on the first 1M page.
BUG=

Review URL: https://codereview.chromium.org/1256203004

Cr-Commit-Position: refs/heads/master@{#29991}

Update V8 DEPS.

Rolling v8/buildtools to 565d04e8741429fb1b4f26d102f2c6c3b849edeb

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1267173003

Cr-Commit-Position: refs/heads/master@{#29990}

remove recursion from NewSpace::AllocateRaw*

The recursion between AllocateRaw* and SlowAllocateRaw makes incremental
stepping very complicated. This patch removes the recursion. Follow-on
patches will improve accounting of allocations done by incremental mark.

See: https://codereview.chromium.org/1252053003/#msg5

BUG=
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/1265443003

Cr-Commit-Position: refs/heads/master@{#29989}

[Interpreter] Consistency fixes.

Change minimum BytecodeArray frame size to zero now return value is in
the accumulator.

Fix inconsistent checks in bytecode-array-builder.cc.

Simplify bytecode disassembly by adding Bytecodes::Decode to
disassemble one bytecode and operands.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1259193004

Cr-Commit-Position: refs/heads/master@{#29988}

Grow heap slowly after running memory reducer.

BUG=

Review URL: https://codereview.chromium.org/1261373006

Cr-Commit-Position: refs/heads/master@{#29987}

GC: Refactor incremental marking steps w/ deadline into a separate call

BUG=

Review URL: https://codereview.chromium.org/1270873002

Cr-Commit-Position: refs/heads/master@{#29986}

Remove JSFunctionResultCache.

There is only one use case for it: String.prototype.search converts a
string argument into a RegExp. The cache is used to avoid repeating that
conversion. However, this does not make the added complexity worthwhile.

Review URL: https://codereview.chromium.org/1267493006

Cr-Commit-Position: refs/heads/master@{#29985}

Enable gdb-jit for PPC64 on Linux (both big-endian and little-endian).

R=danno@chromium.org, mbrandy@us.ibm.com, michael_dawson@ca.ibm.com

BUG=

Review URL: https://codereview.chromium.org/1252913007

Cr-Commit-Position: refs/heads/master@{#29984}

Remove high promotion mode

High promotion mode limits new space size in the case where many objects (high
rate) are promoted.  The result is frequent scavenger runs with low pause times. The
approach conflicts with pretenuring which requires a larger new space size to
collect enough feedback to be usable.

Ultimately the goal is to have pretenuring catch allocation sites that have high
promotion rates.

Revert "Bring back high promotion mode to shrink young generation size when scavenging latency is high."

This reverts commit 37be1d5e9e0a34abe6ba1612b9825e59f28a52d8.

Revert "GC. Delay/avoid entering high promotion mode"

This reverts commit a5221d0779d0839055c764b88f412a0793d959b3.

BUG=chromium:499507,chromium:506910
LOG=n

Review URL: https://codereview.chromium.org/1247723003

Cr-Commit-Position: refs/heads/master@{#29983}

[d8 worker] Fix regression when serializing very large arraybuffer

BUG=chromium:514081
R=jarin@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1264723002

Cr-Commit-Position: refs/heads/master@{#29982}

Check whether a typed array was neutered before writing to it

As demanded by the spec.

BUG=chromium:516251
R=jkummerow@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1261453004

Cr-Commit-Position: refs/heads/master@{#29981}

SIMD.js Fix x87 build.
Rename method EmitIsSpecObject -> EmitIsSimdObject.

LOG=N
BUG=v8:4124

Review URL: https://codereview.chromium.org/1263473008

Cr-Commit-Position: refs/heads/master@{#29980}

Add support for large object IsSlotInBlackObject to filter out all dead slots correctly.

BUG=chromium:454297
LOG=n

Review URL: https://codereview.chromium.org/1268663004

Cr-Commit-Position: refs/heads/master@{#29979}

PPC: Clean up register save/restore logic.

NOPRESUBMIT=true
R=titzer@chromium.org, michael_dawson@ca.ibm.com, jyan@ca.ibm.com, joransiu@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1271583002

Cr-Commit-Position: refs/heads/master@{#29978}

Fix presubmit errors in runtime-simd.cc.

R=mstarzinger@chromium.org
BUG=
NOTREECHECKS=true

Review URL: https://codereview.chromium.org/1263363002

Cr-Commit-Position: refs/heads/master@{#29977}

Reland of land concurrent sweeping of code space. (patchset #1 id:1 of https://codereview.chromium.org/1263343002/)

Reason for revert:
Bogus revert.

Original issue's description:
> Revert of Reland concurrent sweeping of code space. (patchset #6 id:100001 of https://codereview.chromium.org/1242333002/)
>
> Reason for revert:
> Reverted because 507840 came back on recent Chromecrash. Should not have committed this Cl.
>
> Original issue's description:
> > Reland concurrent sweeping of code space.
> >
> > BUG=
> >
> > Committed: https://crrev.com/8516dccf6a561020441773c93c564dd4aa6ee59e
> > Cr-Commit-Position: refs/heads/master@{#29967}
>
> TBR=jochen@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=
>
> Committed: https://crrev.com/5c6e7d00438cc82a5584e3178d7dadf36e4a34f8
> Cr-Commit-Position: refs/heads/master@{#29975}

TBR=jochen@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1271773002

Cr-Commit-Position: refs/heads/master@{#29976}

Revert of Reland concurrent sweeping of code space. (patchset #6 id:100001 of https://codereview.chromium.org/1242333002/)

Reason for revert:
Reverted because 507840 came back on recent Chromecrash. Should not have committed this Cl.

Original issue's description:
> Reland concurrent sweeping of code space.
>
> BUG=
>
> Committed: https://crrev.com/8516dccf6a561020441773c93c564dd4aa6ee59e
> Cr-Commit-Position: refs/heads/master@{#29967}

TBR=jochen@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1263343002

Cr-Commit-Position: refs/heads/master@{#29975}

SIMD.js Add the other SIMD Phase 1 types.

Adds Int32x4, Bool32x4, Int16x8, Bool16x8, Int8x16, Bool8x16.
Adds Simd128Value base heap object class.
Changes heap/factory construction pattern to use arrays.
Adds replaceLane functions to facilitate testing.

NOPRESUBMIT=true
(presubmit checks erroneously interpret array declaration in macro definition as variable size array.)

LOG=Y
BUG=v8:4124

Review URL: https://codereview.chromium.org/1250733005

Cr-Commit-Position: refs/heads/master@{#29974}

[deoptimizer] Fix the frame size calculation for debugger-inspectable frame construction.

The calculation now takes into account the size of the arguments object
if it is present in the optimized frame.

(Yang, many thanks for the awesome repro!)

BUG=chromium:514362
LOG=N
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1264483008

Cr-Commit-Position: refs/heads/master@{#29973}

[Sheriff] Mark test as flaky.

BUG=v8:4141
LOG=n
NOTRY=true
TBR=yangguo@chromium.org, vogelheim@chromium.org

Review URL: https://codereview.chromium.org/1263033005

Cr-Commit-Position: refs/heads/master@{#29972}

[deoptimizer] Do not pass arguments markers to the debugger.

This fixes a bug introduced by r28826 (Unify decoding of deoptimization
translations, https://codereview.chromium.org/1136223004), where we
started leaking arguments marker sentinel to the debugger, which would
then cause crashes. This change replaces the sentinel with the undefined
value in the debugger-inspectable frame.

BUG=chromium:514362
LOG=n
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1263333002

Cr-Commit-Position: refs/heads/master@{#29971}

[Intepreter] BytecodeArrayBuilder and accumulator based bytecodes.

The BytecodeArrayBuilder has responsibility for emitting the BytecodeArray. It will be used by the AST walker.

Bytecode now uses an accumulator plus registers rather being pure register based.

Update BytecodeArray::Disassemble to print operand information.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1266713004

Cr-Commit-Position: refs/heads/master@{#29970}

Disable code recompile verification.

No-snap builds are still failing.

NOTREECHECKS=true
NOTRY=true
TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1260283006

Cr-Commit-Position: refs/heads/master@{#29969}

Partially revert 5aacee to see its impact on memory histograms.

Original CL: https://crrev.com/5aaceefd9a84327ce6afeaea16557449bf83ce57

BUG=chromium:515721
LOG=NO

Review URL: https://codereview.chromium.org/1264063003

Cr-Commit-Position: refs/heads/master@{#29968}

Reland concurrent sweeping of code space.

BUG=

Review URL: https://codereview.chromium.org/1242333002

Cr-Commit-Position: refs/heads/master@{#29967}

Create function name const assignment after parsing language mode.

Otherwise we may choose sloppy const or strict const depending on
whether the function is parsed the first time.

R=mvstanton@chromium.org
BUG=v8:4336
LOG=N

Review URL: https://codereview.chromium.org/1260053004

Cr-Commit-Position: refs/heads/master@{#29966}

[compiler] Verify that type feedback vector structure is the same on recompile.

Use a CHECK statement to find any violations of this rule.

Review URL: https://codereview.chromium.org/1255383004

Cr-Commit-Position: refs/heads/master@{#29965}

X87: [turbofan] Fix kArchTailCallCodeObject on ia32/x64.

port ec9bc7947399e29429c3bdeaff070db2a4cc92f4 (r29949).

original commit message:

    Previously these instructions tried to jump to the value at the code entry's
    location, rather than jumping to this location. Also adds a test.

BUG=

Review URL: https://codereview.chromium.org/1256163003

Cr-Commit-Position: refs/heads/master@{#29964}

X87: VectorICs: refactoring to eliminate "for queries only" vector ic mode.

port 1a5751f9b3ca682fadb6fce8202dda2db5b017c6 (r29956)

original commit message:

    Since we need the notion of a dummy vector ic, we can use that to avoid
    a special case of the IC constructor. Also, consolidate the two dummy
    ICs into one.

BUG=

Review URL: https://codereview.chromium.org/1265113002

Cr-Commit-Position: refs/heads/master@{#29963}

MIPS64: Fix hidden bug in relocations for j and jal.

Introduce new mechanism for relocating j/jal.

Resolves flaky failures of mozilla regress tests.

Additionally:

- internal encoded references are not relocated during code generation phase.
- remove asserts from j and jal which are not
valid because addresses are not final and valid in code generation phase.

TEST=mozilla/js1_5/Regress/regress-280769-2, regress-367561-01,
     mozilla/ecma_3/Statements/regress-444979
BUG=
R=paul.lind@imgtec.com

Review URL: https://codereview.chromium.org/1216823003 .

Patch from dusan.milosavljevic <dusan.milosavljevic@imgtec.com>.

Cr-Commit-Position: refs/heads/master@{#29962}

[Interpreter] Remove unnecessary const specifiers on scalar types.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1269813006

Cr-Commit-Position: refs/heads/master@{#29961}

Update V8 DEPS.

Rolling v8/testing/gmock to 0421b6f358139f02e102c9c332ce19a33faf75be

Rolling v8/testing/gtest to 9855a87157778d39b95eccfb201a9dc90f6d61c6

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1271653002

Cr-Commit-Position: refs/heads/master@{#29960}

PPC: VectorICs: refactoring to eliminate "for queries only" vector ic mode.

Port 1a5751f9b3ca682fadb6fce8202dda2db5b017c6

Original commit message:
    Since we need the notion of a dummy vector ic, we can use that to avoid
    a special case of the IC constructor. Also, consolidate the two dummy
    ICs into one.

R=mvstanton@chromium.org, michael_dawson@ca.ibm.com, jyan@ca.ibm.com, joransiu@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1261433007

Cr-Commit-Position: refs/heads/master@{#29959}

Array Builtin Refactoring: Creating API methods on ElementsAccessor

BUG=

Review URL: https://codereview.chromium.org/1260283002

Cr-Commit-Position: refs/heads/master@{#29958}

[turbofan] Simplifying handling of callee-cleanup stack area.

R=danno@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1269913002

Cr-Commit-Position: refs/heads/master@{#29957}

VectorICs: refactoring to eliminate "for queries only" vector ic mode.

Since we need the notion of a dummy vector ic, we can use that to avoid
a special case of the IC constructor. Also, consolidate the two dummy
ICs into one.

BUG=

Review URL: https://codereview.chromium.org/1268783004

Cr-Commit-Position: refs/heads/master@{#29956}

[turbofan] Float32 LinkageLocations need double registers too.

R=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1268433003

Cr-Commit-Position: refs/heads/master@{#29955}

[turbofan] Merge dependent Word32Equal on ARM64

Improve code generated for flag materialization.

Review URL: https://codereview.chromium.org/1260733003

Cr-Commit-Position: refs/heads/master@{#29954}

[stubs] Unify (and optimize) implementation of ToObject.

This is the initial (big) step towards a more uniform implementation of
the ToObject abstract operation (ES6 7.1.13), where we have a fallback
implementation in JSReceiver::ToObject() and a fast (hydrogen) CodeStub
to deal with the fast case (we should be able to do more cleanup on this
in a followup CL).  For natives we expose the abstract operation via a
%_ToObject intrinsic, also exposed via a macro TO_OBJECT, that unifies
the previous confusion with TO_OBJECT_INLINE, ToObject, TO_OBJECT,
$toObject and %$toObject.  Now the whole implementation of the abstract
operation is context independent, meaning we don't need any magic in the
builtins object nor the native context.

R=mvstanton@chromium.org,yangguo@chromium.org

Review URL: https://codereview.chromium.org/1266013006

Cr-Commit-Position: refs/heads/master@{#29953}

VectorICs: Crankshaft adaptations to deal with vector store ics.

Also, a one line fix in TurboFan to call the correct store ic.

BUG=

Review URL: https://codereview.chromium.org/1266983002

Cr-Commit-Position: refs/heads/master@{#29952}

Debugger: move implementation to a separate folder.

R=cbruni@chromium.org

Review URL: https://codereview.chromium.org/1265923002

Cr-Commit-Position: refs/heads/master@{#29951}

Ensure the memory reduces makes progress.

BUG=

Review URL: https://codereview.chromium.org/1262363002

Cr-Commit-Position: refs/heads/master@{#29950}

[turbofan] Fix kArchTailCallCodeObject on ia32/x64.

Previously these instructions tried to jump to the value at the code entry's
location, rather than jumping to this location. Also adds a test.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1265723003

Cr-Commit-Position: refs/heads/master@{#29949}

[turbofan] GraphBuilderTester uses --print-opt-code.

R=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1256723003

Cr-Commit-Position: refs/heads/master@{#29948}

Take into account freed global handles for heap growing.

This partially brings back the heuristic from v8 4.44.

BUG=

Review URL: https://codereview.chromium.org/1269743002

Cr-Commit-Position: refs/heads/master@{#29947}

After trying once to create a Realm in regress-crbug-501711.js give up

R=hpayer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1261123003

Cr-Commit-Position: refs/heads/master@{#29946}

GC: Add tracing event for rescanning large objects on newspace evacuation

BUG=

Review URL: https://codereview.chromium.org/1269753002

Cr-Commit-Position: refs/heads/master@{#29945}

Revert of [cq] Increase commit burst delay. (patchset #1 id:1 of https://codereview.chromium.org/1258193003/)

Reason for revert:
Committing more than one CL at a time led to some odd buildbot behavior on the console (probably an independent bug).

Original issue's description:
> [cq] Increase commit burst delay.
>
> TBR=jkummerow@chromium.org, hablich@chromium.org
> NOTRY=true
> NOTREECHECKS=true
>
> Committed: https://crrev.com/1f2e914d103532df410f118c81c60fba8b6a00e0
> Cr-Commit-Position: refs/heads/master@{#29914}

TBR=jkummerow@chromium.org,hablich@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1263183002

Cr-Commit-Position: refs/heads/master@{#29944}

X87: [interpreter] Add Interpreter{Entry,Exit}Trampoline builtins.

port c5dd553cf3a44cd8c17958a595198b5ea9492cd0 (r29929).

original commit message:

    Adds interpreter entry and exit trampoline builtins. Also implements the
    Return bytecode handler and fixes a few bugs in InterpreterAssembler
    highlighted by running on other architectures.

BUG=

Review URL: https://codereview.chromium.org/1271433002

Cr-Commit-Position: refs/heads/master@{#29943}

X87: [interpreter] Change interpreter to use an BytecodeArray pointer and and offset.

port 597da503220ab2a632453d2e3a915e9824d6d592 (r29910).

original commit message:

    Changes the interpreter to use a BytecodeArray pointer and an offset to avoid
    having an inner pointer to a BytecodeArray object in registers during dispatch.

BUG=

Review URL: https://codereview.chromium.org/1267783002

Cr-Commit-Position: refs/heads/master@{#29942}

Update V8 DEPS.

Rolling v8/third_party/android_tools to 2bb73b7af7da7116aa54c1474121c28a85d28e6b

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1263453003

Cr-Commit-Position: refs/heads/master@{#29941}

PPC: Speed up cctest/test-debug/DebugBreakLoop.

Port a67f31c48c7bb7a3f653e32e0a48143099d27b68

R=yangguo@chromium.org, michael_dawson@ca.ibm.com, jyan@ca.ibm.com, joransiu@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1263863003

Cr-Commit-Position: refs/heads/master@{#29940}

PPC: [interpreter] Add Interpreter{Entry,Exit}Trampoline builtins.

Port c5dd553cf3a44cd8c17958a595198b5ea9492cd0

Original commit message:
    Adds interpreter entry and exit trampoline builtins. Also implements the
    Return bytecode handler and fixes a few bugs in InterpreterAssembler
    highlighted by running on other architectures.

R=rmcilroy@chromium.org, michael_dawson@ca.ibm.com, jyan@ca.ibm.com, joransiu@ca.ibm.com
BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1266053002

Cr-Commit-Position: refs/heads/master@{#29939}

[turbofan]: Add better encapsulation to LinkageLocation

Add factory methods for different types of LinkageLocations, and ensure that
accesses to the underlying data in the location are classified by type and
funneled through explicit accessors.

Also change the representation of LinkageLocation to use a BitField rather
than using a reserved section of the integer range.

Review URL: https://codereview.chromium.org/1262343002

Cr-Commit-Position: refs/heads/master@{#29938}

Fix the failure when enabling v8 profiler or vtune profiler in chromium.

   When enabling the v8 profiler (Using the following command parameters: --js-flags=--prof)
   or vtune profiling in chromium. it will break. This failure is introduced by this CL:
   https://codereview.chromium.org/1218863002.

   The reason is that V8 will enable the JITted code logging if --prof is set for V8. And under
   this condition, the function Logger::LogCodeObjects() will be invoked and it will trigger a
   mark-compact GC when deserializing the snapshot. This GC will use MemoryReducer to post a
   delay task by invoking V8Platform::CallDelayedOnForegroundThread() function. But at this point
   V8 isolation is still under initialization and the PerIsolationData of this isolation has not
   been created. (isolation_holder.cc:39~40 line). This leads to V8Platform::CallDelayedOnForegroundThread()
   failure because of segment fault.

   According to my understanding, I proposed the following fix. If the heap deserialization has not
   be completed, it does not post the delay task for next GC.

BUG=

Review URL: https://codereview.chromium.org/1270493002

Cr-Commit-Position: refs/heads/master@{#29937}

Debugger: correctly redirect code with no stack check.

This fix makes the redirect mechanism a bit more stable.

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1269733002

Cr-Commit-Position: refs/heads/master@{#29936}

Add CancelableIdleTask.

BUG=chromium:490559
LOG=NO

Review URL: https://codereview.chromium.org/1258923010

Cr-Commit-Position: refs/heads/master@{#29935}

[Interpreter] Add more bytecode definitions and add operand types.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1257543003

Cr-Commit-Position: refs/heads/master@{#29934}