[turbofan] Also update the BranchHint when merging a BooleanNot.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/1218443002

Cr-Commit-Position: refs/heads/master@{#29324}

Reland [android] Migrate more configs to gyp.

This reverts commit e93e4dad632a019c6a863c7dd43491b607d6d096.

BUG=chromium:502176
LOG=n
NOTRY=true
TBR=ulan@chromium.org, jochen@chromium.org

Review URL: https://codereview.chromium.org/1213803002

Cr-Commit-Position: refs/heads/master@{#29323}

Reland 'Additional HandleScopes to limit Handle consumption.'

v8 builds with --no-snap were hitting handle limits compiling natives for handle count unit tests that run with --check_handle_count. Patch now has higher handle limits (~4k more than required for failing natives compilation).

Original issue: https://codereview.chromium.org/1185633002/

Original issue's description:
    > Additional HandleScopes to limit Handle consumption.
    >
    > erikcorry@chromium.org suggested digging into v8 handle usage. Found potential scopes in ast.cc and runtime-literals.cc and added tests.
    >
    > The runtime-literals.cc change reduces peak handles in imaging-darkroom.js from 1,282,610 to 428,218. The ast.cc change reduces the peak handles in string-t
agcloud.js from 80,738 to 8,176.
    >
    > No significant handle count issues found with major websites, but substantial savings on some benchmarks and demos:
    >
    > Kraken's imaging-darkroom.js down from 1,282,610 to 428,218 due to runtime-literals.cc scope.
    > SunSpider's string-tagcloud.js down from 80,738 to 8.176 due to ast.cc
    >
    > http://www.flohofwoe.net/demos/dragons_asmjs.html (738,906 -> 478,296)
    > http://www.flohofwoe.net/demos/instancing_asmjs.html (737,884 -> 477,274)
    > https://dl.dropboxusercontent.com/u/16662598/Ports/DOSBox-web/doom.html?engine=dosbox-growth.js (1,724,114 -> 1,087,408)
    > https://kripken.github.io/ammo.js/examples/new/ammo.html (175,784 -> 142,058)
    >
    > BUG=
    >
    > Committed: https://crrev.com/3a4c7538839186aa38910c66c986abb563f4ccd2
    > Cr-Commit-Position: refs/heads/master@{#29155}

BUG=

Review URL: https://codereview.chromium.org/1192743005

Cr-Commit-Position: refs/heads/master@{#29322}

[turbofan] Enable sharing of context-independent code.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1215643002

Cr-Commit-Position: refs/heads/master@{#29321}

Revert of Re-land new insertion write barrier. (patchset #1 id:1 of https://codereview.chromium.org/1211513002/)

Reason for revert:
Still crashing in the wild.

Original issue's description:
> Re-land new insertion write barrier.
>
> BUG=
>
> Committed: https://crrev.com/6e6af7e7c70050cdd5ce56cdbaee3b6e8a7caa89
> Cr-Commit-Position: refs/heads/master@{#29258}

TBR=ulan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1217443002

Cr-Commit-Position: refs/heads/master@{#29320}

Revert of Reland [android] Migrate more configs to gyp. (patchset #2 id:20001 of https://codereview.chromium.org/1210393003/)

Reason for revert:
[Sheriff] Fails runhooks.

Original issue's description:
> Reland [android] Migrate more configs to gyp.
>
> This reverts commit 3e8892b589f16454d4f592e2ed3f6d4ddf0a0bc6.
>
> BUG=chromium:502176
> LOG=n
> NOTRY=true
> TBR=ulan@chromium.org, jochen@chromium.org
>
> Committed: https://crrev.com/c0d70e43c4cbe2a09c8f1bd55fe2be03cd9ba041
> Cr-Commit-Position: refs/heads/master@{#29317}

TBR=ulan@chromium.org,jochen@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:502176

Review URL: https://codereview.chromium.org/1215593004

Cr-Commit-Position: refs/heads/master@{#29319}

[tools] Add a tool to show potentially missing source deps.

NOTRY=true

Review URL: https://codereview.chromium.org/1208573002

Cr-Commit-Position: refs/heads/master@{#29318}

Reland [android] Migrate more configs to gyp.

This reverts commit 3e8892b589f16454d4f592e2ed3f6d4ddf0a0bc6.

BUG=chromium:502176
LOG=n
NOTRY=true
TBR=ulan@chromium.org, jochen@chromium.org

Review URL: https://codereview.chromium.org/1210393003

Cr-Commit-Position: refs/heads/master@{#29317}

Revert of [android] Migrate more configs to gyp. (patchset #4 id:60001 of https://codereview.chromium.org/1207693004/)

Reason for revert:
Breaks arm64 bots.

Original issue's description:
> [android] Migrate more configs to gyp.
>
> BUG=chromium:502176
> LOG=n
>
> Committed: https://crrev.com/174869573e42c999da1489c264b9c4602b98ba31
> Cr-Commit-Position: refs/heads/master@{#29314}

TBR=jochen@chromium.org,ulan@chromium.org,dusan.milosavljevic@imgtec.com,machenbach@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:502176

Review URL: https://codereview.chromium.org/1211383002

Cr-Commit-Position: refs/heads/master@{#29316}

[turbofan] Canonicalize return sequence for JSFunctions.

This optimization is already implemented in fullcodegen, and
basically makes sure that we do not unecessarily blow up the
code with duplicated return sequences everywhere.

R=danno@chromium.org

Review URL: https://codereview.chromium.org/1211373002

Cr-Commit-Position: refs/heads/master@{#29315}

[android] Migrate more configs to gyp.

BUG=chromium:502176
LOG=n

Review URL: https://codereview.chromium.org/1207693004

Cr-Commit-Position: refs/heads/master@{#29314}

[turbofan] Implement sharing of context-independent code.

This allows context-independent code generated by TurboFan to be cached
in the optimized code map and reused across native contexts. Note that
currently this cache is still flushed at GC time.

R=bmeurer@chromium.org,mvstanton@chromium.org
TEST=cctest/test-compiler/OptimizedCodeSharing

Review URL: https://codereview.chromium.org/1208013002

Cr-Commit-Position: refs/heads/master@{#29313}

Revert of Debugger: use list to find shared function info in a script. (patchset #2 id:20001 of https://codereview.chromium.org/1206573004/)

Reason for revert:
[Sheriff] Breaks layout tests:
http://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/682

Original issue's description:
> Debugger: use list to find shared function info in a script.
>
> Now that we keep tabs on shared function infos from a script, we can speed up finding shared function infos for debugging. However, in case we have to compile a function that cannot be lazily compiled without context, we fall back to the slow heap iteration.
>
> R=mstarzinger@chromium.org
> BUG=v8:4132,v8:4052
> LOG=N
>
> Committed: https://crrev.com/cfe89a71a332ef9ed481c8210bc3ad6d2822034b
> Cr-Commit-Position: refs/heads/master@{#29296}

TBR=mstarzinger@chromium.org,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4132,v8:4052

Review URL: https://codereview.chromium.org/1210393002

Cr-Commit-Position: refs/heads/master@{#29312}

[turbofan] Add support for pushing returns into merges.

This will enable tail call optimization even across inlining. Plus it
might enable some other interesting optimizations as well. In order to
avoid blowing up the generated code, we can still canonicalize the
epilogue in the CodeGenerator, similar to what fullcodegen does.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1215623002

Cr-Commit-Position: refs/heads/master@{#29311}

VectorICs: Lithium support for vector-based stores.

BUG=

Review URL: https://codereview.chromium.org/1209903003

Cr-Commit-Position: refs/heads/master@{#29310}

[turbofan] Use proper eager deopts for %_ThrowNotDateError().

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1210863002

Cr-Commit-Position: refs/heads/master@{#29309}

Serializer: commit new internalized strings after deserialization.

Reserving space for deserialization can cause GC, which
can evict entries from the string table. Having more deleted
entries now, StringTable::EnsureCapacity could cause a GC
later during deserialization even when we actually still
have enough capacity.

Instead, we now keep new internalized strings in a separate list
and commit them to the string table at the end.

R=ulan@chromium.org
BUG=chromium:502085
LOG=N

Review URL: https://codereview.chromium.org/1204863006

Cr-Commit-Position: refs/heads/master@{#29308}

PPC64: Fix "[ic] Record call counts for monomorphic calls made with an IC."

StoreP to a tagged object pointer requires a scratch register.

R=dstence@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1207323002

Cr-Commit-Position: refs/heads/master@{#29307}

Fix cluster-fuzz regression when getting message from Worker

The issue is that Worker.prototype.terminate was deleting the C++ Worker
object, and then Worker.prototype.getMessage was trying to read messages from
the queue.

The simplest solution is to keep workers in a zombie state when they have been
terminated. They won't be reaped until Shell::CleanupWorkers is called.

I've also fixed some threading issues with Workers:

* Workers can be created by another Worker, so the Shell::workers_ variable
must be protected by a mutex.

* An individual Worker can typically only be accessed by the isolate that
created it, but the main thread can always terminate it, so the Worker::state_
must be accessed in a thread-safe way.

BUG=chromium:504136
R=jochen@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1208733002

Cr-Commit-Position: refs/heads/master@{#29306}

MIPS: [turbofan] Fix implementation of Float64Min.

Port d783b763629526a1ec57a9f14caa61d0166efac7

Original commit message:
ARM64's `fmin` and `fmax` instructions don't have the same behaviour as
TurboFan's Float(32|64)(Min|Max) functions.

BUG=4206
LOG=N

Review URL: https://codereview.chromium.org/1204903004

Cr-Commit-Position: refs/heads/master@{#29305}

PPC: [turbofan] Add basic support for calling to (a subset of) C functions.

Port a58ba8d80179bf5b6b7245590c82e47fda8c8a5e

Original commit message:
This introduces some initial building blocks for calling out to
C/C++ functions directly from TurboFan generated code objects.

R=bmeurer@chromium.org, dstence@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1206343002

Cr-Commit-Position: refs/heads/master@{#29304}

PPC: [ic] Record call counts for monomorphic calls made with an IC.

Port c1a4f7477f03ebb0c6889bbf8ea6a4c928e0d413

Original commit message:
The idea is that TurboFan can use this information for more intelligent
inlining.

R=mvstanton@chromium.org, dstence@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1208093002

Cr-Commit-Position: refs/heads/master@{#29303}

PPC: Vector ICs: Like megamorphic keyed koads, use a dummy vector for stores

Port 9e7af9efc5857b3c7e23a77d257f3dfbea597753

Original commit message:
It's useful for the megamorphic keyed store case to not require a
vector and slot as input. Analogous to the load case, we have a dummy
one-ic-slot vector to aid. Since the only kind of MISS is for
megamorphic cache stub failures, we don't need the real vector.
The reason is that megamorphic cache stub failures don't result in any
change to the type feedback vector state.

R=mvstanton@chromium.org, dstence@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1212493002

Cr-Commit-Position: refs/heads/master@{#29302}

PPC: Fix "Unify the stack layout for construct frames"

R=dstence@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1210083002

Cr-Commit-Position: refs/heads/master@{#29301}

PPC: Fix "Fix receiver when calling eval() bound by with scope"

R=wingo@igalia.com, dstence@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1209703002

Cr-Commit-Position: refs/heads/master@{#29300}

Better error message for eval=>42 in strict mode

BUG=v8:4213
R=arv@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1210003003

Cr-Commit-Position: refs/heads/master@{#29299}

Back off normalizing on set length in sync with adding a property

BUG=

Review URL: https://codereview.chromium.org/1211833002

Cr-Commit-Position: refs/heads/master@{#29298}

Only try to delete dictionary elements if the length is actually reduced
BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1209983002

Cr-Commit-Position: refs/heads/master@{#29297}

Debugger: use list to find shared function info in a script.

Now that we keep tabs on shared function infos from a script, we can speed up finding shared function infos for debugging. However, in case we have to compile a function that cannot be lazily compiled without context, we fall back to the slow heap iteration.

R=mstarzinger@chromium.org
BUG=v8:4132,v8:4052
LOG=N

Review URL: https://codereview.chromium.org/1206573004

Cr-Commit-Position: refs/heads/master@{#29296}

Move Add to the elements accessor for everything but dictionary-arguments

BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1205913002

Cr-Commit-Position: refs/heads/master@{#29295}

Remove obsolete options in ScriptCompiler::CompileOptions.

This is a follow-on to https://code.google.com/p/v8/source/detail?r=22431
This will remove the compatibility logic, so that the API as described
in r22431 is the only API.

I'll let this CL will sit around for a while to give embedders a chance
to update their code.

R=yangguo@chromium.org, ulan@chromium.org
BUG=chromium:399580
LOG=Y

Review URL: https://codereview.chromium.org/392263002

Cr-Commit-Position: refs/heads/master@{#29294}

Reapply "Fix receiver when calling eval() bound by with scope"

Originally applied in https://codereview.chromium.org/1202963005

BUG=v8:4214
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
LOG=N
R=arv@chromium.org, mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1208873002

Cr-Commit-Position: refs/heads/master@{#29293}

Unify the stack layout for construct frames

The stack layout was different for different ports.

BUG=v8:3887
LOG=N
R=dslomov@chromium.org, adamk@chromium.org

Review URL: https://codereview.chromium.org/1203103003

Cr-Commit-Position: refs/heads/master@{#29292}

Reland 2 "Keep a canonical list of shared function infos."

BUG=v8:4132
LOG=N

Review URL: https://codereview.chromium.org/1211803002

Cr-Commit-Position: refs/heads/master@{#29291}

Reland Extend big-disjunction optimization to case-independent regexps

Previous code review https://codereview.chromium.org/1182783009/
R=yangguo@chromium.org
BUG=chromium:482998
LOG=n

Review URL: https://codereview.chromium.org/1204123003

Cr-Commit-Position: refs/heads/master@{#29290}

Move reconfiguration into the elements accessor

BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1207613005

Cr-Commit-Position: refs/heads/master@{#29289}

[turbofan] Optimize BooleanNot conditions to Branch nodes.

Also remove the weird work-around for this missing optimization in
CHECK_DATE in macros.py.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/1205353002

Cr-Commit-Position: refs/heads/master@{#29288}

Let AddDictionaryElement / AddFastElement purely add, move transition heuristics to AddDataElement

BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1194023004

Cr-Commit-Position: refs/heads/master@{#29287}

Debugger: remove bogus assertion in BreakLocation constructor.

Currently DebugInfo objects can be created independently from whether
the debugger is active. When tearing down the isolate, we would go
through DebugInfo objects and iterate through break locations,
causing this assertion to fail.

R=ulan@chromium.org
BUG=v8:4241
LOG=N

Review URL: https://codereview.chromium.org/1210813002

Cr-Commit-Position: refs/heads/master@{#29286}

Revert of Reland "Keep a canonical list of shared function infos." (patchset #3 id:40001 of https://codereview.chromium.org/1211453002/)

Reason for revert:
proxies test failing https://chromegw.corp.google.com/i/client.v8/builders/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/builds/903/steps/Mjsunit/logs/proxies

Original issue's description:
> Reland "Keep a canonical list of shared function infos."
>
> This reverts commit 3164aa7483cb476da84895a3c9810015758fccf9.
>
> Committed: https://crrev.com/cacb646d80daa429f6915824a741f595db7d5044
> Cr-Commit-Position: refs/heads/master@{#29282}

TBR=adamk@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1206263002

Cr-Commit-Position: refs/heads/master@{#29285}

Remove overzealous checking of --cache-optimized-code flag.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1206803003

Cr-Commit-Position: refs/heads/master@{#29284}

[turbofan] Properly type %_IsDate intrinsic.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/1208003002.

Cr-Commit-Position: refs/heads/master@{#29283}

Reland "Keep a canonical list of shared function infos."

This reverts commit 3164aa7483cb476da84895a3c9810015758fccf9.

Review URL: https://codereview.chromium.org/1211453002

Cr-Commit-Position: refs/heads/master@{#29282}

[ic] Record call counts for monomorphic calls made with an IC.

The idea is that TurboFan can use this information for more intelligent
inlining.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1201193003

Cr-Commit-Position: refs/heads/master@{#29281}

Vector ICs: Like megamorphic keyed koads, use a dummy vector for stores

It's useful for the megamorphic keyed store case to not require a
vector and slot as input. Analogous to the load case, we have a dummy
one-ic-slot vector to aid. Since the only kind of MISS is for
megamorphic cache stub failures, we don't need the real vector.
The reason is that megamorphic cache stub failures don't result in any
change to the type feedback vector state.

BUG=
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1210583002

Cr-Commit-Position: refs/heads/master@{#29280}

[turbofan] Add basic support for calling to (a subset of) C functions.

This introduces some initial building blocks for calling out to
C/C++ functions directly from TurboFan generated code objects.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/1205023002.

Cr-Commit-Position: refs/heads/master@{#29279}

Simplify interface to optimized code map lookup.

This is one step torwards extracting an OptimizedCodeMap out from the
SharedFunctionInfo in order to have a more flexible implementation.

R=bmeurer@chromium.org, jarin@chromium.org

Review URL: https://codereview.chromium.org/1205783003.

Cr-Commit-Position: refs/heads/master@{#29278}

[turbofan] Revive the useful parts of the SimplifiedOperatorReducer.

This partially reverts https://codereview.chromium.org/1162563002
because we might actually be able to optimize certain combinations
now due to dead code elimination.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1202263006

Cr-Commit-Position: refs/heads/master@{#29277}

Make helper functions compatible with larger ToBooleanStub types.

I missed some functions that need to change.

LOG=N
BUG=v8:4124

Review URL: https://codereview.chromium.org/1199413009

Cr-Commit-Position: refs/heads/master@{#29276}

Make sure bound functions never make it into optimized code map.

This is one step torwards extracting an OptimizedCodeMap out from the
SharedFunctionInfo in order to have a more flexible implementation.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1210523002

Cr-Commit-Position: refs/heads/master@{#29275}

Update V8 DEPS.

Rolling v8/third_party/icu to c3f79166089e5360c09e3053fce50e6e296c3204

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1206173002

Cr-Commit-Position: refs/heads/master@{#29274}

JSON.stringify should handle the replacer before the space

BUG=v8:4227
LOG=N
R=adamk
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1200373003

Cr-Commit-Position: refs/heads/master@{#29273}

Fix evaluation order of Object.prototype.hasOwnProperty

We need to do the ToName before the ToObject.

BUG=v8:4229
LOG=N
R=adamk

Review URL: https://codereview.chromium.org/1211663002

Cr-Commit-Position: refs/heads/master@{#29272}

jsmin.py: Fix issue with escaping of back ticks

The escaping of back ticks in template strings was incorrect

BUG=v8:4240
LOG=N
TBR=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1209713003

Cr-Commit-Position: refs/heads/master@{#29271}

JSON.stringify should use toString of replacer and not valueOf

If the replacer array contains a number wrapper we should use the
toString result and not valueOf.

BUG=v8:4228
LOG=N
R=adamk
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1207013002

Cr-Commit-Position: refs/heads/master@{#29270}

PPC: Debug check fix for test SMI optimization.

R=mbrandy@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1202383005

Cr-Commit-Position: refs/heads/master@{#29269}

i18n.js was not using original functions

The i18n.js code was calling a lot of methods, which might have been
removed or replaced by user code.

Make sure we use the original functions.

BUG=v8:4220
LOG=N
R=adamk, littledan
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1199813004

Cr-Commit-Position: refs/heads/master@{#29268}

Revert of Fix receiver when calling eval() bound by with scope (patchset #3 id:40001 of https://codereview.chromium.org/1202963005/)

Reason for revert:
[Sheriff] Breaks layout tests. Please fix upstream blink first.
http://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Mac/builds/574

Please consider extra blink trybots on a reland.

Original issue's description:
> Fix receiver when calling eval() bound by with scope
>
> Thanks to André Bargull for the report.
>
> BUG=v8:4214
> LOG=N
> R=arv@chromium.org, mstarzinger@chromium.org
>
> Committed: https://crrev.com/3c5f0db3a1768ade68108bf003676ce378d1cbdc
> Cr-Commit-Position: refs/heads/master@{#29259}

TBR=arv@chromium.org,mstarzinger@chromium.org,verwaest@chromium.org,wingo@igalia.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4214

Review URL: https://codereview.chromium.org/1201273004

Cr-Commit-Position: refs/heads/master@{#29267}

Revert of Extend big-disjunction optimization to case-independent regexps (patchset #5 id:80001 of https://codereview.chromium.org/1182783009/)

Reason for revert:
[Sheriff] Test times out now on msan:
http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/builds/2947

Original issue's description:
> Extend big-disjunction optimization to case-independent regexps
>
> R=yangguo@chromium.org
> BUG=chromium:482998
> LOG=n
>
> Committed: https://crrev.com/d2135603bcf462e15a1284d8ed969f6692610dda
> Cr-Commit-Position: refs/heads/master@{#29264}

TBR=yangguo@chromium.org,erikcorry@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:482998

Review URL: https://codereview.chromium.org/1204013003

Cr-Commit-Position: refs/heads/master@{#29266}

Fix cluster-fuzz regression with Workers and recursive serialization

Shell::SerializeValue was using a HandleScope, but was also storing Handles in
an ObjectList. The ObjectList handles would persist after the function had
returned, but will have already been destroyed by the HandleScope, so there is
a use-after-free.

This change removes the HandleScope in Shell::SerializeValue and relies on the
caller's HandleScope.

BUG=chromium:503968
R=jochen@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1211433003

Cr-Commit-Position: refs/heads/master@{#29265}

Extend big-disjunction optimization to case-independent regexps

R=yangguo@chromium.org
BUG=chromium:482998
LOG=n

Review URL: https://codereview.chromium.org/1182783009

Cr-Commit-Position: refs/heads/master@{#29264}

Fix cluster-fuzz regression with Workers when serializing empty string

BUG=chromium:503991
R=jochen@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1210623002

Cr-Commit-Position: refs/heads/master@{#29263}

Fix unexpected token messages in expression classifier

Some tokens need special messages because their token corresponds to
many names.

R=arv@chromium.org
BUG=v8:4213
LOG=N

Review URL: https://codereview.chromium.org/1207743004

Cr-Commit-Position: refs/heads/master@{#29262}

Fix cluster-fuzz regression with Workers on mips.debug

BUG=chromium:503698
R=jochen@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1208573003

Cr-Commit-Position: refs/heads/master@{#29261}

Use C runtime functions for ThrowNewXXError desugarings.

JS runtime function calls cause Hydrogen to bail out.

R=adamk@chromiunm.org,arv@chromium.org

Review URL: https://codereview.chromium.org/1210533003

Cr-Commit-Position: refs/heads/master@{#29260}

Fix receiver when calling eval() bound by with scope

Thanks to André Bargull for the report.

BUG=v8:4214
LOG=N
R=arv@chromium.org, mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1202963005

Cr-Commit-Position: refs/heads/master@{#29259}

Re-land new insertion write barrier.

BUG=

Review URL: https://codereview.chromium.org/1211513002

Cr-Commit-Position: refs/heads/master@{#29258}

PPC: Use big-boy Types to annotate interface descriptor parameters

Port c019d7f498ce6fbac6659924e20ddb6c59aebeb8

Original commit message:
- Thread Type::FunctionType through stubs and the TF pipeline.
- Augment Typer to decorate parameter nodes with types from
  a Type::FunctionType associated with interface descriptors.
- Factor interface descriptors into platform-specific and
  platform-independent components so that all descriptors share
  a common Type::FunctionType for all platforms.

R=danno@chromium.org, dstence@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1206893002

Cr-Commit-Position: refs/heads/master@{#29257}

Ensure there is some space on JS stack available for bootstrapping.

Review URL: https://codereview.chromium.org/1203873005

Cr-Commit-Position: refs/heads/master@{#29256}

Serializer: clear next link in weak cells.

If we do not clear next links during serialization, the
serializer would simply follow those links and serialize
arbitrary objects held by weak cells. This breaks the
invariant in the code serializer, which crashes if it
sees context-dependent objects.

R=ulan@chromium.org
BUG=chromium:503552
LOG=Y

Review URL: https://codereview.chromium.org/1203973002

Cr-Commit-Position: refs/heads/master@{#29255}

PPC: Do not add extra argument for new.target

Port 8196c28a94f62dec026f2b564ba81d690a4ed593

Original commit message:
JSConstructStub for subclass constructors instead locates new.target in
a known location on the stack.

R=dslomov@chromium.org, dstence@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1208443002

Cr-Commit-Position: refs/heads/master@{#29254}

Fix -Werror=sign-compare error with GCC

R=jkummerow@chromium.org
LOG=N
BUG=

Review URL: https://codereview.chromium.org/1202843006

Cr-Commit-Position: refs/heads/master@{#29253}

[android] Set platform to 16 for 32 bit builds.

TBR=ulan, jochen
NOTRY=true

Review URL: https://codereview.chromium.org/1209453003

Cr-Commit-Position: refs/heads/master@{#29252}

[turbofan] Make TyperCache global and thread safe.

This way we need the common types only once per process and we don't
need to recreate them for every compilation. It uses the same pattern
that we already apply to caching operators. This simplifies the type
cache a lot.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/1209513002

Cr-Commit-Position: refs/heads/master@{#29251}

[x64] Fix instruction selection for Word64Equal(Word64And, 0).

This fixes a slight inconsistency in the InstructionSelector that
basically disabled the optimization for things like ObjectIsSmi.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1206773002

Cr-Commit-Position: refs/heads/master@{#29250}

Reland r21101: "ARM64: use jssp for stack slots"

The original implementation assumed that LPushArguments and
LInvoke/Call* could be assumed to be exclusively sequential. However,
this isn't always the case. For example, GenerateCallFunction pushes
some arguments and then selects between HInvokeFunction and
HCallFunction.

This fixed implementation resets a pushed_arguments_ counter based on
the argument_count() of the preceeding basic block, then tracks it
per-instruction as before (except that now we maintain a count rather
than a boolean flag).

At the same time, since we now track exactly how many arguments have
been pushed onto the stack, I was able to adjust the offset accordingly
and use jssp for stack slots even when arguments have been pushed.

BUG=

Review URL: https://codereview.chromium.org/1038363002

Cr-Commit-Position: refs/heads/master@{#29249}

Use big-boy Types to annotate interface descriptor parameters

- Thread Type::FunctionType through stubs and the TF pipeline.
- Augment Typer to decorate parameter nodes with types from
  a Type::FunctionType associated with interface descriptors.
- Factor interface descriptors into platform-specific and
  platform-independent components so that all descriptors share
  a common Type::FunctionType for all platforms.

Review URL: https://codereview.chromium.org/1197703002

Cr-Commit-Position: refs/heads/master@{#29248}

Expand ToBoolean stub so it can handle more types.

SIMD values will require their own type code for conversion to boolean.

LOG=N
BUG=v8:4124

Review URL: https://codereview.chromium.org/1202973003

Cr-Commit-Position: refs/heads/master@{#29247}

Fix ReferenceError of Worker in regress-crbug-503578

Worker is not defined on the V8 Shared bots.

BUG=chromium:503578
R=jarin@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1202763004

Cr-Commit-Position: refs/heads/master@{#29246}

[android] Completly move path logic to gyp config.

BUG=chromium:502176
LOG=n

Review URL: https://codereview.chromium.org/1203653002

Cr-Commit-Position: refs/heads/master@{#29245}

Fix cluster-fuzz found regression in d8 when deserializing ArrayBuffer

BUG=503578
R=jarin@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1204753002

Cr-Commit-Position: refs/heads/master@{#29244}

[turbofan] Remove stale control-reducer.cc file.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1197793005

Cr-Commit-Position: refs/heads/master@{#29243}

Date() should not depend on Date.prototype.toString

We used to call toString as a method which is not safe.

BUG=v8:4225
LOG=Y
R=adamk, littledan
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1200033003

Cr-Commit-Position: refs/heads/master@{#29242}

Revert "Keep a canonical list of shared function infos."

Speculative revert in the hopes of fixing serializer crashes seen in canary.

This reverts commit c1669450834436508e0007885eb7ac266cbcf083, as well as
followup change "Do not look for existing shared function info when compiling a new script."
(commit 7c43967bb73783b46c2ccf9cdd0fa716b74ce278).

BUG=chromium:503552,v8:4132
TBR=yangguo@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1207583002

Cr-Commit-Position: refs/heads/master@{#29241}

Avoid built-ins in `Date.prototype.toISOString`

TEST=mjsunit/date
BUG=v8:4226
LOG=N

Review URL: https://codereview.chromium.org/1203733002

Cr-Commit-Position: refs/heads/master@{#29240}

Add mjsunit tests for optimization of float min/max.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1199053011

Cr-Commit-Position: refs/heads/master@{#29239}

Do not add extra argument for new.target

JSConstructStub for subclass constructors instead locates new.target in
a known location on the stack.

R=arv@chromium.org,adamk@chromium.org
BUG=v8:3886
LOG=N

Review URL: https://codereview.chromium.org/1196193014

Cr-Commit-Position: refs/heads/master@{#29238}

Expose Map/Set methods through the API

Map: get, set, has, delete, clear
Set: add, has, delete, clear

All except clear are implemented as calls into collection.js.

Note that some of these shadow methods of v8::Object. It's unclear
how confusing that's going to be: on the one hand, it seems likely
that most operations you would want to do on a Map or Set are these.
On the other, generic code could get confused if it somehow gets
ahold of a variable that happens to be C++-typed as a v8::Map or v8::Set.

BUG=v8:3340
LOG=y

Review URL: https://codereview.chromium.org/1204623002

Cr-Commit-Position: refs/heads/master@{#29237}

Fixed exception handling in Realm.create().

BUG=chromium:501711
LOG=N

Review URL: https://codereview.chromium.org/1207453002

Cr-Commit-Position: refs/heads/master@{#29236}

Let GC select the collector when the external memory allocation limit is reached

BUG=none
R=hpayer@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1201993002

Cr-Commit-Position: refs/heads/master@{#29235}

PPC: [turbofan] Fix implementation of Float64Min.

The optimized instruction sequences for floating-point min/max do not
have the same behaviour as TurboFan's Float(32|64)(Min|Max) functions
(incorrect handling for NaN operands).

R=dstence@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1193843015

Cr-Commit-Position: refs/heads/master@{#29234}

Don't insert elements transitions into normalized maps

BUG=chromium:499790
LOG=n

Review URL: https://codereview.chromium.org/1203653003

Cr-Commit-Position: refs/heads/master@{#29233}

Cleanup adding elements and in particular dictionary elements

BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1196163005

Cr-Commit-Position: refs/heads/master@{#29232}

[turbofan] Make global variable loads and stores explicit.

This is a precursor to using specialized LoadIC and StoreIC stubs for
global variable access. It also removes the need to keep track of the
global object in the type system, hence freeing up one bit.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1205473004

Cr-Commit-Position: refs/heads/master@{#29231}

[turbofan] NaN is never truish.

BUG=v8:4207
LOG=y
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1198993009

Cr-Commit-Position: refs/heads/master@{#29230}

[arm64][turbofan] Fix implementation of Float64Min.

ARM64's `fmin` and `fmax` instructions don't have the same behaviour as
TurboFan's Float(32|64)(Min|Max) functions.

BUG=4206
LOG=N

Review URL: https://codereview.chromium.org/1200123004

Cr-Commit-Position: refs/heads/master@{#29229}

Fix regexp perf: Only increase array size if needed

BUG=chromium:503457
LOG=n

Review URL: https://codereview.chromium.org/1198993008

Cr-Commit-Position: refs/heads/master@{#29228}

Merge AddFastElement and AddFastDoubleElement

BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1198343004

Cr-Commit-Position: refs/heads/master@{#29227}

Map::ReconfigureProperty() should mark map as unstable when it returns a different map.

BUG=chromium:502930
LOG=N

Review URL: https://codereview.chromium.org/1200003002

Cr-Commit-Position: refs/heads/master@{#29226}

[turbofan] Run DeadCodeElimination together with the advanced reducers.

This will immediately remove dead code from the graph once any of
the advanced reducers inserts it. Also changes the GraphReducer to
use the canonical Dead node for ReplaceWithValue.

R=jarin@chromium.org

Committed: https://crrev.com/88a40c5fb381924b1c0b2403dc582bceb2abe5da
Cr-Commit-Position: refs/heads/master@{#29217}

Review URL: https://codereview.chromium.org/1206533002.

Cr-Commit-Position: refs/heads/master@{#29225}