Merge V8 at r8928: Roll to 3.2.10.37

Bug: 5188807

Change-Id: I0f1fc251f801b222d4dc1647d8a2ec0a8b0f8d83

8 files changed, 66 insertions, 21 deletions

diff --git a/src/arm/deoptimizer-arm.cc b/src/arm/deoptimizer-arm.cc
index f0a69372..6c82c122 100644
--- a/src/arm/deoptimizer-arm.cc
+++ b/src/arm/deoptimizer-arm.cc
@@ -65,8 +65,6 @@ void Deoptimizer::DeoptimizeFunction(JSFunction* function) {
 
   // For each return after a safepoint insert an absolute call to the
   // corresponding deoptimization entry.
-  ASSERT(patch_size() % Assembler::kInstrSize == 0);
-  int call_size_in_words = patch_size() / Assembler::kInstrSize;
   unsigned last_pc_offset = 0;
   SafepointTable table(function->code());
   for (unsigned i = 0; i < table.length(); i++) {
@@ -87,13 +85,18 @@ void Deoptimizer::DeoptimizeFunction(JSFunction* function) {
 #endif
     last_pc_offset = pc_offset;
     if (deoptimization_index != Safepoint::kNoDeoptimizationIndex) {
+      Address deoptimization_entry = Deoptimizer::GetDeoptimizationEntry(
+          deoptimization_index, Deoptimizer::LAZY);
       last_pc_offset += gap_code_size;
+      int call_size_in_bytes = MacroAssembler::CallSize(deoptimization_entry,
+                                                        RelocInfo::NONE);
+      int call_size_in_words = call_size_in_bytes / Assembler::kInstrSize;
+      ASSERT(call_size_in_bytes % Assembler::kInstrSize == 0);
+      ASSERT(call_size_in_bytes <= patch_size());
       CodePatcher patcher(code->instruction_start() + last_pc_offset,
                           call_size_in_words);
-      Address deoptimization_entry = Deoptimizer::GetDeoptimizationEntry(
-          deoptimization_index, Deoptimizer::LAZY);
       patcher.masm()->Call(deoptimization_entry, RelocInfo::NONE);
-      last_pc_offset += patch_size();
+      last_pc_offset += call_size_in_bytes;
     }
   }
 
diff --git a/src/arm/macro-assembler-arm.h b/src/arm/macro-assembler-arm.h
index ab5efb0b..8d817c07 100644
--- a/src/arm/macro-assembler-arm.h
+++ b/src/arm/macro-assembler-arm.h
@@ -100,11 +100,13 @@ class MacroAssembler: public Assembler {
   void Jump(Register target, Condition cond = al);
   void Jump(byte* target, RelocInfo::Mode rmode, Condition cond = al);
   void Jump(Handle<Code> code, RelocInfo::Mode rmode, Condition cond = al);
-  int CallSize(Register target, Condition cond = al);
+  static int CallSize(Register target, Condition cond = al);
   void Call(Register target, Condition cond = al);
-  int CallSize(byte* target, RelocInfo::Mode rmode, Condition cond = al);
+  static int CallSize(byte* target, RelocInfo::Mode rmode, Condition cond = al);
   void Call(byte* target, RelocInfo::Mode rmode, Condition cond = al);
-  int CallSize(Handle<Code> code, RelocInfo::Mode rmode, Condition cond = al);
+  static int CallSize(Handle<Code> code,
+                      RelocInfo::Mode rmode,
+                      Condition cond = al);
   void Call(Handle<Code> code, RelocInfo::Mode rmode, Condition cond = al);
   void Ret(Condition cond = al);
 
@@ -957,7 +959,9 @@ class MacroAssembler: public Assembler {
                            int num_arguments);
 
   void Jump(intptr_t target, RelocInfo::Mode rmode, Condition cond = al);
-  int CallSize(intptr_t target, RelocInfo::Mode rmode, Condition cond = al);
+  static int CallSize(intptr_t target,
+                      RelocInfo::Mode rmode,
+                      Condition cond = al);
   void Call(intptr_t target, RelocInfo::Mode rmode, Condition cond = al);
 
   // Helper functions for generating invokes.
diff --git a/src/ast.cc b/src/ast.cc
index 7ae0f34d..8ab09b38 100644
--- a/src/ast.cc
+++ b/src/ast.cc
@@ -554,6 +554,17 @@ bool CallNew::IsInlineable() const {
 
 
 bool CallRuntime::IsInlineable() const {
+  // Don't try to inline JS runtime calls because we don't (currently) even
+  // optimize them.
+  if (is_jsruntime()) return false;
+  // Don't inline the %_ArgumentsLength or %_Arguments because their
+  // implementation will not work.  There is no stack frame to get them
+  // from.
+  if (function()->intrinsic_type == Runtime::INLINE &&
+      (name()->IsEqualTo(CStrVector("_ArgumentsLength")) ||
+       name()->IsEqualTo(CStrVector("_Arguments")))) {
+    return false;
+  }
   const int count = arguments()->length();
   for (int i = 0; i < count; ++i) {
     if (!arguments()->at(i)->IsInlineable()) return false;
diff --git a/src/bootstrapper.cc b/src/bootstrapper.cc
index a30ffc01..5b876405 100644
--- a/src/bootstrapper.cc
+++ b/src/bootstrapper.cc
@@ -1526,8 +1526,6 @@ bool Genesis::InstallNatives() {
   global_context()->set_string_function_prototype_map(
       HeapObject::cast(string_function->initial_map()->prototype())->map());
 
-  InstallBuiltinFunctionIds();
-
   // Install Function.prototype.call and apply.
   { Handle<String> key = factory->function_class_symbol();
     Handle<JSFunction> function =
@@ -1561,6 +1559,8 @@ bool Genesis::InstallNatives() {
     apply->shared()->set_length(2);
   }
 
+  InstallBuiltinFunctionIds();
+
   // Create a constructor for RegExp results (a variant of Array that
   // predefines the two properties index and match).
   {
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index 086b0e7e..d07e6c7a 100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -3794,6 +3794,13 @@ bool HGraphBuilder::TryArgumentsAccess(Property* expr) {
     return false;
   }
 
+  // Our implementation of arguments (based on this stack frame or an
+  // adapter below it) does not work for inlined functions.
+  if (function_state()->outer() != NULL) {
+    Bailout("arguments access in inlined function");
+    return true;
+  }
+
   HInstruction* result = NULL;
   if (expr->key()->IsPropertyName()) {
     Handle<String> name = expr->key()->AsLiteral()->AsPropertyName();
@@ -4315,10 +4322,17 @@ bool HGraphBuilder::TryCallApply(Call* expr) {
   Property* prop = callee->AsProperty();
   ASSERT(prop != NULL);
 
-  if (info()->scope()->arguments() == NULL) return false;
+  if (!expr->IsMonomorphic() || expr->check_type() != RECEIVER_MAP_CHECK) {
+    return false;
+  }
+  Handle<Map> function_map = expr->GetReceiverTypes()->first();
+  if (function_map->instance_type() != JS_FUNCTION_TYPE ||
+      !expr->target()->shared()->HasBuiltinFunctionId() ||
+      expr->target()->shared()->builtin_function_id() != kFunctionApply) {
+    return false;
+  }
 
-  Handle<String> name = prop->key()->AsLiteral()->AsPropertyName();
-  if (!name->IsEqualTo(CStrVector("apply"))) return false;
+  if (info()->scope()->arguments() == NULL) return false;
 
   ZoneList<Expression*>* args = expr->arguments();
   if (args->length() != 2) return false;
@@ -4328,8 +4342,12 @@ bool HGraphBuilder::TryCallApply(Call* expr) {
   HValue* arg_two_value = environment()->Lookup(arg_two->var());
   if (!arg_two_value->CheckFlag(HValue::kIsArguments)) return false;
 
-  if (!expr->IsMonomorphic() ||
-      expr->check_type() != RECEIVER_MAP_CHECK) return false;
+  // Our implementation of arguments (based on this stack frame or an
+  // adapter below it) does not work for inlined functions.
+  if (function_state()->outer() != NULL) {
+    Bailout("Function.prototype.apply optimization in inlined function");
+    return true;
+  }
 
   // Found pattern f.apply(receiver, arguments).
   VisitForValue(prop->obj());
@@ -4340,10 +4358,7 @@ bool HGraphBuilder::TryCallApply(Call* expr) {
   HValue* receiver = Pop();
   HInstruction* elements = AddInstruction(new(zone()) HArgumentsElements);
   HInstruction* length = AddInstruction(new(zone()) HArgumentsLength(elements));
-  AddCheckConstantFunction(expr,
-                           function,
-                           expr->GetReceiverTypes()->first(),
-                           true);
+  AddCheckConstantFunction(expr, function, function_map, true);
   HInstruction* result =
       new(zone()) HApplyArguments(function, receiver, length, elements);
   result->set_position(expr->position());
@@ -5274,6 +5289,10 @@ void HGraphBuilder::GenerateIsConstructCall(CallRuntime* call) {
 
 // Support for arguments.length and arguments[?].
 void HGraphBuilder::GenerateArgumentsLength(CallRuntime* call) {
+  // Our implementation of arguments (based on this stack frame or an
+  // adapter below it) does not work for inlined functions.  This runtime
+  // function is blacklisted by AstNode::IsInlineable.
+  ASSERT(function_state()->outer() == NULL);
   ASSERT(call->arguments()->length() == 0);
   HInstruction* elements = AddInstruction(new(zone()) HArgumentsElements);
   HArgumentsLength* result = new(zone()) HArgumentsLength(elements);
@@ -5282,6 +5301,10 @@ void HGraphBuilder::GenerateArgumentsLength(CallRuntime* call) {
 
 
 void HGraphBuilder::GenerateArguments(CallRuntime* call) {
+  // Our implementation of arguments (based on this stack frame or an
+  // adapter below it) does not work for inlined functions.  This runtime
+  // function is blacklisted by AstNode::IsInlineable.
+  ASSERT(function_state()->outer() == NULL);
   ASSERT(call->arguments()->length() == 1);
   VISIT_FOR_VALUE(call->arguments()->at(0));
   HValue* index = Pop();
diff --git a/src/hydrogen.h b/src/hydrogen.h
index fbd279f6..37671f4d 100644
--- a/src/hydrogen.h
+++ b/src/hydrogen.h
@@ -801,7 +801,10 @@ class HGraphBuilder: public AstVisitor {
                                             bool is_store);
 
   bool TryArgumentsAccess(Property* expr);
+
+  // Try to optimize fun.apply(receiver, arguments) pattern.
   bool TryCallApply(Call* expr);
+
   bool TryInline(Call* expr);
   bool TryInlineBuiltinFunction(Call* expr,
                                 HValue* receiver,
diff --git a/src/objects.h b/src/objects.h
index bc8f42c1..72daad94 100644
--- a/src/objects.h
+++ b/src/objects.h
@@ -4032,6 +4032,7 @@ class Script: public Struct {
 #define FUNCTIONS_WITH_ID_LIST(V)                   \
   V(Array.prototype, push, ArrayPush)               \
   V(Array.prototype, pop, ArrayPop)                 \
+  V(Function.prototype, apply, FunctionApply)       \
   V(String.prototype, charCodeAt, StringCharCodeAt) \
   V(String.prototype, charAt, StringCharAt)         \
   V(String, fromCharCode, StringFromCharCode)       \
diff --git a/src/version.cc b/src/version.cc
index d72a3550..9c8de04d 100644
--- a/src/version.cc
+++ b/src/version.cc
@@ -35,7 +35,7 @@
 #define MAJOR_VERSION     3
 #define MINOR_VERSION     2
 #define BUILD_NUMBER      10
-#define PATCH_LEVEL       34
+#define PATCH_LEVEL       37
 // Use 1 for candidates and 0 otherwise.
 // (Boolean macro values are not supported by all preprocessors.)
 #define IS_CANDIDATE_VERSION 0