BUG=chromium:693426
NOTRY=true
TBR=mstarzinger@chromium.org,jarin@chromium.org

Change-Id: If9e5611566660455543044ddff60acda1ee153ba
Reviewed-on: https://chromium-review.googlesource.com/446347Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43441}

BUG=chromium:685318
NOTRY=true
TBR=hablich@chromium.org

Change-Id: Ic5a6d721372ff93d1c2254bad0e8c1d9c0b0af94
Reviewed-on: https://chromium-review.googlesource.com/446344Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Aaron Gable <agable@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43440}

Calling AstNode::Print() from within gdb, e.g. during bytecode
generation, sometimes results in a CHECK failure due to handle
dereferencing being disallowed.  This is very frustrating.

Since this function is purely for debugging and not called anywhere in
the code base, I'm now explicitly adding an AllowHandleDereference scope
to it.

R=adamk@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2711003007
Cr-Commit-Position: refs/heads/master@{#43439}

BUG=v8:6005
R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2715793004
Cr-Commit-Position: refs/heads/master@{#43438}

BUG=chromium:662424,chromium:696247
NOTRY=true
TBR=mstarzinger@chromium.org

Change-Id: I8ff62f16267efc20b1f612300498cc0b994c9a58
Reviewed-on: https://chromium-review.googlesource.com/446346Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43437}

BUG=chromium:689877
NOTRY=true
R=yangguo@chromium.org,jgruber@chromium.org

Change-Id: Ic11826510a0c9484832f62aaa8f2078b3088ecc5
Reviewed-on: https://chromium-review.googlesource.com/446395Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43436}

BUG=chromium:695416

Change-Id: Ied3a389d0dfb0132c798bc85e10f7b1fd4432eb4
Reviewed-on: https://chromium-review.googlesource.com/446343Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43435}

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/246a39a..47b9857

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: Ia6870fe800590533b799e96437db0a275284454f
Reviewed-on: https://chromium-review.googlesource.com/446640Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43434}

Currently, ArrayIncludes handles the hypothetical case of an array with
a fast ElementsKind and non-SMI length. This should not happen (and is checked
against in JSArray::JSArrayVerify of objects_debug.cc).

Therefore this CL replaces that handling with a CSA_ASSERT that the length is
indeed SMI.

The CL also simplifies loading of the (SMI) length on 64 bit architectures by
using LoadAndUntagObjectField instead of LoadObjectField+SmiToWord.

BUG=v8:5985

Review-Url: https://codereview.chromium.org/2714193002
Cr-Commit-Position: refs/heads/master@{#43433}

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/buildtools/+log/94cdccb..7e53759

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: I0e85f180a129e1436aaddc1157566e173213f675
Reviewed-on: https://chromium-review.googlesource.com/447016Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43432}

Currently, Generate_ArrayIndexOf handles the hypothetical case of an array with
a fast ElementsKind and non-SMI length. This should not happen (and is checked
against in JSArray::JSArrayVerify of objects_debug.cc).

Therefore this CL replaces that handling with a CSA_ASSERT that the length is
indeed SMI.

The CL also simplifies loading of the (SMI) length on 64 bit architectures by
using LoadAndUntagObjectField instead of LoadObjectField+SmiToWord.

The CL does not add new tests, because test/mjsunit/array-length.js should
cover this already.

BUG=v8:5985

Review-Url: https://codereview.chromium.org/2714173002
Cr-Commit-Position: refs/heads/master@{#43431}

- Renames Create ops to Splat.
- Adds machine operators to initialize all SIMD machine types.
  Boolean vector types may need initialization, so provide zero
  operators.

LOG=N
BUG=v8:4124,695330

Review-Url: https://codereview.chromium.org/2719483002
Cr-Commit-Position: refs/heads/master@{#43430}

Node.js doesn't build because v8_extra_library_files is
used but not defined in v8.gyp.

We can probably clean up the build file and properly
delete v8_extra_library_files, just want to get the integration
build green again.

TBR=adamk@chromium.org

BUG=

Review-Url: https://codereview.chromium.org/2720483002
Cr-Commit-Position: refs/heads/master@{#43429}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/eefc9cc..c7c2db6

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/buildtools/+log/7e53759..94cdccb

Rolling v8/test/wasm-js: https://chromium.googlesource.com/external/github.com/WebAssembly/spec/+log/ac398e4..b8b919e

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/794fff6..246a39a

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/4e912d5..9913fb1

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: Ia8484e1bccf276c89b032201f3aecbe2699ea55f
Reviewed-on: https://chromium-review.googlesource.com/445987Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43428}

- If no comparison function is given for %TypedArray%.prototype.sort,
sort the typedarray using std::sort in C++. This gets 20 times more
benchmark score in Float64Array.
- Move ValidateTypedArray in builtin-typedarray.cc to static inline
method of JSTypedArray class.

BUG=v8:5953

Review-Url: https://codereview.chromium.org/2693043009
Cr-Commit-Position: refs/heads/master@{#43427}

R=dgozman@chromium.org, pfeldman@chromium.org
BUG=v8:5808

Review-Url: https://codereview.chromium.org/2715833003
Cr-Commit-Position: refs/heads/master@{#43426}

It looks like https://codereview.chromium.org/2705293004 changes available space in heap on OOM notification and it produces crash on one of the ports try bot [1].
This test should be more reliable.

[1] https://build.chromium.org/p/client.v8.ports/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20nosnap%20-%20debug

BUG=v8:6018
TBR=dgozman@chromium.org
NOTREECHECKS=true

Review-Url: https://codereview.chromium.org/2714253002
Cr-Commit-Position: refs/heads/master@{#43425}

This reverts commit d2c093bc.

Reason for revert: looks like it brokes try bot [1].

[1] https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20debug

Original change's description:
> [heap] Support for minor MC marking during incremental marking
> 
> BUG=chromium:651354
> 
> Change-Id: Ia8511723b17936b78b33ea685704237c100648e1
> Reviewed-on: https://chromium-review.googlesource.com/439285
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Hannes Payer <hpayer@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#43422}

TBR=ulan@chromium.org,hpayer@chromium.org,mlippautz@chromium.org,hablich@chromium.org,v8-reviews@googlegroups.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:651354

Change-Id: Ib5bada3ecf9d687568668b9a4ef4682bb665b8e1
Reviewed-on: https://chromium-review.googlesource.com/446977Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43424}

Currently try bots [1] are failing on these tests and no CLs can be landed to V8. It looks like these tests were added recently.
Based on https://bugs.chromium.org/p/v8/issues/detail?id=6015, it's known issue in V8 implementation, so mark them as needs investigation.

[1] https://build.chromium.org/p/tryserver.v8/builders/v8_linux64_asan_rel_ng_triggered/builds/16490/steps/Test262%20-%20no%20variants

BUG=v8:6015,v8:6016
TBR=adamk@chromium.org,littledan@chromium.org
NOTREECHECKS=true

Review-Url: https://codereview.chromium.org/2717773002
Cr-Commit-Position: refs/heads/master@{#43423}

BUG=chromium:651354

Change-Id: Ia8511723b17936b78b33ea685704237c100648e1
Reviewed-on: https://chromium-review.googlesource.com/439285
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43422}

BUG=

R=bjaideep@ca.ibm.com, jyan@ca.ibm.com, joransiu@ca.ibm.com

Review-Url: https://codereview.chromium.org/2710153002
Cr-Commit-Position: refs/heads/master@{#43421}

We don't call any of v8::Debug methods in src/inspector codebase and should use debug-interface.h instead.

BUG=none
R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2710243002
Cr-Original-Commit-Position: refs/heads/master@{#43398}
Committed: https://chromium.googlesource.com/v8/v8/+/838b1a8841aba0c421b413c01b0fbd3c024c2249
Review-Url: https://codereview.chromium.org/2710243002
Cr-Commit-Position: refs/heads/master@{#43420}

Introduce a new Object to allow GetIterator("async") to function when the
iterable does not have a Symbol.asyncIterator method.

This patch has been split out from https://codereview.chromium.org/2622833002/
and incorporates test cases.

BUG=v8:5855, v8:4483
R=jgruber@chromium.org, rmcilroy@chromium.org, neis@chromium.org
TBR=hpayer@chromium.org, bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2645313003
Cr-Commit-Position: refs/heads/master@{#43419}

Now that no harmony-flagged features are implemented in experimental
JS, most of this is simply dead code.

As PostExperimentals() is no longer needed, I also removed the use of
Import() in the debug context, allowing the deletion of PostDebug()
along with PostExperimentals(); cleanup code is moved to the
end of PostNatives.

Also gets rid of some longer-dead code in prologue.js related to
TypedArrays, and some duplicate code for setting up SharedArrayBuffer
builtins.

Review-Url: https://codereview.chromium.org/2705293004
Cr-Commit-Position: refs/heads/master@{#43418}

The DescriptorInterceptor should intercept all
Object.getOwnPropertyDescriptor calls. This CL fixes
the interceptor's behavior if the iterator state is
ACCESS_CHECK.

BUG=

Review-Url: https://codereview.chromium.org/2707263002
Cr-Commit-Position: refs/heads/master@{#43417}

Marking it as callable makes typeof return 'function' instead of
'object' when invoked on a remote context or object.

BUG=chromium:527190

Review-Url: https://codereview.chromium.org/2715593002
Cr-Commit-Position: refs/heads/master@{#43416}

If the RHS is 0 and we have Smi feedback, speculate that the result (the LHS)
will continue to be in the Unsigned31 range.  This helps us avoid converting
the result to double when merging with Signed32.

R=jarin@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2709423002
Cr-Commit-Position: refs/heads/master@{#43415}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/2383361..eefc9cc

Rolling v8/test/wasm-js: https://chromium.googlesource.com/external/github.com/WebAssembly/spec/+log/1e5c9c4..ac398e4

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/56214f6..794fff6

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/9982bd3..4e912d5

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: I5ef9779b8d9b238e0372ac48ec06740c5daba6a6
Reviewed-on: https://chromium-review.googlesource.com/446816Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43414}

This is a refactoring CL in preparation for implementing asynchronous compilation.
It moves all the compilation-related functionality to a helper class which will
make it easier to split into background and foreground tasks which is needed
for concurrent/synchronous execution of compilation.

R=clemensh@chromium.org,ahaas@chromium.org
BUG=v8:6003

Review-Url: https://codereview.chromium.org/2710603006
Cr-Commit-Position: refs/heads/master@{#43413}

Adds a perf test for constructing a TypedArray from a regular array,
and from a pre-made ArrayBuffer. Runs both new tests with default and
future configurations for comparison.

BUG=v8:5977

Change-Id: Idd132ca879702c54b2947a0e57ed8fe782f2767f
Reviewed-on: https://chromium-review.googlesource.com/446342Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43412}

This is also needed so that PreParser doesn't need to gather more data for arrow
function params in order to create the uninteresting varblock scopes matching
the scopes created in Parser::BuildParameterInitializationBlock.

This cancels the changes in https://chromium-review.googlesource.com/c/444747
which make PreParser create uninteresting scopes for the normal (non-arrow)
function "eval in default param" case.

R=vogelheim@chromium.org
BUG=v8:5516

Change-Id: I8957ac0796d8738c63492f7928bca6f00e4b4241
Reviewed-on: https://chromium-review.googlesource.com/446339Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43411}

This is a preliminary cleanup necessary for the actual fix of the associated issue.

BUG=chromium:688734

Change-Id: Iecd39ed4cef34c6cc5d9652c5569e048f0db46af
Reviewed-on: https://chromium-review.googlesource.com/446341
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43410}

The only remaining allowed occurence of a context is in WASM_TO_JS
code, which is regenerated for each instance.
This CL removes all the rest, to avoid subtle bugs where we might
forget to patch it. By renaming the BuildCallToRuntime method, we make
sure that noone accidentially calls the version which embeds a context.
For consistency, I even remove it from the WasmRunInterpreter stub,
which is never reused for new instantiations.

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2708743003
Cr-Commit-Position: refs/heads/master@{#43409}

In instruction selector, in the reduction of Word64And(Word64Shr(val,0),
0xFFF...) to EXT instruction, the case where shift value is 0 and mask is
0xFFFFFFFFFFFFFFFF was not supported. We now generate NOP for this case
since no bit extraction is necessary.
We implement the same behavior for MIPS32 even though there are no tests
that are failing.

TEST=cctest/test-run-machops/Regression5951
BUG=

Review-Url: https://codereview.chromium.org/2718433002
Cr-Commit-Position: refs/heads/master@{#43408}

We can make Heap::UpdateAllocationSite cheaper for TurboFan, because
there's no need to check for allocation mementos on Strings in case of
the TurboFan pipeline.

R=mvstanton@chromium.org

Review-Url: https://codereview.chromium.org/2710303002
Cr-Commit-Position: refs/heads/master@{#43407}

TBR=kozyatinskiy@chromium.org
BUG=chromium:695631

Review-Url: https://codereview.chromium.org/2718543005
Cr-Commit-Position: refs/heads/master@{#43406}

This is used for internal security checks in eval(). Expose this to
enable the embedder to implement similar security checks.

R=yangguo@chromium.org
BUG=

Change-Id: I10819713b19527622de5ffffac313d126a887c05
Reviewed-on: https://chromium-review.googlesource.com/446106Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Jochen Eisinger <jochen@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43405}

Revert of [inspector] removed unused #include "include/v8-debug.h" (patchset #2 id:20001 of https://codereview.chromium.org/2710243002/ )

Reason for revert:
breaks presubmit on CI which runs checkdeps

Original issue's description:
> [inspector] removed unused #include "include/v8-debug.h"
>
> We don't call any of v8::Debug methods in src/inspector codebase and should use debug-interface.h instead.
>
> BUG=none
> R=dgozman@chromium.org
>
> Review-Url: https://codereview.chromium.org/2710243002
> Cr-Commit-Position: refs/heads/master@{#43398}
> Committed: https://chromium.googlesource.com/v8/v8/+/838b1a8841aba0c421b413c01b0fbd3c024c2249

TBR=dgozman@chromium.org,kozyatinskiy@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=none

Review-Url: https://codereview.chromium.org/2719433002
Cr-Commit-Position: refs/heads/master@{#43404}

BUG=chromium:695777
NOTRY=true
TBR=tandrii@chromium.org

Review-Url: https://codereview.chromium.org/2714893003 .
Cr-Commit-Position: refs/heads/master@{#43403}

Enable using BaseWithIndexAndDisplacement addressing mode for an address
used by multiple load/stores. It can reduce one instruction to calculate
the address and one register to store the address.

BUG=

Review-Url: https://codereview.chromium.org/2620293004
Cr-Commit-Position: refs/heads/master@{#43402}