If you try to store an object in new space to the Code header, it will
be added to the store buffer, and a DCHECK will fail later, since Code
objects should never occur in the store buffer.

This CL adds DCHECKs to catch such assignments early. Once we handle
this case better, they can be removed again.

R=mstarzinger@chromium.org, ulan@chromium.org
BUG=chromium:674535

Review-Url: https://codereview.chromium.org/2587073002
Cr-Commit-Position: refs/heads/master@{#42142}

R=clemensh@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2595733003
Cr-Commit-Position: refs/heads/master@{#42141}

Downside: this adds all kinds of weird includes in the .cc files.

(See design doc linked in the bug.)

BUG=v8:5402

Review-Url: https://codereview.chromium.org/2622503002
Cr-Commit-Position: refs/heads/master@{#42140}

BUG=

Review-Url: https://codereview.chromium.org/2586513002
Cr-Commit-Position: refs/heads/master@{#42139}

The pattern IsNull(isolate) || IsUndefined(isolate) is used in many places all
over the code base.

Review-Url: https://codereview.chromium.org/2601503002
Cr-Commit-Position: refs/heads/master@{#42138}

R=mvstanton@chromium.org, ulan@chromium.org
BUG=v8:5808

Review-Url: https://codereview.chromium.org/2617363003
Cr-Commit-Position: refs/heads/master@{#42137}

ToName, ToObject, and ToNumber do not need an
eager checkpoint.

BUG=

Review-Url: https://codereview.chromium.org/2623473002
Cr-Commit-Position: refs/heads/master@{#42136}

Review-Url: https://codereview.chromium.org/2614773004
Cr-Commit-Position: refs/heads/master@{#42135}

Review-Url: https://codereview.chromium.org/2614973003
Cr-Commit-Position: refs/heads/master@{#42134}

BUG=v8:5807
NOTRY=true
TBR=clemensh@chromium.org,ahaas@chromium.org

Review-Url: https://codereview.chromium.org/2620653002
Cr-Commit-Position: refs/heads/master@{#42133}

Background to this is that blink needs to be able to pass different internal
fields deserialization callbacks for individual to-be-deserialized contexts.

R=jochen@chromium.org, peria@chromium.org
BUG=chromium:617892

Review-Url: https://codereview.chromium.org/2619203002
Cr-Commit-Position: refs/heads/master@{#42132}

BUG=

Review-Url: https://codereview.chromium.org/2596803002
Cr-Commit-Position: refs/heads/master@{#42131}

We did not associate any position to the stack check in the wasm
function prologue, hence a check failed later when trying to map the
non-existent position to the asm.js source position.

With this CL, we add a mapping to the source position table, mapping
the stack check call to byte offset 0 (which is distinct from any valid
instruction position). Also, we add another entry to the asm.js source
position sidetable, mapping byte offset 0 to the start source position
of the function body.

R=titzer@chromium.org, ahaas@chromium.org
BUG=chromium:677685

Review-Url: https://codereview.chromium.org/2609363004
Cr-Commit-Position: refs/heads/master@{#42130}

This adds tracking the following:
- Declarations created by catch (potentially destructuring)
- Declarations created by for-each (potentially destructuring)
- Class declarations

BUG=v8:5501, v8:5516

Review-Url: https://codereview.chromium.org/2617923003
Cr-Commit-Position: refs/heads/master@{#42129}

The two remaining uses of this intrinsic in debug.js and mirrors.js now
simply rely on the runtime function.

BUG=v8:5339

Review-Url: https://codereview.chromium.org/2591923003
Cr-Original-Commit-Position: refs/heads/master@{#41892}
Committed: https://chromium.googlesource.com/v8/v8/+/c9cb94a06fa7a863d24dd6760b66cecd55748abf
Review-Url: https://codereview.chromium.org/2591923003
Cr-Commit-Position: refs/heads/master@{#42128}

BUG=v8:5805

Review-Url: https://codereview.chromium.org/2619753002
Cr-Commit-Position: refs/heads/master@{#42127}

X87: Revert of [turbofan] Improve codegen for 8- and 16-bit memory comparisons on Intel platforms (patchset #3 id:40001 of https://codereview.chromium.org/2605863002/ ).

  port c16ca32e (r42092)

  original commit message:
  Reason for revert:
  Breaks wasm benchmark (http://crbug.com/v8/5798).

  Original issue's description:
  > [turbofan] Improve codegen for 8- and 16-bit memory comparisons on Intel platforms
  >
  > Recognize and emit in-memory comparisons of 8-bit and 16-bit values with
  > immediate values that fit.
  >
  > LOG=N
  > R=epertoso@chromium.org
  >
  > Review-Url: https://codereview.chromium.org/2605863002
  > Cr-Commit-Position: refs/heads/master@{#41971}
  > Committed: https://chromium.googlesource.com/v8/v8/+/be11812c53ff6c8ce320887bc76a3b60d8103695

BUG=

Review-Url: https://codereview.chromium.org/2622463002
Cr-Commit-Position: refs/heads/master@{#42126}

1) Fix confusion between for of and for in.

2) If a for loop doesn't declare its variables, no new variables
are introduced (the outer scope variables are used).

3) Add more cases for destructuring for and destructuring catch.

BUG=v8:5501, v8:5516

Review-Url: https://codereview.chromium.org/2614023004
Cr-Commit-Position: refs/heads/master@{#42125}

If this is possible at all, we need to at least do the first step
(prepare to parse).

BUG=v8:5215
R=vogelheim@chromium.org,marja@chromium.org

Review-Url: https://codereview.chromium.org/2610173004
Cr-Commit-Position: refs/heads/master@{#42124}

Don't assume that the prototype of an object is always a JSObject when
inlining the known receiver map case for abstract relational comparison.

BUG=chromium:679202
R=ishell@chromium.org

Review-Url: https://codereview.chromium.org/2621583002
Cr-Commit-Position: refs/heads/master@{#42123}

If one input to JSStrictEqual/JSNotStrictEqual is Unique (except
InternalizedString) or the hole, then we can turn that into a
direct pointer comparison, as such values are only equal to exactly
the same unique value.

BUG=v8:5267
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2611363002
Cr-Commit-Position: refs/heads/master@{#42122}

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/4a7b232..487c2d0

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2619713002
Cr-Commit-Position: refs/heads/master@{#42121}

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/9e6944a..4a7b232

Rolling v8/third_party/instrumented_libraries: https://chromium.googlesource.com/chromium/src/third_party/instrumented_libraries/+log/45f5814..5b6f777

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/5b3c04d..d150023

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2618183002
Cr-Commit-Position: refs/heads/master@{#42120}

Revert of [intl] Remove redundant type checking system (patchset #4 id:60001 of https://codereview.chromium.org/2600913002/ )

Reason for revert:
Breaks noi18n.

Original issue's description:
> [intl] Remove redundant type checking system
>
> Previously, the Intl implementation tracked types two ways:
>  - In the intl_initialized_marker_symbol
>  - In various named properties of the intl_impl_object_symbol value
>
> As far as I can tell, these will never disagree with each other,
> modulo bugs in Intl itself. This patch removes the second type
> checking system.
>
> This reland includes a fixed type check for
> Intl.DateTimeFormat.prototype.formatToParts , which is the only Intl
> method which is not bound. All future methods will follow this
> pattern.
>
> BUG=v8:5751,chromium:677055, v8:4962
> CQ_INCLUDE_TRYBOTS=master.tryserver.v8:v8_linux_noi18n_rel_ng
>
> Review-Url: https://codereview.chromium.org/2600913002
> Cr-Commit-Position: refs/heads/master@{#42118}
> Committed: https://chromium.googlesource.com/v8/v8/+/aa8a2d2789f79c2c367db406e453b9044e594e25

TBR=yangguo@chromium.org,adamk@chromium.org,littledan@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5751,chromium:677055, v8:4962

Review-Url: https://codereview.chromium.org/2617323002
Cr-Commit-Position: refs/heads/master@{#42119}

Previously, the Intl implementation tracked types two ways:
 - In the intl_initialized_marker_symbol
 - In various named properties of the intl_impl_object_symbol value

As far as I can tell, these will never disagree with each other,
modulo bugs in Intl itself. This patch removes the second type
checking system.

This reland includes a fixed type check for
Intl.DateTimeFormat.prototype.formatToParts , which is the only Intl
method which is not bound. All future methods will follow this
pattern.

BUG=v8:5751,chromium:677055, v8:4962
CQ_INCLUDE_TRYBOTS=master.tryserver.v8:v8_linux_noi18n_rel_ng

Review-Url: https://codereview.chromium.org/2600913002
Cr-Commit-Position: refs/heads/master@{#42118}

This patch provides improved infrastructure for developing test262 tests
together with V8. It has three parts:
- The test262 test runner is updated to look for local versions of tests
  in the /test/test262/local-tests directory, which mirrors
  /test/test262/data. Additional tests can be added there and are run
  together with tests from upstream. Upstream tests can be locally
  updated by using the same name in local-tests; if a same-named test
  exists, then only the local version will be run. The local-tests
  directory is in the V8 repository, unlike the contents of the data
  directory, so tests can be added in the same patch as something else.
- The tool /test/test262/upstream-local-tests.sh is added to create
  a patch against the test262 respository based on a patch which changes
  the local-tests directory.
- The tool /test/test262/prune-local-tests.sh is added to remove
  redundant local tests on a test262 roll.

See design doc:
https://docs.google.com/document/d/16bj7AIDgZLv4WOsUEzQ5NzcEN9_xo095e88Pz8FC5rA/edit

Review-Url: https://codereview.chromium.org/2611793002
Cr-Commit-Position: refs/heads/master@{#42117}

BUG=

Review-Url: https://codereview.chromium.org/2619113002
Cr-Commit-Position: refs/heads/master@{#42116}

Separated:
- decoding of locals
- loop assignment analysis
- determination of opcode length

as statics that work on a Decoder. Neither need the context of a
Module, and were used in scenarios where one wasn't available either.

Changed BodyLocalDecls to match the usecases for the type. In all but
one (a printer), we want the list (in order of declaration, with
repetitions) of types of locals.

Removed a now-unnecessary constructor for the WasmFullDecoder.

BUG=

Review-Url: https://codereview.chromium.org/2610813009
Cr-Commit-Position: refs/heads/master@{#42115}

Previously the message was "this is not defined" which is nonsensical.

BUG=v8:4407

Review-Url: https://codereview.chromium.org/2614053002
Cr-Commit-Position: refs/heads/master@{#42114}

BUG=v8:5343

Review-Url: https://codereview.chromium.org/2616673003
Cr-Commit-Position: refs/heads/master@{#42113}

Variables requiring initialization are already forced into ignition,
so all the code supporting hole checks in full-codegen and
ast-graph-builder is dead.

R=bmeurer@chromium.org
BUG=v8:5657

Review-Url: https://codereview.chromium.org/2615033002
Cr-Commit-Position: refs/heads/master@{#42112}

The attached chromium bug suggests that turning this on via a flag
regressed a perf test. Having previously run into slowdowns due
to experimental JS natives, my suspicion is that this regression
can be fixed by including the new builtins in the snapshot.
My intention is to land this patch to see if the regression
goes away on the bots.

Given the nature of this feature, it seems low-risk to remove
the runtime flag. If need be, it would be trivial to craft
a patch to remove these two methods from String.prototype
if we run into web compat issues during the release (note
that no release branch has yet picked up this feature).

BUG=v8:4954, chromium:677444

Review-Url: https://codereview.chromium.org/2610853010
Cr-Commit-Position: refs/heads/master@{#42111}

BUG=

Review-Url: https://codereview.chromium.org/2618743004
Cr-Commit-Position: refs/heads/master@{#42110}

Also moves most of the runtime function into TF. There are lots of
runtime calls but they happen only for the debug case so it's fine.

BUG=v8:5343

Review-Url: https://codereview.chromium.org/2611083002
Cr-Commit-Position: refs/heads/master@{#42109}

CmplSmiLiteral should be used to compare smi

R=joransiu@ca.ibm.com, jyan@ca.ibm.com
BUG=

Review-Url: https://codereview.chromium.org/2614663009
Cr-Commit-Position: refs/heads/master@{#42108}

Remove unused size variable from disassembler.

BUG=

Review-Url: https://codereview.chromium.org/2615633004
Cr-Commit-Position: refs/heads/master@{#42107}

Our test infrastructure ignores missing tests which are listed in
status files. Sometimes, tests are removed and status file lines
are not updated. This patch adds a presubmit check for status
files addressing JavaScript tests to not reference missing tests.
It also cleans up existing violations.

R=machenbach

Review-Url: https://codereview.chromium.org/2610353002
Cr-Commit-Position: refs/heads/master@{#42106}

Removing "limit_", using just "end_".

BUG=

Review-Url: https://codereview.chromium.org/2613193002
Cr-Commit-Position: refs/heads/master@{#42105}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/9cde9c9..87eca92

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/0ec6dce..5b3c04d

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2619503002
Cr-Commit-Position: refs/heads/master@{#42104}

R=gsathya@chromium.org

Review-Url: https://codereview.chromium.org/2612373002
Cr-Commit-Position: refs/heads/master@{#42103}