The asm-wasm-builder started allocating SharedFunctionInfos,
this makes it bad we'd passed Script by pointer (due to ignorance).
Switching to Handle<Script>.

R=clemensh@chromium.org,titzer@chromium.org
BUG=v8:5716

Review-Url: https://codereview.chromium.org/2552873003
Cr-Commit-Position: refs/heads/master@{#41529}

R=bradnelson@chromium.org,clemensh@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2553123002
Cr-Commit-Position: refs/heads/master@{#41528}

Make some methods on V8DebuggerScript virtual and provide the
implementations ActualScript for scripts which are backed by scripts on
V8's side, and WasmVirtualScript for wasm scripts.

The added test case ensures that we at least don't crash on the attempt
to get breakable locations for wasm "scripts", which we did previously.
Returning a reasonable result for wasm will be implemented in a
follow-up commit.

R=yangguo@chromium.org, jgruber@chromium.org
BUG=chromium:667767,chromium:613110

Review-Url: https://codereview.chromium.org/2532433003
Cr-Commit-Position: refs/heads/master@{#41527}

Passing kAllowLargeObjectAllocation now allocates in LOS if necessary.
Allow such allocations when growing fixed arrays in RegExp's @@match
and @@split operations.

BUG=chromium:670671

Review-Url: https://codereview.chromium.org/2555703003
Cr-Commit-Position: refs/heads/master@{#41526}

In switching to incremental parsing, we switched to pre-computing
line numbers for forward declarations. This is expensive,
because GetLineNumber reparses lines.

Also, switch typing maps to unordered_map (as they appear hot).

BUG=v8:4203
R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2553033002
Cr-Commit-Position: refs/heads/master@{#41525}

come from the runtime.

This patch fixes an issue of heap growing to max capacity when incremental
marking is finished but cannot finalize due to GC stack guard not triggering.

It can happen if all allocations come from the runtime, for example,
from JSON parser or compiler.

Now before expanding the heap we check if we are above the allocation limit
and the incremental marking needs to be finalized. If so we do not expand
the heap and force GC, which will finalize the incremental marking.
The check is performed for paged spaces and large-object space.

BUG=chromium:670675

Review-Url: https://codereview.chromium.org/2552613004
Cr-Commit-Position: refs/heads/master@{#41524}

BUG=v8:5193
NOTRY=true
TBR=alph@chromium.org,yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2555683003
Cr-Commit-Position: refs/heads/master@{#41523}

It turns out that showing a five-digit number of resources blocks the
UI for a few minutes, and it remains very laggy even after that.
This CL adds another component to the path of wasm scripts if the
module contains more than 300 functions. The additional component will
be the function index rounded down to the next multiple of 100.
Example URL before:
wasm://wasm/wasm-0284f1c6/wasm-0284f1c6-26337
Example URL after:
wasm://wasm/wasm-0284f1c6/26300/wasm-0284f1c6-26337

This avoids showing a five-digit number of entries in the resources view.

R=kozyatinskiy@chromium.org, titzer@chromium.org, yangguo@chromium.org
BUG=chromium:659715

Review-Url: https://codereview.chromium.org/2555433002
Cr-Commit-Position: refs/heads/master@{#41522}

This makes the context allocation less pessimistic in the following cases:

function outer() {
  var a; // Won't be context allocated
  function inner1() { var a; a; }
  function inner2(a) { a; }
  function inner3([a]) { a; }
  function inner4({ a: b}) { a; }
}

BUG=v8:5501

Review-Url: https://codereview.chromium.org/2407163003
Cr-Commit-Position: refs/heads/master@{#41521}

This is done by reimplementing Symbol.for directly on top of
NameDictionary. A nice side effect is the removal of src/js/symbol.js

R=jochen@chromium.org, peria@chromium.org
BUG=chromium:617892

Review-Url: https://codereview.chromium.org/2551763003
Cr-Commit-Position: refs/heads/master@{#41520}

*and* report all "virtual" wasm scripts right when the wasm script is
registered at the inspector.

WasmScript is a subtype of Script, with the cast checking that it is
actually a wasm script.
This layout makes it quite easy to implement functionality that is only
available for wasm scripts, and allows to later directly use the
WasmCompiledModule instead of the i::Script for backing the
debug::WasmScript. We might also add virtual methods to
provide different implementations for GetSourcePosition, Source and
others.

DisassembleWasmFunction now also becomes a method of this class instead
of a static function on the DebugInterface.

The WasmTranslation now uses the new WasmScript type instead of the
Script wrapper, and also registers all virtual wasm scripts immediately
when the wasm script is made public to the inspector (when the wasm
module is created).

R=yangguo@chromium.org,dgozman@chromium.org,titzer@chromium.org
BUG=chromium:613110,chromium:659715

Review-Url: https://codereview.chromium.org/2531163010
Cr-Commit-Position: refs/heads/master@{#41519}

TBR=bmeurer@chromium.org
BUG=chromium:671576

Review-Url: https://codereview.chromium.org/2550143004
Cr-Commit-Position: refs/heads/master@{#41518}

BUG=v8:5716
R=machenbach@chromium.org
NOTRY=true
CC=titzer@chromium.org, bradnelson@chromium.org

Review-Url: https://codereview.chromium.org/2554023002
Cr-Commit-Position: refs/heads/master@{#41517}

This turns the status files check into a source processor similar to
lint and copyright check. On upload and on trybots it will only run
on the affected files.

BUG=v8:5603
NOTRY=true

Review-Url: https://codereview.chromium.org/2553633002
Cr-Commit-Position: refs/heads/master@{#41516}

BUG=v8:4203
R=danno@chromium.org,titzer@chromium.org,rmcilroy@chromium.org

Review-Url: https://codereview.chromium.org/2553963003
Cr-Commit-Position: refs/heads/master@{#41515}

Equality with null/undefined is equivalent to a check on the undetectable bit
on the map of the object. This would be more efficient than performing the entire
comparison operation.

This cl introduces:
1. A new bytecode called TestUndetectable that checks if the object is null/undefined.
2. Updates peeophole optimizer to emit TestUndetectable when a LdaNull/Undefined
precedes equality check.
4. TestUndetectable is transformed to ObjectIsUndetectable operator when building
turbofan graph.

BUG=v8:4280

Review-Url: https://codereview.chromium.org/2547043002
Cr-Commit-Position: refs/heads/master@{#41514}

Move a method that is not referenced in tools/presubmit.py.

BUG=v8:5603
NOTRY=true

Review-Url: https://codereview.chromium.org/2553623002
Cr-Commit-Position: refs/heads/master@{#41513}

Reason for revert:
Breaks layout tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/11861

See:
https://github.com/v8/v8/wiki/Blink-layout-tests

Original issue's description:
> Object
> -- New JSObject for promises: JSPromise
>
> Builtins
> -- PromiseThen TFJ
> -- PromiseCreateAndSet TFJ for internal use
> -- PerformPromiseThen TFJ for internal use
> -- PromiseInit for initial promise setup
> -- SpeciesConstructor for use in PromiseThen
> -- ThrowIfNotJSReceiver for use in SpeciesConstructor
> -- AppendPromiseCallback to update FixedArray with new callback
> -- InternalPerformPromiseThen
>
> Promises.js
> -- Cleanup unused symbols
> -- Remove PerformPromiseThen
> -- Remove PromiseThen
> -- Remove PromiseSet
> -- Remove PromiseAttachCallbacks
>
> Runtime
> -- PromiseSet to set promise inobject values
> -- Refactor functions to use FixedArrays for callbacks instead of
>    JSArray
> -- Runtime_PromiseStatus to return promise status
> -- Runtime_PromiseResult to return promise result
> -- Runtime_PromiseDeferred to return deferred attached to promise
> -- Runtime_PromiseRejectReactions to return reject reactions attached
>    to promise
>
> This CL results in a 13.07% improvement in the promises benchmark
> (over 5 runs).
>
> BUG=v8:5343
>
> Committed: https://crrev.com/30b564c76f490f8f6b311a74b25b26cf0a96be2d
> Cr-Commit-Position: refs/heads/master@{#41503}

TBR=bmeurer@chromium.org,jgruber@chromium.org,caitp@igalia.com,gsathya@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5343

Review-Url: https://codereview.chromium.org/2554013002
Cr-Commit-Position: refs/heads/master@{#41512}

BUG=

Review-Url: https://codereview.chromium.org/2558443002
Cr-Commit-Position: refs/heads/master@{#41511}

asm.js errata on section 5.4 allows fround of numeric literals
without '.'.

BUG=v8:4203
R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2552243002
Cr-Commit-Position: refs/heads/master@{#41510}

This allows us to forward declare Label and Variable classes without including the
code-assembler.h.

BUG=

Review-Url: https://codereview.chromium.org/2551163003
Cr-Commit-Position: refs/heads/master@{#41509}

Port for 3396bb29

TEST=
BUG=

Review-Url: https://codereview.chromium.org/2534413002
Cr-Commit-Position: refs/heads/master@{#41508}

Incooperate suggestion from adamk@ to only sent lexical variables to
I+TF that require explicit initialization, i.e. don't send named
function expressions to I+TF. This should recover most of the regression
now.

Also introduce a regression test for the original let issue.

BUG=chromium:670691,v8:5666
R=adamk@chromium.org,yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2556663002
Cr-Commit-Position: refs/heads/master@{#41507}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/0676437..2b2a961

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/buildtools/+log/102c163..64e38f0

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/627b0d9..287f4bd

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2555663002
Cr-Commit-Position: refs/heads/master@{#41506}

R=bbudge@chromium.org, titzer@chromium.org

Review-Url: https://codereview.chromium.org/2385393002
Cr-Commit-Position: refs/heads/master@{#41505}

Reland of [typedarrays] remove invalid optimization in NAMEConstructor() (patchset #1 id:1 of https://codereview.chromium.org/2548583003/ )

Reason for revert:
The bot was not affected by the revert. Speculation was wrong.

Original issue's description:
> Revert of [typedarrays] remove invalid optimization in NAMEConstructor() (patchset #1 id:1 of https://codereview.chromium.org/2544503002/ )
>
> Reason for revert:
> Speculative revert for causing timeouts on Win Debug gpu fyi bot
>
> Nothing else looks even remotely relevant in the list of changes.
> Will reland if this doesn't fix the issues.
>
> BUG=670396
>
> Original issue's description:
> > [typedarrays] remove invalid optimization in NAMEConstructor()
> >
> > Before, we were treating objects with the builtin ArrayValues iterator
> > method as array-like, where the iterator would iterate through to the
> > full length of the object.
> >
> > This optimization was not sound, because it does not ensure that the
> > next method hasn't been modified. Even if it hasn't been modified,
> > it's entirely possible to be modified during iteration. Thus, this
> > optimization has been removed due to its observability.
> >
> > BUG=v8:5699
> > R=littledan@chromium.org, cbruni@chromium.org
> >
> > Committed: https://crrev.com/77df8c67d9609ada3b7d79e8e6d33f198bbad5a1
> > Cr-Commit-Position: refs/heads/master@{#41394}
>
> TBR=cbruni@chromium.org,littledan@chromium.org,caitp@igalia.com
> # Not skipping CQ checks because original CL landed more than 1 days ago.
> BUG=v8:5699
>
> Committed: https://crrev.com/0ea4a542202d501c4e550474e89512532571f3a0
> Cr-Commit-Position: refs/heads/master@{#41461}

TBR=cbruni@chromium.org,littledan@chromium.org,caitp@igalia.com,enne@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=670396

Review-Url: https://codereview.chromium.org/2553873002
Cr-Commit-Position: refs/heads/master@{#41504}

-- New JSObject for promises: JSPromise

Builtins
-- PromiseThen TFJ
-- PromiseCreateAndSet TFJ for internal use
-- PerformPromiseThen TFJ for internal use
-- PromiseInit for initial promise setup
-- SpeciesConstructor for use in PromiseThen
-- ThrowIfNotJSReceiver for use in SpeciesConstructor
-- AppendPromiseCallback to update FixedArray with new callback
-- InternalPerformPromiseThen

Promises.js
-- Cleanup unused symbols
-- Remove PerformPromiseThen
-- Remove PromiseThen
-- Remove PromiseSet
-- Remove PromiseAttachCallbacks

Runtime
-- PromiseSet to set promise inobject values
-- Refactor functions to use FixedArrays for callbacks instead of
   JSArray
-- Runtime_PromiseStatus to return promise status
-- Runtime_PromiseResult to return promise result
-- Runtime_PromiseDeferred to return deferred attached to promise
-- Runtime_PromiseRejectReactions to return reject reactions attached
   to promise

This CL results in a 13.07% improvement in the promises benchmark
(over 5 runs).

BUG=v8:5343

Review-Url: https://codereview.chromium.org/2536463002
Cr-Commit-Position: refs/heads/master@{#41503}

During bootstrapping when installing the global object we copy over the
properties from the snapshotted global object to the one created from a
provided template. Originally Genesis::TransferNamedProperties just iterated
over the entries, making the final order hash and thus platform dependent.
This CL fixes this by sorting the keys by enumeration index before copying them
to the destination object and thus making the key enumaration on the global
object platform independent.

Drive-by-fix: avoid crash when printing the global object during bootstrapping.

BUG=chromium:669029

Review-Url: https://codereview.chromium.org/2533223002
Cr-Commit-Position: refs/heads/master@{#41502}

It only contained type definitions and static functions, so we
can also just make it a namespace.

R=kozyatinskiy@chromium.org, yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2549133002
Cr-Commit-Position: refs/heads/master@{#41501}

This avoids the crash which ClusterFuzz found, but still does not
report the same position as without validate.asm.
For calls like "foo()|0", we report the position of the call instead of
the position of the "|" if ToNumber throws an error.

After this CL, the correctness-fuzzer for validate-asm will probably
find mismatches there.

R=titzer@chromium.org
BUG=chromium:670808

Review-Url: https://codereview.chromium.org/2548323002
Cr-Commit-Position: refs/heads/master@{#41500}

It's no longer necessary, and has been off for a year.

BUG=

Review-Url: https://codereview.chromium.org/2553643002
Cr-Commit-Position: refs/heads/master@{#41499}

Reorders the jump bytecodes so that the majority of jump checks can be
implemented as range checks (rather than a list of comparisons that get
compiled to a bunch of jumps).

Review-Url: https://codereview.chromium.org/2537123002
Cr-Commit-Position: refs/heads/master@{#41498}

BUG=

Review-Url: https://codereview.chromium.org/2545773003
Cr-Commit-Position: refs/heads/master@{#41497}

R=franzih@chromium.org

Review-Url: https://codereview.chromium.org/2551883002
Cr-Commit-Position: refs/heads/master@{#41496}

R=adamk@chromium.org, verwaest@chromium.org
BUG=v8:5698

Review-Url: https://codereview.chromium.org/2537413003
Cr-Commit-Position: refs/heads/master@{#41495}

Roll includes:
- [inspector_protocol] Move imported/exported information to config options.
- [inspector_protocol] Restructure generator code.

BUG=chromium:664683

Review-Url: https://codereview.chromium.org/2553513002
Cr-Commit-Position: refs/heads/master@{#41494}

This moves all helper functions to the RegExpBuiltinsAssembler together
with some follow-up cleanups for:

* consistent function names,
* consistent parameter names and order,
* removal of global CVariable and CLabel typedefs.

BUG=v8:5339

Review-Url: https://codereview.chromium.org/2554453003
Cr-Commit-Position: refs/heads/master@{#41493}

BUG=

Review-Url: https://codereview.chromium.org/2549083002
Cr-Commit-Position: refs/heads/master@{#41492}

BUG=v8:5339

Review-Url: https://codereview.chromium.org/2543243002
Cr-Commit-Position: refs/heads/master@{#41491}

Microbenchmarks show 25% improvement over C++, 11% improvement over JS
for the constructor. We don't have a microbenchmark covering the compile
method.

Locally, octane/regexp improved by 2%.

BUG=v8:5339

Review-Url: https://codereview.chromium.org/2551443002
Cr-Commit-Position: refs/heads/master@{#41490}