This CL moves even more limits to wasm-limits.h and enforces limits for
types, functions, parameter counts, return counts, local counts, imports,
globals, and exports.

R=clemensh@chromium.org, ahaas@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2574133002
Cr-Commit-Position: refs/heads/master@{#41699}

Avoid needless resizing of the StateValueList's fields vector by
reserving its (already known) size.

Review-Url: https://codereview.chromium.org/2572683005
Cr-Commit-Position: refs/heads/master@{#41698}

R=jarin@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2578563002
Cr-Commit-Position: refs/heads/master@{#41697}

This reverts commit 5c1babcc.

This seems to regress a range of benchmarks on ia32:
  Emscripten for Fannkuch, Zlib, MemOps, Life, Bullet
  AreWeFastYet for BulletLoadTime, Fasta, Fannkuch
  JetStream for towers.c, quicksort.c, gcc-loops.cpp, bigfib.cpp

BUG=673861
R=jarin@chromium.org,shiyu.zhang@intel.com

Review-Url: https://codereview.chromium.org/2573983003
Cr-Commit-Position: refs/heads/master@{#41696}

Adding timing info going to the console about asm.js

Rename ConvertAsmToWasm -> CompileAsmViaWasm, to be more precise.
Add enum for wasm data elements.

BUG=v8:4203
R=titzer@chromium.org,yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2577453003
Cr-Commit-Position: refs/heads/master@{#41695}

... and clean it up.

BUG=

Review-Url: https://codereview.chromium.org/2569353004
Cr-Commit-Position: refs/heads/master@{#41694}

R=danno@chromium.org

BUG=

Review-Url: https://codereview.chromium.org/2568303008
Cr-Commit-Position: refs/heads/master@{#41693}

Without this patch, the tests on lines 410, 414, 418 and 422 in
function testNonStaticName of test/mjsunit/es6/function-name.js
would all fail.  The bug caused non-static "name" methods and
properties to be mistaken for static ones.

R=adamk@chromium.org, verwaest@chromium.org
BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2567343004
Cr-Commit-Position: refs/heads/master@{#41692}

WASM exported functions have additional internal fields which change the instance
size. Adding a getter or setter to such an exported function results in its map
becoming normalized. The normalized map cache, however, finds a different map
with a different instance size, and thus BOOM.

R=verwaest@chromium.org,cbruni@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2554343002
Cr-Commit-Position: refs/heads/master@{#41691}

... and fix the inconsistencies.

BUG=

Review-Url: https://codereview.chromium.org/2573573004
Cr-Commit-Position: refs/heads/master@{#41690}

BUG=v8:5735

Review-Url: https://codereview.chromium.org/2574943002
Cr-Commit-Position: refs/heads/master@{#41689}

R=jgruber@chromium.org
BUG=v8:5530

Review-Url: https://codereview.chromium.org/2566093002
Cr-Commit-Position: refs/heads/master@{#41688}

The least two bits of the owner field of a Page are used to determine
whether the Page is part of a large object. If these bits are not equal
to 0x11, the page is part of a large object and needs special handling
e.g. in MemoryChunk::FromAnyPointerAddress to determine which chunk it
belongs to.

This CL fixes an issue in which the store buffer overflows after
a large object space allocation but before the object has been fully
initialized. Store buffer overflow handling attempts to look up the
chunk of a page, but fails to do so correctly since the page's owner
field has not yet been initialized.

This CL ensures that the owner field of all pages belonging to a large
object allocation are initialized to a value that is interpreted
correctly.

BUG=chromium:672041

Committed: https://crrev.com/9b6808bfb5366beebe3af30a06f9851edb2039d4
Review-Url: https://codereview.chromium.org/2565713002
Cr-Original-Commit-Position: refs/heads/master@{#41641}
Cr-Commit-Position: refs/heads/master@{#41687}

Debug mirrors will no longer be supported in the near future.
It will now only be tested by being used by the v8-inspector.

R=jgruber@chromium.org
BUG=v8:5530

Review-Url: https://codereview.chromium.org/2566103002
Cr-Commit-Position: refs/heads/master@{#41686}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/52f7afe..d16d922

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/c69690a..b7b743b

Rolling v8/third_party/icu: https://chromium.googlesource.com/chromium/deps/icu/+log/73e2473..9cd2828

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/7e13606..6b7c8d5

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2569303003
Cr-Commit-Position: refs/heads/master@{#41685}

Revert of Store SharedFunctionInfos of a Script in a FixedArray indexed by their ID (patchset #11 id:190001 of https://codereview.chromium.org/2547483002/ )

Reason for revert:
LiveEdit is broken in some cases.

Original issue's description:
> Store SharedFunctionInfos of a Script in a FixedArray indexed by their ID
>
> Now that SharedFunctionInfos have a unique ID (and the IDs are dense),
> we can use them as an index into an array, instead of using a
> WeakFixedArray where we have to do a linear scan.
>
> Hooking up liveedit is a bit more involved, see
> https://docs.google.com/presentation/d/1FtNa3U7WsF5bPhY9uGoJG5Y9hnz5VBDabfOWpb4unWI/edit
> for an overview
>
> BUG=v8:5589
> R=verwaest@chromium.org,jgruber@chromium.org
>
> Committed: https://crrev.com/6595e7405769dc9d49e9568d61485efc6d468baf
> Cr-Commit-Position: refs/heads/master@{#41600}

TBR=jgruber@chromium.org,verwaest@chromium.org,yangguo@chromium.org,jochen@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=v8:5589,chromium:673950
NOPRESUBMIT=true

Review-Url: https://codereview.chromium.org/2578433002
Cr-Commit-Position: refs/heads/master@{#41684}

Splits PromiseHandle into two TF builtins to account for catch
prediction. An exception in PromiseHandleReject builtin results in a
"caught" prediction whereas an expception in PromiseHandle results in a
"promise rejection" prediction.

An extra is_exception_caught bit is added to Code to mark this catch
prediction behavior.

BUG=v8:5343

Review-Url: https://codereview.chromium.org/2572623002
Cr-Commit-Position: refs/heads/master@{#41683}

Review-Url: https://codereview.chromium.org/2571883002
Cr-Commit-Position: refs/heads/master@{#41682}

R=jarin@chromium.org

BUG=

Review-Url: https://codereview.chromium.org/2568423003
Cr-Commit-Position: refs/heads/master@{#41681}

BUG=v8:5738
R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2574803002
Cr-Commit-Position: refs/heads/master@{#41680}

R=epertoso@chromium.org,mstarzinger@chromium.org

BUG=671324

Review-Url: https://codereview.chromium.org/2571793002
Cr-Commit-Position: refs/heads/master@{#41679}

Since class RememberedSet only contains static methods, it'd be better
to make it as AllStatic class.

BUG=
R=ulan@chromium.org, yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2570783004
Cr-Commit-Position: refs/heads/master@{#41678}

The fast-path for dynamic local variables was previously checking the
lookup variable rather than the shadowed variable when deciding whether
to add a hole check.

BUG=669540

Review-Url: https://codereview.chromium.org/2551023004
Cr-Commit-Position: refs/heads/master@{#41677}

[interpreter][stubs] Enable graph verification for bytecode handlers and stubs included into snapshot.

BUG=

Review-Url: https://codereview.chromium.org/2575473002
Cr-Commit-Position: refs/heads/master@{#41676}

Review-Url: https://codereview.chromium.org/2570803002
Cr-Commit-Position: refs/heads/master@{#41675}

BUG=v8:5343

Review-Url: https://codereview.chromium.org/2573703002
Cr-Commit-Position: refs/heads/master@{#41674}

BUG=v8:5501

Review-Url: https://codereview.chromium.org/2567953003
Cr-Commit-Position: refs/heads/master@{#41673}

Review-Url: https://codereview.chromium.org/2570813002
Cr-Commit-Position: refs/heads/master@{#41672}

It reduces the add operation for certain checked load/stores by pre-do the add in compiling phase.

BUG=

Review-Url: https://codereview.chromium.org/2563483005
Cr-Commit-Position: refs/heads/master@{#41671}

The assignment in default parameters (e.g., function foo(a = somedefault) { }
doesn't flow through PreParserFactory::NewAssignment even if the comment claims so.
Thus, piping through the variables is not needed.

Kudos to neis@ for pointing this out.

BUG=v8:5501
R=neis@chromium.org

Review-Url: https://codereview.chromium.org/2569983003
Cr-Commit-Position: refs/heads/master@{#41670}

There was previously a race between different phases recording their
first entry -- and thus, their insert order -- on the main and
concurrent-compilation thread. This would later manifest as a segfault
when creating the sorted array of phases for --turbo-stats (as two
phases would have the same insert order and so there would be a gap in
the array).

Review-Url: https://codereview.chromium.org/2572713003
Cr-Commit-Position: refs/heads/master@{#41669}

R=jochen@chromium.org, peria@chromium.org
BUG=chromium:617892

Review-Url: https://codereview.chromium.org/2571743002
Cr-Commit-Position: refs/heads/master@{#41668}

Revert of [deoptimizer] Enable test that should no longer fail. (patchset #1 id:1 of https://codereview.chromium.org/2568723003/ )

Reason for revert:
Still flakes on ARM.

Original issue's description:
> [deoptimizer] Enable test that should no longer fail.
>
> R=jarin@chromium.org
> TEST=cctest/test-cpu-profiler/CollectDeoptEvents
>
> Committed: https://crrev.com/3f9c2c590d687562d6adb531d1159738c07013f4
> Cr-Commit-Position: refs/heads/master@{#41664}

TBR=jarin@chromium.org,machenbach@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2568403003
Cr-Commit-Position: refs/heads/master@{#41667}

incremental marking.

BUG=chromium:671994

Review-Url: https://codereview.chromium.org/2565173004
Cr-Commit-Position: refs/heads/master@{#41666}

Revert of [heap] Enable black allocation when finalizing marking. (patchset #3 id:40001 of https://codereview.chromium.org/2440943002/ )

Reason for revert:
Seems to block roll:
https://codereview.chromium.org/2569133002/

Original issue's description:
> [heap] Enable black allocation when finalizing marking.
>
> BUG=chromium:630386
>
> Committed: https://crrev.com/a98d971412a5c32967bbef4b77b9d2658055ff1c
> Cr-Commit-Position: refs/heads/master@{#41655}

TBR=ulan@chromium.org,hpayer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:630386

Review-Url: https://codereview.chromium.org/2567353002
Cr-Commit-Position: refs/heads/master@{#41665}

R=jarin@chromium.org
TEST=cctest/test-cpu-profiler/CollectDeoptEvents

Review-Url: https://codereview.chromium.org/2568723003
Cr-Commit-Position: refs/heads/master@{#41664}

https://crrev.com/c3a6ca68d0646b10885ef7017557eaf463db2e4a changed what kind of information is dumped which broke some properties of the output that IRHydra relies on:

1. Because IRHydra does not have access to the whole scripts it relies on function sources dumps to map IR and deoptimization to the actual source. This means that source positions must be dumped in a way that allows for this mapping and previously we used positions relative to the beginning of the function to allow that. Now we are dumping absolute script positions which means that function sources must be annotated with the start position so that IRHydra (or any other similar tools) could translate absolute script positions into function-relative ones.

2. When dumping inlined functions we should dump which function are we inlining into because position itself is not enough to recover the inlining stack from the output.

BUG=

Review-Url: https://codereview.chromium.org/2573653002
Cr-Commit-Position: refs/heads/master@{#41663}

Review-Url: https://codereview.chromium.org/2569663003
Cr-Commit-Position: refs/heads/master@{#41662}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/7321edc..52f7afe

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/19565fd..c69690a

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/53bdedc..7e13606

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2566153004
Cr-Commit-Position: refs/heads/master@{#41661}

BUG=v8:5343

Review-Url: https://codereview.chromium.org/2571663002
Cr-Commit-Position: refs/heads/master@{#41660}