Collect code coverage from the available invocation counts.
The granularity is at function level, and invocation counts may
be lost to GC.

Coverage::Collect returns a std::vector of Coverage::ScriptData.
Each ScriptData contains a script ID and a std::vector of
Coverage::RangeEntry.
Each RangeEntry consists of a end position and the invocation
count. The start position is implicit from the end position of
the previous RangeEntry, or 0 if it's the first RangeEntry.

R=jgruber@chromium.org
BUG=v8:5808

Review-Url: https://codereview.chromium.org/2689493002
Cr-Commit-Position: refs/heads/master@{#43072}

BUG=v8:5269

Review-Url: https://codereview.chromium.org/2682153003
Cr-Commit-Position: refs/heads/master@{#43071}

Revert of [compiler] Pass deoptimization_kind through DeoptimizeParameters and FlagsContinuation (patchset #3 id:40001 of https://codereview.chromium.org/2682143002/ )

Reason for revert:
cfi failure:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20cfi/builds/8635

Original issue's description:
> [compiler] Pass deoptimization_kind through DeoptimizeParameters and FlagsContinuation
>
> BUG=
>
> Review-Url: https://codereview.chromium.org/2682143002
> Cr-Commit-Position: refs/heads/master@{#43065}
> Committed: https://chromium.googlesource.com/v8/v8/+/193a0c118845d068ab386b5c90d04daaa64e1e86

TBR=jarin@chromium.org,verwaest@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review-Url: https://codereview.chromium.org/2683203002
Cr-Commit-Position: refs/heads/master@{#43070}

Cleans up the internalization. Also, clean up no-longer-used ast
symbols, iterator and hasInstance, which were left behind after other
refactors. Having an enum here should keep this clean in the future.

Change-Id: Id526784b0361c7a2242b21ecf2af72b0403c6ad8
Reviewed-on: https://chromium-review.googlesource.com/440204Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43069}

R=ishell@chromium.org
TEST=mjsunit/regress/regress-5902
BUG=chromium:688837

Review-Url: https://codereview.chromium.org/2682203003
Cr-Commit-Position: refs/heads/master@{#43068}

BUG=chromium:680995

Change-Id: Ib567c88df357dea77cba802cbc0e567ee4097235
Reviewed-on: https://chromium-review.googlesource.com/440124
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43067}

R=danno@chromium.org

Review-Url: https://codereview.chromium.org/2684263002
Cr-Commit-Position: refs/heads/master@{#43066}

BUG=

Review-Url: https://codereview.chromium.org/2682143002
Cr-Commit-Position: refs/heads/master@{#43065}

BUG=chromium:651354

Change-Id: I8d74133ca9b21ce9e0612efc1e5ace41d1002dae
Reviewed-on: https://chromium-review.googlesource.com/440304Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43064}

These intrinsics are heavily used in typedarray.js and are part of the
reason why the typed array constructors are more than twice as slow in
TurboFan compared to Crankshaft.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2684193003
Cr-Commit-Position: refs/heads/master@{#43063}

Updated according to the recent spec change at
https://github.com/tc39/ecma262/pull/798.

BUG=v8:5949

Review-Url: https://codereview.chromium.org/2681323002
Cr-Commit-Position: refs/heads/master@{#43062}

R=jgruber@chromium.org
BUG=v8:5821

Review-Url: https://codereview.chromium.org/2680163005
Cr-Commit-Position: refs/heads/master@{#43061}

Revert of [debugger] expose side-effect free evaluate to inspector. (patchset #3 id:40001 of https://codereview.chromium.org/2685483002/ )

Reason for revert:
Speculative revert. Seems to block the roll:
https://codereview.chromium.org/2685933005/

Original issue's description:
> [debugger] expose side-effect free evaluate to inspector.
>
> R=jgruber@chromium.org, kozyatinskiy@chromium.org
> BUG=v8:5821
>
> Review-Url: https://codereview.chromium.org/2685483002
> Cr-Commit-Position: refs/heads/master@{#43049}
> Committed: https://chromium.googlesource.com/v8/v8/+/1a989bdeefdc679745215ae547007773edb3d29e

TBR=jgruber@chromium.org,kozyatinskiy@chromium.org,pfeldman@chromium.org,yangguo@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5821

Review-Url: https://codereview.chromium.org/2687013003
Cr-Commit-Position: refs/heads/master@{#43060}

R=jgruber@chromium.org
BUG=v8:5530

Review-Url: https://codereview.chromium.org/2682593003
Cr-Commit-Position: refs/heads/master@{#43059}

BUG=v8:5943

Review-Url: https://codereview.chromium.org/2681123002
Cr-Commit-Position: refs/heads/master@{#43058}

On bots we don't sort due to not being able to store the duration DB. But we should still run the tests marked as slow first.

BUG=v8:5861

Change-Id: Ifa812b3eef15f48e3d3c752c14c3f546b5dd87d1
Reviewed-on: https://chromium-review.googlesource.com/439284Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43057}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/7968040..e62b61f

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/df67b47..5c71aac

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/426ef62..404d542

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: I59c076ae3fa6b6d495011268d6d791173a1ffa8e
Reviewed-on: https://chromium-review.googlesource.com/439745Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43056}

LoadGlobalIC will be inlined into ignition's LdaGlobal family of bytecode
handlers.  This CL splits up LoadGlobalIC into three distinct cases (property
cell, handler, and miss) and introduces the ExitPoint abstraction in order
to make inlining easier.

BUG=v8:5917

Review-Url: https://codereview.chromium.org/2688503002
Cr-Commit-Position: refs/heads/master@{#43055}

arguments.h is one of the headers including objects-inl.h. Files needing
objects-inl.h used to innocently pull in debug.h, so that needs to be fixed now
too.

BUG=v8:5294
R=mstarzinger@chromium.org

Change-Id: I8ce671c533ed757103ef9a3b0bf0a0509230fdd8
Reviewed-on: https://chromium-review.googlesource.com/439287Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43054}

BUG=chromium:688159
NOTRY=true
TBR=bmeurer@chromium.org,mstarzinger@chromium.org

Change-Id: I9b5c0c531af31534a0dd33e078a148b822834448
Reviewed-on: https://chromium-review.googlesource.com/439184Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43053}

BUG=chromium:688856,chromium:664068
NOTRY=true

Change-Id: Icf0e7a51693b6d399c8395eb0bbed9a3c373eb0a
Reviewed-on: https://chromium-review.googlesource.com/439164Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43052}

BUG=v8:5830
R=yangguo@chromium.org

Change-Id: Ic4f41e0afa32de17615f9f1e9c9b9f05f265b7fe
Reviewed-on: https://chromium-review.googlesource.com/439151
Commit-Queue: Jochen Eisinger <jochen@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43051}

Since the empty string is canonical HeapObject now, we can use
this fact to optimize

  - strict equality comparisons with the empty string to a
    simple ReferenceEqual operation, and
  - optimize ToBoolean to avoid instance type checks completely.

Drive-by-fix: Allow InternalizedString for Type::HeapConstant
in the type system. This is safe, since InternalizedStrings
can be compared to other heap constants by reference (except
for non-InternalizedStrings, which are excluded from the
HeapConstant type).

BUG=v8:5267
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2681273002
Cr-Commit-Position: refs/heads/master@{#43050}

R=jgruber@chromium.org, kozyatinskiy@chromium.org
BUG=v8:5821

Review-Url: https://codereview.chromium.org/2685483002
Cr-Commit-Position: refs/heads/master@{#43049}

R=rossberg@chromium.org,bradnelson@chromium.org
BUG=chromium:575167, chromium:690281

Review-Url: https://codereview.chromium.org/2681993003
Cr-Commit-Position: refs/heads/master@{#43048}

Review-Url: https://codereview.chromium.org/2683903002
Cr-Commit-Position: refs/heads/master@{#43047}

Tests are queued retaining the order of testing variants and test suites. This reorders the variants and suites to make sure the slowest run first.

Currently the debugger suite contains the slowest tests.

BUG=v8:5861
TBR=jochen@chromium.org,yangguo@chromium.org,jkummerow@chromium.org

Change-Id: Idae349b5e6db2540c6181f9b5e2ffb689733846e
Reviewed-on: https://chromium-review.googlesource.com/439311Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43046}

Previously the runtime stats tool would only show entries which were in
the baseline version. This change adds any entries which exist in any
version to the comparison table, which would otherwise not appear anywhere
unless that version was selected as the baseline version.

NOTRY=true

Review-Url: https://codereview.chromium.org/2683863004
Cr-Commit-Position: refs/heads/master@{#43045}

E.g.,
{ function lazy_inner(b = somevar) { let somevar; } }

If we don't produce the same scopes, PreParser thinks that the unresolved
variable inside the default parameter resolves into the variable declared inside
the function. Thus, it's not correctly recorded as a free variable.

One part is already done by https://codereview.chromium.org/2638333002 . But at
the laziness boundary, we still produced different scopes.

Unlike previously thought, this is also needed for lazy inner function
correctness, not only for "preparser scope analysis" (ie., skipping inner
functions).

BUG=v8:5938

Change-Id: I047cd43ef16478bb0f18d1f114845e7d1ab8c5f2
Reviewed-on: https://chromium-review.googlesource.com/439345
Commit-Queue: Marja Hölttä <marja@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43044}

Without doing this, a JSMessageObject can be kept alive by the isolate, which
in turn keeps the context alive, until the message is cleared.

BUG=v8:5941

Review-Url: https://codereview.chromium.org/2675203005
Cr-Commit-Position: refs/heads/master@{#43043}

BUG=

R=jyan@ca.ibm.com, joransiu@ca.ibm.com, bjaideep@ca.ibm.com

Review-Url: https://codereview.chromium.org/2685733002
Cr-Commit-Position: refs/heads/master@{#43042}

R=cbruni@chromium.org

Review-Url: https://codereview.chromium.org/2684823003
Cr-Commit-Position: refs/heads/master@{#43041}

Review-Url: https://codereview.chromium.org/2684043002
Cr-Commit-Position: refs/heads/master@{#43040}

Where the arguments have already been inlined, we can replace these
calls with a direct call. We have to make sure that the iteration over
the arguments is not observable.

Also factor out the large chunk of logic shared with
ReduceJSConstructWithSpread.

BUG=v8:5932

Change-Id: I6c4fac670028fbd8ca82c4474d4392231573bc49
Reviewed-on: https://chromium-review.googlesource.com/439329Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43039}

It used to require >1GB of memory which leads to flaky test failures on
machines with less memory when executing multiple variants in parallel

R=cbruni@chromium.org,ulan@chromium.org
BUG=v8:5706

Change-Id: Id8c6f49cbfa51f2d443991c1493f225810efb18f
Reviewed-on: https://chromium-review.googlesource.com/439310
Commit-Queue: Camillo Bruni <cbruni@google.com>
Commit-Queue: Jochen Eisinger <jochen@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43038}

TBR=yangguo@chromium.org
NOTRY=true

Change-Id: I2138299e93f5790118d1b28ddf7f4c8219f5831d
Reviewed-on: https://chromium-review.googlesource.com/439564Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43037}

Arm64 compiles "x +_64 (y >> shift)" into a single instruction if
"shift" is a constant. The code generator expects that "shift" is a
32 bit constant. however, TurboFan can also pass in a 64 bit constant,
which caused a crash in the code generator.

With this CL we cast the constant of TurboFan to an int in the
instruction selector and thereby satisfy the assumption of the code
generator. This should be correct since the code generator anyways cast
the "shift" to an int5 or int6 eventually.

R=v8-arm-ports@googlegroups.com
BUG=v8:5923

Review-Url: https://codereview.chromium.org/2669203005
Cr-Commit-Position: refs/heads/master@{#43036}

Installing a feedback vector in a closure is a multi-step process.
The closure actually points to a Cell that points to a feedback
vector or undefined if we haven't created one yet.
This happens because we often create closures before we've compiled
the code.

JSFunction::EnsureLiterals is the bottleneck in our system that
creates a feedback vector if necessary. The predicates it used to
determine what to do were arcane. This CL allows it to think it
terms of state, and clarifies the reading of that useful
bottleneck.

I also did a few renamings in parts of the code that referred
to a "literals array," which we don't have any more.

BUG=

Review-Url: https://codereview.chromium.org/2681773004
Cr-Commit-Position: refs/heads/master@{#43035}

Do not preinitialize the feedback vector slot if
the lookup iterator is an interceptor, because it is not
guaranteed that the iterator has a PropertyCell.

If the HandlerConfiguration has a non-masking
intercepting setter,
the iterator does not have a valid PropertyCell.

BUG=chromium:656648

Review-Url: https://codereview.chromium.org/2674103002
Cr-Commit-Position: refs/heads/master@{#43034}

TBR=mvstanton@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Change-Id: Ie7e75861347a1c2e65205f2c9f3c4c62204fd6a8
Reviewed-on: https://chromium-review.googlesource.com/439247
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43033}