This adds GN configs for using sanitizer coverage and refactors gcov
configs. Now, both coverage kinds are behind the same gn argument
v8_code_coverage.

This also switches the bot to GN.

Bug: chromium:645890,v8:5502
Change-Id: I3af606e0cad109dd790a121d0d92e53cf4e38f9a
Reviewed-on: https://chromium-review.googlesource.com/549360Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46254}

Forward the concrete class used in CRTP to avoid having virtual class to
the outmost declaration.

Bug: chromium:736641
Change-Id: I8ab693b8f75507318a892c1994d9c899ba5a41d1
Reviewed-on: https://chromium-review.googlesource.com/549303
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46253}

For handling restartability issues, following conditions must be
fulfilled:
- For Branch-and-link restartability: GPR 31 (ra register) must not be
used for the source register rs.
- For Jump-and-Link restartability: Register specifiers rs and rd must
not be equal.
This CL implements checking that GPR 31 is not used as source register.

TEST=
BUG=

Change-Id: I568ff9c497b4efca73f1a5353cb7520202524479
Reviewed-on: https://chromium-review.googlesource.com/549362Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@imgtec.com>
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@imgtec.com>
Cr-Commit-Position: refs/heads/master@{#46252}

BUG=chromium:694255

Change-Id: Ib954eaf868862577fb567a1438ca1c9136821eb4
Reviewed-on: https://chromium-review.googlesource.com/549417Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46251}

Bug: 
Change-Id: I56bfd921d63783ddaa74133dde5f3daf776e68ca
Reviewed-on: https://chromium-review.googlesource.com/548115
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46250}

BUG=v8:6243

Change-Id: Idb9aa8221248cc493c8f5ba4bd50fa712a57f5f8
Reviewed-on: https://chromium-review.googlesource.com/541221
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46249}

This broke after https://codereview.chromium.org/2860653002

NOTRY=true
TBR=ochang@chromium.org,jarin@chromium.org

Bug: v8:5502
Change-Id: I062f6601da0b8249d7749275fc415a72e42d0e40
Reviewed-on: https://chromium-review.googlesource.com/549931
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46248}

This reverts commit 3c04ee6d.

Reason for revert: Speculative revert for OOMs in:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20shared/builds/18563

Original change's description:
> [heap] Make aborting compaction a fatal
> 
> Last attempt failed because of too agressive growing and no proper GC
> scheduling.
> 
> Also refactor live object iteration on the way to avoid a branch when we
> know that we will succeed.
> 
> Bug: chromium:651354
> Change-Id: I8f52cbc79ac293989fb7c29c492d4ae4afe5ebe4
> Reviewed-on: https://chromium-review.googlesource.com/544829
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46245}

TBR=ulan@chromium.org,mlippautz@chromium.org

Change-Id: Ifb9fd0c873c4ec6d4bd895f2978849cc2a223a05
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:651354
Reviewed-on: https://chromium-review.googlesource.com/549324Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46247}

Adds new APIs Isolate::GetIncumbentContext() and
Context::BackupIncumbentScope to support
"the backup incumbent settings object stack" [1].

[1] https://html.spec.whatwg.org/multipage/webappapis.html#backup-incumbent-settings-object-stack

Bug: 
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I1ccea0e6fe2743fe5f3072b9e1236111ce2b1a42
Reviewed-on: https://chromium-review.googlesource.com/536728Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Yuki Shiino <yukishiino@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46246}

Last attempt failed because of too agressive growing and no proper GC
scheduling.

Also refactor live object iteration on the way to avoid a branch when we
know that we will succeed.

Bug: chromium:651354
Change-Id: I8f52cbc79ac293989fb7c29c492d4ae4afe5ebe4
Reviewed-on: https://chromium-review.googlesource.com/544829
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46245}

Change-Id: Id922e799deb0360680b819493fc27b4f6dd436e3
Reviewed-on: https://chromium-review.googlesource.com/544082Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46244}

Adds a CheckString to all operand inputs of JSStringConcat. The operands are
already known to be strings, so this will get eliminated in almost all cases,
however, if there is a yield within the concatenation then we lose the
knowledge that the previous operands are strings since the values are loaded
from the generator object. Adds a test for this case.

BUG=v8:6243

Change-Id: I1601a316e6efbed1c53486f1027cb0ea023ff030
Reviewed-on: https://chromium-review.googlesource.com/549301
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46243}

This reverts commit 72b88fda.

Reason for revert: Changes a layout test:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/16595

Original change's description:
> [runtime] Make all built-in functions strict.
> 
> According to ES#sec-built-in-function-objects all built-in functions
> must be strict.
> 
> This is a preliminary CL before changing the way we define built-in
> functions in native JS files.
> 
> Bug: v8:6459
> Change-Id: I8e60b342f04ea1b0843fe1990334cbb9b26ebac4
> Reviewed-on: https://chromium-review.googlesource.com/546215
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Reviewed-by: Adam Klein <adamk@chromium.org>
> Commit-Queue: Igor Sheludko <ishell@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46237}

TBR=adamk@chromium.org,ishell@chromium.org,verwaest@chromium.org

Change-Id: Ic458b478b2dd23aae7ea2a51aa6052c1f5931c56
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6459
Reviewed-on: https://chromium-review.googlesource.com/549322Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46242}

Bug: chromium:736758
Change-Id: If49fda42618c27be1472a98399e440ad26b7f199
Reviewed-on: https://chromium-review.googlesource.com/548401
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Daniel Clifford <danno@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46241}

CL https://chromium-review.googlesource.com/c/523271/6 introduced a
wrong lookup of ArrayBuffer::Allocator::Allocator::AllocationMode that
breaks compilation with Visual Studio 2013.

R=jochen@chromium.org

Bug: 
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I160242bc24ef8c23574d3ec3734be822a681b408
Reviewed-on: https://chromium-review.googlesource.com/548399Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Commit-Queue: Jochen Eisinger <jochen@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46240}

Change-Id: Ie380c38a91a05b66fd25172eebbb28b4cfeb646b
Reviewed-on: https://chromium-review.googlesource.com/543926Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46239}

Change-Id: Ib94db9145d668d4c565e80f8a25524ad2a44928e
Reviewed-on: https://chromium-review.googlesource.com/544101Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46238}

According to ES#sec-built-in-function-objects all built-in functions
must be strict.

This is a preliminary CL before changing the way we define built-in
functions in native JS files.

Bug: v8:6459
Change-Id: I8e60b342f04ea1b0843fe1990334cbb9b26ebac4
Reviewed-on: https://chromium-review.googlesource.com/546215Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46237}

This reverts commit 2ec46bec.

Reason for revert:
avx2 builders have moved to the chromium swarming pool

Original change's description:
> [CQ] Temporarily make avx2 trybot experimental.
> 
> NOTRY=true
> NOPRESUBMIT=true
> TBR=tandrii@chromium.org
> 
> Bug: chromium:736757
> Change-Id: I920eda5c916981d3588fb7346ec4e811dc5112aa
> Reviewed-on: https://chromium-review.googlesource.com/548360
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46219}

TBR=machenbach@chromium.org,tandrii@chromium.org,clemensh@chromium.org

Change-Id: If228a34be2e6e88dbd2cc3fc1de0b227c4d113c2
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:736757
Reviewed-on: https://chromium-review.googlesource.com/549321Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46236}

This reverts commit 87f71769.

Reason for revert: Performance regressions https://chromeperf.appspot.com/group_report?rev=46185

Original change's description:
> [ignition] Merge bytecode array builder and writer
> 
> Move bytecode array writing logic into the array builder, allowing us to
> remove the bytecode array writer and bytecode node, and convert runtime
> operand writing to compile-time bytecode operand writing using the
> information statically known at compile time.
> 
> Bug: v8:6474
> Change-Id: I210cd9897fd41293745614e4a253c7c251dfffc9
> Reviewed-on: https://chromium-review.googlesource.com/533055
> Commit-Queue: Leszek Swirski <leszeks@chromium.org>
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46183}

TBR=rmcilroy@chromium.org,leszeks@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:6474
Bug: chromium:736646
Change-Id: I00287b2bbbb8efa5a3141bc9c2906f91a7d33e51
Reviewed-on: https://chromium-review.googlesource.com/549319Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46235}

Bug: chromium:736641
Change-Id: I93e8c0bbdcc471750073d39b10b18c18ceee7d8a
Reviewed-on: https://chromium-review.googlesource.com/549416Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46234}

R=clemensh@chromium.org

Change-Id: I74da1171f157f2c8040d2296019f4fb44b329910
Reviewed-on: https://chromium-review.googlesource.com/549356Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46233}

The Construct bytecode is always passed a valid feedback slot (just like
the Call bytecode), so no need to check for invalid feedback slot anymore.
Also perform the call count increment initially for both bytecodes instead
of delaying it, which decreases live range for the feedback vector and slot
registers.

R=mythria@chromium.org, rmcilroy@chromium.org
BUG=v8:4280

Review-Url: https://codereview.chromium.org/2955063002
Cr-Commit-Position: refs/heads/master@{#46232}

Uninitialized property accesses are replaced with SOFT deopts in
TurboFan, but uninitialized JSCall nodes are not, and instead they
just stick around and are also not being inlined because the heurstic
in TurboFan doesn't consider those candidates since their call frequency
is below the threshold. This unifies the behavior and also replaces
uninitialized calls with SOFT deopts, addressing some inconsistency in
optimization behavior as discovered by Brian White of Node for example
here: https://twitter.com/mscdexdotexe/status/879005026202640385

R=jarin@chromium.org
BUG=v8:4551, v8:5267

Review-Url: https://codereview.chromium.org/2956843002
Cr-Commit-Position: refs/heads/master@{#46231}

Rolling v8/base/trace_event/common: https://chromium.googlesource.com/chromium/src/base/trace_event/common/+log/39a3450..65d1d42

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/564be75..41581c8

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/d4f2d77..520dd37

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: I1857e9fa631d41fdfd6bb387e2633497dc9e44f8
Reviewed-on: https://chromium-review.googlesource.com/549198Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46230}

This is towards closing the perf gap between the MSVC build (which uses link-
time optimization) and Clang (where LTO isn't ready on Windows yet). We did
a study (see bug) to see which non-inlined functions are hit a lot during render
start-up, and which would be inlined during LTO. This should benefit performance
in all builds which currently don't use LTO (Android, Linux, Mac) as well as
the Win/Clang build.

The binary size of chrome_child.dll increases by 2KB with this.

BUG=chromium:728324
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_chromium_compile_dbg_ng;master.tryserver.chromium.mac:mac_chromium_compile_dbg_ng

Review-Url: https://codereview.chromium.org/2950993002
Cr-Commit-Position: refs/heads/master@{#46229}

The missing export caused component build breakage when
Bytecodes::SizeOfOperand was moved into the header in
https://codereview.chromium.org/2950993002.

BUG=none

Review-Url: https://codereview.chromium.org/2954353002
Cr-Commit-Position: refs/heads/master@{#46228}

BUG=v8:6511

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Ie6b62df693d3b847837c071e1f985b7ce3b420c8
Reviewed-on: https://chromium-review.googlesource.com/548499Reviewed-by: Fadi Meawad <fmeawad@chromium.org>
Commit-Queue: Jochen Eisinger <jochen@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46227}

R=marja@chromium.org
BUG=v8:6408

Change-Id: Ied0c4d1aba18ec84d5feb02c3522b77759be216e
Reviewed-on: https://chromium-review.googlesource.com/548636Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46226}

If a String object contains unicode, the returned {ToCString()} may
actually longer than the {length()} of the String.
But it's always null-terminated, so we can just print it without
explicitly passing a length.

R=ahaas@chromium.org

Change-Id: I3398f151d70ed459ecd8093ea18409670a7374c7
Reviewed-on: https://chromium-review.googlesource.com/548058
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46225}

BUG=chromium:694255
TBR=mlippautz@chromium.org

Change-Id: I8eaec556d187453bd0d1cfbd0a12c0e81306862c
Reviewed-on: https://chromium-review.googlesource.com/548597Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46224}

This removes support for code-stub to tail-call into the runtime via the
deoptimizer. The Hydrogen code-stubs would trigger a deopt in order to
materialize a trampoline frame, which would then continue execution in a
runtime function associated with each stub. This is no longer needed for
code-stubs built with the CSA.

R=jarin@chromium.org
BUG=v8:6408

Change-Id: I1ff8dc03ac716200b28e962259a3e233aeda1234
Reviewed-on: https://chromium-review.googlesource.com/548375Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46223}

With https://chromium-review.googlesource.com/c/532993/ the isolate
can shutdown without a crash even when an async compile job is still
active. This should allow us to turn on async compilation again.

R=mtrofin@chromium.org, bradnelson@chromium.org

Change-Id: I822112c4f2a7a32133aa1d086881ed77baf42f76
Reviewed-on: https://chromium-review.googlesource.com/533293Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46222}

The implication was actually in the wrong direction: If there is no
memory start address, then the size must be 0.
If the size is 0 though, we might allocate nevertheless to have guard
pages around the accessible memory.

R=ahaas@chromium.org
BUG=chromium:736584

Change-Id: I297dece658d5eaf69c58ecb109ff21d3ca0b8a8d
Reviewed-on: https://chromium-review.googlesource.com/548635Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46221}

Test that unicode identifiers can be used for imports and exports, and
that unicode function names appear correctly in error messages.

R=ahaas@chromium.org

Change-Id: Ic6ac77159c275845886b2eb779cf59edb8cba9ea
Reviewed-on: https://chromium-review.googlesource.com/548315
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46220}

NOTRY=true
NOPRESUBMIT=true
TBR=tandrii@chromium.org

Bug: chromium:736757
Change-Id: I920eda5c916981d3588fb7346ec4e811dc5112aa
Reviewed-on: https://chromium-review.googlesource.com/548360Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46219}

Instead of calling {TryAllocateBackingStore} with
{enable_guard_regions==false}, we just directly call
{array_buffer_allocator->Allocate}.
Drive-by optimization: Don't allocate if the size is 0.

R=titzer@chromium.org

Change-Id: Iabf7af7e0f1bc970c03efcd9ee4c23e5307a7095
Reviewed-on: https://chromium-review.googlesource.com/548398Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46218}

This prepares switching the gcov coverage bot to GN.

We skip instrumenting test executables explicitly in gn configs.
In gyp, we did the same through an extra compiler wrapper script.

NOTRY=true

Bug: chromium:645890
Change-Id: I663fb479347063ae9228598d356bb654ca2a496c
Reviewed-on: https://chromium-review.googlesource.com/548275
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46217}

BUG=chromium:736567

Review-Url: https://codereview.chromium.org/2962503002
Cr-Commit-Position: refs/heads/master@{#46216}

This removes specialized support for materializing arguments objects.
For TurboFan we use the generic escape analysis mechanism when such
objects are materialized already, only Crankshaft used this deprecated
mechanism.

R=jarin@chromium.org
BUG=v8:6408

Change-Id: Ibed52a028752e667b05a60fa7cf0275a6a372897
Reviewed-on: https://chromium-review.googlesource.com/548595Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46215}