The spec was modified to relax some requirements which implementors had not been
enforcing. Part of this process involved introducing a new abstract operation
ToIndex, which had partial overlap with our existing semantics as well as some
differences (most notably treating undefined as 0). Test262 tests were introduced to
check for the new semantics, some of which we were failing. This patch amends the
parts of our implementation corresponding to specification algorithms which use
ToIndex to follow its semantics precisely.

BUG=v8:4784,v8:5120

Review-Url: https://codereview.chromium.org/2090353003
Cr-Commit-Position: refs/heads/master@{#37406}

In ES2016, function declarations nested in blocks are formally allowed. This was
never a part of ECMAScript, but was a common extension. Unfortunately
implementations differed in the exact semantics. Annex B.3.3 in the spec tries
to standardize the parts which are common to different implementations, but does
so with some fairly complicated semantics.

This CL addresses three issues related to annex B.3.3:
* When the outer function had a complex parameter list, no hoisting whatsoever was
  being performed.
* Hoisting was not blocked by parameters of the same name.
* Hoisting was not blocked by nested lexical declarations of the same name.

We had tests which checked for the second, but they were incorrectly passing due to
the first. This CL adds more complete tests.

BUG=v8:5151, v8:5111

Review-Url: https://codereview.chromium.org/2099623003
Cr-Commit-Position: refs/heads/master@{#37405}

Occasionally tests output characters that aren't valid unicode UTF-8
characters.  This causes the --json-test-results file not to be written.
Replace these characters with the UTF-8 invalid character.

BUG=

Review-Url: https://codereview.chromium.org/2086143003
Cr-Commit-Position: refs/heads/master@{#37404}

BUG=v8:5117
TBR=yangguo@chromium.org,ivica.bogosavljevic@imgtec.com

Review-Url: https://codereview.chromium.org/2105553007
Cr-Commit-Position: refs/heads/master@{#37403}

Port e60c4053

    this fix applies to ppc as well.

R=jarin@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2109153002
Cr-Commit-Position: refs/heads/master@{#37402}

Mircea and Andreas have been making changes to wasm.

R=titzer@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2103793006
Cr-Commit-Position: refs/heads/master@{#37401}

Perform the following transformation:

    | Before           | After               |
    |------------------+---------------------|
    | add w2, w0, w1   | adds w2, w0, w1     |
    | cmp w2, #0x0     | b.<cond'> <addr>    |
    | b.<cond> <addr>  |                     |
    |------------------+---------------------|
    | add w2, w0, w1   | adds w2, w0, w1     |
    | cmp #0x0, w2     | b.<cond'> <addr>    |
    | b.<cond> <addr>  |                     |

and the same for and instructions instead of add.  When the result of the
add/and is not used, generate cmn/tst instead. We need to take care with which
conditions we can handle and what new condition we map them to.

BUG=

Review-Url: https://codereview.chromium.org/2065243005
Cr-Commit-Position: refs/heads/master@{#37400}

With the current approach we only need to track using an unordered set as we can
still access the backing store pointer and length by the time we free the
backing store.

Reland:
The issue was fixed in 67b5a501.

BUG=chromium:619491, chromium:611688
LOG=N
R=ulan@chromium.org

This reverts commit 0e1eaec7.

Review-Url: https://codereview.chromium.org/2109913003
Cr-Commit-Position: refs/heads/master@{#37399}

This CL changed layout of UnseededNumberDictionary: https://codereview.chromium.org/2102073002.

Review-Url: https://codereview.chromium.org/2105553006
Cr-Commit-Position: refs/heads/master@{#37398}

R=mstarzinger@chromium.org
BUG=v8:5117

Review-Url: https://codereview.chromium.org/2109613004
Cr-Commit-Position: refs/heads/master@{#37397}

JSTypedArray::kBufferOffset contains a 32-bit integer in memory.
And it's stored as whole at set_bit_field. When we try to load its
first byte in memory, we get the less significant byte on LE but
the most significant byte on BE, which is not consistent.

R=bmeurer@chromium.org, gsathya@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com, bjaideep@ca.ibm.com
BUG=

Review-Url: https://codereview.chromium.org/2102203002
Cr-Commit-Position: refs/heads/master@{#37396}

Reland of [turbofan] Implicitly emit eager checkpoint at graph building. (patchset #1 id:1 of https://codereview.chromium.org/2104973004/ )

Reason for revert:
Can be cleanly relanded without any changes after a fix to redundancy elimination. Kudos go to Benedikt.

Depends on: https://codereview.chromium.org/2112463002/

Original issue's description:
> Revert of [turbofan] Implicitly emit eager checkpoint at graph building. (patchset #13 id:260001 of https://codereview.chromium.org/2074703002/ )
>
> Reason for revert:
> Causers flaky failures on the waterfall on Mac with the following error in the builtin QuickSort method:
>
> #
> # Fatal error in Zone
> # Allocation failed - process out of memory
> #
>
> Original issue's description:
> > [turbofan] Implicitly emit eager checkpoint at graph building.
> >
> > This makes preparation of eager checkpoints within the graph builder
> > implicit. Every sub-expression visitation is now guaranteed to emit
> > valid checkpoints in AstContext.
> >
> > R=jarin@chromium.org
> > BUG=v8:5021
> >
> > Committed: https://crrev.com/74e328efee7995aeee6d568f9d14f9bbc1087100
> > Cr-Commit-Position: refs/heads/master@{#37368}
>
> TBR=jarin@chromium.org
> # Skipping CQ checks because original CL landed less than 1 days ago.
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=v8:5021
>
> Committed: https://crrev.com/45190a4fbfa5199f6ddf5ed9a7e2f50be865e0db
> Cr-Commit-Position: refs/heads/master@{#37372}

TBR=jarin@chromium.org
BUG=v8:5021

Review-Url: https://codereview.chromium.org/2107163002
Cr-Commit-Position: refs/heads/master@{#37395}

Revert of [builtins] New frame type for exits to C++ builtins (patchset #5 id:80001 of https://codereview.chromium.org/2090723005/ )

Reason for revert:
Looks like this breaks on nosnap: http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap%20-%20debug/builds/7626

Original issue's description:
> [builtins] New frame type for exits to C++ builtins
>
> Prior to this commit, calls to C++ builtins created standard exit
> frames, which are skipped when constructing JS stack traces. In order to
> show these calls on traces, we introduce a new builtin exit frame type.
>
> Builtin exit frames contain target and new.target on the stack and are
> not skipped during stack trace construction.
>
> BUG=v8:4815
> R=bmeurer@chromium.org, yangguo@chromium.org
> CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
>
> Committed: https://crrev.com/3c60c6b105f39344f93a8407f41534e5e60cf19a
> Cr-Commit-Position: refs/heads/master@{#37384}

TBR=yangguo@chromium.org,jgruber@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4815

Review-Url: https://codereview.chromium.org/2106113002
Cr-Commit-Position: refs/heads/master@{#37394}

Commit d0b8e7fb introduced some functionality to allocate additional
space in the function table, filled with an "undefined" function
signature. Use -1 instead of undefined_value() as the latter can have
the top bits cleared (which happens often for arm64) and causes
intermittent test failures.

BUG=

Review-Url: https://codereview.chromium.org/2105293002
Cr-Commit-Position: refs/heads/master@{#37393}

R=bmeurer@chromium.org
BUG=v8:5117

Review-Url: https://codereview.chromium.org/2109673003
Cr-Commit-Position: refs/heads/master@{#37392}

Avoid repeatedly traversing empty kHuge empty free list categories. This is an
oversight as all other categories are already eagerly unlinked upon getting
empty (in FreeList::FindNodeIn).

R=ulan@chromium.org

Review-Url: https://codereview.chromium.org/2109473004
Cr-Commit-Position: refs/heads/master@{#37391}

The implementation of DoubleRepresentation was based on undefined
behavior, and it can be replaced by bit_casts.

BUG=chromium:623168
R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2105683006
Cr-Commit-Position: refs/heads/master@{#37390}

A pointer comparison on the effect path states is not sufficient to
guarantee termination; we really need to check the actual nodes to
make sure we terminate properly, similar to what BranchElimination
does.

R=jarin@chromium.org
BUG=v8:5161

Review-Url: https://codereview.chromium.org/2112463002
Cr-Commit-Position: refs/heads/master@{#37389}

- Changes InstructionOperand canonicalization to map all FP operands to kFloat64 on Intel and other platforms with simple aliasing.
- Bypass expensive interference calculations and fixed FP live range processing for platforms with simple aliasing.

LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2101653003
Cr-Commit-Position: refs/heads/master@{#37388}

R=ahaas@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2110053002
Cr-Commit-Position: refs/heads/master@{#37387}

This functionality is duplicated with the same functionality in
SimplifiedLowering, which is kinda premature and doesn't seem to
be useful.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2103323003
Cr-Commit-Position: refs/heads/master@{#37386}

BUG=chromium:474921

Review-Url: https://codereview.chromium.org/2109083002
Cr-Commit-Position: refs/heads/master@{#37385}

Prior to this commit, calls to C++ builtins created standard exit
frames, which are skipped when constructing JS stack traces. In order to
show these calls on traces, we introduce a new builtin exit frame type.

Builtin exit frames contain target and new.target on the stack and are
not skipped during stack trace construction.

BUG=v8:4815
R=bmeurer@chromium.org, yangguo@chromium.org
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review-Url: https://codereview.chromium.org/2090723005
Cr-Commit-Position: refs/heads/master@{#37384}

R=ahaas@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2111433003
Cr-Commit-Position: refs/heads/master@{#37383}

There are no useful typing rules for Change and Checked operators, so we
better make sure we don't run them through the Typer at all.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2107783004
Cr-Commit-Position: refs/heads/master@{#37382}

This function should also be callable from a concurrent thread, so we cannot use
the scope here. Instead, provide a test that checks that no handles are created.

R=ulan@chromium.org
TEST=cctest/test-conversions/NoHandlesForTryNumberToSize
BUG=

Review-Url: https://codereview.chromium.org/2106083002
Cr-Commit-Position: refs/heads/master@{#37381}

BUG=

Review-Url: https://codereview.chromium.org/2099683002
Cr-Commit-Position: refs/heads/master@{#37380}

This changes many interfaces to accept StandardFrames instead of
JavaScriptFrames, and use the StackTraceFrameIterator instead of the
JavaScriptFrameIterator.
Also, the detailed frame information array now contains the script in
addition to the function, as wasm frames are not associated to any
javascript function.

This is a rebase of (https://codereview.chromium.org/2069823003/), since clemensh's internship has ended.

R=yangguo@chromium.org,ahaas@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2109093003
Cr-Commit-Position: refs/heads/master@{#37379}

The start argument must be converted to an integer before the length argument is
converted.  (Consequently, the start argument is converted even when the length
is 0.)  This matters because conversion is observable.

Also rewrite the function in a way that closely resembles the spec text.

R=littledan@chromium.org
BUG=v8:5140

Review-Url: https://codereview.chromium.org/2109583002
Cr-Commit-Position: refs/heads/master@{#37378}

R=yangguo@chromium.org,jarin@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2112443002
Cr-Commit-Position: refs/heads/master@{#37377}

BUG=

Review-Url: https://codereview.chromium.org/2109943003
Cr-Commit-Position: refs/heads/master@{#37376}

R=bmeurer@chromium.org

BUG=v8:5086,v8:5157

Review-Url: https://codereview.chromium.org/2107733002
Cr-Commit-Position: refs/heads/master@{#37375}

BUG=

Review-Url: https://codereview.chromium.org/2107833002
Cr-Commit-Position: refs/heads/master@{#37374}

Reland of https://codereview.chromium.org/2034093002 (reverted by
https://codereview.chromium.org/2080153002).

Original commit message:
Implement WASM support on big-endian platforms. WASM has
an implicit requirement that it is running on little-endian
machine. We achieve WASM support on BE by keeping data
in memory in little-endian order, and changing data
endianness before storing to memory and after loading from
memory.

BUG=

Review-Url: https://codereview.chromium.org/2083523002
Cr-Commit-Position: refs/heads/master@{#37373}

Revert of [turbofan] Implicitly emit eager checkpoint at graph building. (patchset #13 id:260001 of https://codereview.chromium.org/2074703002/ )

Reason for revert:
Causers flaky failures on the waterfall on Mac with the following error in the builtin QuickSort method:

#
# Fatal error in Zone
# Allocation failed - process out of memory
#

Original issue's description:
> [turbofan] Implicitly emit eager checkpoint at graph building.
>
> This makes preparation of eager checkpoints within the graph builder
> implicit. Every sub-expression visitation is now guaranteed to emit
> valid checkpoints in AstContext.
>
> R=jarin@chromium.org
> BUG=v8:5021
>
> Committed: https://crrev.com/74e328efee7995aeee6d568f9d14f9bbc1087100
> Cr-Commit-Position: refs/heads/master@{#37368}

TBR=jarin@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5021

Review-Url: https://codereview.chromium.org/2104973004
Cr-Commit-Position: refs/heads/master@{#37372}

  The reason:
  All RunFloat64Sin/RunFloat64Cos/RunFloat64Expm1/RunFloat64Tan/Ieee754.Expm1/Ieee754.Cos/Ieee754.Tan test cases
  use the C++ function to generate the expected value or result. So for x87, all those expected value or result are
  extended double precision as the extended double precision is default for x87 Gcc compiler and std lib on linux platform.

  The issue is:
  For RunFloat64Sin/RunFloat64Cos/RunFloat64Expm1/RunFloat64Tan test cases, the expected values generated by C++ function
  are extended double precision, the results generated by X87 jitted code are double precision according to the ECMA standard.
  The comparison of different precisons caused some of those test cases failed.

  For Ieee754.Expm1/Ieee754.Cos/Ieee754.Tan test cases, the expected values are pre-defined double precision values, the results
  generated by C++ function are extended double precision. The comparison of different precisons caused some of those test cases
  failed too.

  This CL disables RunFloat64Sin/RunFloat64Cos/RunFloat64Expm1/RunFloat64Tan/Ieee754.Expm1/Ieee754.Cos/Ieee754.Tan test cases for x87.

BUG=

Review-Url: https://codereview.chromium.org/2111493002
Cr-Commit-Position: refs/heads/master@{#37371}

Operand(reg) -> reg
Operand(reg, 0) -> [reg]

BUG=

Review-Url: https://codereview.chromium.org/2111503002
Cr-Commit-Position: refs/heads/master@{#37370}

The lastIndex property must be written with the semantics of a strict [[Set]],
so an exception must be thrown when the attributes don't allow writing.  We used
to ignore the attributes.

R=littledan@chromium.org, yangguo@chromium.org
BUG=v8:5138

Review-Url: https://codereview.chromium.org/2109593002
Cr-Commit-Position: refs/heads/master@{#37369}

This makes preparation of eager checkpoints within the graph builder
implicit. Every sub-expression visitation is now guaranteed to emit
valid checkpoints in AstContext.

R=jarin@chromium.org
BUG=v8:5021

Review-Url: https://codereview.chromium.org/2074703002
Cr-Commit-Position: refs/heads/master@{#37368}

It's not safe to magically compute types during representation
selection, so better disable the Typer decorator before we start
to do the representation/truncation analysis. This will also allow
us to move to a world where we can run representation selection
concurrently eventually.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2103363004
Cr-Commit-Position: refs/heads/master@{#37367}