Adding implementation for step 9 which is missing for spec:
https://tc39.github.io/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-ownpropertykeys
Update bytecode_expectations as well.

Bug v8:6776

Change-Id: Id191f9604e2dc08e71cbcff8ebd5707c233af193
Reviewed-on: https://chromium-review.googlesource.com/c/1419779Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#59180}

This reverts commit b022e825.

Reason for revert: Fails nosnap: https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Linux%20-%20nosnap%20-%20debug/22761

Original change's description:
> [builtins] Verify Isolate compatibility with the embedded blob
> 
> Embedded builtins (= the embedded blob) have a few dependencies on the
> snapshot state. For instance, they require that metadata stored on
> builtin Code objects as well as the builtins constant table remain
> unchanged from mksnapshot-time. Embedders may violate these
> assumptions by accident, e.g. by loading a snapshot generated with
> different build flags, leading to seemingly unrelated failures later
> on.
> 
> This CL introduces an Isolate hash stored in the embedded blob which
> hashes relevant parts of builtin Code objects and the builtins
> constant table. It's verified in Isolate::Init in debug builds.
> 
> Bug: v8:8723
> Change-Id: Ifc9bdbe6f56ea67d8984f162afa73a3572cfbba8
> Reviewed-on: https://chromium-review.googlesource.com/c/1442641
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#59177}

TBR=sigurds@chromium.org,jgruber@chromium.org

Change-Id: I027ae2585bd06290ea3245b1fc23efba544eb470
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:8723
Reviewed-on: https://chromium-review.googlesource.com/c/1443059Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59179}

Bug: v8:7790
Change-Id: I0576e44aad53f0d2a14526749ec7cc0140a54ab8
Reviewed-on: https://chromium-review.googlesource.com/c/1443052
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59178}

Embedded builtins (= the embedded blob) have a few dependencies on the
snapshot state. For instance, they require that metadata stored on
builtin Code objects as well as the builtins constant table remain
unchanged from mksnapshot-time. Embedders may violate these
assumptions by accident, e.g. by loading a snapshot generated with
different build flags, leading to seemingly unrelated failures later
on.

This CL introduces an Isolate hash stored in the embedded blob which
hashes relevant parts of builtin Code objects and the builtins
constant table. It's verified in Isolate::Init in debug builds.

Bug: v8:8723
Change-Id: Ifc9bdbe6f56ea67d8984f162afa73a3572cfbba8
Reviewed-on: https://chromium-review.googlesource.com/c/1442641
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59177}

Bug: v8:7790
Change-Id: If48109451676b7f028367f8366848a539949c3a8
Reviewed-on: https://chromium-review.googlesource.com/c/1442255
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59176}

Registered callbacks should not keep the NativeModule alive. Otherwise,
tiering will always run to completion, even if the NativeModule is not
being used any more.
This change can cause the callback to not be called if the module dies
before it finishes top-tier compilation. This is the desired behaviour.

R=ahaas@chromium.org
CC=titzer@chromium.org, bbudge@chromium.org

Bug: v8:8689, chromium:719172
Change-Id: Ide9d639f465497c3ed3439c7ce25c76dceeb97eb
Reviewed-on: https://chromium-review.googlesource.com/c/1435937Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59175}

This fixes RunWasmInterpreter_* tests on big endian mips/ppc/s390.

Change-Id: I4b9b767d0de45004ee1195ac225c6d1027c17a05
Reviewed-on: https://chromium-review.googlesource.com/c/1439517
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59174}

This is not needed generally, and might prevent catching bugs where
labels are not bound correctly. Instead, only unuse labels on errors.

R=mstarzinger@chromium.org

Change-Id: I1dc77ea21ca80c5be801f17ba284908e1c04abe0
Reviewed-on: https://chromium-review.googlesource.com/c/1443051
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59173}

On Liftoff bailout, instead of binding all unbound labels (to avoid
triggering DCHECKS in their destructor), just Unuse them.

R=mstarzinger@chromium.org

Bug: chromium:924843
Change-Id: Icf581bca06eaa7369ab2bbd5d805112289d6a801
Reviewed-on: https://chromium-review.googlesource.com/c/1442645Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59172}

This is a reland of acb60162

Original change's description:
> [test] Add testing facility for SerializerForBackgroundCompilation
> 
> R=neis@chromium.org
> 
> Bug: v8:7790
> Change-Id: Id759112d0c780ff857eb094102245b38fcbb1709
> Reviewed-on: https://chromium-review.googlesource.com/c/1434375
> Reviewed-by: Georg Neis <neis@chromium.org>
> Commit-Queue: Maya Lekova <mslekova@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#59153}

Bug: v8:7790
Change-Id: I1593a768c77c563707b498d47b34a2b1e7fa5dea
Reviewed-on: https://chromium-review.googlesource.com/c/1442234
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59171}

In some test-run-wasm-js cctests we want to call wasm code through the
js-to-wasm wrapper. This did not work if we wanted to run the wasm code
in the interpreter, because we never compiled a WasmInterpreterEntry,
and we did not patch the jump table.

With this CL we do both now.

R=clemensh@chromium.org
CC=fgm@chromium.org

Change-Id: I49971c5079053ed572928da7eab3e6ea3cb57c25
Reviewed-on: https://chromium-review.googlesource.com/c/1435941
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59170}

jumbo.gni will check whether use_jumbo_build is set or not and
if it's not set it will just check that |jumbo_excluded_sources|
lists do not include non-existing files. That means that there
is little/nothing to lose by always routing v8_source_set that
way, and it adds a bit in build file simplicity and local
checking of |jumbo_excluded_sources|.

Change-Id: I19ed91d304f4a2edbf10661d20e5f5d3180b3a35
Reviewed-on: https://chromium-review.googlesource.com/c/1430832
Commit-Queue: Daniel Bratell <bratell@opera.com>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59169}

During execution, the tier can be switch from Liftoff to TurboFan. We
already handle this in some locations by getting the tier before
execution, so that we later know which was the requested tier for that
unit.
In the case of the --wasm-tier-mask-for-testing flag, this accounting
was not right because the tier was already switched in the constructor.
This CL changes the compilation units to store both the requested and
the executed tier explicitly, so we know which counter to decrement
when the unit finishes.

R=ahaas@chromium.org

Bug: chromium:925671
Change-Id: I673463135e9b3ab17e40cfdfd5d3a526ad5a9b79
Reviewed-on: https://chromium-review.googlesource.com/c/1442639Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59168}

There is no linking stage any more, and all the {Link} method did was
to set the module to executable. Thus rename the method to reflect that.

R=ahaas@chromium.org

Bug: v8:8562
Change-Id: Ifc83b5cbbb1377312d7c318e50a0f9d1ede45aa6
Reviewed-on: https://chromium-review.googlesource.com/c/1439237Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59167}

This is a followup change for https://crrev.com/c/1437275 to keep
the core wasm spec tests in sync with the tests checked out in
test/wasm-js/data.

R=clemensh@chromium.org

Change-Id: I3c78c5db647e9c871b4c64efbc9656acd1266efb
Reviewed-on: https://chromium-review.googlesource.com/c/1442638
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59166}

Currently, errors somewhere deep in a promise chain are not reported as
test failures. We would print the error, but still return with exit
status 0. This CL fixes this to treat any uncaught exception as
failure, as we already do in {Shell::ExecuteString}.

R=yangguo@chromium.org

Change-Id: Idc4e58cc0d45f8fca3f7b2c5070ab68d317fc00b
Reviewed-on: https://chromium-review.googlesource.com/c/1439378Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59165}

This is a reland of d4cc132e
without changes.

Original change's description:
> [turbofan] Extend/change serializer list of bytecodes.
>
> In particular, don't clear environment for StackCheck.
> Clear it for all throw and generator-related operations.
>
> Also improve some printing.
>
> Bug: v8:7790
> Change-Id: I45d0994a06ba7ca430e78d631d85b2c6b2e9e323
> Reviewed-on: https://chromium-review.googlesource.com/c/1439376
> Commit-Queue: Georg Neis <neis@chromium.org>
> Reviewed-by: Maya Lekova <mslekova@chromium.org>
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#59157}

Tbr: mslekova@chromium.org
Bug: v8:7790
Change-Id: I86a72170eebff332ade08679f7fd895dd0652e1a
Reviewed-on: https://chromium-review.googlesource.com/c/1442633Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59164}

Also removes some obsolete gn definitions.

Bug: v8:8678
Change-Id: I418051177f059ab413b996a641ecf23f70d6c8bc
Reviewed-on: https://chromium-review.googlesource.com/c/1433789
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59163}

Bug: chromium:926036
Change-Id: Ibc8d3ffc3f9411fa33c0ed6326cb6b19a7d8dd05
Reviewed-on: https://chromium-review.googlesource.com/c/1442635Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59162}

Cq-Include-Trybots: luci.chromium.try:linux-blink-rel
Change-Id: I9693dbdebbfb8590c5887bd07971fa9b3b042313
Reviewed-on: https://chromium-review.googlesource.com/c/1437275Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Sven Sauleau <ssauleau@igalia.com>
Cr-Commit-Position: refs/heads/master@{#59161}

This is a reland of 3145505a,
after removing the clashing Register name binding.

Original change's description:
> [turbofan] Support new.target in the serializer.
>
> Bug: v8:7790
> Change-Id: Ie98cff6f8b1f184c8152952cc3d39e373c93565d
> Reviewed-on: https://chromium-review.googlesource.com/c/1435943
> Commit-Queue: Georg Neis <neis@chromium.org>
> Reviewed-by: Maya Lekova <mslekova@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#59118}

Tbr: mslekova@chromium.org
Bug: v8:7790
Change-Id: I354d7907342e1f040d01eecc8b51ffca6e83c28d
Reviewed-on: https://chromium-review.googlesource.com/c/1442233
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59160}

This reverts commit d4cc132e.

Reason for revert: Bad merge due to other reverted CL

Original change's description:
> [turbofan] Extend/change serializer list of bytecodes.
> 
> In particular, don't clear environment for StackCheck.
> Clear it for all throw and generator-related operations.
> 
> Also improve some printing.
> 
> Bug: v8:7790
> Change-Id: I45d0994a06ba7ca430e78d631d85b2c6b2e9e323
> Reviewed-on: https://chromium-review.googlesource.com/c/1439376
> Commit-Queue: Georg Neis <neis@chromium.org>
> Reviewed-by: Maya Lekova <mslekova@chromium.org>
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#59157}

TBR=jarin@chromium.org,neis@chromium.org,mslekova@chromium.org

Change-Id: I349398e8ec1b00d2725032435374c0d4205982f3
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7790
Reviewed-on: https://chromium-review.googlesource.com/c/1442632Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59159}

This reverts commit 7e93c3bf.

Reason for revert: Bug was fixed

Original change's description:
> [release] Temporarily remove two gpu bots from V8 auto-roller
> 
> TBR=mslekova@chromium.org
> NOTRY=true
> 
> Bug: chromium:925750
> Change-Id: I6700ce261e2e083867b71874dfe4c308ccc0d764
> Reviewed-on: https://chromium-review.googlesource.com/c/1437117
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#59126}

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org,mslekova@chromium.org

Change-Id: If1373a5151386f5dcd7998f0ba97460d30aeb9e7
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:925750
Reviewed-on: https://chromium-review.googlesource.com/c/1442631Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59158}

In particular, don't clear environment for StackCheck.
Clear it for all throw and generator-related operations.

Also improve some printing.

Bug: v8:7790
Change-Id: I45d0994a06ba7ca430e78d631d85b2c6b2e9e323
Reviewed-on: https://chromium-review.googlesource.com/c/1439376
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59157}

This replaces InNewSpace with InYoungGeneration, which is
a prerequisite for young large objects.

Additional changes:
- FROM_SPACE, TO_SPACE flags are renamed to FROM_PAGE, TO_PAGE.
- A new LARGE_PAGE flag is added.
- The external string table is refactored to track young string
  instead of new space strings.

Bug: chromium:924547
Change-Id: Ia4e3ba1b72995c3400257a1f98559f091533e811
Reviewed-on: https://chromium-review.googlesource.com/c/1437274Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59156}

Change-Id: I0e538704f6dd9e7344c2bf77d5ca4b5765927d74
Reviewed-on: https://chromium-review.googlesource.com/c/1437287Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59155}

This reverts commit acb60162.

Reason for revert: Breaks arm build - https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Linux%20-%20arm%20-%20sim%20-%20lite/2035

Original change's description:
> [test] Add testing facility for SerializerForBackgroundCompilation
> 
> R=​neis@chromium.org
> 
> Bug: v8:7790
> Change-Id: Id759112d0c780ff857eb094102245b38fcbb1709
> Reviewed-on: https://chromium-review.googlesource.com/c/1434375
> Reviewed-by: Georg Neis <neis@chromium.org>
> Commit-Queue: Maya Lekova <mslekova@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#59153}

TBR=neis@chromium.org,mslekova@chromium.org

Change-Id: I5e6a3b94a9b177242aebb582c5184bb35e999314
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7790
Reviewed-on: https://chromium-review.googlesource.com/c/1442232Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59154}

R=neis@chromium.org

Bug: v8:7790
Change-Id: Id759112d0c780ff857eb094102245b38fcbb1709
Reviewed-on: https://chromium-review.googlesource.com/c/1434375Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59153}

This CL extends the kCircularStructure error message to include the
constructors and keys involved in the circle:

const a = {};
a.arr = [];
a.arr[0] = a;
JSON.stringify(a);

TypeError: Converting circular structure to JSON
    --> starting at object with constructor 'Object'
    |     property 'arr' -> object with constructor 'Array'
    --- index 0 closes the circle

R=gsathya@chromium.org, yangguo@chromium.org

Bug: v8:6513, v8:8696
Change-Id: I393aa3ce47d8bfd03734fccac63445006940ef7a
Reviewed-on: https://chromium-review.googlesource.com/c/1433776Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59152}

This CL factors out the preparation of Microtask to a function, so that
we don't miss the common set up for new types of Microtasks.

Bug: v8:8124
Change-Id: I5e1e46b368dfc3d28a5d0a97d0f47e0479d600f4
Reviewed-on: https://chromium-review.googlesource.com/c/1423981Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Taiju Tsuiki <tzik@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59151}

Bug: v8:7793
Change-Id: I28a60cdbce211fadf3b749b582a81ae78ff76548
Reviewed-on: https://chromium-review.googlesource.com/c/1435945
Commit-Queue: Daniel Clifford <danno@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59150}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/a041d21..7a588f4

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/514fe3e..eae881c

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/bdb1123..9f5b861

Rolling v8/third_party/fuchsia-sdk: https://chromium.googlesource.com/chromium/src/third_party/fuchsia-sdk/+log/5157be4..0544fee

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: Ic5ff7060b57aed1624a1a7fa2c7b0456f95e797a
Reviewed-on: https://chromium-review.googlesource.com/c/1441913Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#59149}

This is a reland of 516d9068

Original change's description:
> Expose the number of microtasks from RunMicrotasks
>
> This CL adds the number of processed microtasks to the tracing marker
> of RunMicrotasks, plus let RunMicrotasks return the number.
>
> Bug: v8:7804, v8:8124
> Change-Id: Ie584e22964121fbda3a822379d760e7518fc54a7
> Reviewed-on: https://chromium-review.googlesource.com/c/1425277
> Commit-Queue: Taiju Tsuiki <tzik@chromium.org>
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#59017}

Bug: v8:7804, v8:8124
Change-Id: I4a57ba3e23973f6b46414c4502244091c42cf532
Reviewed-on: https://chromium-review.googlesource.com/c/1430399Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Taiju Tsuiki <tzik@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59148}

Bug: v8:7770
Change-Id: I649dd1fb52c1598281e7f70cce74b1798504640a
Reviewed-on: https://chromium-review.googlesource.com/c/1436598
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59147}

Bug: chromium:925216
Change-Id: I29d71df0c4c7850a80a86cd0719dea04fcc61816
Reviewed-on: https://chromium-review.googlesource.com/c/1436597Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59146}

Bug: v8:7834,v8:8613,v8:8243
Change-Id: I4464b52ac70fde0e8cec175197833b3f72806263
Reviewed-on: https://chromium-review.googlesource.com/c/1440561Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59145}

Numeric conversions are defined behavior iff the value is in the
range of what the target type can represent.

Bug: v8:3770
Change-Id: Ic6f2276c64cb39345a45d8e37e604c28ecca34c2
Reviewed-on: https://chromium-review.googlesource.com/c/1436216
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59144}

Smi::LexicographicCompare: signed integer overflow on negation.
Drive-by improvement: reduce number of branches.

RegExpQuantifier: signed integer overflow on multiplication.

DateCache::DaylightSavingsOffsetInMs: signed integer overflow
on addition.

Bug: v8:3770,chromium:923466,chromium:923642,chromium:923626
Change-Id: If7d995a13893d1315449ee0bab8b5f2553e170f5
Reviewed-on: https://chromium-review.googlesource.com/c/1436229Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59143}

NativeRegExpMacroAssembler::Match() can return either a Result sentinel
or an int indicating the number of matches, so it should return a plain
int which we can only safely cast to Result or IrregexpResult when it's
guaranteed to be the former case.

Bug: v8:3770
Change-Id: I4c3447e0cdebd5f825964e086574ab504a1799cd
Reviewed-on: https://chromium-review.googlesource.com/c/1435735Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59142}

Since we allocate raw zone memory for its inputs right behind the Node
object anyway, drop the previously OOB-accessed 1-element array within
the Node and use address computation to get to the inputs storage.
Note that this saves one pointer per Node, except for Nodes with zero
inputs, where it uses 1*sizeof(Use) more memory than before.

Bug: v8:3770
Change-Id: I7f5965c6f1b49013eb7f5a447b685d47decaa8fb
Reviewed-on: https://chromium-review.googlesource.com/c/1436218Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59141}