Default parameters have additional declaration block scopes inserted
around them when something in the function scope calls eval. This
patch sets the parent scope of the expressions introduced due to
those defaults to the new block scope.

R=adamk
BUG=chromium:616386

Review-Url: https://codereview.chromium.org/2077283004
Cr-Commit-Position: refs/heads/master@{#37198}

We would otherwise also count if its just trimming whitespaces.

R=adamk@chromium.org
BUG=chromium:618595

Review-Url: https://codereview.chromium.org/2080183003
Cr-Commit-Position: refs/heads/master@{#37197}

R=adamk@chromium.org
BUG=chromium:621496
LOG=N

Review-Url: https://codereview.chromium.org/2084703005
Cr-Commit-Position: refs/heads/master@{#37196}

Currently CpuProfiler is a subclass of CodeEventListener, it listens code events
from Logger, constructs and stores CodeEventsContainer. This patch is part of
the effort to split the logic of CodeEventListener as ProfilerListener out of
the profiling functionality logic in CpuProfiler. A ProfilerListener will listen
to code events, construct code event to CodeEventsContainer and pass it to code
event handler.

The reason we refactor CpuProfiler is that eventually we want to move
CpuProfiler as part of sampler library and code event listener should stay
inside V8.

Main changes:
1. Refactored CpuProfiler into two parts, the CpuProfiler with profling
functionality and the ProfilerListener listening to code events from Logger.
2. Created CodeEventObserver and made CpuProfiler inherit from it.
ProfilerListener will have a list of observers and call CodeEventHandler once a
code event is created.
3. Moved code entry list from CodeEntry to ProfilerListener.

Minor changes:
1. Moved static code entry as part of CodeEntry.
2. Added ProfilerListener to Logger.

BUG=v8:4789

Committed: https://crrev.com/cb59fc1facc9b390e2c7544b4da56a4e0a9b3222
Review-Url: https://codereview.chromium.org/2053523003
Cr-Original-Commit-Position: refs/heads/master@{#37112}
Cr-Commit-Position: refs/heads/master@{#37195}

BUG=v8:4483

Review-Url: https://codereview.chromium.org/2083653003
Cr-Commit-Position: refs/heads/master@{#37194}

Because --help does not show how to use boolean flags.

R=jkummerow@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2087223002
Cr-Commit-Position: refs/heads/master@{#37193}

BUG=
LOG=no

Review-Url: https://codereview.chromium.org/2085043005
Cr-Commit-Position: refs/heads/master@{#37192}

BUG=

Review-Url: https://codereview.chromium.org/2085273002
Cr-Commit-Position: refs/heads/master@{#37191}

BUG=
LOG=no

Review-Url: https://codereview.chromium.org/2084823004
Cr-Commit-Position: refs/heads/master@{#37190}

Updates kProfilerTicksBeforeBaseline in runtime-profiler to allow
functions to switch from ignition to full-codgen earlier. This helps
on many benchmarks and does not impact the code size significantly.

BUG=v8:4280
LOG=N

Review-Url: https://codereview.chromium.org/2085153003
Cr-Commit-Position: refs/heads/master@{#37189}

BUG=chromium:616035
NOTRY=true

Review-Url: https://codereview.chromium.org/2088963003
Cr-Commit-Position: refs/heads/master@{#37188}

BUG=chromium:609107
R=machenbach@chromium.org

Review-Url: https://codereview.chromium.org/2081323004
Cr-Commit-Position: refs/heads/master@{#37187}

TBR=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2087803005
Cr-Commit-Position: refs/heads/master@{#37186}

Adds support for intrinsics which can be called as stubs. Namely:
 - HasProperty
 - MathPow
 - NewObject
 - NumberToString
 - RegExpConstructResult
 - RegExpExec
 - Substring
 - ToString
 - ToName
 - ToLength
 - ToNumber
 - ToObject

Also adds interface descriptors for stub calls which have arguments
passed on the stack.

BUG=v8:4280
LOG=N

Review-Url: https://codereview.chromium.org/2051573002
Cr-Commit-Position: refs/heads/master@{#37185}

The missing part from
  https://codereview.chromium.org/2078403002/

R=jochen@chromium.org
BUG=chromium:621869
LOG=N

Review-Url: https://codereview.chromium.org/2077353004
Cr-Commit-Position: refs/heads/master@{#37184}

If the semaphore is stored as a local variable in {CompileInParallel},
then the semaphore was sometimes deallocated too early and caused
the compilation tasks to crash. This only happens with libc-2.19,
libc-2.21 fixes the problem.

R=mlippautz@chromium.org, rossberg@chromium.org

Review-Url: https://codereview.chromium.org/2080223006
Cr-Commit-Position: refs/heads/master@{#37183}

Receiver is the hole when we construct a builtin object.

BUG=chromium:611684

Review-Url: https://codereview.chromium.org/2083163003
Cr-Commit-Position: refs/heads/master@{#37182}

Previously only stubs built in the snapshot were checked for having an
eager frame. This caused a regression to creap in on ia32 for
RegExpConstructResultStub. Change test to always check.

CQ_EXTRA_TRYBOTS=tryserver.v8:v8_linux_nosnap_dbg

Review-Url: https://codereview.chromium.org/2089673002
Cr-Commit-Position: refs/heads/master@{#37181}

The CL avoids superfluous conversions / reboxing and handlescopes.

BUG=

Review-Url: https://codereview.chromium.org/2089703004
Cr-Commit-Position: refs/heads/master@{#37180}

This way embedders don't have to manually convert them to strings

BUG=chromium:619166
R=verwaest@chromium.org

Review-Url: https://codereview.chromium.org/2085223002
Cr-Commit-Position: refs/heads/master@{#37179}

R=vogelheim@chromium.org

Review-Url: https://codereview.chromium.org/2083303002
Cr-Commit-Position: refs/heads/master@{#37178}

Review-Url: https://codereview.chromium.org/2066313002
Cr-Commit-Position: refs/heads/master@{#37177}

- Moves the most often used 32 items to the top. This shaves off 10kB
  from the startup snapshot size.
- Sorts the rest by usage and type.

R=mlippautz@chromium.org

Review-Url: https://codereview.chromium.org/2088023003
Cr-Commit-Position: refs/heads/master@{#37176}

R=mlippautz@chromium.org

Review-Url: https://codereview.chromium.org/2080223005
Cr-Commit-Position: refs/heads/master@{#37175}

This was necessary since certain named handlers didn't check the name beforehand, and could miss to LoadIC_Miss with a name convertible to an index. This is currently not supported anymore, so we can drop this path. We should make sure we miss to the right label instead.

BUG=

Review-Url: https://codereview.chromium.org/2083283002
Cr-Commit-Position: refs/heads/master@{#37174}

edi is expected to contain the JS function. Ensure that it is not
overwritten.

BUG=chromium:621431,chromium:621550,chromium:621217
R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2085043004
Cr-Commit-Position: refs/heads/master@{#37173}

R=mlippautz@chromium.org

Review-Url: https://codereview.chromium.org/2087163002
Cr-Commit-Position: refs/heads/master@{#37172}

Failing to do the right check in AdvancePage results in a crash in a CHECK later
in EnsureCurrentCapacity.

BUG=chromium:620750,chromium:622115
LOG=N
R=jochen@chromium.org

Review-Url: https://codereview.chromium.org/2090013002
Cr-Commit-Position: refs/heads/master@{#37171}

R=vogelheim@chromium.org

Review-Url: https://codereview.chromium.org/2081703002
Cr-Commit-Position: refs/heads/master@{#37170}

R=jgruber@chromium.org
BUG=v8:4703

Review-Url: https://codereview.chromium.org/2088703002
Cr-Commit-Position: refs/heads/master@{#37169}

This adds a dedicated test to make sure we don't try constant folding on
checks (in this case CheckTaggedPointer), which would generate invalid
code as we removing checks that guard the constant without knowing
whether it's safe to do so.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2087153002
Cr-Commit-Position: refs/heads/master@{#37168}

Let the SimplifiedOperatorReducer perform some strength reduction for
certain CheckTaggedSigned and CheckTaggedPointer inputs (reusing the
existing logic for ObjectIsSmi).

R=jarin@chromium.org
BUG=v8:5141

Review-Url: https://codereview.chromium.org/2080703006
Cr-Commit-Position: refs/heads/master@{#37167}

Review-Url: https://codereview.chromium.org/2084943002
Cr-Commit-Position: refs/heads/master@{#37166}

BUG=v8:3266, v8:3468, v8:3493, v8:5086, v8:5108
R=rtoy@chromium.org

Review-Url: https://codereview.chromium.org/2086663004
Cr-Commit-Position: refs/heads/master@{#37165}

We cannot change x - y < 0 to x < y, because it would only be safe if
x - y cannot overflow, which we don't know in general.

R=jarin@chromium.org
BUG=v8:5129

Review-Url: https://codereview.chromium.org/2090493002
Cr-Commit-Position: refs/heads/master@{#37164}

Revert of [Crankshaft] Always check for stubs marked to not require an eager frame. (patchset #2 id:20001 of https://codereview.chromium.org/2089673002/ )

Reason for revert:
Breaks with nosnap: https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap%20-%20debug/builds/7474/steps/Check/logs/regress-2612

Original issue's description:
> [Crankshaft] Always check for stubs marked to not require an eager frame.
>
> Previously only stubs built in the snapshot were checked for having an
> eager frame. This caused a regression to creap in on ia32 for
> RegExpConstructResultStub. Change test to always check.
>
> Committed: https://crrev.com/f6facbb2106ffc2918dd249166233a7fa95dc449
> Cr-Commit-Position: refs/heads/master@{#37162}

TBR=rmcilroy@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2087963004
Cr-Commit-Position: refs/heads/master@{#37163}

Previously only stubs built in the snapshot were checked for having an
eager frame. This caused a regression to creap in on ia32 for
RegExpConstructResultStub. Change test to always check.

Review-Url: https://codereview.chromium.org/2089673002
Cr-Commit-Position: refs/heads/master@{#37162}

Rolling v8/build to f56976d676dfd5597229b21a83a53a58704582bf

Rolling v8/buildtools to 56eaae134648135663c4aa1ed82278572b5f35ef

Rolling v8/tools/mb to 5268873c8c1eebbf1a3aaed7e63f99b600fab65e

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2087933004
Cr-Commit-Position: refs/heads/master@{#37161}

PPC/s390: [builtins] NonNumberToNumber and StringToNumber now use CallRuntime instead of TailCallRuntime

Port b5c69cbf

Original commit message:

    With the tail call, pointers to the JS heap could be pushed on a
    js-to-wasm frame. On the js-to-wasm frame, however, this pointer would
    not be updated by the GC.

R=ahaas@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=617084
LOG=N

Review-Url: https://codereview.chromium.org/2085183002
Cr-Commit-Position: refs/heads/master@{#37160}

Add a flag to gate experimental support for dynamic code loading and JITing (at runtime in a wasm module).

Enhancing functionality of the indirect function table to support JITing and dynamic linking by allowing additional space to be filled with an "undefined" function signature.

BUG=v8:5044
LOG=N
TEST=None
R=mtrofin@chromium.org,bradnelson@chromium.org

Review-Url: https://codereview.chromium.org/2049513003
Cr-Commit-Position: refs/heads/master@{#37159}