As part of this CL, object reference tracking is implemented (and tested with a
self-referential object). This sort of reference tracking will be shared with
other receivers (array, date, regexp and host objects).

Not included in this CL is compatibility with version-0 objects (which don't
support a non-tree object graph, and require a little stack to correctly
deserialize).

BUG=chromium:148757

Review-Url: https://codereview.chromium.org/2246093003
Cr-Commit-Position: refs/heads/master@{#38683}

The Smi case was updating the feedback with a bitwise AND instead of a bitwise OR. This was causing feedback that should have been 'kAny' to be erroneusly reported as 'kSignedSmall'.

R=rmcilroy@chromium.org

Review-Url: https://codereview.chromium.org/2251863004
Cr-Commit-Position: refs/heads/master@{#38682}

We mark an object allocated as uninitialized. If we happen to have a GC before
fields of a map are written, msan will observe access to unitialized memory and
crash.

This also unifies the handling as we now deal with all spaces in the same way.
In future we could parallelize clearing.

BUG=chromium:638226
R=hpayer@chromium.org

Review-Url: https://codereview.chromium.org/2251993002
Cr-Commit-Position: refs/heads/master@{#38681}

Fix 2cf2eef7

Fix test failures with tests working on external Uint32 arrays. Problem
started to appear because Uint32 value was compared using Int32 compare
operators in ChangeUint32ToTagged. On MIPS64. Uint32 value is not sign-
extended, so upper 32 bits of this value are zero. MIPS64 doesn't have
Word32Compare instructions but uses Word64Compare instructions in
combination with properly sign-extended Int32 values.

BUG=cctest/test-api/Uint32Array,cctest/test-api/SharedUint32Array,
cctest/test-api/FixedUint32Array,mjsunit/compiler/uint32

Review-Url: https://codereview.chromium.org/2231053002
Cr-Commit-Position: refs/heads/master@{#38680}

R=rmcilroy@chromium.org
TEST=webkit/fast/js/deep-recursion-test

Review-Url: https://codereview.chromium.org/2254773002
Cr-Commit-Position: refs/heads/master@{#38679}

This removes the representation axis from the type of {Load/StoreField}
operators representing a property load/store. The representation would
be narrowed to {None} which causes problems for all places where we use
the type to reason about the value representation. Instead we should
fully switch to {MachineRepresentation}. This is just a stop-gap fix.

R=jarin@chromium.org
BUG=chromium:636716

Review-Url: https://codereview.chromium.org/2255533003
Cr-Commit-Position: refs/heads/master@{#38678}

1, restrict use of LiteralBuffers to the tokens that actually need it.
  - E.g., previously the Token::FUNCTION would have a literal buffer
    containing "function", which was never actually used.
  - This eliminates copies of the string data for every call to
    PeekAhead or SetBookmark.
2, document & enforce the "secret" Scanner API contract w/ DCHECK
  - Document & check the correspondence of token value and literal buffer.
  - Document & check preconditions for calling PeekAhead, ScanRegExp*,
    ScanTemplate*.

BUG=v8:4947

Review-Url: https://codereview.chromium.org/2240513003
Cr-Commit-Position: refs/heads/master@{#38677}

Now that all backends use the source position builder to record source
positions, simplify the code line logging events to take a source
position table on code creation. This means that the source position
table builder no longer needs to access the isolate until the table is
generated. This is required for off-thread bytecode generation.

BUG=v8:5203

Review-Url: https://codereview.chromium.org/2248673002
Cr-Commit-Position: refs/heads/master@{#38676}

At the moment, two NumberConstant nodes get different type even if their
value is the same because we always allocate a new heap number for
each number constant. This can lead to replacing a node with a node of
disjoint type in value numbering, which can result in incorrect code
down the line because of inconsistent types.

This fix makes sure that we only replace a node with a sub-type
node. Once we introduce a proper type for number constants, we can
move back to the intersection typing in value numbering.

Unfortunately, it is quite hard to write a repro for this because we cache NumberConstant nodes. We only throw away cached values that have too many conflicts (>5), so the test has to contain values that fall into the same bucket. That's where the magic floating point numbers in the test come from (they have the same low 8-bits of their hashes).

BUG=chromium:633497

Review-Url: https://codereview.chromium.org/2251833002
Cr-Commit-Position: refs/heads/master@{#38675}

This CL removes the optional operator flag of Float64Max and Float64Min.
Additionally it renames the instruction codes on x64 and ia32 because
the old instructions codes (e.g. SSEFloat64Max) do not match the
generated code anymore.

R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2237813002
Cr-Commit-Position: refs/heads/master@{#38674}

BUG=v8:5209

Review-Url: https://codereview.chromium.org/2254433002
Cr-Commit-Position: refs/heads/master@{#38673}

Rolling v8/build to 9a1647ec813695da7960692f711a1cebc948d551

Rolling v8/third_party/WebKit/Source/platform/inspector_protocol to b53e3af6bfca3333fc2dd69302dac6667a8c6418

Rolling v8/tools/clang to b5889296bac50b31f1d2806633fe99dfc2b26b54

Rolling v8/tools/mb to c5a112880d83d509e88c01d524c988845a3a3ba6

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2247183004
Cr-Commit-Position: refs/heads/master@{#38672}

See https://google.github.io/styleguide/cppguide.html#Enumerator_Names

Also rename "FunctionBody" to "FunctionBodyType" and move it inside
Parser, which is the only place it's referenced.

R=caitp@igalia.com, littledan@chromium.org

Review-Url: https://codereview.chromium.org/2245133003
Cr-Commit-Position: refs/heads/master@{#38671}

BUG=

Review-Url: https://codereview.chromium.org/2249293002
Cr-Commit-Position: refs/heads/master@{#38670}

Revert of [Interpreter] Introduce InterpreterCompilationJob (patchset #7 id:140001 of https://codereview.chromium.org/2240463002/ )

Reason for revert:
Breaks Win64 bot

Original issue's description:
> [Interpreter] Introduce InterpreterCompilationJob
>
> Adds InterpreterCompilationJob as a sub-class of
> CompilationJob, to enable off-thread bytecode
> generation. Currently only used in
> Interpreter::MakeBytecode.
>
> As part of this change, CompilationJob is modified
> to make it less specific to optimized compilation,
> renaming the phases as follows:
>  - CreateGraph -> PrepareJob
>  - OptimizeGraph -> ExecuteJob
>  - GenerateCode -> FinalizeJob
>
> RegisterWeakObjectsInOptimizedCode is also moved out
> of CompilationJob and instead becomes a static function
> on Compiler.
>
> BUG=v8:5203
>
> Committed: https://crrev.com/1fb6a7e697e8bc5b4af51647553741f966e00cdc
> Committed: https://crrev.com/785990e9fc0dd9a9d963d25d0bed2909165e4ca9
> Cr-Original-Commit-Position: refs/heads/master@{#38662}
> Cr-Commit-Position: refs/heads/master@{#38668}

TBR=mstarzinger@chromium.org,jkummerow@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5203

Review-Url: https://codereview.chromium.org/2251673003
Cr-Commit-Position: refs/heads/master@{#38669}

Adds InterpreterCompilationJob as a sub-class of
CompilationJob, to enable off-thread bytecode
generation. Currently only used in
Interpreter::MakeBytecode.

As part of this change, CompilationJob is modified
to make it less specific to optimized compilation,
renaming the phases as follows:
 - CreateGraph -> PrepareJob
 - OptimizeGraph -> ExecuteJob
 - GenerateCode -> FinalizeJob

RegisterWeakObjectsInOptimizedCode is also moved out
of CompilationJob and instead becomes a static function
on Compiler.

BUG=v8:5203

Committed: https://crrev.com/1fb6a7e697e8bc5b4af51647553741f966e00cdc
Review-Url: https://codereview.chromium.org/2240463002
Cr-Original-Commit-Position: refs/heads/master@{#38662}
Cr-Commit-Position: refs/heads/master@{#38668}

- Add object template categories.
- Add optimized code literals.
- Add compilation cache hash tables.
- Report overhead for code cache when used as hashtable.

BUG=chromium:631094

Review-Url: https://codereview.chromium.org/2246473002
Cr-Commit-Position: refs/heads/master@{#38667}

Revert of Better pack fields in Variable (patchset #1 id:1 of https://codereview.chromium.org/2253513002/ )

Reason for revert:
Revert: Breaks ARM build: https://uberchromegw.corp.google.com/i/client.v8.ports/builders/V8%20Arm%20-%20builder/builds/2999

Original issue's description:
> Better pack fields in Variable
>
> This reduces sizeof(Variable) from 64 to 40 on x64
>
> BUG=v8:5209
>
> Committed: https://crrev.com/d84343568047c8621a6b8f88f20a7f34586321b8
> Cr-Commit-Position: refs/heads/master@{#38659}

TBR=marja@chromium.org,jkummerow@chromium.org,verwaest@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5209

Review-Url: https://codereview.chromium.org/2249203002
Cr-Commit-Position: refs/heads/master@{#38666}

If a key is a substring of an earlier value, then the earlier value
will unintentionally be clobbered. For example with:
  macro SET_PRIVATE(obj, sym, val) = (obj[sym] = val);
  SET_PRIVATE(iterator, arrayIteratorObjectSymbol, object);
if the mapping is:
  {'val': 'object',
   'obj': 'iterator',
   'sym': 'arrayIteratorObjectSymbol'}
then 'obj' -> 'iterator' will clobber 'val' -> 'object', resulting in
'val' -> 'iteratorect'. To fix this, replace all substitutions
simultaneously.

Patch from Zoe Clifford <zoeclifford@google.com>

Review-Url: https://codereview.chromium.org/2249873004
Cr-Commit-Position: refs/heads/master@{#38665}

Port d941b52d

Original commit message:

    These new representations aren't used yet.

R=mvstanton@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2246213004
Cr-Commit-Position: refs/heads/master@{#38664}

Revert of [Interpreter] Introduce InterpreterCompilationJob (patchset #7 id:140001 of https://codereview.chromium.org/2240463002/ )

Reason for revert:
Failing on Win64 bot:
https://build.chromium.org/p/client.v8/builders/V8%20Win64/builds/12061/steps/Check/logs/regress-635429

Original issue's description:
> [Interpreter] Introduce InterpreterCompilationJob
>
> Adds InterpreterCompilationJob as a sub-class of
> CompilationJob, to enable off-thread bytecode
> generation. Currently only used in
> Interpreter::MakeBytecode.
>
> As part of this change, CompilationJob is modified
> to make it less specific to optimized compilation,
> renaming the phases as follows:
>  - CreateGraph -> PrepareJob
>  - OptimizeGraph -> ExecuteJob
>  - GenerateCode -> FinalizeJob
>
> RegisterWeakObjectsInOptimizedCode is also moved out
> of CompilationJob and instead becomes a static function
> on Compiler.
>
> BUG=v8:5203
>
> Committed: https://crrev.com/1fb6a7e697e8bc5b4af51647553741f966e00cdc
> Cr-Commit-Position: refs/heads/master@{#38662}

TBR=mstarzinger@chromium.org,jkummerow@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5203

Review-Url: https://codereview.chromium.org/2249153002
Cr-Commit-Position: refs/heads/master@{#38663}

Adds InterpreterCompilationJob as a sub-class of
CompilationJob, to enable off-thread bytecode
generation. Currently only used in
Interpreter::MakeBytecode.

As part of this change, CompilationJob is modified
to make it less specific to optimized compilation,
renaming the phases as follows:
 - CreateGraph -> PrepareJob
 - OptimizeGraph -> ExecuteJob
 - GenerateCode -> FinalizeJob

RegisterWeakObjectsInOptimizedCode is also moved out
of CompilationJob and instead becomes a static function
on Compiler.

BUG=v8:5203

Review-Url: https://codereview.chromium.org/2240463002
Cr-Commit-Position: refs/heads/master@{#38662}

BUG=v8:5209

Review-Url: https://codereview.chromium.org/2244233003
Cr-Commit-Position: refs/heads/master@{#38661}

Port 77c9cb83.

Original commit message:
This commit fixes wasm little-endian load issue on big-endian platform
by introducing reverse byte operation immediately after a load.

BUG=

Review-Url: https://codereview.chromium.org/2235703002
Cr-Commit-Position: refs/heads/master@{#38660}

This reduces sizeof(Variable) from 64 to 40 on x64

BUG=v8:5209

Review-Url: https://codereview.chromium.org/2253513002
Cr-Commit-Position: refs/heads/master@{#38659}

R=ahaas@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2253543003
Cr-Commit-Position: refs/heads/master@{#38658}

These new representations aren't used yet.

BUG=

Review-Url: https://codereview.chromium.org/2216383002
Cr-Commit-Position: refs/heads/master@{#38657}

BUG=

Review-Url: https://codereview.chromium.org/2253503002
Cr-Commit-Position: refs/heads/master@{#38656}

There was a weird check in AllocateNonParameterLocal which looked
like ".result" was treated differently from other
temporaries. This couldn't be generalized to other temporaries,
since some temporaries were both in temps_ and params_ (and some,
like ".result" would be only in params_).

Side product: Don't use AstValueFactory in scope analysis. It's
unnecessary (was only used for some DCHECKs which can be replaced
with more general checks). This change also ensures we don't
create new values during scope analysis.

BUG=v8:5209

Review-Url: https://codereview.chromium.org/2242783002
Cr-Commit-Position: refs/heads/master@{#38655}

Port d61a5c37

Original commit message:

    As a first step I uncommit the memory on the main thread. Also
    to measure impact and stability of that optimization. In a
    follow-up CL, the uncommitting should be moved on the concurrent thread.

R=jochen@chromium.org, hpayer@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2245703002
Cr-Commit-Position: refs/heads/master@{#38654}

Slots in ConsString/SlicedString can point to an evacutaion candidate.
The MakeExternal function makes in-place conversion to external string.
After the conversion we can have a recorded slot containing an external
pointer. As long as the external pointer is aligned, this is not a
problem. We clear the recorded slots to fix verify-heap checks.

BUG=chromium:631969
LOG=NO

Finalizing CL: https://codereview.chromium.org/2199863002/

Review-Url: https://codereview.chromium.org/2242183003
Cr-Commit-Position: refs/heads/master@{#38653}

BUG=

Review-Url: https://codereview.chromium.org/2241503002
Cr-Commit-Position: refs/heads/master@{#38652}

Allows us to create a corresponding TurboFan node, so TF can
optimize it.

BUG=v8:4280
LOG=n

Review-Url: https://codereview.chromium.org/2248633002
Cr-Commit-Position: refs/heads/master@{#38651}

This moves language-mode initialization for MODULE_SCOPE from Scope::SetDefaults to the single constructor that needs to do it. The CL additionally makes it more obvious that scope-info-backed scopes always initialize language-mode unless WITH_SCOPE.

BUG=

Review-Url: https://codereview.chromium.org/2251683002
Cr-Commit-Position: refs/heads/master@{#38650}

[turbofan] Instead of using properties, use a whitelist for store-store elimination. Make --turbo imply --turbo-store-elimination, so it is tested by ClusterFuzz.

This should fix bug v8:5280.

BUG=v8:5280

Review-Url: https://codereview.chromium.org/2236443006
Cr-Commit-Position: refs/heads/master@{#38649}

This stages the --ignition-preserve-bytecode flag which preserves the
bytecode even when switching to baseline code. It is now implied by the
combined --ignition-staging flag.

R=rmcilroy@chromium.org

Review-Url: https://codereview.chromium.org/2244303003
Cr-Commit-Position: refs/heads/master@{#38648}

BUG=v8:5291
R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2241203004
Cr-Commit-Position: refs/heads/master@{#38647}

BUG=v8:5209

Review-Url: https://codereview.chromium.org/2247073003
Cr-Commit-Position: refs/heads/master@{#38646}

Simple stack traces are captured through Isolate::CaptureSimpleStackTrace.
Captured frames are stored in a FixedArray, which in turn is stored as a
property (using a private symbol) on the error object itself. Actual formatting
of the textual stack trace is done lazily when the user reads the stack
property of the error object.

This would involve many conversions back and forth between index-encoded raw
data (receiver, function, offset and code), JS CallSite objects, and C++
CallSite objects.

This commit refactors the C++ CallSite class into a Struct class called
StackTraceFrame, which is the new single point of truth frame information.
Isolate::CaptureSimpleStackTrace stores an array of StackTraceFrames, and JS
CallSite objects (now created only when the user specifies custom stack trace
formatting through Error.prepareStackTrace) internally only store a reference
to a StackTraceFrame.

BUG=

Review-Url: https://codereview.chromium.org/2230953002
Cr-Commit-Position: refs/heads/master@{#38645}

A test exercising the public APIs for wasm serialization and
simulates the serialization scenario - serialize in one isolate, deserialize
in another.

BUG=v8:5072

Review-Url: https://codereview.chromium.org/2249973002
Cr-Commit-Position: refs/heads/master@{#38644}