Also add support for JSFunction::prototype and JSString::length
accessors to CodeStubAssembler::CallGetterIfAccessor and remove
the special case hack from the LoadIC_Uninitialized.

Also address the TODO to unify the implementation with the
LoadIC_FunctionPrototype handler.

BUG=v8:5269,v8:6325
R=ishell@chromium.org

Change-Id: Ic51221e35a051c403d3a86dc41213c913e8f9d85
Reviewed-on: https://chromium-review.googlesource.com/489946
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44964}

BUG=v8:6316
R=jbroman@chromium.org,yangguo@chromium.org

Change-Id: Icfc33e3e51cdbfad246a971a5a2737a8fdfba058
Reviewed-on: https://chromium-review.googlesource.com/488941
Commit-Queue: Jochen Eisinger <jochen@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44963}

TBR=yangguo@chromium.org,ahaas@chromium.org
NOTRY=true

Change-Id: I1612d95a3782b23371b70d3a8fed600945988486
Reviewed-on: https://chromium-review.googlesource.com/489522Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44962}

Call ToObject on the GetPropertyStub input first, so that lookups on
Strings and other primitives don't automatically hit the runtime, i.e.
as the stub is also used to lookup the special @@split and @@replace
symbols for various String builtins.

BUG=v8:5269
R=ishell@chromium.org

Change-Id: I5dbbc84aa2051173bf10be71c782fbe448481034
Reviewed-on: https://chromium-review.googlesource.com/488441
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44961}

The bot is too slow in it's current configuration.

TBR=bmeurer@chromium.org
NOTRY=true

Change-Id: Ic0318894c4501e47f441c0298a46474afdc45026
Reviewed-on: https://chromium-review.googlesource.com/489502
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44960}

The spec requires that a null @@split / @@replace symbol is treated exactly the
same as if it were undefined, i.e. execution should move on to the default
implementation instead of throwing a TypeError.

BUG=v8:6313

Review-Url: https://codereview.chromium.org/2845153002
Cr-Commit-Position: refs/heads/master@{#44959}

Revert of [turbofan] General consolidation of element access. (patchset #1 id:1 of https://codereview.chromium.org/2836913004/ )

Reason for revert:
Breaks load:tools:drive story

Original issue's description:
> [turbofan] General consolidation of element access.
>
> Avoid TransitionElementsKind when storing to objects which only differ
> in holeyness of their elements kind. Instead go for polymorphic
> CheckMaps, which can often by optimized and avoid the mutation of the
> array map.
>
> This generalizes the approach https://codereview.chromium.org/2836943003
> which covered only element loads.
>
> R=yangguo@chromium.org
> BUG=v8:5267
>
> Review-Url: https://codereview.chromium.org/2836913004
> Cr-Commit-Position: refs/heads/master@{#44828}
> Committed: https://chromium.googlesource.com/v8/v8/+/ed573cee5c1d1e42158829dc0b92fb697234e121

TBR=yangguo@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=v8:5267,chromium:715936

Review-Url: https://codereview.chromium.org/2852623002
Cr-Commit-Position: refs/heads/master@{#44958}

When accessing JSArray::length property from GenericPropertyLoad
(i.e. via a megamorphic KEYED_LOAD_IC), we'd always go to the runtime
at this point, because the CallGetterIfAccessor method didn't support
AccessorInfos at all. Now there's initial support for JSArray::length,
which reduces the number of %KeyedGetProperty calls we see in the
Speedometer/EmberJS test by 5000.

Also-By: ishell@chromium.org
BUG=v8:5269
TBR=ishell@chromium.org

Review-Url: https://codereview.chromium.org/2842373005
Cr-Commit-Position: refs/heads/master@{#44957}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/8ed22b4..02044bf

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/8062a57..9c9ac13

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: I5203736e8ea4c799f3ff90cedafcb50bb9bdfd18
Reviewed-on: https://chromium-review.googlesource.com/489828Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44956}

BUG=

Review-Url: https://codereview.chromium.org/2847683002
Cr-Commit-Position: refs/heads/master@{#44955}

This roll includes:
  - [inspector_protocol] added StringUtil::toDouble method as requirement [1]

[1] https://codereview.chromium.org/2843223005/

BUG=chromium:712610
R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2846673005
Cr-Commit-Position: refs/heads/master@{#44954}

It now passes on both 32-bit and 64-bit nosnap bots.

TBR=ulan@chromium.org
NOTREECHECKS=true

Change-Id: Id797c88f1eb32868433e112883c2c64b8640eb2c
Reviewed-on: https://chromium-review.googlesource.com/489682Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44953}

These tests assume that a newly-created Isolate is pristine, but that's
not true for nosnap builds.

TBR=ulan@chromium.org

Change-Id: Ie5d0fb0450f285c8eeb8e088feef6729102c0f14
Reviewed-on: https://chromium-review.googlesource.com/489063Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44952}

With fix for architectures where x<<32 != x.

Original change's description:
> [base] Introduce RoundUpToPowerOfTwo64
>
> And fix RoundUpToPowerOfTwo32 to return 1 for the input 0.
> 0 is no power of two.
> Beside being the correct value, this also avoids a special case in the
> (new) fast path using the number of leading zeros.
>
> R=​jochen@chromium.org, ahaas@chromium.org
>
> Change-Id: I87173495e13b334954bcebbb55724fb666dfa809
> Reviewed-on: https://chromium-review.googlesource.com/488143
> Reviewed-by: Jochen Eisinger <jochen@chromium.org>
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#44925}

TBR=ahaas@chromium.org,jochen@chromium.org,clemensh@chromium.org,v8-reviews@googlegroups.com

Change-Id: I7b4719d84a419bb7b38e3b5c9d6d183275087ace
Reviewed-on: https://chromium-review.googlesource.com/488981
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44951}

Most callers passed kFinalizeIncrementalMarkingMask, so use that as
a default argument (not using default argument syntax to avoid including
heap.h in cctest.h).

Change-Id: I904f1eb3a0f5fdbe63eab16f6a6f01d04618645d
Reviewed-on: https://chromium-review.googlesource.com/488104Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44950}

When branching to a loop header, we were trying to copy over {arity}
values from the value stack. This is correct for block labels, but not
for loops. When branching back to a loop header, no values need to be
transferred.

R=ahaas@chromium.org
BUG=chromium:715454

Change-Id: I90d806de63d039abf8dcac1abec057860c8f69ca
Reviewed-on: https://chromium-review.googlesource.com/488146
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44949}

HeapVisitor is similar to StaticVisitor but uses virtual dispatch
instead of static function table. It is intended as replacement
of StaticVisitor using the CRTP.

This CL also changes the concurrent marker to use the HeapVisitor.

BUG=chromium:709075

Review-Url: https://codereview.chromium.org/2808093003
Cr-Commit-Position: refs/heads/master@{#44948}

BUG=chromium:715232

Review-Url: https://codereview.chromium.org/2839903003
Cr-Commit-Position: refs/heads/master@{#44947}

We used to rely on the fact that all values kept alive through wrapper
tracing were materialized as heap objects. Smis break this invariant and
need to be filter out.

BUG=chromium:716031

Review-Url: https://codereview.chromium.org/2852463003
Cr-Commit-Position: refs/heads/master@{#44946}

BUG=chromium:704293

Review-Url: https://codereview.chromium.org/2804643006
Cr-Commit-Position: refs/heads/master@{#44945}

Accidental revert...

Original change's description:
> [wasm] [cleanup] Remove unused parameter from SyncValidate
> 
> R=​ahaas@chromium.org
> 
> Change-Id: I952c5461ef44d4b01e99390e668bfc0d7f7ba25b
> Reviewed-on: https://chromium-review.googlesource.com/488341
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#44931}

TBR=ahaas@chromium.org,clemensh@chromium.org,v8-reviews@googlegroups.com

Change-Id: I7e57ccec6c58aa61052613c14d2fd7936e3fb6da
Reviewed-on: https://chromium-review.googlesource.com/488366Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44944}

R=franzih@chromium.org, machenbach@chromium.org

Review-Url: https://codereview.chromium.org/2846883002
Cr-Commit-Position: refs/heads/master@{#44943}

Most of these suppressions were for the old asm-validator or for the old compiler pipeline. Some more are just optimistically removed.

Bug: chromium:681088, chromium:681241, chromium:681806, chromium:662840
NOTRY=true

Change-Id: I4c6851a72d22070026eeaca90ad3394cfce10f90
Reviewed-on: https://chromium-review.googlesource.com/488641
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44942}

With this CL we reduce the difference between directly using a null prototype
in a literal or using Object.create(null).
- The EmitFastCloneShallowObject builtin now supports cloning slow
  object boilerplates.
- Unified behavior to find the matching Map and instantiating it for
  Object.create(null) and literals with a null prototype.
- Cleanup of literal type parameter of CompileTimeValue, now in sync with
  ObjectLiteral flags.

Review-Url: https://codereview.chromium.org/2445333002
Cr-Commit-Position: refs/heads/master@{#44941}

I moved the wasm update scripts from tools/ to tools/wasm. In addition
I cleaned up the scripts a bit.

R=machenbach@chromium.org

Change-Id: I545dd556712e272e6509b78e343e9063346abe56
Reviewed-on: https://chromium-review.googlesource.com/488601Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44940}

R=joransiu@ca.ibm.com, jyan@ca.ibm.com
BUG=
LOG=n

Review-Url: https://codereview.chromium.org/2839343003
Cr-Commit-Position: refs/heads/master@{#44939}

This makes sure that asm.js modules can only be instantiated with a
valid {ArrayBuffer} as the underlying heap buffer for all cases where
accepting anything else would be observably different from JavaScript
proper.

R=clemensh@chromium.org
TEST=mjsunit/asm/asm-memory
BUG=chromium:715505,chromium:715748

Change-Id: I355686200151c5667bf836824de922d657a8d943
Reviewed-on: https://chromium-review.googlesource.com/488521
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44938}

R=machenbach@chromium.org
BUG=v8:6318
NOTRY=true
NOTREECHECKS=true

Change-Id: If57bc5bab8d2544519f140ee4a19aa89b1125fd7
Reviewed-on: https://chromium-review.googlesource.com/488603
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44937}

Revert of PPC/s390: SmiUntag only for 32bit (patchset #1 id:1 of https://codereview.chromium.org/2842843005/ )

Reason for revert:
few tests are failing with stack overflow, will reland with the fix.

Original issue's description:
> PPC/s390: SmiUntag only for 32bit
>
> R=joransiu@ca.ibm.com, jyan@ca.ibm.com
> BUG=
> LOG=n
>
> Review-Url: https://codereview.chromium.org/2842843005
> Cr-Commit-Position: refs/heads/master@{#44908}
> Committed: https://chromium.googlesource.com/v8/v8/+/76dfdb7a32c4be41190ff6a01b23905976e5e0ff

TBR=joransiu@ca.ibm.com,jyan@ca.ibm.com
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review-Url: https://codereview.chromium.org/2852433002
Cr-Commit-Position: refs/heads/master@{#44936}

This reverts commit 9ceaf212.

Reason for revert: Fails on arm: http://build.chromium.org/p/client.v8.ports/builders/V8%20Arm%20-%20debug/builds/2950/steps/Check/logs/Bits.RoundUpToPowerOf..

Original change's description:
> [base] Introduce RoundUpToPowerOfTwo64
> 
> And fix RoundUpToPowerOfTwo32 to return 1 for the input 0.
> 0 is no power of two.
> Beside being the correct value, this also avoids a special case in the
> (new) fast path using the number of leading zeros.
> 
> R=​jochen@chromium.org, ahaas@chromium.org
> 
> Change-Id: I87173495e13b334954bcebbb55724fb666dfa809
> Reviewed-on: https://chromium-review.googlesource.com/488143
> Reviewed-by: Jochen Eisinger <jochen@chromium.org>
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#44925}

TBR=ahaas@chromium.org,jochen@chromium.org,clemensh@chromium.org,v8-reviews@googlegroups.com,wasm-v8@google.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Change-Id: Ib353ee0a944316da6f919bac3bb88d4f95d98ea0
Reviewed-on: https://chromium-review.googlesource.com/488365Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44935}

This reverts commit 33b0b710.

Reason for revert: Fails on arm: http://build.chromium.org/p/client.v8.ports/builders/V8%20Arm%20-%20debug/builds/2950/steps/Check/logs/Bits.RoundUpToPowerOf..

Original change's description:
> [wasm] [cleanup] Remove unused parameter from SyncValidate
> 
> R=​ahaas@chromium.org
> 
> Change-Id: I952c5461ef44d4b01e99390e668bfc0d7f7ba25b
> Reviewed-on: https://chromium-review.googlesource.com/488341
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#44931}

TBR=ahaas@chromium.org,clemensh@chromium.org,v8-reviews@googlegroups.com,wasm-v8@google.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Change-Id: Ie5f28109b86d7810b95053cbca563dea96bd13b2
Reviewed-on: https://chromium-review.googlesource.com/488364Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44934}

The spec tests are stored on a mirror and are downloaded with the DEPS
file. The test files on the mirror are updated with a script which has
to be executed manually.

This CL contains the following changes:

* A script which updates the spec tests and uploads the generated files
  to the mirror.
* Changes to the DEPS file to download the files from the mirror.
* Changes so that tools/run-tests.py can run the spec tests.

R=machenbach@chromium.org, rossberg@chromium.org

Change-Id: Ia50d09bb1501c0c0f1d1506aa3657a3aa69c2864
Reviewed-on: https://chromium-review.googlesource.com/488083
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44933}

For int16 imm values Subu would emit addiu with -imm value, but doing
this with min_int16 would overflow and produce incorrect result. This is
fixed by checking if -imm is int16. A test for this case is created.

An optimization is also added for values imm where we cannot just emit
addiu and loading -imm to a register takes one instruction using ori.
Then instead of loading imm with lui;ori and subtracting with subu, we
can load -imm with ori and add with addu.

BUG=
TEST=cctest/test-assembler-mips/Subu

Review-Url: https://codereview.chromium.org/2845043002
Cr-Commit-Position: refs/heads/master@{#44932}

R=ahaas@chromium.org

Change-Id: I952c5461ef44d4b01e99390e668bfc0d7f7ba25b
Reviewed-on: https://chromium-review.googlesource.com/488341Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44931}

BUG=v8:6311
R=jkummerow@chromium.org

Review-Url: https://codereview.chromium.org/2845853003
Cr-Commit-Position: refs/heads/master@{#44930}

R=jkummerow@chromium.org

Change-Id: I6fc3817410df4f070675051397a30cc1b0ca7dfe
Reviewed-on: https://chromium-review.googlesource.com/488030Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44929}

This reverts commit 0322be81.

Reason for revert: Breaks:
https://build.chromium.org/p/client.v8.ports/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20nosnap%20-%20debug/builds/4612

Original change's description:
> [ic] Handle JSArray::length in CodeStubAssembler::CallGetterIfAccessor.
> 
> When accessing JSArray::length property from GenericPropertyLoad
> (i.e. via a megamorphic KEYED_LOAD_IC), we'd always go to the runtime
> at this point, because the CallGetterIfAccessor method didn't support
> AccessorInfos at all. Now there's initial support for JSArray::length,
> which reduces the number of %KeyedGetProperty calls we see in the
> Speedometer/EmberJS test by 5000.
> 
> Also-By: ishell@chromium.org
> BUG=v8:5269
> R=​ishell@chromium.org
> 
> Change-Id: I44ce7966f9b7257808110a24d95a8167ab035df9
> Reviewed-on: https://chromium-review.googlesource.com/488224
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#44915}

TBR=ishell@chromium.org,bmeurer@chromium.org,v8-reviews@googlegroups.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5269

Change-Id: Ib32e87c4ec4fd746abe3cdea3ec1cd96aabb4cff
Reviewed-on: https://chromium-review.googlesource.com/488362Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44928}

R=verwaest@chromium.org,haraken@chromium.org,yukishiino@chromium.org
BUG=

Change-Id: I273f5ce305f80b2aa5e9c8c42a6e8e5afc51a0a7
Reviewed-on: https://chromium-review.googlesource.com/484422Reviewed-by: Kentaro Hara <haraken@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Jochen Eisinger <jochen@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44927}

This also fixes incorrect type for fixed array accesses.

BUG=chromium:715651,v8:6309,chromium:715204

Review-Url: https://codereview.chromium.org/2848583002
Cr-Commit-Position: refs/heads/master@{#44926}

And fix RoundUpToPowerOfTwo32 to return 1 for the input 0.
0 is no power of two.
Beside being the correct value, this also avoids a special case in the
(new) fast path using the number of leading zeros.

R=jochen@chromium.org, ahaas@chromium.org

Change-Id: I87173495e13b334954bcebbb55724fb666dfa809
Reviewed-on: https://chromium-review.googlesource.com/488143Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44925}