This fixes a bug where the re-creation of phi nodes leads to divergence. The fix makes sure that once a node created a phi node, it sticks to it and does not forget about it, even if the inputs suddenly agree again. The bug appeared on the trybots in https://codereview.chromium.org/2512733003/.

Also I added a line to mark effect phi nodes on the queue. This is unrelated, but seems to be an obvious ommission.

R=bmeurer@chromium.org
BUG=v8:5633

Review-Url: https://codereview.chromium.org/2522253002
Cr-Commit-Position: refs/heads/master@{#41239}

BUG=

R=joransiu@ca.ibm.com, michael_dawson@ca.ibm.com, bjaideep@ca.ibm.com

Review-Url: https://codereview.chromium.org/2522283003
Cr-Commit-Position: refs/heads/master@{#41238}

Descriptions for (typed)arrays will use parenthesis instead of square brackets
"Array(10)" instead of "Array[10]". This CL also adds size hints to descriptions
of maps and sets.

Related CL for DevTools: https://codereview.chromium.org/2524913002/

BUG=405845

Review-Url: https://codereview.chromium.org/2521853003
Cr-Commit-Position: refs/heads/master@{#41237}

Introducing a TF_BUILTIN macro that wraps CodeStubAssembler usage
into a convenient interface (using a subclass under the hood).

Review-Url: https://codereview.chromium.org/2517833005
Cr-Commit-Position: refs/heads/master@{#41236}

Reducing visual clutter.

No changes since previous attempt; this was only reverted because it blocked another revert.
Original review: https://codereview.chromium.org/2519093002/

TBR=ishell@chromium.org

Review-Url: https://codereview.chromium.org/2526803002
Cr-Commit-Position: refs/heads/master@{#41235}

Add support for WebAssembly.Memory objects to be simultaneously referenced by multiple Instance objects. GrowingMemory should maintain a consistent view of memory across instances.
 - Store a link to instances that share WebAssembly.Memory in the WasmMemoryObject, updated on instantiate.
 - Implement WasmInstanceWrapper as a wrapper around the instance object to keep track of previous/next instances, instance object is stored as a WeakCell that can be garbage collected.
 - MemoryInstanceFinalizer maintains a valid list of instances when an instance is garbage collected.
 - Refactor GrowInstanceMemory to GrowMemoryBuffer that allocates a new buffer, and UncheckedUpdateInstanceMemory that updates memory references for an instance.

 R=titzer@chromium.org, mtrofin@chromium.org, bradnelson@chromium.org

Committed: https://crrev.com/30ef8e33f3a199a27ca8512bcee314c9522d03f6
Committed: https://crrev.com/3c98e339599b068f1ed630afb7601ff942424d31
Review-Url: https://codereview.chromium.org/2471883003
Cr-Original-Original-Commit-Position: refs/heads/master@{#41121}
Cr-Original-Commit-Position: refs/heads/master@{#41198}
Cr-Commit-Position: refs/heads/master@{#41234}

BUG=

Review-Url: https://codereview.chromium.org/2524733007
Cr-Commit-Position: refs/heads/master@{#41233}

New console.assert implementation is faster then custom user implementation.

BUG=chromium:663845
R=dgozman@chromium.org

Committed: https://crrev.com/f658e41d864267fb9e99ea76faa7758b0b63d5c9
Review-Url: https://codereview.chromium.org/2505493002
Cr-Original-Commit-Position: refs/heads/master@{#41227}
Cr-Commit-Position: refs/heads/master@{#41232}

Revert of [inspector] make console.assert much faster (patchset #3 id:40001 of https://codereview.chromium.org/2505493002/ )

Reason for revert:
Speculative revert as there seems to be a layout test crash:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/11585

Please reland if it doesn't get green.

Original issue's description:
> [inspector] make console.assert much faster
>
> New console.assert implementation is faster then custom user implementation.
>
> BUG=chromium:663845
> R=dgozman@chromium.org
>
> Committed: https://crrev.com/f658e41d864267fb9e99ea76faa7758b0b63d5c9
> Cr-Commit-Position: refs/heads/master@{#41227}

TBR=dgozman@chromium.org,yangguo@chromium.org,kozyatinskiy@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:663845

Review-Url: https://codereview.chromium.org/2521323005
Cr-Commit-Position: refs/heads/master@{#41231}

Revert of [heap] Refactor heap object iteration (patchset #6 id:100001 of https://codereview.chromium.org/2516303006/ )

Reason for revert:
Breaks msan:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/builds/12103

Original issue's description:
> [heap] Refactor heap object iteration
>
> BUG=
>
> Committed: https://crrev.com/d094fa76f3dd0bb5fc3f4c669762aa97d88e0f76
> Cr-Commit-Position: refs/heads/master@{#41226}

TBR=hpayer@chromium.org,mlippautz@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review-Url: https://codereview.chromium.org/2529663002
Cr-Commit-Position: refs/heads/master@{#41230}

Revert of [counters] RuntimeStats: fix wrong bookkeeping when dynamically changing counters. (patchset #15 id:320001 of https://codereview.chromium.org/2511093002/ )

Reason for revert:
The test is very flaky on the bots, e.g.:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20ASAN/builds/17031
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20shared/builds/14776

Original issue's description:
> [counters] RuntimeStats: fix wrong bookkeeping when dynamically changing counters
>
> RuntimeTimerScopes always subtract their own time from the parent timer's
> counter to properly account for the own time. Once a scope is destructed it
> adds it own timer to the current active counter. However, if the current
> counter is changed with CorrectCurrentCounterId we will attribute all the
> subtimers to the previous counter, and add the own time to the new counter.
> This way it is possible to end up with negative times in certain counters but
> the overall would still be correct.
>
> BUG=
>
> Committed: https://crrev.com/f6c74d964d9387df4bed3d8c1ded51eb9e8aa6e8
> Committed: https://crrev.com/491651792d7818aed04eaeffb9890b5a309b543e
> Cr-Original-Commit-Position: refs/heads/master@{#41142}
> Cr-Commit-Position: refs/heads/master@{#41214}

TBR=ishell@chromium.org,fmeawad@chromium.org,lpy@chromium.org,cbruni@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review-Url: https://codereview.chromium.org/2526843002
Cr-Commit-Position: refs/heads/master@{#41229}

Revert of [parser] Fix scopes in rewriting of for-of and destructuring assignments. (patchset #6 id:100001 of https://codereview.chromium.org/2520883002/ )

Reason for revert:
Speculative revert: Seems to break jsfunfuzz:
https://build.chromium.org/p/client.v8/builders/V8%20Fuzzer/builds/14385

Original issue's description:
> [parser] Fix scopes in rewriting of for-of and destructuring assignments.
>
> The catch scopes were created with the wrong parent scope.
>
> R=littledan@chromium.org
> BUG=v8:5648
>
> Committed: https://crrev.com/f385268d11d6da9508e481202b39f75f4b56afdd
> Cr-Commit-Position: refs/heads/master@{#41222}

TBR=littledan@chromium.org,verwaest@chromium.org,neis@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5648

Review-Url: https://codereview.chromium.org/2519333005
Cr-Commit-Position: refs/heads/master@{#41228}

New console.assert implementation is faster then custom user implementation.

BUG=chromium:663845
R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2505493002
Cr-Commit-Position: refs/heads/master@{#41227}

BUG=

Review-Url: https://codereview.chromium.org/2516303006
Cr-Commit-Position: refs/heads/master@{#41226}

R=mstarzinger@chromium.org, neis@chromium.org

BUG=v8:5657

Review-Url: https://codereview.chromium.org/2526763002
Cr-Commit-Position: refs/heads/master@{#41225}

R=yangguo@chromium.org
BUG=chromium:667142

Review-Url: https://codereview.chromium.org/2525663003
Cr-Commit-Position: refs/heads/master@{#41224}

BUG=chromium:668101

Review-Url: https://codereview.chromium.org/2525913002
Cr-Commit-Position: refs/heads/master@{#41223}

The catch scopes were created with the wrong parent scope.

R=littledan@chromium.org
BUG=v8:5648

Review-Url: https://codereview.chromium.org/2520883002
Cr-Commit-Position: refs/heads/master@{#41222}

Since we are specializing on the native context, we don't have to load
the vector from the closure. For one thing, this reduces the machinery for
nodes that use a vector in their generic incarnation.

BUG=
R=mstarzinger@chromium.org

Review-Url: https://codereview.chromium.org/2529463002
Cr-Commit-Position: refs/heads/master@{#41221}

This fixes the message reported via the {TypeError} thrown when trying
to call a non-constructable function as a constructor. Also adds some
more related message tests for similar exceptions.

R=bmeurer@chromium.org
TEST=message/call-non-constructable
BUG=chromium:661579

Review-Url: https://codereview.chromium.org/2523803003
Cr-Commit-Position: refs/heads/master@{#41220}

The implementation was removed in http://crrev.com/2248393002.

R=rmcilroy@chromium.org

Review-Url: https://codereview.chromium.org/2522983004
Cr-Commit-Position: refs/heads/master@{#41219}

For dictionary-mode receivers, the KeyedStoreGeneric stub can store
properties directly in most cases. Doing so avoids the need to have
an entry in the stub cache for every map/property combination.

Original review: https://codereview.chromium.org/2504403005/

Review-Url: https://codereview.chromium.org/2524943002
Cr-Commit-Position: refs/heads/master@{#41218}

In order for profiles of optimized code to have accurate source
positions, we need to prepare for this when compiling. If the profiler
is enabled late, this may be missing, leading to inaccurate profile
data. A compromise to solve this is to prepare for accurate positions if
the debugger (and therefore DevTools) is active, even if we are not
currently capturing a profile.

The alternative is to deopt everything upon profiling, but that would
affect the profile significantly.

R=alph@chromium.org, bmeurer@chromium.org, neis@chromium.org, tebbi@chromium.org

Review-Url: https://codereview.chromium.org/2519003002
Cr-Commit-Position: refs/heads/master@{#41217}

Eval calls are tracked by ParserBase::CheckPossibleEvalCall which
doesn't use (Pre)?Parser::IsDirectEvalCall.

Also we no longer seem to care about IsBinaryOperation (Parser didn't
have it either).

BUG=

Review-Url: https://codereview.chromium.org/2528603003
Cr-Commit-Position: refs/heads/master@{#41216}

R=jgruber@chromium.org
BUG=v8:5530

Review-Url: https://codereview.chromium.org/2530533002
Cr-Commit-Position: refs/heads/master@{#41215}

RuntimeTimerScopes always subtract their own time from the parent timer's
counter to properly account for the own time. Once a scope is destructed it
adds it own timer to the current active counter. However, if the current
counter is changed with CorrectCurrentCounterId we will attribute all the
subtimers to the previous counter, and add the own time to the new counter.
This way it is possible to end up with negative times in certain counters but
the overall would still be correct.

BUG=

Committed: https://crrev.com/f6c74d964d9387df4bed3d8c1ded51eb9e8aa6e8
Review-Url: https://codereview.chromium.org/2511093002
Cr-Original-Commit-Position: refs/heads/master@{#41142}
Cr-Commit-Position: refs/heads/master@{#41214}

[ic] Don't enable property cell mode for a LoadGlobalIC if the holder is a different global object than the receiver.

Test contributed by crlf0710 <crlf0710@gmail.com>.

BUG=v8:5552

Review-Url: https://codereview.chromium.org/2523173002
Cr-Commit-Position: refs/heads/master@{#41213}

This is similar to how the native context has an empty function set up as it's closure field.

BUG=666984

Review-Url: https://codereview.chromium.org/2528603002
Cr-Commit-Position: refs/heads/master@{#41212}

R=neis@chromium.org
BUG=v8:1569

Review-Url: https://codereview.chromium.org/2528433005
Cr-Commit-Position: refs/heads/master@{#41211}

Passing in the isolate to retrieve the heap constants (undefine, the_hole, null)
has a positive performance impact.

BUG=

Review-Url: https://codereview.chromium.org/2517153002
Cr-Commit-Position: refs/heads/master@{#41210}

BUG=v8:4280,v8:5657

Review-Url: https://codereview.chromium.org/2505933008
Cr-Commit-Position: refs/heads/master@{#41209}

Revert of [wasm] WebAssembly.Memory object can be referenced by multiple Instance objects. (patchset #13 id:240001 of https://codereview.chromium.org/2471883003/ )

Reason for revert:
Test crashes after an unrelated revert: https://chromegw.corp.google.com/i/client.v8/builders/V8%20Linux%20-%20gc%20stress/builds/7189

Reverting because of recommendation from WASM team.

Original issue's description:
> [wasm] WebAssembly.Memory object can be referenced by multiple Instance objects.
>
> Add support for WebAssembly.Memory objects to be simultaneously referenced by multiple Instance objects. GrowingMemory should maintain a consistent view of memory across instances.
>  - Store a link to instances that share WebAssembly.Memory in the WasmMemoryObject, updated on instantiate.
>  - Implement WasmInstanceWrapper as a wrapper around the instance object to keep track of previous/next instances, instance object is stored as a WeakCell that can be garbage collected.
>  - MemoryInstanceFinalizer maintains a valid list of instances when an instance is garbage collected.
>  - Refactor GrowInstanceMemory to GrowMemoryBuffer that allocates a new buffer, and UncheckedUpdateInstanceMemory that updates memory references for an instance.
>
>  R=titzer@chromium.org, mtrofin@chromium.org, bradnelson@chromium.org
>
> Committed: https://crrev.com/30ef8e33f3a199a27ca8512bcee314c9522d03f6
> Committed: https://crrev.com/3c98e339599b068f1ed630afb7601ff942424d31
> Cr-Original-Commit-Position: refs/heads/master@{#41121}
> Cr-Commit-Position: refs/heads/master@{#41198}

TBR=bradnelson@chromium.org,mtrofin@chromium.org,titzer@chromium.org,gdeepti@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2529573002
Cr-Commit-Position: refs/heads/master@{#41208}

Revert of [stubs] KeyedStoreGeneric: inline dictionary property stores (patchset #5 id:100001 of https://codereview.chromium.org/2504403005/ )

Reason for revert:
Blocks roll: https://codereview.chromium.org/2526573002/

Original issue's description:
> [stubs] KeyedStoreGeneric: inline dictionary property stores
>
> For dictionary-mode receivers, the KeyedStoreGeneric stub can store
> properties directly in most cases. Doing so avoids the need to have
> an entry in the stub cache for every map/property combination.
>
> Committed: https://crrev.com/af168e330e95c4460fd1bb7734f0e9a750f2e748
> Cr-Commit-Position: refs/heads/master@{#41185}

TBR=ishell@chromium.org,rmcilroy@chromium.org,jkummerow@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2528583002
Cr-Commit-Position: refs/heads/master@{#41207}

Revert of [cleanup] CodeStubAssembler: s/compiler::Node/Node/ (patchset #2 id:20001 of https://codereview.chromium.org/2519093002/ )

Reason for revert:
Blocks revert of roll blocker: https://codereview.chromium.org/2528583002/

Original issue's description:
> [cleanup] CodeStubAssembler: s/compiler::Node/Node/
>
> Reducing visual clutter.
>
> Committed: https://crrev.com/36a17e87d86d2d978b64eb37044c9e9f98ebea67
> Cr-Commit-Position: refs/heads/master@{#41187}

TBR=ishell@chromium.org,jkummerow@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2528593002
Cr-Commit-Position: refs/heads/master@{#41206}

BUG=v8:5530,chromium:667218

Review-Url: https://codereview.chromium.org/2519773003
Cr-Commit-Position: refs/heads/master@{#41205}

  port 09255541 (r41135)

  original commit message:
  This removes the deprecated generator support for resumable functions
  from {FullCodeGenerator}. The existing {AstNumbering} heuristic already
  triggers Ignition for most resumable functions, with this change we make
  said heuristic a hard choice and remove the deprecated code. This also
  has the advantage that any suspended {JSGeneratorObject} instance on the
  heap is guaranteed to have code based on a bytecode array.

BUG=

Review-Url: https://codereview.chromium.org/2522653003
Cr-Commit-Position: refs/heads/master@{#41204}

  port d4f01b8a (r41108)

  original commit message:
  Add fast paths for holey smi and object arrays to
  Function.prototype.apply, Reflect.apply and Reflect.construct.

BUG=

Review-Url: https://codereview.chromium.org/2519303002
Cr-Commit-Position: refs/heads/master@{#41203}

BUG=

Review-Url: https://codereview.chromium.org/2513413006
Cr-Commit-Position: refs/heads/master@{#41202}

The AstGraphBuilder pipeline is only used for asm.js now, so the whole
type feedback mechanism is essentially dead code currently, thus we
better nuke it.

BUG=v8:5267,v8:5657

Review-Url: https://codereview.chromium.org/2523953002
Cr-Commit-Position: refs/heads/master@{#41201}

Wsign-compare exposed this error in s390 31-bit debug
build.

R=joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2523683003
Cr-Commit-Position: refs/heads/master@{#41200}