BUG=v8:5437

Review-Url: https://codereview.chromium.org/2776263003
Cr-Commit-Position: refs/heads/master@{#44194}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/5dd7ff3..947f28d

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/d979a85..e044353

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: I902b94f5b225847b4bf1ac5a3bea807f4a62e37a
Reviewed-on: https://chromium-review.googlesource.com/461959Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44193}

- support register expression for addresses, e.g.: $r15-1
- show whether addresses are in the minidump with "*"
- show decoded Smis with dd
- dd without arguments continues printing the next words

Change-Id: I1a6a4f9f470c25eee7da1381014252e723ef5f7c
Reviewed-on: https://chromium-review.googlesource.com/461900Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44192}

BUG=

Change-Id: Ibadaef9ee4cb16afa01b782afc07a32bd39ad8aa
Reviewed-on: https://chromium-review.googlesource.com/461140
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44191}

NOTRY=true

Review-Url: https://codereview.chromium.org/2782463002
Cr-Commit-Position: refs/heads/master@{#44190}

Introduce 'contextual keyword' tokens, which are parsed as identifiers but
in some contexts are treated by the parser like proper keywords. These are
usually keywords introduced by recent ECMAScript versions, which for reasons
of backwards compatibility are still permissible as regular identifiers in
most contexts.

Current usage is to check for Token::IDENTIFIER and then do a string
compare. With this change the initial scan will scan them as usual, but
will then record the token as IDENTIFIER plus a secondary token with the
'contextual' value.

BUG=v8:6902

Change-Id: I6ae390382998cf756a23720bd481cb9c0eb78a72
Reviewed-on: https://chromium-review.googlesource.com/459479
Commit-Queue: Daniel Vogelheim <vogelheim@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44189}

BUG=

Change-Id: I5e60705764b8ea20b171981cdd44d57a928fa34d
Reviewed-on: https://chromium-review.googlesource.com/461178Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44188}

This extends the existing insertion of soft deopts during early lowering
from named loads to keyed loads as well (i.e. from just {JSLoadName} to
{JSLoadProperty}). Stores will be handled in a follow-up change.

R=bmeurer@chromium.org

Change-Id: I6ad7d0a3561f9160e15e13c64ec5255b4f45e614
Reviewed-on: https://chromium-review.googlesource.com/459421Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44187}

BUG=v8:6116

Change-Id: I8e2587926f9e11f022624778fd5168799d20d2df
Reviewed-on: https://chromium-review.googlesource.com/461158Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44186}

We were not implementing the specified ToWebAssemblyValue coercion at
all. This caused a failure on arm architectures.

R=ahaas@chromium.org
BUG=v8:5822
TEST=mjsunit/wasm/interpreter

Change-Id: Ic77cfd13007d45308bafa285d517f3820a3b1c80
Reviewed-on: https://chromium-review.googlesource.com/461859
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44185}

Implement ASSEMBLE_ATOMIC_LOAD/STORE_INTEGER using acquire/release instructions,
to match the existing ASSEMBLE_ATOMIC_EXCHANGE_INTEGER macro.

BUG=v8:6097

Review-Url: https://codereview.chromium.org/2760963002
Cr-Commit-Position: refs/heads/master@{#44184}

TurboFan didn't support transitioning stores that also need to grow the
properties backing store so far. This CL adds support for re-allocating
the properties backing store in-place, so these stores can participate
properly in various optimizations like escape analysis and allocation
folding.

R=ishell@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2778133003
Cr-Commit-Position: refs/heads/master@{#44183}

This implements support for named captures in
RegExp.prototype[@@replace] for when the replaceValue is not callable.

Named captures can be referenced from replacement strings by using the
"$<name>" syntax. A couple of examples:

let re = /(?<fst>.)(?<snd>.)/u;
"abcd".replace(re, "$<snd>$<fst>")  // "bacd"
"abcd".replace(re, "$2$1")     // "bacd" (numbered refs work as always)
"abcd".replace(re, "$<snd")    // SyntaxError (unterminated named ref)
"abcd".replace(re, "$<42$1>")  // "cd" (invalid name)
"abcd".replace(re, "$<thd>")   // "cd" (non-existent name)
"abcd".replace(/(?<fst>.)|(?<snd>.)/u, "$<snd>")  // "cd" (non-matched capture)

Support is currently behind the --harmony-regexp-named-captures flag.

BUG=v8:5437

Review-Url: https://codereview.chromium.org/2775303002
Cr-Original-Commit-Position: refs/heads/master@{#44171}
Committed: https://chromium.googlesource.com/v8/v8/+/17f13863b64b25eccf565e0aa9c4c441f0562b84
Review-Url: https://codereview.chromium.org/2775303002
Cr-Commit-Position: refs/heads/master@{#44182}

In a recent CL (https://codereview.chromium.org/2738683003) I changed
the generation of call instructions on arm to emit a constant pool if
necessary. However it can happen now that a call is generated within a
PredictableSizeScope, which causes a crash if a constant pool is
actually emitted, which naturally changes the size of the generated
code. With this CL I add a flag to the generation of a call where we
can state explicitly that for particular calls, i.e. those calls within
a PredictableSizeScope, we do not want to emit a constant pool.

BUG=chromium:704528

Change-Id: I7740d5440d007a2a5457c524aa8eec1b74944d57
Reviewed-on: https://chromium-review.googlesource.com/459602Reviewed-by: Jacob Bramley <jacob.bramley@arm.com>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44181}

Revert of [regexp] Named capture support for string replacements (patchset #5 id:80001 of https://codereview.chromium.org/2775303002/ )

Reason for revert:
Invalid DCHECKs for non-matched groups.

Original issue's description:
> [regexp] Named capture support for string replacements
>
> This implements support for named captures in
> RegExp.prototype[@@replace] for when the replaceValue is not callable.
>
> Named captures can be referenced from replacement strings by using the
> "$<name>" syntax. A couple of examples:
>
> let re = /(?<fst>.)(?<snd>.)/u;
> "abcd".replace(re, "$<snd>$<fst>")  // "bacd"
> "abcd".replace(re, "$2$1")     // "bacd" (numbered refs work as always)
> "abcd".replace(re, "$<snd")    // SyntaxError (unterminated named ref)
> "abcd".replace(re, "$<42$1>")  // "cd" (invalid name)
> "abcd".replace(re, "$<thd>")   // "cd" (non-existent name)
> "abcd".replace(/(?<fst>.)|(?<snd>.)/u, "$<snd>")  // "cd" (non-matched capture)
>
> Support is currently behind the --harmony-regexp-named-captures flag.
>
> BUG=v8:5437
>
> Review-Url: https://codereview.chromium.org/2775303002
> Cr-Commit-Position: refs/heads/master@{#44171}
> Committed: https://chromium.googlesource.com/v8/v8/+/17f13863b64b25eccf565e0aa9c4c441f0562b84

TBR=yangguo@chromium.org,littledan@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5437

Review-Url: https://codereview.chromium.org/2776293003
Cr-Commit-Position: refs/heads/master@{#44180}

This CL removes code which is based on the assumption that if
WebAssembly code says that memory accesses are aligned, that they are
really aligned. On arm, memory accesses crashed when this assumption
was violated.

Most likely this CL will cause a performance regression on arm. At the
moment we plan to fix this regression eventually by using arm NEON
instructions in V8.

R=titzer@chromium.org

Change-Id: Ibb60fa1ef0173c13af813a3cb7eb26bfa2a847c2
Reviewed-on: https://chromium-review.googlesource.com/451297Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44179}

A step towards removing isolate from ParseInfo.
Removing isolate from ParseInfo will make it easier to create and
execute parse tasks on background threads.

BUG=v8:6093

Change-Id: Ic189610a943251b6b0cbd316afbf422c0da7a4cd
Reviewed-on: https://chromium-review.googlesource.com/458007
Commit-Queue: Wiktor Garbacz <wiktorg@google.com>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44178}

As far as I can see, we have had this bug as long as destructuring assignments
have been there (i.e., this is not regression).

The problem was that Parser::DoParseFunction parsed the arrow function parameters
but didn't rewrite the destructuring assignments in them.

BUG=chromium:704811

Change-Id: I0b1424e7d5103eda6efd51b403fe81a4ee235e01
Reviewed-on: https://chromium-review.googlesource.com/459618
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44177}

A step towards removing isolate from ParseInfo.
Removing isolate from ParseInfo will make it easier to create and
execute parse tasks on background threads.

BUG=v8:6093

Change-Id: I0a3546618d01b9232014da94cf8d0f72427a0d1d
Reviewed-on: https://chromium-review.googlesource.com/458006
Commit-Queue: Wiktor Garbacz <wiktorg@google.com>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44176}

We were notifying the debug event listeners after every 1000 steps.
This CL fixes this to only notify them if we actually paused because of
a hit breakpoint.

R=ahaas@chromium.org
BUG=v8:5822

Change-Id: I00e36b89307c7e761ceb24ccdb3157056cfb8178
Reviewed-on: https://chromium-review.googlesource.com/459480Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44175}

This removes the static helper which is by now only used by a single
runtime function. In general the {Runtime} class no longer acts as a
grab-bag for various helper functions.

R=petermarshall@chromium.org

Change-Id: I9c2141bbd88db27ae1f95fe004bcc8a7c5506208
Reviewed-on: https://chromium-review.googlesource.com/459597
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44174}

A step towards removing isolate from ParseInfo.
Removing isolate from ParseInfo will make it easier to create and
execute parse tasks on background threads.

BUG=v8:6093

Change-Id: Ief4eb3c9873026a93338d5556985f31c9abe17e6
Reviewed-on: https://chromium-review.googlesource.com/458005
Commit-Queue: Wiktor Garbacz <wiktorg@google.com>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Daniel Clifford <danno@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44173}

BUG= v8:6132
NOTRY=true

Change-Id: I47beef4f90b37c259252b86a856f5bc075979084
Reviewed-on: https://chromium-review.googlesource.com/461299
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44172}

This implements support for named captures in
RegExp.prototype[@@replace] for when the replaceValue is not callable.

Named captures can be referenced from replacement strings by using the
"$<name>" syntax. A couple of examples:

let re = /(?<fst>.)(?<snd>.)/u;
"abcd".replace(re, "$<snd>$<fst>")  // "bacd"
"abcd".replace(re, "$2$1")     // "bacd" (numbered refs work as always)
"abcd".replace(re, "$<snd")    // SyntaxError (unterminated named ref)
"abcd".replace(re, "$<42$1>")  // "cd" (invalid name)
"abcd".replace(re, "$<thd>")   // "cd" (non-existent name)
"abcd".replace(/(?<fst>.)|(?<snd>.)/u, "$<snd>")  // "cd" (non-matched capture)

Support is currently behind the --harmony-regexp-named-captures flag.

BUG=v8:5437

Review-Url: https://codereview.chromium.org/2775303002
Cr-Commit-Position: refs/heads/master@{#44171}

R=machenbach@chromium.org
BUG=v8:6127

Change-Id: I19092232bc0de728ec37fa9188998ec9dbd94bed
Reviewed-on: https://chromium-review.googlesource.com/459498
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44170}

When the optimal parameter mode is untagged (i.e. on x64), it's more
efficient to read the length of the properties backing store untagged
instead of reading the tagged value first and then untagging it
explicitly.

Change-Id: I0f685523e11da12fe51fad138bf972ee743c3ac8
Reviewed-on: https://chromium-review.googlesource.com/461138Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44169}

BUG=v8:6027

Review-Url: https://codereview.chromium.org/2772203005
Cr-Commit-Position: refs/heads/master@{#44168}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/ad3a39a..5dd7ff3

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/0cfeabf..d979a85

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/5c4f541..9fbab72

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: I488badea7b8f36fb366cc514269f9bccf538ba37
Reviewed-on: https://chromium-review.googlesource.com/461400Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44167}

BUG=chromium:699485

R=ahaas@chromium.org, bradnelson@chromium.org

Review-Url: https://codereview.chromium.org/2772973002
Cr-Commit-Position: refs/heads/master@{#44166}

This was causing GC stress failures. Garbage collections can happen during
runtime calls, such was WasmStackGuard. If the collection cleans up Wasm
objects, then they will have to modify the trap handler data structures, which
requires taking a lock. This lock can only be taken if the thread-in-wasm flag
is clear. We were getting crashes because this flag was not clear.

This change fixes the issue by making sure any runtime calls from Wasm clear the
thread-in-wasm flag and then restore it upon return. In addition, it cleans up
the code by adding a helper function that generates the code to modify the flag.

BUG= v8:6132

Change-Id: I95d43388dff60ba792c57fe13448a40a02ed4802
Reviewed-on: https://chromium-review.googlesource.com/458698
Commit-Queue: Eric Holk <eholk@chromium.org>
Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44165}

Currently, V8 uses the same counter to count both wasm and and asm js. This
splits the counters into two separate counters, and then uses the appropriate
counter when instantiating the module.

BUG=chromium:704922
R=bbudge@chromium.org,bradnelson@chromium.org

Review-Url: https://codereview.chromium.org/2777073003
Cr-Commit-Position: refs/heads/master@{#44164}

Currently, V8 uses the same counter to collect decoding time for both asm.js and
WASM. This separates that counter into two separate counters, and then uses the appropriate counter when instantiating a module.

BUG=chromium:704922
R=bbudge@chromium.org,mtrofin@chromium.org

Review-Url: https://codereview.chromium.org/2780563002
Cr-Commit-Position: refs/heads/master@{#44163}

Previously we threw a generic error meesage on failing hole check for
accessing 'this'. But 'this' can be a hole only if the super() has not
been called so we change the error message.

BUG=v8:5957

Change-Id: I2f0e3d813f16919645d8a5efa7d26e73bd2d83fe
Reviewed-on: https://chromium-review.googlesource.com/459085
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44162}

Change-Id: Ib278d08768062c94b3a2f568f17984bb6761bc30
Reviewed-on: https://chromium-review.googlesource.com/461321Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44161}

A step towards removing isolate from ParseInfo.
Removing isolate from ParseInfo will make it easier to create and
execute parse tasks on background threads.

BUG=v8:6093

Change-Id: I977eec8faecc8a112506f219994b4e4ec388b180
Reviewed-on: https://chromium-review.googlesource.com/458004
Commit-Queue: Wiktor Garbacz <wiktorg@google.com>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44160}

Previously this test was flaky, but it seems to have been fixed
upstream and it now consistently passes locally for 100 runs.

BUG=v8:4253

Change-Id: I583d6d7848ddbb9bcdacdbe7bf4374b01ba569af
Reviewed-on: https://chromium-review.googlesource.com/459739Reviewed-by: Daniel Ehrenberg <littledan@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44159}

We don't need hints from embedder any more.

BUG=none
R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2773143002
Cr-Commit-Position: refs/heads/master@{#44158}

R=joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2776263002
Cr-Commit-Position: refs/heads/master@{#44157}

- Fixes vmovl for widening 16 to 32, 32 to 64.
- Adds vqmovn.

LOG=N
BUG=v8:6020

Review-Url: https://codereview.chromium.org/2773303002
Cr-Commit-Position: refs/heads/master@{#44156}

The SerializeGeneric method assumes that the object was not serialized
before. Hence, we should not call it repeatedly for the same builtin.
This CL now exposes SerializeBuiltin, and calls that directly.
We also serialize the Illegal builtin for wasm interpreter entries,
which are never reused across instantiations anyway.

R=ahaas@chromium.org, yangguo@chromium.org
BUG=v8:5822

Change-Id: Id74b86fe29171908ed35ddbc06c93f0d241e4917
Reviewed-on: https://chromium-review.googlesource.com/458380Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44155}