R=jgruber@chromium.org
BUG=v8:6274

Review-Url: https://codereview.chromium.org/2826073004
Cr-Commit-Position: refs/heads/master@{#44745}

Without this fix, we create a new state-values node for parameters per environment. This is especially bad for heavily branching functions. With the fix, we should only create one node per function.

Drive-by: removes some unused fields for state values in the environment.

BUG=v8:5267

Review-Url: https://codereview.chromium.org/2826223004
Cr-Commit-Position: refs/heads/master@{#44744}

This reverts commit 64bb6e6c.

Reason for revert: Breaks layout tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/15092

See:
https://github.com/v8/v8/wiki/Blink-layout-tests

Original change's description:
> [runtime] Pass global proxy as receiver to native accessors in case of contextual access
> 
> Bug:
> 
> Change-Id: I288c0d7a34b65eda6c6e46168c436b87a350f6d4
> Reviewed-on: https://chromium-review.googlesource.com/483199
> Commit-Queue: Toon Verwaest <verwaest@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#44739}

TBR=yangguo@chromium.org,verwaest@chromium.org,v8-reviews@googlegroups.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Change-Id: Ifc204ce5a2e6d774b993210fcc6782fc6f27dd7b
Reviewed-on: https://chromium-review.googlesource.com/483480Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44743}

Preparser does not keep track of function names. If we want to
parse top-level function and top-level code was only preparsed
we need to parse the function name again. Even if we parsed the
function name, passing it is non-trivial so it makes sense to just
reparse.

BUG=v8:6093

Change-Id: Iafbcd677981f1db52b485eee0f0d769e4fd26543
Reviewed-on: https://chromium-review.googlesource.com/483359
Commit-Queue: Wiktor Garbacz <wiktorg@google.com>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44742}

When cross compiling inspector with GYP on MIPS and ARM, there are three
rules that generate the same file both host toolset and target toolset.
This causes problems because of rule duplication; depending on
compilation configuration this can cause warning or error.
We fix this by disabling the host rule and using target rule for all
depending rules.

BUG=v8:6176

Review-Url: https://codereview.chromium.org/2819283005
Cr-Commit-Position: refs/heads/master@{#44741}

So that we can delete object properties without a runtime call.
The builtin implements a few fast paths (for now only deletion
of dictionary properties), and calls the runtime for all other
cases.

Review-Url: https://codereview.chromium.org/2810363003
Cr-Commit-Position: refs/heads/master@{#44740}

Bug:

Change-Id: I288c0d7a34b65eda6c6e46168c436b87a350f6d4
Reviewed-on: https://chromium-review.googlesource.com/483199
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44739}

- Migrate make grokdump to GYP and GN
- Move code from d8 into stand-alone execution
- Add test case to ensure it's up-to-date

Review-Url: https://codereview.chromium.org/2809653003
Cr-Original-Original-Commit-Position: refs/heads/master@{#44687}
Committed: https://chromium.googlesource.com/v8/v8/+/0cc0c130fa56f129c90c2a74cb01bda85df5e42a
Review-Url: https://codereview.chromium.org/2809653003
Cr-Original-Commit-Position: refs/heads/master@{#44710}
Committed: https://chromium.googlesource.com/v8/v8/+/477f00557458d383bd9ebef281890ba485ee882a
Review-Url: https://codereview.chromium.org/2809653003
Cr-Commit-Position: refs/heads/master@{#44738}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/bca1cbe..98f2769

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/buildtools/+log/88811f4..98f00fa

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/cabc131..6939b1d

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: I3a593ac90e3bda51717fc193478e55af949c34f3
Reviewed-on: https://chromium-review.googlesource.com/482919Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44737}

BUG=v8:6175
TBR=dgozman@chromium.org
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2828133002
Cr-Commit-Position: refs/heads/master@{#44736}

- and reduce limit to 128 * 1024.

BUG=v8:6189
R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2824293002
Cr-Commit-Position: refs/heads/master@{#44735}

- Adds unary Reverse shuffles (swizzles): S32x2Reverse, S16x4Reverse,
  S16x2Reverse, S8x8Reverse, S8x4Reverse, S8x2Reverse. Reversals are
  done within the sub-vectors that prefix the opcode name, e.g. S8x2
  reverses the 8 consecutive pairs in an S8x16 vector.

- Adds binary Zip (interleave) left and right half-shuffles to return a
  single vector: S32x4ZipLeft, S32x4ZipRightS16x8ZipLeft, S16x8ZipRight,
  S8x16ZipLeft, S8x16ZipRight.

- Adds binary Unzip (de-interleave) left and right half shuffles to return
  a single vector: S32x4UnzipLeft, S32x4UnzipRight, S16x8UnzipLeft,
  S16x8UnzipRight, S8x16UnzipLeft, S8x16UnzipRight.

- Adds binary Transpose left and right half shuffles to return
  a single vector: S32x4TransposeLeft, S32x4TransposeRight,
  S16x8TransposeLeft, S16xTransposeRight, S8x16TransposeLeft,
  S8x16TransposeRight.

- Adds binary Concat (concatenate) byte shuffle: S8x16Concat #bytes to
  paste two vectors together.

LOG=N
BUG=v8:6020

Review-Url: https://codereview.chromium.org/2801183002
Cr-Commit-Position: refs/heads/master@{#44734}

BUG=v8:6189
R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2822073002
Cr-Commit-Position: refs/heads/master@{#44733}

There's no reason to keep track, for a preparsed function itself,
whether that function calls eval. All that matters is that the ancestor
scopes are marked as having an inner scope which calls eval. The function
will have its "calls eval" bit persisted if/when it's fully parsed.

The only "behavioral" change in this patch is the removal of a DCHECK.

Bug: v8:6092
Change-Id: I17e396c8a265030fe0ad941707e4a97972e6650b
Reviewed-on: https://chromium-review.googlesource.com/481223
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44732}

let/const declarations in "standard" C-style for-loops have
some complex desugaring to accommodate the case where loop
loop variables may be captured. This slows down the baseline
performance of for-loops with let variables.

This change attempts to avoid this desugaring if it's known that
the loop variable is not captured at any point. A side effect of
this change is that let/const loop variables, when not captured
within the loop body, are not necessarily shown in the debugger,
similar to other stack-allocated vars.

BUG=v8:4762, v8:5460
R=marja@chromium.org, adamk@chromium.org, yangguo@chromium.org

Change-Id: I8dbe545a12c086f675972bdba60c94998268311a
Reviewed-on: https://chromium-review.googlesource.com/472247
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44731}

This patch retires runtime.js:
  - Removes some dead code from runtime.js (ToPositiveInteger, ToIndex),
  - Moves Array.prototype initialization to prologue.js
  - Moves SpeciesConstructor to the only file that calls it (typedarray.js)
  - Renames the remainder to reflect its only inhabitants ({Max,Min}Simple)

Change-Id: If9048a30c4f6b86396bfd647bb637b4175880fc3
Reviewed-on: https://chromium-review.googlesource.com/478579Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44730}

When asked for a module that previously failed to compile or
instantiate, the embedder necessarily has to signal failure.  In this
case, we expect an exception to be scheduled, which we will rethrow.

BUG=v8:1569

Review-Url: https://codereview.chromium.org/2827733002
Cr-Commit-Position: refs/heads/master@{#44729}

- Reserves q15 (d30,d31) as a scratch register for NEON operations.
- Rewrites CodeGenerator::AssembleSwap to use it.

LOG=N
BUG=v8:6020

Review-Url: https://codereview.chromium.org/2827743002
Cr-Commit-Position: refs/heads/master@{#44728}

Move JSOrdinaryHasInstance lowering to JSNativeContextSpecialization,
which was previously mostly done in JSTypedLowering (for no reason).
Add new logic to the lowering to constant-fold OrdinaryHasInstance
checks when the map of the left-hand side and the "prototype" of the
right-hand side is known. This address the performance issue with the
(base) class constructors generated by Babel, i.e.:

  function _classCallCheck(instance, Constructor) {
    if (!(instance instanceof Constructor)) {
      throw new TypeError("Cannot call a class as a function");
    }
  }

  var C = function C() { _classCallCheck(this, C); };

for

  class C {}

Also ensure that a known constructor being used inside an instanceof
get's a proper initial map on-demand.

BUG=v8:6275
R=mstarzinger@chromium.org

Review-Url: https://codereview.chromium.org/2827013002
Cr-Commit-Position: refs/heads/master@{#44727}

When adding or overwriting properties of an object, the generic
keyed store stub must check if that property's name might have
an associated protector (e.g. the ArraySpeciesProtector) and
take the slow path if so to ensure that the protector is updated
as needed.

BUG=v8:6269

Review-Url: https://codereview.chromium.org/2821213004
Cr-Commit-Position: refs/heads/master@{#44726}

This uses the common macro lists instead of duplicating the list of
available math functions and values in {AsmJs::IsStdlibValid}.

R=rossberg@chromium.org
BUG=v8:6127

Change-Id: Ic480d74bb0b5f0f425d1e601e5128fa6f466bea1
Reviewed-on: https://chromium-review.googlesource.com/481260Reviewed-by: Andreas Rossberg <rossberg@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44725}

1) Function recording conditions need to be consistent (this same condition is used above)

2) byte is not wide enough for storing the backing store size.

Bugs uncovered by the existing tests with the flag on.

BUG=v8:5516

Change-Id: Iec6aff0cf1858afe1083526e4ada9a8eca08f062
Reviewed-on: https://chromium-review.googlesource.com/481320
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44724}

BUG=v8:6093

Change-Id: I4572fcb4258c9a6ee6e5d5ed18e3567460c90211
Reviewed-on: https://chromium-review.googlesource.com/481300Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Wiktor Garbacz <wiktorg@google.com>
Cr-Commit-Position: refs/heads/master@{#44723}

This includes a fastpath in the ElementsAccessor for the source
array being a JSArray with FastSmi or FastDouble packed kinds. This
is probably a pretty common usage, where an array is passed in as
a way of initializing the TypedArray at creation (as there is not other
syntax to do this). e.g. new Float64Array([1.0, 1.0, 1.0]) for some
sort of vector application.

BUG= v8:5977

Change-Id: Ice4ad9fc29f56b1c4b0b30736a1330efdc289003
Reviewed-on: https://chromium-review.googlesource.com/465126Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44722}

R=rossberg@chromium.org
BUG=v8:6127

Change-Id: I1ed8f22eecd3ee674c909ae511bbba4460bcdd17
Reviewed-on: https://chromium-review.googlesource.com/481759Reviewed-by: Andreas Rossberg <rossberg@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44721}

When accessing the "prototype" property of a known JSFunction in
TurboFan, we can automatically create the initial map if it hasn't been
instantiated so far. This happens with hand-grown inheritance mechanisms
where the base classes might not be instantiated regularly at all, but
the base class constructors are only called via F.p.call from the
subclass constructors.

R=mstarzinger@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2830633002
Cr-Commit-Position: refs/heads/master@{#44720}

In particular the Babel generated code for simple constructors is
of interest here, since that's what we hit in the wild most often
currently.

BUG=v8:6275
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2822203004
Cr-Commit-Position: refs/heads/master@{#44719}

The StringIndexOf fast path used to be very narrow, only allowing
one-byte single-char search strings (and a one-byte subject string).

This changes the CSA fast path to call into our internal SearchString C++
function instead (after attempting to unpack both Strings), and can handle
strings of arbitrary length and encoding. The only remaining runtime call is
when either string needs to be flattened.

BUG=

Review-Url: https://codereview.chromium.org/2814373002
Cr-Commit-Position: refs/heads/master@{#44718}

R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2824383003
Cr-Commit-Position: refs/heads/master@{#44717}

This new API sets a native data property on an object
directly, as Template::SetNativeDataProperty does.
It is similar to Object::SetAccessor, but properties
set by SetNativeDataProperty without kReadOnly flag
can be replaced.


Bug:chromium:617892

Change-Id: I32973f7190906d76be6802da9a0489edce0bd93e
Reviewed-on: https://chromium-review.googlesource.com/479474Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Commit-Queue: Hitoshi Yoshida <peria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44716}

This is to make testing parse tasks, which currently only work with
external strings, easier.

BUG=v8:6093

Change-Id: Ia248ea9e9547604b4c81179e54d8ef564377e2a9
Reviewed-on: https://chromium-review.googlesource.com/480559
Commit-Queue: Wiktor Garbacz <wiktorg@google.com>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44715}

This fixes source position tracking within the "increment" expression of
a for-statement. The old {StashCode} method was inherently incompatible
with side tables like the source position table, as it would leave them
untouched while mutating the bytecode stream. It was hence trimmed down
to {DeleteCode}.

R=bradnelson@chromium.org
BUG=v8:6127

Change-Id: I7a5ff60cd5334208c44b165c8b54144d9ae83209
Reviewed-on: https://chromium-review.googlesource.com/480301
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44714}

This changes the message from

"method_name is not generic"

to

"method_name requires that 'this' be a primitive_name object"

BUG=v8:6206

Review-Url: https://codereview.chromium.org/2814043006
Cr-Original-Commit-Position: refs/heads/master@{#44683}
Committed: https://chromium.googlesource.com/v8/v8/+/21b104e3b83569b52539ecaa83e68a3646065101
Review-Url: https://codereview.chromium.org/2814043006
Cr-Commit-Position: refs/heads/master@{#44713}

The typing rule for JSCreateArguments must properly declare rest
parameters as arrays and only consider sloppy and strict arguments
objects as Type::OtherObject.

TBR=jarin@chromium.org
BUG=v8:6262,chromium:712802

Review-Url: https://codereview.chromium.org/2828573004
Cr-Commit-Position: refs/heads/master@{#44712}

Revert of Introduce mkgrokdump to update tools/v8heapconst.py. (patchset #21 id:390001 of https://codereview.chromium.org/2809653003/ )

Reason for revert:
Test driver runs into assert:
https://build.chromium.org/p/client.v8/builders/V8%20Win64/builds/17082

Original issue's description:
> Introduce mkgrokdump to update tools/v8heapconst.py.
>
> - Migrate make grokdump to GYP and GN
> - Move code from d8 into stand-alone execution
> - Add test case to ensure it's up-to-date
>
> Review-Url: https://codereview.chromium.org/2809653003
> Cr-Original-Commit-Position: refs/heads/master@{#44687}
> Committed: https://chromium.googlesource.com/v8/v8/+/0cc0c130fa56f129c90c2a74cb01bda85df5e42a
> Review-Url: https://codereview.chromium.org/2809653003
> Cr-Commit-Position: refs/heads/master@{#44710}
> Committed: https://chromium.googlesource.com/v8/v8/+/477f00557458d383bd9ebef281890ba485ee882a

TBR=mstarzinger@chromium.org,yangguo@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2826743003
Cr-Commit-Position: refs/heads/master@{#44711}

- Migrate make grokdump to GYP and GN
- Move code from d8 into stand-alone execution
- Add test case to ensure it's up-to-date

Review-Url: https://codereview.chromium.org/2809653003
Cr-Original-Commit-Position: refs/heads/master@{#44687}
Committed: https://chromium.googlesource.com/v8/v8/+/0cc0c130fa56f129c90c2a74cb01bda85df5e42a
Review-Url: https://codereview.chromium.org/2809653003
Cr-Commit-Position: refs/heads/master@{#44710}

Functions that take mandatory parameters plus a number of optional
parameters, that need to be materialized as an Array are quite common.
The simplest possible case of this is essentially:

  function foo(mandatory, ...args) { return args; }

Babel translates this to something like:

  function foo(mandatory) {
    "use strict";
    for (var _len = arguments.length,
             args = Array(_len > 1 ? _len - 1 : 0),
             _key = 1; _key < _len; _key++) {
      args[_key - 1] = arguments[_key];
    }
    return args;
  }

The key to great performance here is to make sure that we don't
materialize the (unmapped) arguments object in this case, plus that we
have some kind of fast-path for the Array constructor and the
initialization loop.

This microbenchmark ensures that we have decent performance even in the
case where the assignment to args is polymorphic, i.e. the arguments
have seen different elements kinds, starting with FAST_HOLEY_ELEMENTS
and then FAST_HOLEY_SMI_ELEMENTS.

R=yangguo@chromium.org
BUG=v8:6262

Review-Url: https://codereview.chromium.org/2823343004
Cr-Commit-Position: refs/heads/master@{#44709}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/1501368..bca1cbe

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/49eb11f..cabc131

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/88db8e4..a38e11d

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: Ie226bf35dc3da7f158f98c22033a58326077e67b
Reviewed-on: https://chromium-review.googlesource.com/481203Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44708}

Bug: v8:5717
Change-Id: I88e1e3089844b0955f0f7a6a792c2e10949a5b18
Reviewed-on: https://chromium-review.googlesource.com/480927Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44707}

 - I8x16Splat, I8x16ExtractLane, I8x16ReplaceLane
 - Binops: I8x16Add, I8x16AddSaturateS, I8x16Sub, I8x16SubSaturateS, I8x16MinS,
 I8x16MaxS, I8x16AddSaturateU, I8x16SubSaturateU, I8x16MinU, I8x16MaxU
 - Compare ops: I8x16Eq, I8x16Ne

BUG=v8:6020

R=bbudge@chromium.org, bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2829483002
Cr-Commit-Position: refs/heads/master@{#44706}