Rolling v8/build to 87f8ed60519428c429030cd9ccb3feaf9f616881

Rolling v8/third_party/WebKit/Source/platform/inspector_protocol to a78b8834da38e5bca9eb5f0d8c28ffe4561dd224

Rolling v8/tools/clang to bd3311be3d35277e6d839596873e906b0b069ab5

Rolling v8/tools/mb to 2f9349ee2aec6dd7b167b26cbbcac2891a9649ab

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2307433002
Cr-Commit-Position: refs/heads/master@{#39061}

Port 7516fe1e

Original commit message:

    The only remaining use of this VariableMode is for the names of sloppy
    named function expressions. This patch instead uses CONST for such
    bindings (just as we do in strict mode) and instead marks those
    Variables specially. During code generation a new helper method,
    Variable::throw_on_const_assignment(), is called to decide whether
    to throw or silently ignore the assignment.

R=adamk@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com
BUG=

Review-Url: https://codereview.chromium.org/2299043002
Cr-Commit-Position: refs/heads/master@{#39060}

  port 7516fe1e (r39052)

  original commit message:
  The only remaining use of this VariableMode is for the names of sloppy
  named function expressions. This patch instead uses CONST for such
  bindings (just as we do in strict mode) and instead marks those
  Variables specially. During code generation a new helper method,
  Variable::throw_on_const_assignment(), is called to decide whether
  to throw or silently ignore the assignment.

BUG=

Review-Url: https://codereview.chromium.org/2299103002
Cr-Commit-Position: refs/heads/master@{#39059}

Revert of [inspector] Initial import of v8_inspector. (patchset #3 id:40001 of https://codereview.chromium.org/2292573002/ )

Reason for revert:
Presubmit

Original issue's description:
> [inspector] Initial import of v8_inspector.
>
> BUG=chromium:635948
> NOPRESUBMIT=true (for code style)
>
> Committed: https://crrev.com/e29594ea3c5c41de0844e71f7a82c990a8da71ee
> Cr-Commit-Position: refs/heads/master@{#39057}

TBR=jochen@chromium.org,pfeldman@chromium.org,dgozman@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:635948

Review-Url: https://codereview.chromium.org/2300823002
Cr-Commit-Position: refs/heads/master@{#39058}

BUG=chromium:635948
NOPRESUBMIT=true (for code style)

Review-Url: https://codereview.chromium.org/2292573002
Cr-Commit-Position: refs/heads/master@{#39057}

This patch arranges that property names are parsed in a single pass,
reporting the name as well as the type of the property, instead of
parsing qualifiers like 'static' or 'get' initially as names and then
re-parsing. This change is easier to reason about, very slightly (4%)
faster in some cases (although slower in other, less common ones, though
this slowdown will be fixed in an upcoming patch), and is a prerequisite
for separating the parsing of object and class literal properties, which
will become increasingly important as ECMAScript adds more class features.

This is a reland of https://codereview.chromium.org/2278153004/,
which fixes the issue causing the revert and adds more tests.

Review-Url: https://codereview.chromium.org/2300503002
Cr-Commit-Position: refs/heads/master@{#39056}

The event is used by DevTools to mark microtask execution intervals.
To reduces the overhead the event is only emitted when there are
microtasks to run.

BUG=642228

Review-Url: https://codereview.chromium.org/2289593005
Cr-Commit-Position: refs/heads/master@{#39055}

BUG=
R=ulan@chromium.org

Review-Url: https://codereview.chromium.org/2286613002
Cr-Commit-Position: refs/heads/master@{#39054}

BUG=

Review-Url: https://codereview.chromium.org/2292223004
Cr-Commit-Position: refs/heads/master@{#39053}

The only remaining use of this VariableMode is for the names of sloppy
named function expressions. This patch instead uses CONST for such
bindings (just as we do in strict mode) and instead marks those
Variables specially. During code generation a new helper method,
Variable::throw_on_const_assignment(), is called to decide whether
to throw or silently ignore the assignment.

Review-Url: https://codereview.chromium.org/2233673003
Cr-Commit-Position: refs/heads/master@{#39052}

Previously, fast holey elements accessors would detect element presence
by simply doing a hole check on any slot within the backing store's
capacity. This relied on the (mostly-true but brittle) assumption that
slots beyond the length are always correctly zapped with The Hole.

Review-Url: https://codereview.chromium.org/2297253002
Cr-Commit-Position: refs/heads/master@{#39051}

This has been unused since #38728.

BUG=

Review-Url: https://codereview.chromium.org/2297233002
Cr-Commit-Position: refs/heads/master@{#39050}

This introduces a new heap object ModuleInfo, which is to ModuleDescriptor
what ScopeInfo is to Scope.  When deserializing a scope info that contains
a module info, we deserialize the module info into a module descriptor and
put it into the synthesized module scope.

Currently, module infos only store exports.

R=adamk@chromium.org
BUG=v8:1569

Review-Url: https://codereview.chromium.org/2277253003
Cr-Commit-Position: refs/heads/master@{#39049}

Just always predeclare it

R=marja@chromium.org,verwaest@chromium.org
BUG=v8:5215

Review-Url: https://codereview.chromium.org/2298743002
Cr-Commit-Position: refs/heads/master@{#39048}

Both x64.optdebug and x64.debug map to the x64.debug config, so
just printing arch/mode is still confusing.

R=machenbach@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2299623002
Cr-Commit-Position: refs/heads/master@{#39047}

The fuzzer found out that "start" is not always a good control input
for a diamond.

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2295173002
Cr-Commit-Position: refs/heads/master@{#39046}

Ignition OSR to turbofan seems to cause instruction selector crashes
(where instructions selector gets simplified operators, probably
because we break the effect chain somehow).

BUG=chromium:641893

Review-Url: https://codereview.chromium.org/2298613003
Cr-Commit-Position: refs/heads/master@{#39045}

TBR=ulan@chromium.org
BUG=chromium:468240
NOTRY=true

Review-Url: https://codereview.chromium.org/2293903004
Cr-Commit-Position: refs/heads/master@{#39044}

TBR=rmcilroy@chromium.org
BUG=NONE

Review-Url: https://codereview.chromium.org/2298703002
Cr-Commit-Position: refs/heads/master@{#39043}

The goal is to not have to look at the outer scope chain during parsing.

BUG=v8:5215
R=verwaest@chromium.org,marja@chromium.org

Review-Url: https://codereview.chromium.org/2298673002
Cr-Commit-Position: refs/heads/master@{#39042}

- Respect a deadline when processing wrappers during incremental marking, i.e.,
  don't force completetion on each individual step
- Only finalize when both, the internal marking deque and wrappers, are
  processed

Some results (twitter using --enable-blink-features=TraceWrappables)

=== BEFORE ===
incremental_wrapper_tracing_longest_step
  len: 13
  min: 0.0
  ---> max: 6.6
  ---> avg: 3.83846153846
  [0,5[: 7
  [5,10[: 6
mark.wrapper_tracing
  len: 13
  min: 0.0
  max: 2.0 (non-incremental MC)
  avg: 0.153846153846
  [0,5[: 13

=== AFTER ===
incremental_wrapper_tracing_longest_step
  len: 8
  min: 0.0
  ---> max: 1.1
  ---> avg: 0.8875
  [0,5[: 8
mark.wrapper_tracing (not excluding non-incremental MC)
  len: 8
  min: 0.0
  max: 2.5 (non-incremental MC)
  avg: 0.3125
  [0,5[: 8

BUG=chromium:468240
R=ulan@chromium.org

Review-Url: https://codereview.chromium.org/2287343002
Cr-Commit-Position: refs/heads/master@{#39041}

When we try to further fold previously folded allocations in Crankshaft
GVN we don't properly transform the allocations involved, which causes
the mechanism to leave holes in the new/old space (and thereby violate
the iterability property of the new/old space).

BUG=chromium:621868
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2297983003
Cr-Commit-Position: refs/heads/master@{#39040}

The last user was propagating asm_module_ to inner function scopes as asm_function_. asm_function_ is already set upon scope creation when the outer scope IsAsmModule(). With default parameter it's possible that inner scopes are created before set_asm_module() is called. To keep current behavior we'll eagerly mark inner scopes as asm_function_ upon set_asm_module().

There's only one special case that used to be marked asm_function_ which is now no longer marked as such: asm functions in block scopes that are 'Finalized'. PropagateScopeInfo used to mark them as asm_function_ as well, whereas the new version would not mark them upon construction of the inner scope.

I presume both above cornercases aren't actually intended valid asm.js use-cases anyway. The second we can now easily identify in the verifier and mark as invalid asm, since we'll have an asm module with non-asm-function inner functions. If we want to disallow the first, we can also not mark them as asm_functions_ (by removing the loop I added in set_asm_module), which will reveal this structure to the validator.

BUG=v8:5209

Review-Url: https://codereview.chromium.org/2270743003
Cr-Commit-Position: refs/heads/master@{#39039}

This way, many files which only need CompilationInfo but not compiler.h
and its dependencies can include just compilation-info.h.

BUG=

Review-Url: https://codereview.chromium.org/2284313003
Cr-Commit-Position: refs/heads/master@{#39038}

R=marja@chromium.org
TBR=verwaest@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2294193003
Cr-Commit-Position: refs/heads/master@{#39037}

This is the first step towards unifying ParseVariableDeclarations.

BUG=

Review-Url: https://codereview.chromium.org/2297643002
Cr-Commit-Position: refs/heads/master@{#39036}

Rolling v8/build to 679c9fd3fa7390897bcf6891f0dc57a5e5dced0d

Rolling v8/tools/mb to d939c7d364f0565ac2ddcae09aafe01c9bf8007d

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2293333002
Cr-Commit-Position: refs/heads/master@{#39035}

Ports https://codereview.chromium.org/2293853002 to unblock
deps roller.

BUG=474921
TBR=jochen@chromium.org, kjellander@chromium.org, vogelheim@chromium.org
NOTRY=true

Review-Url: https://codereview.chromium.org/2290233005
Cr-Commit-Position: refs/heads/master@{#39034}

The way we use FinishRegion for transitioning stores makes them eligible
for elimination by TypedOptimization, which is unintended and removes
the atomicity of the transitioning stores. This is a quickfix to ensure
that we don't remove the FinishRegion nodes during TypedOptimization;
the real fix is probably to have separate region operators for value
(producing) regions (i.e. allocations) and for effect-only regions (i.e.
transitioning stores).

R=jarin@chromium.org
BUG=v8:5303

Review-Url: https://codereview.chromium.org/2293023003
Cr-Commit-Position: refs/heads/master@{#39033}

If the type of a tracked field or element value is less precise than the
advertised type of the field or element load, then we replace the load
operation with a TypeGuard that guards the advertised type.

R=jarin@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2295643002
Cr-Commit-Position: refs/heads/master@{#39032}

We (mis)used Type::Class to track stable field maps in the past. But
that always more or less unsupport and wrong for various reasons, mostly
because the class types do not really present static information and
thus it is possible to violate fundamental assumptions of the type
system (i.e. intersecting class types and other types produces
"interesting" results).

Now it is possible to finally nuke the class types completely and thus
simplify (and ideally correctify) the type system further.

Note to performance sheriff: We do expect to see some performance
regressions from this change. This is because we do not yet have a sane
replacement mechanism to track known field maps and utilize them during
LoadElimination. This will be accomplished in a follow up CL.

BUG=v8:5270,v8:5267
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2293343002
Cr-Commit-Position: refs/heads/master@{#39031}

This removes two bits of duplication:
  - Parsing of each AssignmentExpression, which previously was called
    first outside the loop and then inside the loop.
  - Parsing of arrow rest parameters, which previously was handled
    separately for the one-arg and N-arg cases.

The only change in behavior is in a few error messages.

Review-Url: https://codereview.chromium.org/2279363002
Cr-Commit-Position: refs/heads/master@{#39030}

Revert of Refactor object/class literal property name parsing (patchset #7 id:120001 of https://codereview.chromium.org/2278153004/ )

Reason for revert:
Fails to reject "{*foo: 1}" as an object literal, found
by the fuzzer:

https://build.chromium.org/p/client.v8/builders/V8%20Fuzzer/builds/12315/steps/Fuzz%20on%20Ubuntu-12.04/logs/stdio

Original issue's description:
> Refactor object/class literal property name parsing
>
> This patch arranges that property names are parsed in a single pass,
> reporting the name as well as the type of the property, instead of
> parsing qualifiers like 'static' or 'get' initially as names and then
> re-parsing. This change is easier to reason about, very slightly (4%)
> faster in some cases (although slower in other, less common ones, though
> this slowdown will be fixed in an upcoming patch), and is a prerequisite
> for separating the parsing of object and class literal properties, which
> will become increasingly important as ECMAScript adds more class features.
>
> Committed: https://crrev.com/6dd26c729584024e17a05a2a76b319d4aecdc138
> Cr-Commit-Position: refs/heads/master@{#39027}

TBR=littledan@chromium.org,marja@chromium.org,bakkot@google.com
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2295743003
Cr-Commit-Position: refs/heads/master@{#39029}

Test ensuring globals are isolated between instances. Also
added support for globals section to mjsunit's
WebModuleBuilder as a prerequisite.

BUG=

Review-Url: https://codereview.chromium.org/2296993002
Cr-Commit-Position: refs/heads/master@{#39028}

This patch arranges that property names are parsed in a single pass,
reporting the name as well as the type of the property, instead of
parsing qualifiers like 'static' or 'get' initially as names and then
re-parsing. This change is easier to reason about, very slightly (4%)
faster in some cases (although slower in other, less common ones, though
this slowdown will be fixed in an upcoming patch), and is a prerequisite
for separating the parsing of object and class literal properties, which
will become increasingly important as ECMAScript adds more class features.

Review-Url: https://codereview.chromium.org/2278153004
Cr-Commit-Position: refs/heads/master@{#39027}

Increasingly, we avoid using the representation dimension of Type,
  and set it explicitly ourselves.

BUG=

Review-Url: https://codereview.chromium.org/2290233002
Cr-Commit-Position: refs/heads/master@{#39026}

When changing from Tagged to Float64 representation, it's not unlikely
to see a HeapNumber (or if feedback says so, an Oddball), so we
shouldn't penalize the code that deals with this case by marking it as
deferred.

R=mvstanton@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2295933003
Cr-Commit-Position: refs/heads/master@{#39025}

BUG=chromium:616434
LOG=NO

Review-Url: https://codereview.chromium.org/2294783002
Cr-Commit-Position: refs/heads/master@{#39024}

When FieldType::None() returns a cast Smi::FromInt(0), which translates
as nullptr, the FieldType::IsNone() check becomes equivalent to
`this == nullptr` which is not allowed by the standard and
therefore optimized away as a false constant by GCC 6.

This has lead to crashes when invoking methods on FieldType::None().

Using a different Smi constant for FieldType::None() makes the compiler
always include a comparison against that value. The choice of these
constants has no effect as they are effectively arbitrary.

BUG=https://github.com/nodejs/node/issues/8310

Review-Url: https://codereview.chromium.org/2292953002
Cr-Commit-Position: refs/heads/master@{#39023}

If the input of grow-memory was not representable as a SMI, then the
input was not passed correctly to the runtime, which caused a crash.
With this CL the input of grow-memory is checked before the runtime is
called.

R=titzer@chromium.org, gdeepti@chromium.org
TEST=mjsunit/wasm/grow-memory.js:testGrowMemoryTrapsWithNonSmiInput()

Review-Url: https://codereview.chromium.org/2288773002
Cr-Commit-Position: refs/heads/master@{#39022}