This changes many interfaces to accept StandardFrames instead of
JavaScriptFrames, and use the StackTraceFrameIterator instead of the
JavaScriptFrameIterator.
Also, the detailed frame information array now contains the script in
addition to the function, as wasm frames are not associated to any
javascript function.

This is a rebase of (https://codereview.chromium.org/2069823003/), since clemensh's internship has ended.

R=yangguo@chromium.org,ahaas@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2109093003
Cr-Commit-Position: refs/heads/master@{#37379}

The start argument must be converted to an integer before the length argument is
converted.  (Consequently, the start argument is converted even when the length
is 0.)  This matters because conversion is observable.

Also rewrite the function in a way that closely resembles the spec text.

R=littledan@chromium.org
BUG=v8:5140

Review-Url: https://codereview.chromium.org/2109583002
Cr-Commit-Position: refs/heads/master@{#37378}

R=yangguo@chromium.org,jarin@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2112443002
Cr-Commit-Position: refs/heads/master@{#37377}

BUG=

Review-Url: https://codereview.chromium.org/2109943003
Cr-Commit-Position: refs/heads/master@{#37376}

R=bmeurer@chromium.org

BUG=v8:5086,v8:5157

Review-Url: https://codereview.chromium.org/2107733002
Cr-Commit-Position: refs/heads/master@{#37375}

BUG=

Review-Url: https://codereview.chromium.org/2107833002
Cr-Commit-Position: refs/heads/master@{#37374}

Reland of https://codereview.chromium.org/2034093002 (reverted by
https://codereview.chromium.org/2080153002).

Original commit message:
Implement WASM support on big-endian platforms. WASM has
an implicit requirement that it is running on little-endian
machine. We achieve WASM support on BE by keeping data
in memory in little-endian order, and changing data
endianness before storing to memory and after loading from
memory.

BUG=

Review-Url: https://codereview.chromium.org/2083523002
Cr-Commit-Position: refs/heads/master@{#37373}

Revert of [turbofan] Implicitly emit eager checkpoint at graph building. (patchset #13 id:260001 of https://codereview.chromium.org/2074703002/ )

Reason for revert:
Causers flaky failures on the waterfall on Mac with the following error in the builtin QuickSort method:

#
# Fatal error in Zone
# Allocation failed - process out of memory
#

Original issue's description:
> [turbofan] Implicitly emit eager checkpoint at graph building.
>
> This makes preparation of eager checkpoints within the graph builder
> implicit. Every sub-expression visitation is now guaranteed to emit
> valid checkpoints in AstContext.
>
> R=jarin@chromium.org
> BUG=v8:5021
>
> Committed: https://crrev.com/74e328efee7995aeee6d568f9d14f9bbc1087100
> Cr-Commit-Position: refs/heads/master@{#37368}

TBR=jarin@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5021

Review-Url: https://codereview.chromium.org/2104973004
Cr-Commit-Position: refs/heads/master@{#37372}

  The reason:
  All RunFloat64Sin/RunFloat64Cos/RunFloat64Expm1/RunFloat64Tan/Ieee754.Expm1/Ieee754.Cos/Ieee754.Tan test cases
  use the C++ function to generate the expected value or result. So for x87, all those expected value or result are
  extended double precision as the extended double precision is default for x87 Gcc compiler and std lib on linux platform.

  The issue is:
  For RunFloat64Sin/RunFloat64Cos/RunFloat64Expm1/RunFloat64Tan test cases, the expected values generated by C++ function
  are extended double precision, the results generated by X87 jitted code are double precision according to the ECMA standard.
  The comparison of different precisons caused some of those test cases failed.

  For Ieee754.Expm1/Ieee754.Cos/Ieee754.Tan test cases, the expected values are pre-defined double precision values, the results
  generated by C++ function are extended double precision. The comparison of different precisons caused some of those test cases
  failed too.

  This CL disables RunFloat64Sin/RunFloat64Cos/RunFloat64Expm1/RunFloat64Tan/Ieee754.Expm1/Ieee754.Cos/Ieee754.Tan test cases for x87.

BUG=

Review-Url: https://codereview.chromium.org/2111493002
Cr-Commit-Position: refs/heads/master@{#37371}

Operand(reg) -> reg
Operand(reg, 0) -> [reg]

BUG=

Review-Url: https://codereview.chromium.org/2111503002
Cr-Commit-Position: refs/heads/master@{#37370}

The lastIndex property must be written with the semantics of a strict [[Set]],
so an exception must be thrown when the attributes don't allow writing.  We used
to ignore the attributes.

R=littledan@chromium.org, yangguo@chromium.org
BUG=v8:5138

Review-Url: https://codereview.chromium.org/2109593002
Cr-Commit-Position: refs/heads/master@{#37369}

This makes preparation of eager checkpoints within the graph builder
implicit. Every sub-expression visitation is now guaranteed to emit
valid checkpoints in AstContext.

R=jarin@chromium.org
BUG=v8:5021

Review-Url: https://codereview.chromium.org/2074703002
Cr-Commit-Position: refs/heads/master@{#37368}

It's not safe to magically compute types during representation
selection, so better disable the Typer decorator before we start
to do the representation/truncation analysis. This will also allow
us to move to a world where we can run representation selection
concurrently eventually.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2103363004
Cr-Commit-Position: refs/heads/master@{#37367}

BUG=chromium:620553
LOG=N
R=hpayer@chromium.org

Review-Url: https://codereview.chromium.org/2102243002
Cr-Commit-Position: refs/heads/master@{#37366}

BUG=none
R=ulan@chromium.org

Review-Url: https://codereview.chromium.org/2101413002
Cr-Commit-Position: refs/heads/master@{#37365}

Port c1d01aea

Fix a few failures which occur because instruction cache
hasn't been flushed after update of WASM references.

BUG=mjsunit/wasm/asm-wasm-heap,mjsunit/wasm/start-function

Review-Url: https://codereview.chromium.org/2103093003
Cr-Commit-Position: refs/heads/master@{#37364}

BUG=v8:5161
NOTRY=true
NOTREECHECKS=true
TBR=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2111483002
Cr-Commit-Position: refs/heads/master@{#37363}

BUG=v8:5161
NOTRY=true
TBR=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2107113002
Cr-Commit-Position: refs/heads/master@{#37362}

The only real use case left for TypeGuard was the renaming inside the
LoadElimination, but this case only occurs in dead code (guarded by a
previous Check), so it's not relevant, and we can drop the TypeGuard
operator completely.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2108793003
Cr-Commit-Position: refs/heads/master@{#37361}

TBR=hablich@chromium.org, kbr@chromium.org
NOTRY=true

Review-Url: https://codereview.chromium.org/2106053002
Cr-Commit-Position: refs/heads/master@{#37360}

This is the last user of %_DoubleLo and actually unnecessary, since we
can just use the normal Math.random() instead.

R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2109483004
Cr-Commit-Position: refs/heads/master@{#37359}

Revert of [heap] Optimize ArrayBuffer tracking (patchset #5 id:80001 of https://codereview.chromium.org/2107443002/ )

Reason for revert:
Seems to break GPU bots

Original issue's description:
> [heap] Optimize ArrayBuffer tracking
>
> With the current approach we only need to track using an unordered set as we can
> still access the backing store pointer and length by the time we free the
> backing store.
>
> BUG=chromium:619491, chromium:611688
> LOG=N
> R=ulan@chromium.org
>
> Committed: https://crrev.com/8d2ae27808f047ca8b8f90e63a9c8735321d2ad0
> Cr-Commit-Position: refs/heads/master@{#37318}

TBR=ulan@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:619491, chromium:611688

Review-Url: https://codereview.chromium.org/2105273002
Cr-Commit-Position: refs/heads/master@{#37358}

R=bmeurer@chromium.org
BUG=v8:5117

Review-Url: https://codereview.chromium.org/2101523003
Cr-Commit-Position: refs/heads/master@{#37357}

Rolling v8/build to 5340820b7f216d4f155213173cf678774741788d

Rolling v8/buildtools to c36df184fb212b911d5e0fdee45647610e3ea54d

Rolling v8/tools/mb to e79fc1007f026e7d899abec066b714c750103019

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2102393002
Cr-Commit-Position: refs/heads/master@{#37356}

Add a flag harmony_trailing_commas_in_parameters that allows trailing
commas in function parameter declaration lists and function call
parameter lists. Trailing commas are allowed in parenthetical lists like
`(a, b, c,)` only if the next token is `=>`, thereby making it an arrow
function declaration. Only 1 trailing comma is allowed, not `(a,,)`. A
trailing comma must follow a non-rest parameter, so `(,)` and `(...a,)`
are still SyntaxErrors. However, a trailing comma is allowed after a
spread parameter, e.g. `a(...b,);`.

Add parser tests for all of the above.

BUG=v8:5051
LOG=y

Review-Url: https://codereview.chromium.org/2094463002
Cr-Commit-Position: refs/heads/master@{#37355}

BUG=617526
R=bradnelson@chromium.org
TEST=regress-617526.js

Review-Url: https://codereview.chromium.org/2101923003
Cr-Commit-Position: refs/heads/master@{#37354}

Comparisons were allowing asm 'int' values in places
that require strict 'signed' or 'unsigned' but not both.

Fixes crash when these make it to asm-wasm.

BUG=599413
BUG=v8:4203
R=aseemgarg@chromium.org

Review-Url: https://codereview.chromium.org/2106683003
Cr-Commit-Position: refs/heads/master@{#37353}

This reverts commit 1eb1dfab.

The original compilation separation change avoided associating a heap
for the wasm instance if memory was not provided, nor needed. The
grow memory CL assumed the old behavior, where a memory buffer was
always present, but may have had a zero size.

The 2CLS  landed shortly after one another. We decided to treat the
grow memory as the race condition winner, so this CL here re-lands
compilation separation, plus adjusts grow memory to deal with
the undefined mem buffer.

BUG=

Review-Url: https://codereview.chromium.org/2102193003
Cr-Commit-Position: refs/heads/master@{#37352}

This reverts commit 0c7ee927.

BUG=

Review-Url: https://codereview.chromium.org/2103983003
Cr-Commit-Position: refs/heads/master@{#37351}

asm.js forbids mixing signed and unsigned % or /.
We had been allowing these.

Fixes crash.

BUG=618602
BUG=v8:4203
R=aseemgarg@chromium.org

Review-Url: https://codereview.chromium.org/2107683002
Cr-Commit-Position: refs/heads/master@{#37350}

We were not checking that the string passed to instantiateFromAsm
contains a function declaration (any declaration was allowed).

Fixes crash.

BUG=620649
BUG=v8:4203
R=aseemgarg@chromium.org

Review-Url: https://codereview.chromium.org/2109533002
Cr-Commit-Position: refs/heads/master@{#37349}

Support for serializing/deserializing the compiled wasm module.

We want to reuse the javascript snapshotting mechanics, at least in the
short term, when we still use the JS heap for the compiled wasm code.
Given that a module may be compiled in one v8 instance and then
instantiated later, in a different instance, whatever information we need
at instantiation time must also be serializable.

We currently hold on to the un-decoded wasm bytes, for enabling
debugging scenarios. This imposes a ~20% penalty on the memory
requirements of the wasm compiled code. We do not need this data
otherwise, for runtime, and it is sensible to consider eventually loading it
on demand. Therefore, I intentionally avoided relying on it and re-
decoding the wasm module data, and instead saved the information
necessary to support instantiation.

Given how whatever we need to persist must be serializable, the CL
uses a structure made out of serializable objects (fixed arrays mostly)
for storing this information. I preferred going this route rather than
adding more wasm-specific support to the serializer, given that we want
to eventually move off the JS heap, and therefore the serializer.

Additionally, it turns out this extra information is relatively not complex:
minimal structure, little nesting depth, mostly simple data like numbers
or byte blobs, or opaque data like compiled functions.

This CL also moves export compilation ahead of instantiation time.

This change added a helper getter to FixedArray, to make typed retrieval
of elements easier.

BUG=

Review-Url: https://codereview.chromium.org/2094563002
Cr-Commit-Position: refs/heads/master@{#37348}

Revert of [heap] Reland uncommit unused large object page memory. (patchset #1 id:1 of https://codereview.chromium.org/2101383002/ )

Reason for revert:
Crashes unbox-double-arrays

Original issue's description:
> [heap] Reland uncommit unused large object page memory.
>
> BUG=
>
> Committed: https://crrev.com/dd0ee5fd11653ba41a292641ccd66ae7cc5a8398
> Cr-Commit-Position: refs/heads/master@{#37341}

TBR=ulan@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review-Url: https://codereview.chromium.org/2106933003
Cr-Commit-Position: refs/heads/master@{#37347}

Port 5e058540

Original commit message:

    The reason for reverting is: This breaks gc-stress bot:
    https://chromegw.corp.google.com/i/client.v8/builders/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot

    Abortion of compaction could cause duplicate entries in the typed-old-to-new remembered set.
    These duplicates could cause a DCHECK to trigger which checks that slots recorded in the
    remembered set never point to to-space. This reland-CL allows duplicates in the remembered
    set by removing the DCHECK, and additionally clears entries in the remembered set if objects are moved.

    Original issue's description:

    Cells were needed originally because there was no typed remembered set to
    record direct pointers from code space to new space. A previous
    CL (https://codereview.chromium.org/2003553002/) already introduced
    the remembered set, this CL uses it.

    This CL
    * stores direct pointers in code objects, even if the target is in new space,
    * records the slot of the pointer in typed-old-to-new remembered set,
    * adds a list which stores weak code-to-new-space references,
    * adds a test to test-heap.cc for weak code-to-new-space references,
    * removes prints in tail-call-megatest.js

R=ahaas@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2108673003
Cr-Commit-Position: refs/heads/master@{#37346}

The opcodes for 'cmpw r/m16, r16' and 'cmpw r16, r/m16' were swapped, causing a few issues when less than/greater than comparison were performed.

Adds a regression test.

BUG=621926

Committed: https://crrev.com/efa7095e3e360fbadbe909d831ac11b268ca26b0
Review-Url: https://codereview.chromium.org/2103713003
Cr-Original-Commit-Position: refs/heads/master@{#37339}
Cr-Commit-Position: refs/heads/master@{#37345}

Port e607e12e

Original commit message:
    Introduce a new machine operator Float64Pow that for now is backed by
    the existing MathPowStub to start the unification of Math.pow, and at
    the same time address the main performance issue that TurboFan still has
    with the imaging-darkroom benchmark in Kraken.

    Also migrate the Math.pow builtin itself to a TurboFan builtin and
    remove a few hundred lines of hand-written platform code for special
    handling of the fullcodegen Math.pow version.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=v8:3599,v8:5086,v8:5157
LOG=N

Review-Url: https://codereview.chromium.org/2106883002
Cr-Commit-Position: refs/heads/master@{#37344}

Addressing comment in https://codereview.chromium.org/2102073002/

BUG=chromium:576312, chromium:623516

Review-Url: https://codereview.chromium.org/2109713002
Cr-Commit-Position: refs/heads/master@{#37343}

Revert of [ia32] Fixes a bug in cmpw. (patchset #3 id:40001 of https://codereview.chromium.org/2103713003/ )

Reason for revert:
Causes "buildbot failure in V8 on V8 Linux gcc 4.8, Check"

Original issue's description:
> [ia32] Fixes a bug in cmpw.
>
> The opcodes for 'cmpw r/m16, r16' and 'cmpw r16, r/m16' were swapped, causing a few issues when less than/greater than comparison were performed.
>
> Adds a regression test.
>
> BUG=621926
>
> Committed: https://crrev.com/efa7095e3e360fbadbe909d831ac11b268ca26b0
> Cr-Commit-Position: refs/heads/master@{#37339}

TBR=bmeurer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=621926

Review-Url: https://codereview.chromium.org/2106913002
Cr-Commit-Position: refs/heads/master@{#37342}

BUG=

Review-Url: https://codereview.chromium.org/2101383002
Cr-Commit-Position: refs/heads/master@{#37341}

PERFORMANCE_DEFAULT mode.

BUG=

Review-Url: https://codereview.chromium.org/2108503003
Cr-Commit-Position: refs/heads/master@{#37340}