When the input to Function.prototype.bind is a known function, we can
inline the allocation of the JSBoundFunction into TurboFan, which
provides a 2x speed-up for several hot functions in Node streams (as
discovered by Matteo Collina). One of example of this can be found in
https://github.com/nodejs/node/pull/13322, which can be optimized and
made more readable using bind instead of closures.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2916063002
Cr-Commit-Position: refs/heads/master@{#45679}

Based on past discussions I'm going to try to reland this change. This makes window.document and document behave the same after navigation, which is a change from what the spec says. If this works out though, it would greatly simplify the spec; and fix the fact that currently it's leaking the underlying global object, which we don't want for security and object-identity reasons.

Bug: chromium:713732
Change-Id: I5ce89afb46349ff92b7f5a884a7c388fcff887bf
Reviewed-on: https://chromium-review.googlesource.com/522605Reviewed-by: Kentaro Hara <haraken@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45678}

We want to be stricter about checking in the future, so give embedders a
way to disable checking while they fix their microtasks scopes.

BUG=chromium:728583
R=machenbach@chromium.org

Change-Id: I443575bf6820b432def59cbbd4d048b2007573c8
Reviewed-on: https://chromium-review.googlesource.com/522604
Commit-Queue: Jochen Eisinger <jochen@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45677}

NOTRY=true
NOTREECHECKS=true
TBR=tandrii@chromium.org,kjellander@chromium.org

Bug: chromium:726584
Change-Id: I3bf3587e2d58c34b5697785c6033d28eb584146d
Reviewed-on: https://chromium-review.googlesource.com/522126
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45676}

This is a first step towards reducing the number of stores/loads when suspending/resuming a generator.

Unfortunately, even for an empty generator, we still use 8 register for various things (try-finally, copies of generator object, parser-introduced temporaries). I will try to get rid of these in separate CLs.

Changes:

- SuspendGenerator bytecode now takes register list to save.
- ResumeGenerator was split into two bytecodes:
  * Resume generator reads the state out and marks the generator as
      'executing'.
  * RestoreGeneratorRegisters reloads the registers from
      the generator.
    + this required adding support for output register list.

- Introduced generator_object_ register in the bytecode generator.
  * in subsequent CLs, I will make better use of it, the goal is
      to get rid if the .generator_object local variable.

- Taught register optimizer to flush unassigned registers.

BUG=v8:6379

Review-Url: https://codereview.chromium.org/2894293003
Cr-Commit-Position: refs/heads/master@{#45675}

Bug: v8:5717
Change-Id: I87cfef5d6d69106fd454338e77c2c703fcdba67b
Reviewed-on: https://chromium-review.googlesource.com/520576Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45674}

Revert of [heap] Decrease old space physical memory factor. (patchset #3 id:40001 of https://codereview.chromium.org/2907363003/ )

Reason for revert:
Fails on other bots now:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20debug/builds/16197
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/builds/13170
https://build.chromium.org/p/client.v8.ports/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20gc%20stress/builds/6749

Original issue's description:
> Fix tests regress-336820 and regress-678917.
>
> Execution tests regress-336820 and regress-678917 finished with error
> messages "allocation failure GC in old space requested" and "fatal
> javascript OOM in CALL_AND_RETRY_LAST". For successful execution,
> parameter max_old_space_size must be increased and this is done inside
> tests.
>
> TEST=mjsunit/regress/regress-336820,
>      mjsunit/regress/regress-678917
> BUG=
>
> Review-Url: https://codereview.chromium.org/2907363003
> Cr-Commit-Position: refs/heads/master@{#45672}
> Committed: https://chromium.googlesource.com/v8/v8/+/1550c869094c5873da9226ae9b4de7084692a857

TBR=hpayer@chromium.org,jochen@chromium.org,mlippautz@chromium.org,mstarzinger@chromium.org,ulan@chromium.org,ivica.bogosavljevic@imgtec.com,bmeurer@chromium.org,jarin@chromium.org,ishell@chromium.org,Ilija.Pavlovic@imgtec.com,Ilija.Pavlovic@imgtec.com,Ilija.Pavlovic@imgtec.com,Ilija.Pavlovic@imgtec.com
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review-Url: https://codereview.chromium.org/2917063002
Cr-Commit-Position: refs/heads/master@{#45673}

Execution tests regress-336820 and regress-678917 finished with error
messages "allocation failure GC in old space requested" and "fatal
javascript OOM in CALL_AND_RETRY_LAST". For successful execution,
parameter max_old_space_size must be increased and this is done inside
tests.

TEST=mjsunit/regress/regress-336820,
     mjsunit/regress/regress-678917
BUG=

Review-Url: https://codereview.chromium.org/2907363003
Cr-Commit-Position: refs/heads/master@{#45672}

BUG=chromium:728228,chromium:626082
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_chromium_rel_ng

Review-Url: https://codereview.chromium.org/2917853004
Cr-Commit-Position: refs/heads/master@{#45671}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/54fde1e..a055d2e

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/e6ad063..b33525e

Rolling v8/third_party/icu: https://chromium.googlesource.com/chromium/deps/icu/+log/c844075..ae18d60

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: I5da56e51e4c890df61ef9b55f2a4d271d55ec922
Reviewed-on: https://chromium-review.googlesource.com/522165Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45670}

This is just a cleanup patch.

BUG=none

Review-Url: https://codereview.chromium.org/2921623006
Cr-Commit-Position: refs/heads/master@{#45669}

This is in an effort to narrow down the root cause of the
referenced, very flaky, bug.

Bug: chromium:725559
Change-Id: I8235983fea6f579d228e81177fdcac9ef6115d1f
Reviewed-on: https://chromium-review.googlesource.com/521923Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Mircea Trofin <mtrofin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45668}

This patch adds ability to connect multiple sessions to a single context group. This is an experimental feature, which is already supported in test harness.

So far covered runtime domain with tests (and found a bug thanks to the test). More tests to follow in next patches, probably with code adjustments as well.

BUG=chromium:590878

Review-Url: https://codereview.chromium.org/2906153002
Cr-Commit-Position: refs/heads/master@{#45667}

Similar to marking, seed the pointers updating with items.

Bug: chromium:726040
Change-Id: Iaa480d153de96d744c425c478c68e7629550c85a
Reviewed-on: https://chromium-review.googlesource.com/521145Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45666}

BUG=chromium:724972

R=clemensh@chromium.org, rossberg@chromium.org

Review-Url: https://codereview.chromium.org/2917603002
Cr-Commit-Position: refs/heads/master@{#45665}

Bug: v8:5717, v8:6354, v8:6410
Change-Id: Ie652f4358f2a68c7ea76d546e26a6b4fb815df4a
Reviewed-on: https://chromium-review.googlesource.com/518923
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45664}

Currently x instanceof Map/Set checks cannot take the fast path, since
the Map/Set constructor has dictionary properties. To avoid that, just
forcibly migrate the Map/Set constructor to fast properties again once
it's fully setup in the bootstrapper.

Bug: v8:5717, v8:5902
Change-Id: I23dfd00456c9206a0ca5af71dfbc9236982936fc
Reviewed-on: https://chromium-review.googlesource.com/520578
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45663}

Add support for S1x4And, S1x4Or, S1x4Xor, S1x4Not, S1x4AnyTrue,
S1x4AllTrue, S1x8And, S1x8Or, S1x8Xor, S1x8Not, S1x8AnyTrue,
S1x8AllTrue, S1x16And, S1x16Or, S1x16Xor, S1x16Not, S1x16AnyTrue,
S1x16AllTrue, SimdLoad, SimdStore operations for mips32 and mips64
architectures.

BUG=

Review-Url: https://codereview.chromium.org/2801683003
Cr-Commit-Position: refs/heads/master@{#45662}

This fixes an issue with ful-codegen where code target entries for the OSR
check were being incorrectly shared. We now explicitly disable sharing of code
target constant pool entries for full-codegen and for calls to builtins from
WASM code, using a scope.

BUG=chromium:725743

Review-Url: https://codereview.chromium.org/2922433002
Cr-Commit-Position: refs/heads/master@{#45661}

R=clemensh@chromium.org
TEST=mjsunit/asm/regress-719866
BUG=chromium:719866

Change-Id: I6cc9f222769aa036275654286c9c6271ef2d1334
Reviewed-on: https://chromium-review.googlesource.com/520945Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45660}

Revert "Reland "[runtime] Pass global proxy as receiver to native accessors in case of contextual access""

This reverts commit ba8a7539.

Reason for revert: A layout test is unhappy:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/16010

Original change's description:
> Reland "[runtime] Pass global proxy as receiver to native accessors in case of contextual access"
> 
> Based on past discussions I'm going to try to reland this change. This makes window.document and document behave the same after navigation, which is a change from what the spec says. If this works out though, it would greatly simplify the spec; and fix the fact that currently it's leaking the underlying global object, which we don't want for security and object-identity reasons.
> 
> Bug: chromium:713732
> Change-Id: I835ef510fc78f04c602434a7cec6420e027c4012
> Reviewed-on: https://chromium-review.googlesource.com/520764
> Commit-Queue: Toon Verwaest <verwaest@chromium.org>
> Reviewed-by: Kentaro Hara <haraken@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#45654}

TBR=haraken@chromium.org,verwaest@chromium.org
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:713732

Change-Id: Iecde1cd855c21efa73939bbfbff0c26540ee2d98
Reviewed-on: https://chromium-review.googlesource.com/521045Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45659}

SRWLOCK is a faster and lightweight alternative of CRITICAL_SECTION for
non-recursive use case.

Bug: chromium:592752
Change-Id: Ie97cd9cee2d50a95f316b41c30e953f586b06c99
Reviewed-on: https://chromium-review.googlesource.com/520828Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Commit-Queue: Loo Rong Jie <loorongjie@gmail.com>
Cr-Commit-Position: refs/heads/master@{#45658}

Furthermore avoid lock-step between pointer updating phases as they
should execute in parallel without synchronization restrictions.

This reverts commit bc6adb86.

Bug: chromium:726040
Change-Id: I1713d4333f0ce1604ff51c02461f3ef91e4bdaed
Reviewed-on: https://chromium-review.googlesource.com/521062Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45657}

On left trimming the main thread ensures that the array
is black before changing its map and length.

The concurrent marker snapshots the length of the array
and then tries to change its color to black. If the change
is successful, then the array is iterated using the saved
length.


BUG=chromium:694255

Change-Id: Ib06c1c9c3240ace56c1897e5a73462aa447d41f5
Reviewed-on: https://chromium-review.googlesource.com/519323Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45656}

Embedders should use Module::InstantiateModule

R=neis@chromium.org

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Iebd5beeeeb9ea7025c61b97b666827e0a6ec89ad
Reviewed-on: https://chromium-review.googlesource.com/519162Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Jochen Eisinger <jochen@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45655}

Based on past discussions I'm going to try to reland this change. This makes window.document and document behave the same after navigation, which is a change from what the spec says. If this works out though, it would greatly simplify the spec; and fix the fact that currently it's leaking the underlying global object, which we don't want for security and object-identity reasons.

Bug: chromium:713732
Change-Id: I835ef510fc78f04c602434a7cec6420e027c4012
Reviewed-on: https://chromium-review.googlesource.com/520764
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45654}

On ia32, AssembleMove used to emit different code depending on whether
the to-be-moved heap object is in new space or not. This may have been
necessary in the past but is no longer. Moreoever, it's incompatible
with running off-thread. With this CL, we don't do the new-space check
and just emit a mov.

R=mstarzinger@chromium.org

Bug: v8:6048
Change-Id: I93abd61a5f290311a431edee3d4fa0a240d52085
Reviewed-on: https://chromium-review.googlesource.com/519248Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45653}

Use relaxed reads to allow changing the pointer concurrently in the 
GC. The layout descriptor will either be fast and there's nothing
to be done, or it will be slow, and we will use the forwarding
pointer to determine the proper version to use.

Bug: chromium:726040
Change-Id: I0a376752c3a99abf0874070387fcaeb3cee0dcb2
Reviewed-on: https://chromium-review.googlesource.com/519346
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45652}

Switch to use Win32 CONDITION_VARIABLE like Chromium.

This greatly simplifies the implementation of ConditionVariable
class for Windows with better performance.

Bug:NO

Change-Id: Iea5e5cb80520a966aeb687bebb4b5256396cb13b
Reviewed-on: https://chromium-review.googlesource.com/519542Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Commit-Queue: Loo Rong Jie <loorongjie@gmail.com>
Cr-Commit-Position: refs/heads/master@{#45651}

Visitor id for JSObjects does not depend on the instance size.

BUG=chromium:694255

Change-Id: I6b4b559207609f4a4c19373572be6692a55c5187
Reviewed-on: https://chromium-review.googlesource.com/520763Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45650}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/0312f98..54fde1e

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/32a3f0b..e6ad063

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: I2c9f167618d17546e4df4abbed2da0d428226868
Reviewed-on: https://chromium-review.googlesource.com/520922Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45649}

Port 510ebfc3
Port 8f61fbc6

R=neis@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2920523002
Cr-Commit-Position: refs/heads/master@{#45648}

This fixes the counter inconsistencies while leaving the memory in an
inaccessible state.

Bug: chromium:724947
Change-Id: I431eb6fda84922a52dfb9380c6b482ada55bccee
Reviewed-on: https://chromium-review.googlesource.com/519164
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45647}

Bug: 
Change-Id: If4a5408f8ff63a8a2b189f60fda37896a9403d3d
Reviewed-on: https://chromium-review.googlesource.com/519386Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45646}

This reverts commit 33d5006e.

Reason for revert: Still failing TSAN: https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20TSAN/builds/15527/steps/Check%20-%20extra%20%28flakes%29/logs/regress-470804

Original change's description:
> Reland "[heap] Move pointers updating to ItemParallelJob""
> 
> Furthermore avoid lock-step between pointer updating phases as they
> should execute in parallel without synchronization restrictions.
> 
> This reverts commit 68a72399.
> 
> Bug: chromium:726040
> Change-Id: I76bb31d146f8aa20f8b7c486eeae9f09efa0cd53
> Reviewed-on: https://chromium-review.googlesource.com/518150
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#45644}

TBR=ulan@chromium.org,mlippautz@chromium.org

No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:726040
Change-Id: I96090250a6ecc5068c3c927e8435e0b605c3c335
Reviewed-on: https://chromium-review.googlesource.com/519409
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45645}

Furthermore avoid lock-step between pointer updating phases as they
should execute in parallel without synchronization restrictions.

This reverts commit 68a72399.

Bug: chromium:726040
Change-Id: I76bb31d146f8aa20f8b7c486eeae9f09efa0cd53
Reviewed-on: https://chromium-review.googlesource.com/518150
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45644}

Bug: chromium:724973
Change-Id: I227b30b50f92fac7d6cf3ec3369e324282352ccb
Reviewed-on: https://chromium-review.googlesource.com/514348Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Ben Smith <binji@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45643}

When checking {const char*} (or similar) against each other, don't
print them as c strings on failure. Just print the pointer value.
In wasm, where we use byte pointers into wasm wire bytes, this was
sometimes hiding check failures behind segfaults which happened when
trying to output invalid pointers as c strings.
Anyway, it's more useful to see the raw pointer values in these cases.
Other use cases, where we really compare against c string pointers
should be rare in our code base.

R=ishell@chromium.org

Change-Id: I92a13221d18c987a97cf2a29ac8f454178ff2bb5
Reviewed-on: https://chromium-review.googlesource.com/517166
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45642}

In https://chromium-review.googlesource.com/c/505614/ I added code to
the test runner which deletes the old corpus of the wasm fuzzer. It's
time now to remove this code again.

R=machenbach@chromium.org

Change-Id: Ic3b8f7a1f6d725f0bf070b404a75ac37551a07c0
Reviewed-on: https://chromium-review.googlesource.com/519405Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45641}

DebugInfo was very closely tied to break point support:
* It contained only information relevant to break points.
* It was created and freed by break point implementation.
* Existence of a DebugInfo on the shared function info implied existence of
  break points.

This CL is a step towards making DebugInfo usable by other debugging
functionality such as block coverage by decoupling it from break point support,
which is now only one kind of information stored on the DebugInfo object.

BUG=v8:6000

Review-Url: https://codereview.chromium.org/2909893002
Cr-Commit-Position: refs/heads/master@{#45640}