Add support for WebAssembly.Memory objects to be simultaneously referenced by multiple Instance objects. GrowingMemory should maintain a consistent view of memory across instances.
 - Store a link to instances that share WebAssembly.Memory in the WasmMemoryObject, updated on instantiate.
 - Implement WasmInstanceWrapper as a wrapper around the instance object to keep track of previous/next instances, instance object is stored as a WeakCell that can be garbage collected.
 - MemoryInstanceFinalizer maintains a valid list of instances when an instance is garbage collected.
 - Refactor GrowInstanceMemory to GrowMemoryBuffer that allocates a new buffer, and UncheckedUpdateInstanceMemory that updates memory references for an instance.

 R=titzer@chromium.org, mtrofin@chromium.org, bradnelson@chromium.org

Review-Url: https://codereview.chromium.org/2471883003
Cr-Commit-Position: refs/heads/master@{#41121}

The code which pushes and pops to the function name inference stack
generally checks if the stack is active with the IsOpen method. One
piece of code pertaining to async functions was missing that check.
This patch adds it.

BUG=chromium:658267
R=gsathya,caitp

Review-Url: https://codereview.chromium.org/2514893002
Cr-Commit-Position: refs/heads/master@{#41120}

BUG=v8:5624

Review-Url: https://codereview.chromium.org/2518513002
Cr-Commit-Position: refs/heads/master@{#41119}

BUG=666622, v8:5388
R=bmeurer@chromium.org, mstarzinger@chromium.org

Review-Url: https://codereview.chromium.org/2515683002
Cr-Commit-Position: refs/heads/master@{#41118}

A simple Print API for debugging assessments in the regalloc
verifier.

BUG=

Review-Url: https://codereview.chromium.org/2512943003
Cr-Commit-Position: refs/heads/master@{#41117}

This patch also cleans up NewPromiseCapability.

This patch results in a 20% improvement over 4 runs with the following micro
benchmark -

var x = Promise.resolve();

async function bar() {
    return x;
}

async function foo() {
    await bar();
}

var start = performance.now();
var count = 0;
var max = 10000;
for(var i = 0; i <= max; i++) {
    foo().then(() => {
        count++;
        if(count === max) print( performance.now() - start );
    })
}

BUG=v8:5639

Review-Url: https://codereview.chromium.org/2512103002
Cr-Commit-Position: refs/heads/master@{#41116}

... at least for the function which will remain after restructuring of
the debug interface. For some methods that will be removed anyway, we
just return zero / null for now.

I also refactored the ScriptLocationFromLine method to make it more
readable and reuse parts in other files (like ScriptLinePosition).

BUG=5655
R=titzer@chromium.org, jgruber@chromium.org

Review-Url: https://codereview.chromium.org/2512833003
Cr-Commit-Position: refs/heads/master@{#41115}

Some minifiers use the pattern !function ... () for JS code that should
be immediately executed. This change recognizes that pattern and treats
it equally to parenthesized functions.

A bit more background info is in the referenced bug.

R=verwaest@chromium.org
BUG=v8:5643

Review-Url: https://codereview.chromium.org/2509143003
Cr-Commit-Position: refs/heads/master@{#41114}

Port a1103a11

Original commit message:
 - Simplify the variable-length pop sequence on entry. (It now uses
   smaller code with no branches.)
 - Use conditional compare to merge branches where appropriate.
 - Make use of Ldrsw + UntagSmiFieldMemOperand to load smis more
   efficiently.
 - Only load 'undefined' and 'null' once per builtin.
 - A few other small improvements.

Review-Url: https://codereview.chromium.org/2507683003
Cr-Commit-Position: refs/heads/master@{#41113}

are created using new Array(N) and setLength(N).

Currently the limit is based on max old generation size, which
will break with the upcoming change that allows large heaps.

BUG=chromium:652721

Review-Url: https://codereview.chromium.org/2513923002
Cr-Commit-Position: refs/heads/master@{#41112}

This is a next step towards removing names table from type feedback metadata.

BUG=chromium:576312, v8:5561

Review-Url: https://codereview.chromium.org/2514453002
Cr-Commit-Position: refs/heads/master@{#41111}

It originates from the era where we used to run a separate preparse step
before parsing and store the function data. Now the usage of preparser
is something completely different, so this flag doesn't make sense any
more.

In addition, this way we get more test coverage for preparser (for small
scripts).

BUG=

Review-Url: https://codereview.chromium.org/2513563002
Cr-Commit-Position: refs/heads/master@{#41110}

This reverts commit 3c96c5e2.

The CL was reverted to see its impact on UMA memory counters.
There was no impact, so we can safely reland the CL.

BUG=

Review-Url: https://codereview.chromium.org/2507293004
Cr-Commit-Position: refs/heads/master@{#41109}

Add fast paths for holey smi and object arrays to
Function.prototype.apply, Reflect.apply and Reflect.construct.

R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2510043004
Cr-Commit-Position: refs/heads/master@{#41108}

This way we can just process new space strings when needed.

BUG=chromium:651354

Review-Url: https://codereview.chromium.org/2515643002
Cr-Commit-Position: refs/heads/master@{#41107}

This is a next step towards removing names table from type feedback metadata.

BUG=chromium:576312, v8:5561

Review-Url: https://codereview.chromium.org/2507143003
Cr-Commit-Position: refs/heads/master@{#41106}

[crankshaft] Don't inline the fast path for instanceof if the function has a non-instance .prototype

BUG=chromium:666308

Review-Url: https://codereview.chromium.org/2516603002
Cr-Commit-Position: refs/heads/master@{#41105}

Adds the marking logic to mark the young generation.

BUG=chromium:651354

Review-Url: https://codereview.chromium.org/2498583002
Cr-Commit-Position: refs/heads/master@{#41104}

The test is too fragile.

NOTREECHECKS=true

Review-Url: https://codereview.chromium.org/2510403002
Cr-Commit-Position: refs/heads/master@{#41103}

This makes wasm frames show up nicely in stack traces generated e.g. by
Isolate::PrintStack() and Isolate::PrintCurrentStackTrace().
With this CL, we print the script name, function index, function name,
pc and source position.

R=titzer@chromium.org, ahaas@chromium.org

Review-Url: https://codereview.chromium.org/2509323002
Cr-Commit-Position: refs/heads/master@{#41102}

Add bytecode for defining data properties, which initially just calls the runtime function.

BUG=v8:5624

Review-Url: https://codereview.chromium.org/2510743002
Cr-Commit-Position: refs/heads/master@{#41101}

Revert of [interpreter] Properly collect rhs feedback for comparisons with oddballs. (patchset #1 id:1 of https://codereview.chromium.org/2513903002/ )

Reason for revert:
Seems to break layout tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/11452

Original issue's description:
> [interpreter] Properly collect rhs feedback for comparisons with oddballs.
>
> Ignition skipped collecting NumberOrOddball feedback if the right hand
> side of a relational comparison is undefined, thus leading to a
> deoptimization loop, because it reported Number feedback to TurboFan.
>
> This was caught on 3d-raytrace test of SunSpider.
>
> R=rmcilroy@chromium.org
>
> Committed: https://crrev.com/d240ffec32ae034e50c006f7d5715171b32bbbc4
> Cr-Commit-Position: refs/heads/master@{#41094}

TBR=rmcilroy@chromium.org,bmeurer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2511243004
Cr-Commit-Position: refs/heads/master@{#41100}

Instead of having functions for 0 to 5 arguments, we now have a
variadic template, allowing for an arbitrary number of arguments.
I also refactored the internal FmtElm class to only include the type
field if building for debug, because it is only used in this setting.

R=titzer@chromium.org, ahaas@chromium.org

Review-Url: https://codereview.chromium.org/2507093004
Cr-Commit-Position: refs/heads/master@{#41099}

In component build, fuzzer did not link with icu libraries, causing
errors. By adding icu libraries to dependencies fuzzer links correctly.

BUG=
TEST=fuzzer/*

Review-Url: https://codereview.chromium.org/2510063002
Cr-Commit-Position: refs/heads/master@{#41098}

We never increment live bytes concurrent to the sweeper.

BUG=

Review-Url: https://codereview.chromium.org/2504193002
Cr-Commit-Position: refs/heads/master@{#41097}

There's a typo in a couple of lithium backends, where we assume that the
array protector on the Isolate is a Cell instead of a PropertyCell. This
could lead to unnecessary deoptimizations.

R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2512943002
Cr-Commit-Position: refs/heads/master@{#41096}

BUG=v8:5580

Review-Url: https://codereview.chromium.org/2460873003
Cr-Commit-Position: refs/heads/master@{#41095}

Ignition skipped collecting NumberOrOddball feedback if the right hand
side of a relational comparison is undefined, thus leading to a
deoptimization loop, because it reported Number feedback to TurboFan.

This was caught on 3d-raytrace test of SunSpider.

R=rmcilroy@chromium.org

Review-Url: https://codereview.chromium.org/2513903002
Cr-Commit-Position: refs/heads/master@{#41094}

This fixes the bogus implementation of the function in question and adds
test coverage for the deserialization of the corresponding flags from
the serialized scope info. Note that the tests so far only cover cases
where the module and the function contain context-allocated variables.

R=verwaest@chromium.org
TEST=cctest/test-parsing/AsmFunctionFlag
BUG=v8:5653

Review-Url: https://codereview.chromium.org/2507063004
Cr-Commit-Position: refs/heads/master@{#41093}

This is the TurboFan counterpart of http://crrev.com/2504263004, but it
is a bit more involved, since in TurboFan we always inline the appropriate
call to the @@hasInstance handler, and by that we can optimize a lot more
patterns of instanceof than Crankshaft, and even yield fast instanceof
for custom @@hasInstance handlers (which we can now properly inline as
well).

Also we now properly optimize Function.prototype[@@hasInstance], even if
the right hand side of an instanceof doesn't have the Function.prototype
as its direct prototype.

For the baseline case, we still rely on the global protector cell, but
we can address that in a follow-up as well, and make it more robust in
general.

TEST=mjsunit/compiler/instanceof
BUG=v8:5640
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2511223003
Cr-Commit-Position: refs/heads/master@{#41092}

See https://github.com/mathiasbynens/es-regexp-unicode-property-escapes

Changes:
- only allow General Category, binary properties, Script, and Script_Extensions.
- implement Script_Extensions.

R=littledan@chromium.org
BUG=v8:4743

Review-Url: https://codereview.chromium.org/2502933002
Cr-Commit-Position: refs/heads/master@{#41091}

Reland of Update usage of linux blink try bot to use linux_trusty_blink_rel. (patchset #1 id:1 of https://codereview.chromium.org/2507853002/ )

Reason for revert:
linux_trusty_blink_rel is now working, with more capacity

Original issue's description:
> Revert of Update usage of linux blink try bot to use linux_trusty_blink_rel. (patchset #1 id:1 of https://codereview.chromium.org/2475563002/ )
>
> Reason for revert:
> Submitting this before more capacity was added to linux_trusty_blink_rel caused that builder to get too busy (http://crbug.com/665246); should be able to reland after http://crbug.com/665917 is fixed.
>
> Original issue's description:
> > Update usage of linux blink try bot to use linux_trusty_blink_rel.
> >
> > Reason: We're planning to drop support for Linux Precise for layout tests.
> >
> > BUG=chromium:660580
> > NOTRY=true
>
> TBR=machenbach@chromium.org
> # Not skipping CQ checks because original CL landed more than 1 days ago.
> BUG=chromium:660580
> NOTRY=true

TBR=machenbach@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:660580

Review-Url: https://codereview.chromium.org/2505403002
Cr-Commit-Position: refs/heads/master@{#41090}

With this change, WebAssembly.Memory objects have backing stores allocated as an
8GB region where everything beyond the size of the Wasm heap is inaccessible.

GrowMemory is now implemented by changing the protection on the guard regions to
make the new portions of the heap accessible.

Guard pages are not enabled by default, but this change adds a flag and a test
variant to make sure we get test coverage on them.

BUG= https://bugs.chromium.org/p/v8/issues/detail?id=5277

Review-Url: https://codereview.chromium.org/2396433008
Cr-Commit-Position: refs/heads/master@{#41089}

BUG=

Review-Url: https://codereview.chromium.org/2507293003
Cr-Commit-Position: refs/heads/master@{#41088}

After moving inspector from blink to V8, inspector can use DebugInterface to compile and mark internal scripts.

BUG=v8:5530
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2502173002
Cr-Commit-Position: refs/heads/master@{#41087}

Review-Url: https://codereview.chromium.org/2509293002
Cr-Commit-Position: refs/heads/master@{#41086}

With the new wasm object types, the GetCompiledModule and GetWasmBytes
functions are not needed any more. The same functions are already
public on the wasm objects.
In order to use them properly, I changed a few more locations to make
use of the new types.

R=ahaas@chromium.org, titzer@chromium.org

Review-Url: https://codereview.chromium.org/2503403005
Cr-Commit-Position: refs/heads/master@{#41085}

BUG=chromium:665398

Review-Url: https://codereview.chromium.org/2509753002
Cr-Commit-Position: refs/heads/master@{#41084}

Adds --wasm-no-bounds-checks and --wasm-no-stack-checks which
help in diagnosing potential sources of slowdown in WASM code.

R=ahaas@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2511113002
Cr-Commit-Position: refs/heads/master@{#41083}

R=titzer@chromium.org
NOTRY=true
NOTREECHECKS=true

Review-Url: https://codereview.chromium.org/2511763002
Cr-Commit-Position: refs/heads/master@{#41082}