Bug: v8:8238
Change-Id: I4bb14e4457b78b91a960680ab22c808b5f88052c
Reviewed-on: https://chromium-review.googlesource.com/c/1302053
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57068}

R=ishell@chromium.org

Bug: v8:7965
Change-Id: Ia67e567790f4a5b39e24504c13c472091776ec4f
Reviewed-on: https://chromium-review.googlesource.com/c/1303296
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57067}

and make it Isolate-independent.

Bug: v8:8238
Change-Id: I23faae87c302d24877ef001873f673d4a1cdd327
Reviewed-on: https://chromium-review.googlesource.com/c/1301484Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57066}

Accidentally introduced in https://crrev.com/c/1293951; they were never
needed.

R=mstarzinger@chromium.org

Change-Id: Idbd06800de3f70d1de7c98cb9a11198a6c814093
Reviewed-on: https://chromium-review.googlesource.com/c/1303300
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57065}

Now that embedded builtins are enabled everywhere*, lazy
deserialization can be turned off and removed.

* Except nosnap builds, on aix and in msvc builds.

Bug: v8:6666, v8:6624, v8:7990
Change-Id: Ib5fefe10e7ff35b13a1eb803fbc3736b8851b22b
Reviewed-on: https://chromium-review.googlesource.com/c/1288638Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57064}

While not strictly necessary, this is consistent with how
SlowFlagGetter behaves. It adds an additional shift operation (which
we could fold into the smi untagging if needed).

Drive-by: Typify flag accessors.

Bug: chromium:899464
Change-Id: Ib154d626e522ed723e2c19b1ab7f68560ac414bc
Reviewed-on: https://chromium-review.googlesource.com/c/1304315Reviewed-by: Peter Wong <peter.wm.wong@gmail.com>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57063}

R=marja@chromium.org

Bug: v8:7965
Change-Id: I740f7fa1ec19e269d15358fcf66862b15096e132
Reviewed-on: https://chromium-review.googlesource.com/c/1303295
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57062}

Node.js uses the tick processor as well, but wraps the script
differently so that `this.arguments` does not work.

Also fixed outdated comments.

R=petermarshall@chromium.org

Change-Id: Ia902962b302ec4aa02d31a6ac31ac20510ddcca7
Reviewed-on: https://chromium-review.googlesource.com/c/1304353Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57061}

R=marja@chromium.org

Bug: v8:7965
Change-Id: I596712f55266c245f4df9e2fc7670e518f3e9d52
Reviewed-on: https://chromium-review.googlesource.com/c/1303294Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57060}

When replacing a LoadElement with variable index with its known fields,
only do it if the types match, otherwise we end up with a graph that
representation selection cannot handle. That can only happen in dead
code, but TurboFan would nevertheless crash in representation selection.

Bug: chromium:893982, chromium:899524, v8:5267, v8:6200
Change-Id: I01e645d5e01bffb911d216d37d923792d9d0beab
Reviewed-on: https://chromium-review.googlesource.com/c/1303721Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57059}

Bug: chromium:899474, v8:8363, v8:7926
Change-Id: I89680d35ab2557f5a2b2282813362f5f654862a9
Reviewed-on: https://chromium-review.googlesource.com/c/1304314
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57058}

This reverts commit ea8aa6a7.

Reason for revert: Breaking V8 Win64 - debug build, see
https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Win64%20-%20debug/25531

Original change's description:
> [parser] Set all tokens to ILLEGAL on parser error
> 
> Otherwise already peeked tokens will possibly pass later checks causing us to
> parse more than necessary. Initially we held off on doing this since subsequent
> Consume calls would fail after previous checks succeeded; especially in the
> case of stack overflow. However, we've previously relaxed that DCHECK to also
> pass if the parser has an error.
> 
> Change-Id: I413dffd475982d07299a08270fa94fdc3858e883
> Reviewed-on: https://chromium-review.googlesource.com/c/1304313
> Reviewed-by: Marja Hölttä <marja@chromium.org>
> Commit-Queue: Toon Verwaest <verwaest@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#57054}

TBR=marja@chromium.org,verwaest@chromium.org

Change-Id: Ifddd3cefa3876ec03aa1c137dfa95da3d933532e
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/1304295Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57057}

These two headers can be included in isolation currently, so no need to
exclude them.

R=marja@chromium.org

Bug: v8:7965
Change-Id: I6250a237e6884bc3f89e666bca5d8f4129472fe6
Reviewed-on: https://chromium-review.googlesource.com/c/1303715Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57056}

In order for Error.prepareStackTrace() to be able to reconstruct the
same stack frame that the internal mechanism can, we need to also
expose the index for the Promise.all() builtin. The newly added
CallSite#getPromiseIndex() does exactly that.

Bug: v8:7522
Change-Id: I904a4c1005f539536a71926ea1da38b31e2a2e8a
Reviewed-on: https://chromium-review.googlesource.com/c/1304293Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57055}

Otherwise already peeked tokens will possibly pass later checks causing us to
parse more than necessary. Initially we held off on doing this since subsequent
Consume calls would fail after previous checks succeeded; especially in the
case of stack overflow. However, we've previously relaxed that DCHECK to also
pass if the parser has an error.

Change-Id: I413dffd475982d07299a08270fa94fdc3858e883
Reviewed-on: https://chromium-review.googlesource.com/c/1304313Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57054}

This blocks building with official clang-cl and Windows SDK

Refs: https://github.com/nodejs/node/issues/19630
Change-Id: I41fdf934f486c660df7a9e0dd284f6eb3c294dd4
Reviewed-on: https://chromium-review.googlesource.com/c/1297479
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57053}

In the process implement TopType to express undefined values and
transient types after they no longer are valid, as well as checks to
make sure that transtioning callables are transitively marked
to express if they or their call chain modify transient types.

Bug: v8:7793
Change-Id: Idb237e878d3a511a4f460b6510ffd4876593951d
Reviewed-on: https://chromium-review.googlesource.com/c/1297963
Commit-Queue: Daniel Clifford <danno@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57052}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/425295f..c55a0b9

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/2b71832..cb629a4

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: I10387d35ae298c7d20bc5eacfb70cff05ecd4052
Reviewed-on: https://chromium-review.googlesource.com/c/1304193
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#57051}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/94314f9..425295f

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: If6f2893e829c4f03e52cd869fbb7f261a6aa53c2
Reviewed-on: https://chromium-review.googlesource.com/c/1303539Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#57050}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/df2e6ae..94314f9

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/687f318..985e130

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: Id21b9e29ba5f71ed92390e026e7bd74b9751959f
Reviewed-on: https://chromium-review.googlesource.com/c/1303536Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#57049}

This is a reland of 9cde8808 now the the underlying
problem in Chromium is fixed by:
   https://chromium-review.googlesource.com/c/chromium/src/+/1301459

Original change's description:
> [Compile] Ensure we don't access the native context during bytecode finalization.
>
> Resets the isolate's context to nullptr in debug builds during bytecode finalization
> to ensure that we don't rely on the native context during context independent
> unoptimized compilation.
>
> BUG=chromium:898076, v8:8041
>
> Change-Id: Ifaa5006a7a3d31d7fbd535ebb63f8889c75526c4
> Reviewed-on: https://chromium-review.googlesource.com/c/1297961
> Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#56979}

TBR=leszeks@chromium.org

Bug: chromium:898076, v8:8041
Change-Id: I11904e19e843b0eadab698196ac1ef9c7aeec766
Cq-Include-Trybots: luci.chromium.try:linux_chromium_headless_rel; luci.chromium.try:linux_chromium_dbg_ng
Reviewed-on: https://chromium-review.googlesource.com/c/1301480Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57048}

Bug: v8:5751
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: Ibceb4412713c0bec82b234e2eea6c86aa0d275f7
Reviewed-on: https://chromium-review.googlesource.com/c/1295932
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57047}

The builder has shown to be too brittle when run on dirty V8 ToT.

TBR=sergiyb@chromium.org
NOTRY=true

Bug: chromium:898965
Change-Id: I7eb1f54febeebfcc6c385cc1a9d97262f8583103
Reviewed-on: https://chromium-review.googlesource.com/c/1302056Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57046}

Bug: v8:8363, v8:7926
Change-Id: I19d878139b383799081dea296b951ce6945b05d3
Reviewed-on: https://chromium-review.googlesource.com/c/1301853
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57045}

Bug: chromium:899133, v8:7926
Change-Id: I44121c5e6a5bfc27da30bd574a202a6c579594e5
Reviewed-on: https://chromium-review.googlesource.com/c/1301482
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57044}

This reverts commit 2690e2fc.

Reason for revert: this is not needed because objects in the worklist
are guaranteed to be not black allocated.

Original change's description:
> [heap] Correctly check for black allocated objects in concurrent marker.
> 
> The markbit check should be performed before using the map of the
> object.
> 
> Change-Id: Ia19e48fd4660387d239e1e330368808727359c7f
> Reviewed-on: https://chromium-review.googlesource.com/c/1301496
> Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Hannes Payer <hpayer@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#57040}

TBR=ulan@chromium.org,hpayer@chromium.org,mlippautz@chromium.org

Change-Id: I4f188197620c511060fda4f60c80a3c389007054
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/1301993Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57043}

BUG=v8:8293

Change-Id: I1d0e75f8671d3ec1c899c65bb9a865f2358173de
Reviewed-on: https://chromium-review.googlesource.com/c/1280527
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57042}

In order to ensure that Isolate::New()/Isolate::Delete() are the bottlenecks
this CL also makes the Isolate class final.

Bug: v8:8182
Change-Id: I6bb170363a1210f66d63f4bcc46ea06fb5000d50
Reviewed-on: https://chromium-review.googlesource.com/c/1301481
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57041}

The markbit check should be performed before using the map of the
object.

Change-Id: Ia19e48fd4660387d239e1e330368808727359c7f
Reviewed-on: https://chromium-review.googlesource.com/c/1301496
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57040}

Tbr: ishell@chromium.org
Bug: v8:8238
Change-Id: I3fe3b821105d2ce58df717970085098f6336f937
Reviewed-on: https://chromium-review.googlesource.com/c/1301512Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57039}

The assumption behind this optimization was invalid. Even if the
string's prototype is unchanged, the symbol could exist somewhere
further up the prototype chain.

GetProperty has been sped up significantly so it might be fine to just
skip this fast path. An alternative would be to use a protector cell.

Bug: v8:8357
Change-Id: Ia577107a58157350eb15780c02aa63d77e600637
Reviewed-on: https://chromium-review.googlesource.com/c/1301498
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57038}

and also move embedder fields from Isolate to IsolateData.

The external memory counter fields are temporarily moved to IsolateData in
order to avoid unexpected Node JS bot failures which happen if the fields
are left in the Heap class.

Bug: v8:8182
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I9d58f235c0ce40e110f595addd03b80b3617aa77
Reviewed-on: https://chromium-review.googlesource.com/c/1278793
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57037}

This changes the GC histograms from HistogramTimer to TimedHistogram.

Bug: chromium:898613
Change-Id: Ie18c6dd3b958c3ce93f0f84faec0f306d699afa0
Reviewed-on: https://chromium-review.googlesource.com/c/1299241
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57036}

Bug: v8:8363, v8:7926
Change-Id: I80d62c2077ccf271e954d6bb9dda3e0d35d08a76
Reviewed-on: https://chromium-review.googlesource.com/c/1301510Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57035}

This just adds calls to SerializePrototype right before we access the
serialized prototype. Eventually we need to do this earlier.

Bug: v8:7790, chromium:899115
Change-Id: I597e95f5f6df8aae608ee295fe9550e7c2a45e6d
Reviewed-on: https://chromium-review.googlesource.com/c/1301475Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57034}

Flag -Wno-defaulted-function-deleted is not known to clang 4.0, which is
currently the default on many systems, so filter the flag for now.

R=mslekova@chromium.org

Notry: true
Change-Id: I9ee9cbbf97f411d409b8b4150897d7741abe24af
Reviewed-on: https://chromium-review.googlesource.com/c/1301511
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57033}

BUG= v8:8372

Change-Id: Ic29847674a1e455a405c4599c01785ee7aefcedc
Reviewed-on: https://chromium-review.googlesource.com/c/1301500
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57032}

TBR=santa

Change-Id: Iff32a0c25b083003a0dc6caa53ed5bb182f4de2d
Reviewed-on: https://chromium-review.googlesource.com/c/1301508Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57031}

NOTRY=true
TBR=sergiyb@chromium.org

Change-Id: I7f87b58242fa2e29166c11aacc235ef9c279b3e8
Reviewed-on: https://chromium-review.googlesource.com/c/1301478Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57030}

Fix some JS smells as suggested in
https://github.com/WebAssembly/spec/issues/897.

R=ahaas@chromium.org

Bug: v8:8238
Change-Id: Idc4f738da849f28477563df628dcae2805b1b47e
Reviewed-on: https://chromium-review.googlesource.com/c/1301476Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57029}