Rationale:

- To do scope analysis based on PreParser, and use the result again when parsing
  later, PreParser and Parser need to produce the same Scopes and variable
  declarations in them.

- This is not the case for non-simple parameters: Parser creates an additional
  inner Scope where the declarations were, whereas PreParser does
  DeclareVariableName directly in the function Scope.

- So this CL fixes that by moving the Scope creation for non-simple parameters
  into ParserBase.

- As a side product (and a partial proof that this change makes sense),
  PreParser::ParseEagerFunctionBody is now gone.

BUG=v8:5516

Review-Url: https://codereview.chromium.org/2638333002
Cr-Commit-Position: refs/heads/master@{#42537}

BUG=chromium:681984
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2640983006
Cr-Commit-Position: refs/heads/master@{#42536}

Let the Typer assign proper types to Map, Set, WeakMap and WeakSet
builtins. Also assign a proper type to Array.isArray, Object.assign
and Object.create.

R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2640783006
Cr-Commit-Position: refs/heads/master@{#42535}

Revert of [regexp] Create property on result for each named capture (patchset #5 id:80001 of https://codereview.chromium.org/2630233003/ )

Reason for revert:
Breaks no18n build: https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20noi18n%20-%20debug/builds/11604

Original issue's description:
> [regexp] Store named captures on the regexp result
>
> This implements storing named captures on the regexp result object.
> For instance, /(?<a>.)/u.exec("b") will return a result such that:
>
> result.group.a  // "b"
>
> The spec proposal is not yet final, so this may still change in the future.
>
> BUG=v8:5437
>
> Review-Url: https://codereview.chromium.org/2630233003
> Cr-Commit-Position: refs/heads/master@{#42532}
> Committed: https://chromium.googlesource.com/v8/v8/+/70000946eb2a9155679528702a766219a1fcf154

TBR=yangguo@chromium.org,littledan@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5437

Review-Url: https://codereview.chromium.org/2643213002
Cr-Commit-Position: refs/heads/master@{#42534}

Revert of [heap] Provide ObjectMarking with marking transitions (patchset #5 id:80001 of https://codereview.chromium.org/2644523002/ )

Reason for revert:
Breaks the tree: https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20gc%20stress/builds/8349/steps/Mjsunit/logs/compiled-module-seria..

Original issue's description:
> [heap] Provide ObjectMarking with marking transitions
>
> BUG=chromium:651354
>
> Review-Url: https://codereview.chromium.org/2644523002
> Cr-Commit-Position: refs/heads/master@{#42531}
> Committed: https://chromium.googlesource.com/v8/v8/+/cbb8929e97ee475dab4f704a71637e76342e903a

TBR=hpayer@chromium.org,mlippautz@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:651354

Review-Url: https://codereview.chromium.org/2647873002
Cr-Commit-Position: refs/heads/master@{#42533}

This implements storing named captures on the regexp result object.
For instance, /(?<a>.)/u.exec("b") will return a result such that:

result.group.a  // "b"

The spec proposal is not yet final, so this may still change in the future.

BUG=v8:5437

Review-Url: https://codereview.chromium.org/2630233003
Cr-Commit-Position: refs/heads/master@{#42532}

BUG=chromium:651354

Review-Url: https://codereview.chromium.org/2644523002
Cr-Commit-Position: refs/heads/master@{#42531}

The %_ClassOf intrinsic roughly corresponds to the deprecated ES5
[[Class]] internal property, and should not be used anymore ideally.
However since we still have quite a couple of uses of this intrinsic
in the self hosted JavaScript builtins, we would tank some builtins
like Map, Set, WeakMap, WeakSet, etc. quite significantly unless we
also support this intrinsic until the builtins are all migrated to
C++/CSA builtins.

R=yangguo@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2647833004
Cr-Commit-Position: refs/heads/master@{#42530}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/70270c1..0081085

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/cfcae9b..49e3f62

Rolling v8/third_party/jinja2: https://chromium.googlesource.com/chromium/src/third_party/jinja2/+log/b61a2c0..d343832

Rolling v8/third_party/markupsafe: https://chromium.googlesource.com/chromium/src/third_party/markupsafe/+log/484a566..8f45f5c

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/7a4c8c9..fa8cd67

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2644693006
Cr-Commit-Position: refs/heads/master@{#42529}

BUG=

Review-Url: https://codereview.chromium.org/2644643009
Cr-Commit-Position: refs/heads/master@{#42528}

Flag is used by followup patches split apart from
https://codereview.chromium.org/2622833002/, and tests for each split
out CL ends up using Symbol.asyncIterator, so it makes sense to land it
first (behind a flag).

BUG=v8:5855
R=littledan@chromium.org, adamk@chromium.org

Review-Url: https://codereview.chromium.org/2645923003
Cr-Commit-Position: refs/heads/master@{#42527}

It's crashing in TurboFan after c70ec473
(a change to turn on some Intl features, which aren't possible TF-related).

BUG=v8:5873
TBR=machenbach@chromium.org
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2638333006
Cr-Commit-Position: refs/heads/master@{#42526}

BUG=v8:5865

Review-Url: https://codereview.chromium.org/2640363003
Cr-Commit-Position: refs/heads/master@{#42525}

Update string-capitalize expected result because now it
passes all the tests in the file.
Mark fast/js/string-capitalization as failing with no_i18n.

Relanding after revert because the failure was taken care of
by Adam's CL at https://codereview.chromium.org/2597543002 .

3rd langing after a crash is taken care of in
https://codereview.chromium.org/2621393002

In addition to the previous version of this CL (PS #4) that landed and
reverted, drop String.prototype.to(Locale){Upper,Lower}Case from the
whitelist of built-in functions for side-effect-free-debugging.

BUG=v8:4477, v8:4476
TEST=test262/{built-ins,intl402}/Strings/*, webkit/fast/js/*,
     mjsunit/string-case, intl/general/case*

Cr-Original-Original-Commit-Position: refs/heads/master@{#41834}
Committed: https://chromium.googlesource.com/v8/v8/+/7c79e23c34ea971947eedc6e42d8a882617c0e47
Review-Url: https://codereview.chromium.org/2588963002
Cr-Original-Commit-Position: refs/heads/master@{#41883}
Committed: https://chromium.googlesource.com/v8/v8/+/a42c8c67dece5328896b13d37c5c846a2a0f5b0b
Review-Url: https://codereview.chromium.org/2588963002
Cr-Commit-Position: refs/heads/master@{#42524}

Clang just got more strict about unused lambda captures,
and that requires us to clean all places with this issue
across all the Chromium code base. This CL fixes all such
cases in V8.

BUG=chromium:681136

Review-Url: https://codereview.chromium.org/2646553002
Cr-Commit-Position: refs/heads/master@{#42523}

The %ClassOf runtime function and %_ClassOf intrinsics always produce an
internalized string, or Null for primitive inputs.

BUG=v8:5267
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2646523004
Cr-Commit-Position: refs/heads/master@{#42522}

Right now running the Map and Set builtins with I+TF would tank
seriously because these builtins are still built on top of a
couple of classic intrinsics that TurboFan doesn't understand.
Middle-term the idea is to replace the Map and Set builtins with
a CodeStubAssembler based solution, but for that might not be
ready in time, so adding support for a couple of the critical
intrinsics to mitigate the tankage a bit, namely

 - %_JSCollectionGetTable,
 - %_TheHole, and
 - %_StringGetRawHashField.

Together these double the score on most of the existing performance
tests for collections.

R=yangguo@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2647733002
Cr-Commit-Position: refs/heads/master@{#42521}

- builtins-ic.cc takes the place of the AccessorAssembler shim
- AccessorAssemblerImpl can then be renamed
- some cleanup in code-factory.cc
- drop old _TF name suffixes
- fix Generate##Name##Impl in TF_BUILTIN macro

Review-Url: https://codereview.chromium.org/2647493002
Cr-Commit-Position: refs/heads/master@{#42520}

Make wasm code generation (including deserialization) aware of
allow_codegen_callback - if one were set by the host - akin to what we
do for `eval`.

This allows web pages that opt out of unsafe-eval to also opt out of
wasm scenarios.

BUG=v8:5869

Review-Url: https://codereview.chromium.org/2646713002
Cr-Commit-Position: refs/heads/master@{#42519}

Review-Url: https://codereview.chromium.org/2645673004
Cr-Commit-Position: refs/heads/master@{#42518}

GC performance issues need to be addressed first.

TBR=bmeurer@chromium.org, mstarzinger@chromium.org, yangguo@chromium.org
BUG=v8:5456

Review-Url: https://codereview.chromium.org/2642743002
Cr-Original-Commit-Position: refs/heads/master@{#42495}
Committed: https://chromium.googlesource.com/v8/v8/+/7803aa1ffb2f835c5f317ed2a097390d53e52567
Review-Url: https://codereview.chromium.org/2642743002
Cr-Commit-Position: refs/heads/master@{#42517}

This uses the aforementioned helper within the {FastAccessorAssembler}.
It was made available as a helper function now that several users create
code objects following {kCallJSFunction} linkage via the {CodeAssembler}.

R=vogelheim@chromium.org

Review-Url: https://codereview.chromium.org/2644033003
Cr-Commit-Position: refs/heads/master@{#42516}

Review-Url: https://codereview.chromium.org/2644743003
Cr-Commit-Position: refs/heads/master@{#42515}

Revert of [wasm] Fix I32ReinterpretF32 and I64ReinterpretF64 on ia32. (patchset #3 id:40001 of https://codereview.chromium.org/2639353002/ )

Reason for revert:
compilation problems on mips

Original issue's description:
> [wasm] Fix I32ReinterpretF32 and I64ReinterpretF64 on ia32.
>
> On ia32 return statements in C++ automatically convert signalling NaNs
> to quiet NaNs, even when bit_cast is used. This CL removes all uses of
> bit_cast<float> and bit_cast<double> in the wasm compiler and wasm
> interpreter.
>
> R=titzer@chromium.org, clemensh@chromium.org
>
> Review-Url: https://codereview.chromium.org/2639353002
> Cr-Commit-Position: refs/heads/master@{#42512}
> Committed: https://chromium.googlesource.com/v8/v8/+/7739affa5b57e0d28674d476f63de60d71728fb6

TBR=clemensh@chromium.org,titzer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2645693003
Cr-Commit-Position: refs/heads/master@{#42514}

Also update a call in cctest to check the result.

BUG=chromium:681843

Review-Url: https://codereview.chromium.org/2647573003
Cr-Commit-Position: refs/heads/master@{#42513}

On ia32 return statements in C++ automatically convert signalling NaNs
to quiet NaNs, even when bit_cast is used. This CL removes all uses of
bit_cast<float> and bit_cast<double> in the wasm compiler and wasm
interpreter.

R=titzer@chromium.org, clemensh@chromium.org

Review-Url: https://codereview.chromium.org/2639353002
Cr-Commit-Position: refs/heads/master@{#42512}

This API does not allow reporting failure, but we should crash rather than have
the caller get an ArrayBuffer that isn't properly set up.

BUG=chromium:681843

Review-Url: https://codereview.chromium.org/2641953002
Cr-Commit-Position: refs/heads/master@{#42511}

BUG=chromium:681843

Review-Url: https://codereview.chromium.org/2645673002
Cr-Commit-Position: refs/heads/master@{#42510}

Broke after https://codereview.chromium.org/2621983002

BUG=chromium:581766

Review-Url: https://codereview.chromium.org/2644113002
Cr-Commit-Position: refs/heads/master@{#42509}

BUG=v8:5639

Review-Url: https://codereview.chromium.org/2638073002
Cr-Commit-Position: refs/heads/master@{#42508}

Issue was fixed in 38088853, re-enabling test.

BUG=v8:5829
NOTRY=true

Review-Url: https://codereview.chromium.org/2643043002
Cr-Commit-Position: refs/heads/master@{#42507}

BUG=679724

Review-Url: https://codereview.chromium.org/2631063003
Cr-Commit-Position: refs/heads/master@{#42506}

Document that frame summaries are bottom-to-top, i.e. caller before
callee, rename FrameSummary::GetFirst to FrameSummary::GetBottom and
introduce FrameSummary::GetTop.
For debugged JavaScript frames, it does not really matter which of the
functions we call, so I replaced a few GetFirst by GetTop instead of
GetBottom because it matches the semantics more closely.

This CL also reverts part of http://crrev.com/2621953002 by changing
BreakLocation::FromFrame back to accept a DebugInfo and a
JavaScriptFrame. We don't plan to create BreakLocations for wasm.

R=yangguo@chromium.org
BUG=v8:5822

Review-Url: https://codereview.chromium.org/2647433002
Cr-Commit-Position: refs/heads/master@{#42505}

TBR=machenbach@chromium.org, vogelheim@chromium.org
NOTRY=true

Review-Url: https://codereview.chromium.org/2641003003 .
Cr-Commit-Position: refs/heads/master@{#42504}

using newly introduced ThinStrings, which store a pointer to the actual,
internalized string they represent.

BUG=v8:4520

(Previously landed as #42168 / af51befe)
(Previously landed as #42193 / 4c699e34)
(Previously landed as #42235 / ec45e6ed)

Review-Url: https://codereview.chromium.org/2549773002
Cr-Commit-Position: refs/heads/master@{#42503}

R=rossberg@chromium.org
BUG=chromium:682659

Review-Url: https://codereview.chromium.org/2638383004
Cr-Commit-Position: refs/heads/master@{#42502}

Properly recognize and optimize typeof in a strict/abstract equality
comparison with the string literal "object" to a check for Null or a
check of the map for Receiver instance type and non-callable.

Drive-by-fix: Also optimize typeof o === "function" somewhat, now that
we have the new types for Callable and NonCallable.

R=jarin@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2646763003
Cr-Commit-Position: refs/heads/master@{#42501}

Instead of doing the dance via JSStrictEqual for comparisons with null,
undefined or the hole, we can just go to ReferenceEqual directly. Also
avoid the Select(x, false, true) dance for negation and use BooleanNot
directly.

R=mstarzinger@chromium.org

Review-Url: https://codereview.chromium.org/2646763004
Cr-Commit-Position: refs/heads/master@{#42500}

R=rossberg@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2640953002
Cr-Commit-Position: refs/heads/master@{#42499}

BUG=

Review-Url: https://codereview.chromium.org/2644843002
Cr-Commit-Position: refs/heads/master@{#42498}