We already have an optimization to constant-fold access to an object's
prototype via the special __proto__ accessor (specified in appendix B).
We can use the same optimization to also constant-fold accesses to an
object's prototype via the official Object.getPrototypeOf function.

Also add the optimization for Reflect.getPrototypeOf, which is
equivalent for object inputs.

This is commonly used by Babel to implement various new language
features, for example subclassing and certain property lookups.

R=yangguo@chromium.org
BUG=v8:6292

Review-Url: https://codereview.chromium.org/2841463002
Cr-Commit-Position: refs/heads/master@{#44788}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/e3e598a..4636d31

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: Ibd4494496354a6ee1c7aa348d06c081507f39e69
Reviewed-on: https://chromium-review.googlesource.com/485140Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44787}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/ff3857b..e3e598a

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/34ee837..4d43438

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: Ibba7b3dafaba3cc1f416e960595305e657e0c82f
Reviewed-on: https://chromium-review.googlesource.com/484939Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44786}

.. replace all of them with prepared global object template.

+ bonus: wrap inspector related methods with inspector namespace.

BUG=none
R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2832723004
Cr-Commit-Position: refs/heads/master@{#44785}

These can be synthesized from existing operations and scheduled for
better performance than if we have to generate blocks of instructions
that take many cycles to complete.
- Remove F32x4RecipRefine, F32x4RecipSqrtRefine. Clients are better off
  synthesizing these from splats, multiplies and adds.
- Remove F32x4Div, F32x4Sqrt, F32x4MinNum, F32x4MaxNum. Clients are
  better off synthesizing these or using the reciprocal approximations,
  possibly with a refinement step.

LOG=N
BUG=v8:6020

Review-Url: https://codereview.chromium.org/2827143002
Cr-Commit-Position: refs/heads/master@{#44784}

Review-Url: https://codereview.chromium.org/2827263004
Cr-Commit-Position: refs/heads/master@{#44783}

BUG=chromium:713365

Change-Id: I5d9d5b5e00a637923a1a3e0dc7f81fa4075c4e82
Reviewed-on: https://chromium-review.googlesource.com/484300Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44782}

Bug:

Change-Id: I532e8894df288c81a71b08ca85742f2847f57191
Reviewed-on: https://chromium-review.googlesource.com/484339
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44781}

Ensure source map is not stable if elements kind transitions are expected.

BUG=chromium:700733

Change-Id: Ie937e7064127250b1100109986c3e9b411fae1d6
Reviewed-on: https://chromium-review.googlesource.com/483442Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44780}

If we avoid throwing a stack overflow exception from Irregexp code during
direct calls, there is no need to construct exit frames before the Irregexp
call anymore. As that was the last remaining blocker, we can now implement the
entire stub in CSA.

BUG=v8:5339

Review-Url: https://codereview.chromium.org/2752143003
Cr-Original-Original-Commit-Position: refs/heads/master@{#44770}
Committed: https://chromium.googlesource.com/v8/v8/+/74f2497eae068f85da26904d8c451376c77957bf
Review-Url: https://codereview.chromium.org/2752143003
Cr-Original-Commit-Position: refs/heads/master@{#44775}
Committed: https://chromium.googlesource.com/v8/v8/+/9c0832eb1aceba625a2443a31d51bcaf550c575a
Review-Url: https://codereview.chromium.org/2752143003
Cr-Commit-Position: refs/heads/master@{#44779}

R=franzih@chromium.org

Review-Url: https://codereview.chromium.org/2834053002
Cr-Commit-Position: refs/heads/master@{#44778}

NOTRY=true

Review-Url: https://codereview.chromium.org/2834853002
Cr-Commit-Position: refs/heads/master@{#44777}

Revert of [regexp] Remove remainder of native RegExpExecStub (patchset #10 id:180001 of https://codereview.chromium.org/2752143003/ )

Reason for revert:
More failures on ports:

https://build.chromium.org/p/client.v8.ports/builders/V8%20Android%20Arm64%20-%20builder/builds/9123/steps/compile/logs/stdio

https://build.chromium.org/p/client.v8.ports/builders/V8%20Mips%20-%20builder/builds/8966/steps/compile/logs/stdio

Original issue's description:
> [regexp] Remove remainder of native RegExpExecStub
>
> If we avoid throwing a stack overflow exception from Irregexp code during
> direct calls, there is no need to construct exit frames before the Irregexp
> call anymore. As that was the last remaining blocker, we can now implement the
> entire stub in CSA.
>
> BUG=v8:5339
>
> Review-Url: https://codereview.chromium.org/2752143003
> Cr-Original-Commit-Position: refs/heads/master@{#44770}
> Committed: https://chromium.googlesource.com/v8/v8/+/74f2497eae068f85da26904d8c451376c77957bf
> Review-Url: https://codereview.chromium.org/2752143003
> Cr-Commit-Position: refs/heads/master@{#44775}
> Committed: https://chromium.googlesource.com/v8/v8/+/9c0832eb1aceba625a2443a31d51bcaf550c575a

TBR=ishell@chromium.org,mstarzinger@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5339

Review-Url: https://codereview.chromium.org/2832193002
Cr-Commit-Position: refs/heads/master@{#44776}

If we avoid throwing a stack overflow exception from Irregexp code during
direct calls, there is no need to construct exit frames before the Irregexp
call anymore. As that was the last remaining blocker, we can now implement the
entire stub in CSA.

BUG=v8:5339

Review-Url: https://codereview.chromium.org/2752143003
Cr-Original-Commit-Position: refs/heads/master@{#44770}
Committed: https://chromium.googlesource.com/v8/v8/+/74f2497eae068f85da26904d8c451376c77957bf
Review-Url: https://codereview.chromium.org/2752143003
Cr-Commit-Position: refs/heads/master@{#44775}

Review-Url: https://codereview.chromium.org/2831083003
Cr-Commit-Position: refs/heads/master@{#44774}

Revert "Revert of [regexp] Remove remainder of native RegExpExecStub (patchset #8 id:140001 of https://codereview.chromium.org/2752143003/ )"

This reverts commit da118ddf.

Erroneous double revert.

TBR=jgruber@chromium.org
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true

Change-Id: Iecabbb9b046e9c66cb86f9e9c5c6e0de6eab1c58
Reviewed-on: https://chromium-review.googlesource.com/484382Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44773}

Revert of [regexp] Remove remainder of native RegExpExecStub (patchset #8 id:140001 of https://codereview.chromium.org/2752143003/ )

Reason for revert:
https://build.chromium.org/p/client.v8.ports/builders/V8%20Android%20Arm64%20-%20builder/builds/9118

Original issue's description:
> [regexp] Remove remainder of native RegExpExecStub
>
> If we avoid throwing a stack overflow exception from Irregexp code during
> direct calls, there is no need to construct exit frames before the Irregexp
> call anymore. As that was the last remaining blocker, we can now implement the
> entire stub in CSA.
>
> BUG=v8:5339
>
> Review-Url: https://codereview.chromium.org/2752143003
> Cr-Commit-Position: refs/heads/master@{#44770}
> Committed: https://chromium.googlesource.com/v8/v8/+/74f2497eae068f85da26904d8c451376c77957bf

TBR=ishell@chromium.org,mstarzinger@chromium.org,jgruber@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5339

Review-Url: https://codereview.chromium.org/2827243005
Cr-Commit-Position: refs/heads/master@{#44772}

Revert of [regexp] Remove remainder of native RegExpExecStub (patchset #8 id:140001 of https://codereview.chromium.org/2752143003/ )

Reason for revert:
https://build.chromium.org/p/client.v8.ports/builders/V8%20Android%20Arm64%20-%20builder/builds/9118

Original issue's description:
> [regexp] Remove remainder of native RegExpExecStub
>
> If we avoid throwing a stack overflow exception from Irregexp code during
> direct calls, there is no need to construct exit frames before the Irregexp
> call anymore. As that was the last remaining blocker, we can now implement the
> entire stub in CSA.
>
> BUG=v8:5339
>
> Review-Url: https://codereview.chromium.org/2752143003
> Cr-Commit-Position: refs/heads/master@{#44770}
> Committed: https://chromium.googlesource.com/v8/v8/+/74f2497eae068f85da26904d8c451376c77957bf

TBR=ishell@chromium.org,mstarzinger@chromium.org,jgruber@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5339

Review-Url: https://codereview.chromium.org/2833083002
Cr-Commit-Position: refs/heads/master@{#44771}

If we avoid throwing a stack overflow exception from Irregexp code during
direct calls, there is no need to construct exit frames before the Irregexp
call anymore. As that was the last remaining blocker, we can now implement the
entire stub in CSA.

BUG=v8:5339

Review-Url: https://codereview.chromium.org/2752143003
Cr-Commit-Position: refs/heads/master@{#44770}

Now that we are counting deopts instead of optimizations for the
"too many deoptimizations" bailout, we can remove the OSR deopt
increment hack.

Bug: chromium:700016
Change-Id: I3edd55db986cc47add632bb5af969dcee4e7a2b5
Reviewed-on: https://chromium-review.googlesource.com/484340Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44769}

This simplifies the double-indirection used for the signature cache in
function imports and also reduces the memory its memory footprint. Also
switch to use the local zone as an underlying storage.

R=rossberg@chromium.org
BUG=v8:6127

Change-Id: I8bc6cf13f2ce9ffa02485e76b7e36f389c9e02e5
Reviewed-on: https://chromium-review.googlesource.com/483443Reviewed-by: Andreas Rossberg <rossberg@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44768}

Adds general support for concurrent modifications to live byte counters.

BUG=chromium:651354

Review-Url: https://codereview.chromium.org/2836583002
Cr-Commit-Position: refs/heads/master@{#44767}

Bug: v8:6284

Change-Id: I3a52819f4e67a143a0b3b63358fc4dd0df384553
Reviewed-on: https://chromium-review.googlesource.com/483482
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44766}

BUG=v8:6102

Review-Url: https://codereview.chromium.org/2833463002
Cr-Commit-Position: refs/heads/master@{#44765}

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/a9a3094..5d201de

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: I27cd525fb18d47ff9fcf1c60c45d251d4f36ef80
Reviewed-on: https://chromium-review.googlesource.com/484100Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44764}

This also removes a broken optimization regarding immutable (i.e. const)
global variables. For now mutable and immutable global variables are
treated the same and hence copied during module initialization.

R=rossberg@chromium.org
TEST=mjsunit/asm/global-imports
BUG=v8:6279

Change-Id: I020fc12036dc534f5a62fb43f5c6fdb252314e62
Reviewed-on: https://chromium-review.googlesource.com/483360Reviewed-by: Andreas Rossberg <rossberg@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44763}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/98f2769..ff3857b

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/6939b1d..34ee837

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/a38e11d..a9a3094

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: I0f3817c86616ae1c7020ee8834070a68900657d8
Reviewed-on: https://chromium-review.googlesource.com/484003Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44762}

This reverts commit 64c12860.

Reason for revert: the number of buckets can be changed later, so we can't cache the value

Original change's description:
> [OrderedHashSet] Remove extra entry lookup
> 
> Bug: v8:5717
> Change-Id: I999ea81f745a25a1f3a539e50594e597e64f5287
> Reviewed-on: https://chromium-review.googlesource.com/481044
> Reviewed-by: Adam Klein <adamk@chromium.org>
> Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#44705}

TBR=adamk@chromium.org,cbruni@chromium.org,gsathya@chromium.org,v8-reviews@googlegroups.com
# Not skipping CQ checks because original CL landed > 1 day ago.

Change-Id: Iade35c0041e943f6dedb24844b07034f56ff1150
Reviewed-on: https://chromium-review.googlesource.com/483904
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44761}

This reverts commit 88376a78.

Reason for revert: the number of buckets could change, so we can't cache the value

Original change's description:
> [OrderedHashSet] Remove redundant hash to bucket
> 
> Bug: v8:5717
> Change-Id: I88e1e3089844b0955f0f7a6a792c2e10949a5b18
> Reviewed-on: https://chromium-review.googlesource.com/480927
> Reviewed-by: Adam Klein <adamk@chromium.org>
> Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#44707}

TBR=adamk@chromium.org,cbruni@chromium.org,gsathya@chromium.org,v8-reviews@googlegroups.com
# Not skipping CQ checks because original CL landed > 1 day ago.

Change-Id: I4d42021a1d1f5bc069b3787efc828761098038e0
Reviewed-on: https://chromium-review.googlesource.com/483903Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44760}

BUG=
R=jyan@ca.ibm.com, bjaideep@ca.ibm.com, joransiu@ca.ibm.com

Review-Url: https://codereview.chromium.org/2829713003
Cr-Commit-Position: refs/heads/master@{#44759}

The included test case illustrates the problem. It subtracts (16 << 27)
from another number. The Machine Operator Reducer would replace the
shift computation with 0x0000000080000000, and then change the subtract
to an add of -(0x0000000080000000), which is 0xffffffff80000000.
The instruction selector would determine that this value could be an
immediate, because it fits in 32 bits, so it would select the lea
instruction. Finally, the code generator would detect that the
immediate was less than 0, flip the sign and replace the add with a
subtract of 0x80000000. Because the x64 subtract instruction's
immediate field is 32 bits, the processor would interpret this as
0xffffffff80000000 instead of an unsigned value.

This change fixes the issue by making the CanBeImmediate check
explicitly compare against INT_MIN and INT_MAX. We disallow INT_MIN
as an immediate precisely because we cannot tell 0x0000000080000000
from 0xffffffff80000000 when truncated to 32 bits.

Bug: chromium:711203
Change-Id: Ie371b8ea290684a6bb723bae9c693a866f961850
Reviewed-on: https://chromium-review.googlesource.com/482448
Commit-Queue: Eric Holk <eholk@chromium.org>
Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44758}

It was a straight pass-through to JSFunction::SetPrototype, with the
added wrinkle that it appeared to sometimes throw (although it never did).

Also improves typing of JSFunction::SetInstancePrototype signature to
require being passed a JSReceiver.

Change-Id: Ie85b9a74955f72bf988cd902c5eec34e32b51a24
Reviewed-on: https://chromium-review.googlesource.com/482421Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44757}

Now you can do: "gm.py x64.release mkgrokdump"

NOTRY=true

Review-Url: https://codereview.chromium.org/2827383003
Cr-Commit-Position: refs/heads/master@{#44756}

BUG=v8:6189
R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2826183002
Cr-Commit-Position: refs/heads/master@{#44755}

v8::Extension should be replaced with ObjectTemplates. So let's not use it for utils.

BUG=none
R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2828143002
Cr-Commit-Position: refs/heads/master@{#44754}

Since we already have cache on V8 side we can introduce caching on inspector side. It will decrease memory consumption and reduce time which we spend for collecting stacks. See [1] for details.

[1] https://docs.google.com/a/google.com/document/d/13H1Pn6dekcwqlaYP26CfyyYGuL-U9LtUPWmt3TIpOag/edit?usp=sharing

BUG=v8:6189
R=dgozman@chromium.org,yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2825903002
Cr-Commit-Position: refs/heads/master@{#44753}

A lot of web sites around the world has hack which replaces native console.assert by function with fast return.
Current console.assert is slow because we need to run CPP builtin but we should enter this builtin iff condition is false or omitted.

BUG=v8:6175
R=ishell@chromium.org,dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2828933002
Cr-Commit-Position: refs/heads/master@{#44752}

Change-Id: I436e8390073fce6488cb9a26b9bde60f92935638
Reviewed-on: https://chromium-review.googlesource.com/482578Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44751}

With recent CLs we always store maximum N async stack traces and when we reach limit we drop half of them.
Current promise collected event requires creating weak handle:
- it takes time,
- it consumes memory.
Since async task id distribution for promises is uniform (each new promise has last_async_task_id + 1 as an id) our hash map is good enough to handle any amount of async task ids, following time of executing 1 000 000 000 of lookups:
- for empty hash map: 1.45 seconds,
- for hash map with one entry: 14.95 seconds
- 1024 entries: 15.03 seconds
- 1024 * 1024 entries: 14.82 seconds
- 1024 * 1024 * 1024: 17.9 seconds

BUG=v8:6189
R=dgozman@chromium.org,yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2819423005
Cr-Commit-Position: refs/heads/master@{#44750}

Fix 6ee0b6ce

Fix wrong register usage for MIPS ports

TEST=mjsunit/regress/regress-5638b
BUG=

Review-Url: https://codereview.chromium.org/2831733004
Cr-Commit-Position: refs/heads/master@{#44749}