... to make AsyncFunction subclassing work.

Bug: chromium:725537
Change-Id: I7edf4891e14e01567046e7536b3aa93877111448
Reviewed-on: https://chromium-review.googlesource.com/517087
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45544}

... which caused assertion failures in --enable-slow-asserts mode.
The surrounding code treated the constructor value properly so regression
test is not necessary.

Bug: chromium:726622
Change-Id: Icd43d9117a1125bec8feca8eca5708993de2c3ef
Reviewed-on: https://chromium-review.googlesource.com/516626Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45543}

BUG=v8:6243

Change-Id: Ia6dfa407591d1b06d5b014627bb44413540aecb3
Reviewed-on: https://chromium-review.googlesource.com/516984Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45542}

Bug: 
Change-Id: I56f41392a2c3bbd203553e3fb386f8b7234d5e75
Reviewed-on: https://chromium-review.googlesource.com/516624Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45541}

Which I introduced in:

c15b3ffc [arm] Share constant pool entries in snapshot.

BUG=chromium:725714

Review-Url: https://codereview.chromium.org/2905643002
Cr-Commit-Position: refs/heads/master@{#45540}

All other properties in the boilerplate are data fields, so we can avoid additional checks.

Bug: 
Change-Id: Ie494329332b0ba646515850b6d267fb05735f0ea
Reviewed-on: https://chromium-review.googlesource.com/517044Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45539}

This removes a lot of special handling for the predictable platform.
Instead of executing spawned foreground and background tasks
immediately (i.e. inside the scope that spawns the tasks), just add
both to the foreground task queue.

This avoids existing special handling for predictable mode in wasm
async compilation, and should fix current failures on the predictable
bot.

BUG=v8:6427

Change-Id: Idbaa764a3dc8c230c29f3937d885e12174691ac4
Reviewed-on: https://chromium-review.googlesource.com/509694Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45538}

Bug: chromium:726636
Change-Id: Ied6af8c969ed05b7a334238b30930658af060e7d
Reviewed-on: https://chromium-review.googlesource.com/516734Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45537}

This speeds up fast-mode object copying by ~2x and __proto__:null cases by ~20x.

Bug: 
Change-Id: Ic3893ae4c87063f0c8c524ef55c0e786b7a87192
Reviewed-on: https://chromium-review.googlesource.com/516983
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45536}

This CL removes the isolate_ property from the Cancelable class. The
isolate is actually not used in the class itself, only in sub-classes
which can store the isolate themselves.

R=jochen@chromium.org, mlippautz@chromium.org

Change-Id: If102fdea41b81fb3cb25782728f7fcbce9642815
Reviewed-on: https://chromium-review.googlesource.com/516704Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45535}

- This won't save a bit, since the enum is not a flags enum and there is
  still room for another value.
- While it may be possible to eliminate this value, the code to init
  and check for invalid becomes much more complex. Unallocated operands
  are currently created with invalid vreg code, so we also have to check
  the policy.

BUG=v8:6325

Review-Url: https://codereview.chromium.org/2904603004
Cr-Commit-Position: refs/heads/master@{#45534}

- Removes set_virtual_register method. InstructionOperands are immutable.
- Adds a new ctor to copy an UnallocatedOperand with a new vreg.
- Removes some DCHECKs in UnallocatedOperand that are always true. To
  make sure, make UnallocatedOperand final.
- Cleans up some comments on UnallocatedOperand Lifetime enum.

BUG=v8:6325

Review-Url: https://codereview.chromium.org/2897203002
Cr-Commit-Position: refs/heads/master@{#45533}

R=joransiu@ca.ibm.com, bjaideep@ca.ibm.com

Bug: 
Change-Id: I73c44a0dd93e3925dbe895a477175d255edbed56
Reviewed-on: https://chromium-review.googlesource.com/514123Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#45532}

Fix 233b6926

With the introduction of upfront deopt table generation, case where
deoptimization tables have more than 8000 entries become much more common
and bugs started to appear.

This CL fixes the issue, but it is far from perfect. We had to
increase number of instruction per table entry from 2 to 3 in
order to accommodate larger tables.

TEST=mjsunit/array-sort,mjsunit/json,mjsunit/md5
BUG=

Review-Url: https://codereview.chromium.org/2901393003
Cr-Commit-Position: refs/heads/master@{#45531}

This CL improves break locations for expressions like 'var a = <expr>'. Without CL we use <expr> position as break location for initialization statement, with this CL we use position of first character after '=' as position.
Benefits (see test for details):
- only one break in expressions which includes mix of property lookup and calls, e.g. var p = Promise.resolve().then(x => x * 2),
- removed redundant break location for expressions like: let { x, y } = { x: 1, y: 2}.

Bug: v8:5909
Change-Id: I039d911903a2826c9859710a63ab0462c992e11b
Reviewed-on: https://chromium-review.googlesource.com/513926
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45530}

- Increase FPUregisters_[] element size to 128b in order to support MSA regs
- Add skeleton for MSA instr. decoding in mips32 and mips64 simulator
- Add support for fill.df, copy_u.df and copy_s.df MSA instructions
- Assembler test for fill.df, copy_u.df and copy_s.df

BUG=

Review-Url: https://codereview.chromium.org/2799923002
Cr-Commit-Position: refs/heads/master@{#45529}

This reverts commit 92cfe00c.

Reason for revert: Breaking all the clusterfuzz builders with error message:
group @"./mksnapshot.rsp" ./libv8_libbase.so ./libv8_libplatform.so ./libicui18n.so ./libicuuc.so ./libc++.so -Wl,--end-group   -ldl -lrt 
../../buildtools/third_party/libc++/trunk/include/string:1831: error: undefined reference to 'std::__1::__basic_string_common<true>::__throw_length_error() const'
../../buildtools/third_party/libc++/trunk/include/vector:930: error: ...

e.g.: https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20ASAN%20-%20debug%20builder/builds/16157/steps/compile/logs/stdio

Original change's description:
> Update V8 DEPS.
> 
> Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/5488ca8..3532f27
> 
> Rolling v8/buildtools: https://chromium.googlesource.com/chromium/buildtools/+log/98f00fa..57c9408
> 
> Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/51b3178..518df53
> 
> Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/05f3060..f294e27
> 
> TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org
> 
> Change-Id: I8e154bcc89d8cdc292409a15dc4081666941c959
> Reviewed-on: https://chromium-review.googlesource.com/514762
> Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
> Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#45527}

TBR=v8-autoroll@chromium.org,machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Change-Id: I2c06ebf13219c92b4fa8891743c9dd9f23e91fcf
Reviewed-on: https://chromium-review.googlesource.com/515462Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45528}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/5488ca8..3532f27

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/buildtools/+log/98f00fa..57c9408

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/51b3178..518df53

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/05f3060..f294e27

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: I8e154bcc89d8cdc292409a15dc4081666941c959
Reviewed-on: https://chromium-review.googlesource.com/514762Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45527}

Creates a new class StatsCounterThreadSafe to be used by counters that
can be updated when compiling/decoding etc. are done using workers.

Does this by using a mutex on all opreations.

Also updates the StatsCounterThreadSafe constructor to force counter
initialization, as well as method Reset(). In addition, whenever the
method StatsTable::SetCounterFunction() is called (from the main
thread), it forces counter initialization for all thread safe stats
counters.

BUG=v8:6361

Review-Url: https://codereview.chromium.org/2887193002
Cr-Commit-Position: refs/heads/master@{#45526}

Compilation failure is result to overloaded-virtual warning
treated as error.

BUG=

Review-Url: https://codereview.chromium.org/2895923002
Cr-Commit-Position: refs/heads/master@{#45525}

A few tests that would be good to have to verify that the known manifestations
of this bug are resolved.

Previously, the async generator and async function tests would crash. The other
ones never did, but still resulted in the register overwite bug.

BUG=v8:6322
R=adamk@chromium.org

Change-Id: Ic2238227629077de5671d67d18b3bfe018dd23f4
Reviewed-on: https://chromium-review.googlesource.com/514230Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Cr-Commit-Position: refs/heads/master@{#45524}

R=joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2905683002
Cr-Commit-Position: refs/heads/master@{#45523}

Rather than trying to pre-calculate the number of contexts required during
scope analysis, instead just allocate context registers in the register
allocator. This reduces frame size a bit due to reusing of registers when
the context isn't pushed.

 BUG=v8:6322, chromium:716265

Change-Id: I145e38fcb3797a3b86c91e90ea9326a6e55b9b89
Reviewed-on: https://chromium-review.googlesource.com/514087Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45522}

Revert of [turbofan] Speculatively optimize string character access. (patchset #1 id:1 of https://codereview.chromium.org/2905623003/ )

Reason for revert:
Changes layout tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/15867

See:
https://github.com/v8/v8/wiki/Blink-layout-tests

Original issue's description:
> [turbofan] Speculatively optimize string character access.
>
> Add a protector cell for string bounds checks that is being used to
> protect speculative bounds for String.prototype.charCodeAt and
> String.prototype.charAt in TurboFan (and Crankshaft). This way we don't
> have the diamond in optimized code, which stands in the way of other
> optimizations for charCodeAt that are currently being worked on by
> petermarshall@.
>
> BUG=v8:6391
> TBR=mlippautz@chromium.org
> R=petermarshall@chromium.org
>
> Review-Url: https://codereview.chromium.org/2905623003
> Cr-Commit-Position: refs/heads/master@{#45514}
> Committed: https://chromium.googlesource.com/v8/v8/+/9d8bd0551657d60c66b2f96544eecedfba1cba8a

TBR=petermarshall@chromium.org,mlippautz@chromium.org,bmeurer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:6391

Review-Url: https://codereview.chromium.org/2900333002
Cr-Commit-Position: refs/heads/master@{#45521}

TBR=machenbach@chromium.org

Bug: 
Change-Id: I916d52297bd81c5015fcd3185105dcb0d0a3d78f
Reviewed-on: https://chromium-review.googlesource.com/513906Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Commit-Queue: Daniel Vogelheim <vogelheim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45520}

This reverts commit ee3729d2.

Reason for revert: The initial commit required https://chromium-review.googlesource.com/c/510021/ also land on the Blink side. I mistakenly thought it did.

Original change's description:
> Revert "[wasm] Remove override-ability from async compile and instantiate."
> 
> This reverts commit 2869dd55.
> 
> Reason for revert: Breaks:
> https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/15850
> 
> See also:
> https://github.com/v8/v8/wiki/Blink-layout-tests
> 
> Original change's description:
> > [wasm] Remove override-ability from async compile and instantiate.
> > 
> > We're now using explicit APIs.
> > 
> > Bug: 
> > Change-Id: I4a4248e44543f6e7dfcbdc66456e610fb98ff5ee
> > Reviewed-on: https://chromium-review.googlesource.com/513406
> > Commit-Queue: Brad Nelson <bradnelson@chromium.org>
> > Reviewed-by: Brad Nelson <bradnelson@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#45500}
> 
> TBR=bradnelson@chromium.org,mtrofin@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> 
> Bug: 
> Change-Id: Ie7c2db40279bd07c535c20afaa1cea51b680fe65
> Reviewed-on: https://chromium-review.googlesource.com/513862
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#45502}

TBR=bradnelson@chromium.org,machenbach@chromium.org,mtrofin@chromium.org,v8-reviews@googlegroups.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Bug: 
Change-Id: Ib826b590b5d362d005460fcebdc6800c8d6c5f63
Reviewed-on: https://chromium-review.googlesource.com/513496Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
Commit-Queue: Mircea Trofin <mtrofin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45519}

Bug: chromium:725201
Change-Id: Ic75f4080b8ef28e64b471887871c526c0bac316b
Reviewed-on: https://chromium-review.googlesource.com/514004Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45518}

Change-Id: I5e725f984178c2c9d48ba48c1270faea1b63ff3e
Reviewed-on: https://chromium-review.googlesource.com/513943Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45517}

Missing parentheses are causing compilation failures, added them.

BUG=

Review-Url: https://codereview.chromium.org/2906433002
Cr-Commit-Position: refs/heads/master@{#45516}

In particular, local variables should be allocated on stack (in bytecode register), and stored/loaded to the generator object on generator suspend/resume.

The CL is based on @adamk's change to scoping/parsers (https://chromium-review.googlesource.com/c/498538/), I only made the debugger cope with this change.

I should note that the CL changes the scope type of suspended generators from ScopeType.Closure to ScopeType.Local. In the future we might want to introduce ScopeType.SuspendedGenerator to make the distinction explicit.

Some of the changes in the tests have been made because the debugger functions do not return scopes of closed generators anymore. Generators should be allowed to throw away their internal state when they finish.

BUG=v8:6368

Review-Url: https://codereview.chromium.org/2898163002
Cr-Commit-Position: refs/heads/master@{#45515}

Add a protector cell for string bounds checks that is being used to
protect speculative bounds for String.prototype.charCodeAt and
String.prototype.charAt in TurboFan (and Crankshaft). This way we don't
have the diamond in optimized code, which stands in the way of other
optimizations for charCodeAt that are currently being worked on by
petermarshall@.

BUG=v8:6391
TBR=mlippautz@chromium.org
R=petermarshall@chromium.org

Review-Url: https://codereview.chromium.org/2905623003
Cr-Commit-Position: refs/heads/master@{#45514}

- Create getters for number of tasks for all parallel stages
- Count slots for the minor MC and limit tasks by the overall number of slots.
- Cleanup existing getters.

Bug: chromium:651354
Change-Id: I9f67cca4474cbe1800faff4a549fbec019b096ce
Reviewed-on: https://chromium-review.googlesource.com/512862
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45513}

Add support for I8x16Add, I8x16AddSaturateS, I8x16Sub, I8x16SubSaturateS,
I8x16Mul, I8x16MaxS, I8x16MinS, I8x16Eq, I8x16Ne, I8x16LtS,
I8x16LeS, I8x16ShrU, I8x16AddSaturateU, I8x16SubSaturateU, I8x16MaxU,
I8x16MinU, I8x16LtU, I8x16LeU, S128And, S128Or, S128Xor, S128Not for
mips32 and mips64 architectures.

BUG=

Review-Url: https://codereview.chromium.org/2798853003
Cr-Commit-Position: refs/heads/master@{#45512}

This removes the need for certain context scopes to skip popping the
context register. For the {incoming_context} the flag was already
obsolete, because its destructor would only run once the basic block
ended with a return. For {local_function_context} the same holds now
by moving handling of implicit returns into the body visitor.

R=rmcilroy@chromium.org

Change-Id: Icceaab1b30d7223b2b2f87a092a6580be7d7d675
Reviewed-on: https://chromium-review.googlesource.com/513963Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45511}

This is safe since we already take the page lock.

Bug: 
Change-Id: Id7797ef66c387be150064cda1213c1f2b75d31d3
Reviewed-on: https://chromium-review.googlesource.com/514003Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45510}

There are two break locations at the same source location by desugaring:
- call iterator.next,
- before variable assignment.

Additionally location for for..of loops is moved from before "of" to before each variable expression.

We should not report first implicit call to avoid user confusion. User still able to go into .next function with both scenarios:
- when this call is reached by stepOver or stepInto from previous line,
- when this call is reached because of breakpoint at current line.

BUG=v8:6425
R=dgozman@chromium.org,jgruber@chromium.org

Review-Url: https://codereview.chromium.org/2893313002
Cr-Commit-Position: refs/heads/master@{#45509}

Add a sequential string type to the compiler, and transform
charCodeAt on SeqString into SeqStringCharCodeAt.

SeqStringCharCodeAt can handle one and two byte strings.

Bug: v8:6391
Change-Id: I2785257522c28f3b268c9833f5313e9630cb982a
Reviewed-on: https://chromium-review.googlesource.com/509573Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45508}

This avoids emitting redundant {PopContext} bytecode instructions when
non-local control-flow leaves the method body. It also folds multiple
such {PopContext} instructions into one, in case several scoping levels
are crossed at one. Only the expected context of the target of a local
control-flow transfer matters.

R=rmcilroy@chromium.org
TEST=debugger/regress/regress-crbug-724858
BUG=chromium:724858

Change-Id: Id4a47ae9fea25e75ae1af13619720b16a3975edf
Reviewed-on: https://chromium-review.googlesource.com/512545Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45507}

This reverts commit 589a4d1d.

Reason for revert: Breaks webkit:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20predictable/builds/11714

Original change's description:
> [test] Don't hide crashes in predictable mode
> 
> Bug: v8:6426
> Change-Id: I278dda0d628732bb9c539c2648d2b27bcbc89bf0
> Reviewed-on: https://chromium-review.googlesource.com/512643
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#45504}

TBR=jkummerow@chromium.org,machenbach@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
Bug: v8:6426

Change-Id: I85c573fa332f436bb57f2747ad98c26e1c1f23bd
Reviewed-on: https://chromium-review.googlesource.com/513866Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45506}

NOTRY=true
TBR=hpayer@chromium.org

Bug: chromium:651354
Change-Id: Ibff438d987b07907b2c4463a42bef685864c1602
Reviewed-on: https://chromium-review.googlesource.com/513903Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45505}