This should recover part of the Bluebird regression caused by
sending let/const to TurboFan+Ignition.

R=gsathya@chromium.org

Review-Url: https://codereview.chromium.org/2552583002
Cr-Commit-Position: refs/heads/master@{#41467}

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/ca719be..627b0d9

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2545293002
Cr-Commit-Position: refs/heads/master@{#41466}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/a8dd8be..83f770a

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/36566dd..ca719be

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/f4b896b..d48a09f

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2550913002
Cr-Commit-Position: refs/heads/master@{#41465}

In the current implementation, WasmInstanceWrapper is allocated after the imports for the instance are processed, and before the InstanceFinalizer callback is associated with the instance. This raises the possibility of triggering a gc in the middle of the instantiate flow which is incorrect.

BUG=5707

R=titzer@chromium.org, petermarshall@chromium.org

Review-Url: https://codereview.chromium.org/2544273002
Cr-Commit-Position: refs/heads/master@{#41464}

Several cleanups to the output of the debug-only --print-scopes flag:
  - Function name variable only printed once
  - Only print headers for sections of variables that are non-empty
  - Assume Variables stored in Scope::variables_ are never null

R=verwaest@chromium.org

Review-Url: https://codereview.chromium.org/2544063004
Cr-Commit-Position: refs/heads/master@{#41463}

BUG=chromium:665398

Review-Url: https://codereview.chromium.org/2549653002
Cr-Commit-Position: refs/heads/master@{#41462}

Revert of [typedarrays] remove invalid optimization in NAMEConstructor() (patchset #1 id:1 of https://codereview.chromium.org/2544503002/ )

Reason for revert:
Speculative revert for causing timeouts on Win Debug gpu fyi bot

Nothing else looks even remotely relevant in the list of changes.
Will reland if this doesn't fix the issues.

BUG=670396

Original issue's description:
> [typedarrays] remove invalid optimization in NAMEConstructor()
>
> Before, we were treating objects with the builtin ArrayValues iterator
> method as array-like, where the iterator would iterate through to the
> full length of the object.
>
> This optimization was not sound, because it does not ensure that the
> next method hasn't been modified. Even if it hasn't been modified,
> it's entirely possible to be modified during iteration. Thus, this
> optimization has been removed due to its observability.
>
> BUG=v8:5699
> R=littledan@chromium.org, cbruni@chromium.org
>
> Committed: https://crrev.com/77df8c67d9609ada3b7d79e8e6d33f198bbad5a1
> Cr-Commit-Position: refs/heads/master@{#41394}

TBR=cbruni@chromium.org,littledan@chromium.org,caitp@igalia.com
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=v8:5699

Review-Url: https://codereview.chromium.org/2548583003
Cr-Commit-Position: refs/heads/master@{#41461}

BUG=670470
R=dpranke@chromium.org

Review-Url: https://codereview.chromium.org/2544053002
Cr-Commit-Position: refs/heads/master@{#41460}

BUG=chromium:613518

Review-Url: https://codereview.chromium.org/2407153002
Cr-Commit-Position: refs/heads/master@{#41459}

... even when a receiver is not an object.

BUG=v8:5697

Review-Url: https://codereview.chromium.org/2548753003
Cr-Commit-Position: refs/heads/master@{#41458}

TBR=machenbach@chromium.org
BUG=v8:5666

Review-Url: https://codereview.chromium.org/2542843008
Cr-Commit-Position: refs/heads/master@{#41457}

BUG=v8:5708

Review-Url: https://codereview.chromium.org/2548813002
Cr-Commit-Position: refs/heads/master@{#41456}

Turbofan uses 64-bit load followed by 32 bit arithmetic shift when
loading higher 32 bits of 64-bit value. We simplify this
by loading higher 32 bits directly.

BUG=

Review-Url: https://codereview.chromium.org/2532333003
Cr-Commit-Position: refs/heads/master@{#41455}

R=machenbach@chromium.org,jarin@chromium.org
BUG=v8:5710

Review-Url: https://codereview.chromium.org/2551433002
Cr-Commit-Position: refs/heads/master@{#41454}

BUG=v8:4947

Review-Url: https://codereview.chromium.org/2547493002
Cr-Commit-Position: refs/heads/master@{#41453}

This apparently gradually fell out of use after the more general
Token::IsIdentifer was introduced, and whoever left last forgot to
turn out the lights.

The only remaining use was in an assertion in DeclareLabel, but
meanwhile DeclareLabel is only called if IsIdentifier. I added re-formulated assertions, just in case.

R=verwaest@chromium.org
BUG=v8:4947

Review-Url: https://codereview.chromium.org/2549493002
Cr-Commit-Position: refs/heads/master@{#41452}

This enables {FLAG_debug_code} by default in debug builds. The advantage
is that generated code contained within the snapshot will contain such
debug code. Before we would only get coverage for these pieces with the
no-snapshot builds, which have a meager coverage. One can still pass the
inverse --no-debug-code flag to ensure generated code remains readable
within debug builds as well.

R=machenbach@chromium.org

Review-Url: https://codereview.chromium.org/2528913002
Cr-Commit-Position: refs/heads/master@{#41451}

Since we don't pass references to this constant to the DCHECKs any more
(see http://crrev.com/2524093002), the constant can now be initialized
in the header, reducing code size and increasing performance.

Before the mentioned change in CHECK/DCHECK, this caused link errors.

R=ishell@chromium.org
CC=jgruber@chromium.org
BUG=v8:5684

Review-Url: https://codereview.chromium.org/2541533002
Cr-Commit-Position: refs/heads/master@{#41450}

[ic] Use validity cells to protect keyed element stores against object's prototype chain modifications.

... instead of clearing of all the KeyedStoreICs which didn't always work.

BUG=chromium:662907, chromium:669411, v8:5561
TBR=verwaest@chromium.org, bmeurer@chromium.org

Committed: https://crrev.com/a39522f44f7e0be4686831688917e9675255dcaf
Review-Url: https://codereview.chromium.org/2534613002
Cr-Original-Commit-Position: refs/heads/master@{#41332}
Cr-Commit-Position: refs/heads/master@{#41449}

Revert of Introduce a separate FunctionLiteral ID for Eval (patchset #1 id:1 of https://codereview.chromium.org/2533303006/ )

Reason for revert:
My assumption that eval and top-level code should be handled differently was wrong

Original issue's description:
> Introduce a separate FunctionLiteral ID for Eval
>
> Top level SharedFunctionInfos will end up in a scripts SFI list, but
> eval'd SFIs shouldn't. Separate IDs will allow for adding a
> corresponding DCHECK.
>
> BUG=v8:5589
> R=marja@chromium.org
>
> Committed: https://crrev.com/c6d421ff9aee7f3cab9e48faac88f6b08d2f1cf5
> Cr-Commit-Position: refs/heads/master@{#41421}

TBR=marja@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5589

Review-Url: https://codereview.chromium.org/2544003003
Cr-Commit-Position: refs/heads/master@{#41448}

Tests were falling in qemu because of inexact computation in tests.
After correcting tests, simulator also had to be fixed.

Review-Url: https://codereview.chromium.org/2539133002
Cr-Commit-Position: refs/heads/master@{#41447}

This relands API deprecation (without removing the implementation),
removal of NewFunction and BeforeCompile events, and removal of
DebugCommandProcessor tests.

The remaining portion of the original CLs can be relanded after the 4.7
branch point.

Original CLs:

https://codereview.chromium.org/2524323002
https://codereview.chromium.org/2531543002

BUG=v8:5510

Review-Url: https://codereview.chromium.org/2546473008
Cr-Commit-Position: refs/heads/master@{#41446}

Crankshaft has this highly unpredictable performance cliff around the
"Unsupported phi use of const or let variable", which is due to the
fact that Crankshaft refuses to do hole checks (for a couple of
reasons). So ideally we should not even try to send any lexically bound
variables to fullcodegen+Crankshaft, but instead give them to Ignition
and TurboFan.

This CL only adds the appropriate check to the AstNumbering, but doesn't
remove the functionality from fullcodegen/Crankshaft yet. This would be
step two in case this CL sticks. If you see any major performance
regressions with this CL in the range, just revert it and ping me.

See Node.js issue https://github.com/nodejs/node/issues/9729 for
additional information.

BUG=v8:5666
R=hablich@chromium.org, mstarzinger@chromium.org, rmcilroy@chromium.org

Review-Url: https://codereview.chromium.org/2525243002
Cr-Commit-Position: refs/heads/master@{#41445}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/ac12d5e..a8dd8be

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/582ccd4..36566dd

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/ccd4a12..f4b896b

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2543143002
Cr-Commit-Position: refs/heads/master@{#41444}

BUG=v8:4124
TEST:test-run-wasm-simd-lowering
R=bradnelson@chromium.org,titzer@chromium.org,mtrofin@chromium.org

Review-Url: https://codereview.chromium.org/2498283002
Cr-Commit-Position: refs/heads/master@{#41443}

Descriptions for (typed)arrays will use parenthesis instead of square brackets
"Array(10)" instead of "Array[10]". This CL also adds size hints to descriptions
of maps and sets.

Related CL for DevTools: https://codereview.chromium.org/2524913002/

BUG=405845

Committed: https://crrev.com/92c77a57390e6a9ef726535b255a24359751992d
Review-Url: https://codereview.chromium.org/2521853003
Cr-Original-Commit-Position: refs/heads/master@{#41237}
Cr-Commit-Position: refs/heads/master@{#41442}

Port 2b991784

R=danno@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, bjaideep@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=chromium:608675
LOG=N

Review-Url: https://codereview.chromium.org/2542313002
Cr-Commit-Position: refs/heads/master@{#41441}

Use %is_promise instead

BUG=v8:5343

Review-Url: https://codereview.chromium.org/2521723003
Cr-Commit-Position: refs/heads/master@{#41440}

BUG=chromium:608675
LOG=N

Review-Url: https://codereview.chromium.org/2532483002
Cr-Commit-Position: refs/heads/master@{#41439}

BUG=v8:5343,chromium:660947,chromium:658194

Review-Url: https://codereview.chromium.org/2497523002
Cr-Commit-Position: refs/heads/master@{#41438}

- These operations are identical for Float32x4 and Int32x4.
- Make them generic, following the naming for generic Simd128 / S128
opcodes.
- F32x4/I32x4 -> S32x4, similarly to S128
- Float32x4/Int32x4 -> Simd32x4, similarly to Simd128.

LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2543773002
Cr-Commit-Position: refs/heads/master@{#41437}

BUG=

Review-Url: https://codereview.chromium.org/2541793004
Cr-Commit-Position: refs/heads/master@{#41436}

1) CSA::StoreMap() added which triggers map-specific write barrier
   unlike StoreObjectField() which triggers the full write barrier.
2) CSA::StoreMapNoWriteBarrier(object, map_root_index) added.
3) StoreMapNoWriteBarrier() is used for storing immortal immovable
   maps since they don't require write barriers even for objects in
   old space.

BUG=

Review-Url: https://codereview.chromium.org/2544793002
Cr-Commit-Position: refs/heads/master@{#41435}

This is just a flag flip to enable WASM optimizations.

R=ahaas@chromium.org,bmeurer@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2545463002
Cr-Commit-Position: refs/heads/master@{#41434}

Fix compilation failure in test-macro-assembler[64].cc
caused by 8fcfe66f
due to warning `lambda-expression in unevaluated context`.

TEST=cctest/test-macro-assembler-mips[64]
BUG=

Review-Url: https://codereview.chromium.org/2543643005
Cr-Commit-Position: refs/heads/master@{#41433}

BUG=v8:5339

Review-Url: https://codereview.chromium.org/2537973004
Cr-Commit-Position: refs/heads/master@{#41432}

This moves the location of the bytecode-offset translation that turns
offsets of back jumps into offsets of loop headers. This translation is
now done by the {BytecodeGraphBuilder} after loop analysis has been
performed. It safes one redudant iteration over the bytecode array. Note
that this changes the semantics of the BailoutId used as an {osr_ast_id}
throughout the compiler pipeline for OSR from Ignition.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2465913002
Cr-Commit-Position: refs/heads/master@{#41431}

The overload simply wraps creation of an IntPtrConstant and makes things more
readable.

Review-Url: https://codereview.chromium.org/2541843006
Cr-Commit-Position: refs/heads/master@{#41430}

Before, it was a method in wasm namespace, and received a
Handle<WasmCompiledModule>. As it does not allocate on the heap, we can
just make it a non-static method on WasmCompiledModule.

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2536373007
Cr-Commit-Position: refs/heads/master@{#41429}

The loop for non-"static" properties is no longer needed in
full-codegen since all computed property
names in object literals go through Ignition first.

BUG=v8:5657

Review-Url: https://codereview.chromium.org/2547433003
Cr-Commit-Position: refs/heads/master@{#41428}