When compiling a wasm to js wrapper for a signature which is not JS
compatible, we generate a runtime call to throw a type error and return
immediately afterwards. We were using the return value of the runtime
call as return value for the wrapper.
This worked for integer return values, since the same registers are
used for tagged values and integer values. For float values, however,
it failed, since the return value needs to be stored in another
register.

R=titzer@chromium.org
BUG=v8:6096

Change-Id: I8f39ea132cd150c3044673d25fa3c3588b4266bf
Reviewed-on: https://chromium-review.googlesource.com/455816Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43821}

BUG=v8:5294

Change-Id: I6214c50c7d1344210a80763b066e5ec56df1265a
Reviewed-on: https://chromium-review.googlesource.com/453460
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43820}

Mark slow tests discovered by manual audit of reported durations.

Slow tests will run first, which will lead to higher test runner throughput.

Also some tests have flaky timeouts occasionally.

BUG=chromium:601468

Change-Id: If9aeb5422e79ff25b867b01c50386a5fdebeb494
Reviewed-on: https://chromium-review.googlesource.com/455736Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43819}

BUG=

Change-Id: I1fd0ae3dcb0e644e9f2a56c242720b4def4bb579
Reviewed-on: https://chromium-review.googlesource.com/454836
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43818}

This commit will likely capture several perf alerts from bots that hung.

All allerts might be attributable to the I+TF switch.

BUG=v8:6067
NOTRY=true
NOTREECHECKS=true
NOPRESUBMIT=true
TBR=hablich@chromium.org

Change-Id: Ie6d0dc977823f8740856904bdcf157c8b021d60b
Reviewed-on: https://chromium-review.googlesource.com/455776Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43817}

BUG=

Change-Id: Ic63c63a312c6282814c14176d982b8c825ba6dc4
Reviewed-on: https://chromium-review.googlesource.com/454756
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43816}

R=jarin@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2745753002
Cr-Commit-Position: refs/heads/master@{#43815}

This changes the IR to no longer require single {IfSuccess} projection
nodes unless there is a corresponding {IfException} node that links the
potentially throwing call to an exception handler. This reduces graph
size as well as compilation time when exception handlers aren't present.

The new invariant for potentially throwing nodes is: Nodes that can
potentially throw either have both IfSuccess/IfException projections as
the only control uses and no direct control uses, or no projections at
all and solely direct control uses.

R=jarin@chromium.org

Change-Id: I3d9cd816d74ad5af13e0673da7ec7a98f1ecdc7e
Reviewed-on: https://chromium-review.googlesource.com/449715
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43814}

For the old asm.js pipeline, there's no point in running either the
JSCallReducer or the JSNativeContextSpecialization, as both will not
kick in for any asm.js relevant code.

So remove the kDeoptimizationEnabled flag from both of them and just
run them on regular JavaScript only.

Drive-by-fix: Slightly rearrange keyed access to String receivers in the
JSNativeContextSpecialization::ReduceKeyedAccess method to access constant
characters independent of the IC mode (as long as the constant index is
within the range of the receiver).

BUG=v8:5267
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2743253002
Cr-Commit-Position: refs/heads/master@{#43813}

BUG=chromium:700883

Review-Url: https://codereview.chromium.org/2751513006
Cr-Commit-Position: refs/heads/master@{#43812}

BUG=chromium:693425

Review-Url: https://codereview.chromium.org/2749193003
Cr-Commit-Position: refs/heads/master@{#43811}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/7de5863..2744073

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/1ec68b3..e9f547b

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/f091611..2a8813f

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: Ie78a772ac8d840d4f18a6b756a8ae67979cd2ef1
Reviewed-on: https://chromium-review.googlesource.com/455397Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43810}

Also use vinstr for vps/vpd/vss/vsd

BUG=

Review-Url: https://codereview.chromium.org/2747103002
Cr-Commit-Position: refs/heads/master@{#43809}

Change-Id: I47f0d5578a7c26aa7a30c97175eefc1a9c935d77
Reviewed-on: https://chromium-review.googlesource.com/455318
Commit-Queue: Eric Holk <eholk@chromium.org>
Commit-Queue: Brad Nelson <bradnelson@chromium.org>
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43808}

Android sets both V8_OS_ANDROID and V8_OS_LINUX. For the Wasm trap
handler, the difference between these OSes matters.

BUG= chromium:701590

Change-Id: I5ae703a1d932c8a63e499ad39a057ad1871a2ab1
Reviewed-on: https://chromium-review.googlesource.com/455556
Commit-Queue: Eric Holk <eholk@chromium.org>
Commit-Queue: Brad Nelson <bradnelson@chromium.org>
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43807}

Removes the --ignition-staging flag since it is no longer used
by anything and won't be a shipping configuration. Also removes
ignition_turbo variant from testrunner, since it is now 
the same as the turbofan variant.

BUG=v8:4280

Change-Id: I3b96e986879fc70b8e202fe9496334828acdd0ba
Reviewed-on: https://chromium-review.googlesource.com/452621
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43806}

Revert of Collect type profile for DevTools. (patchset #40 id:750001 of https://codereview.chromium.org/2707873002/ )

Reason for revert:
gcc bot is now flaky https://build.chromium.org/p/client.v8/builders/V8%20Linux%20gcc%204.8/builds/11863

Original issue's description:
> Collect type profile for DevTools
>
> Collect type information for JavaScript variables and display it
> in Chrome DevTools.
> Design Doc: https://docs.google.com/a/google.com/document/d/1O1uepXZXBI6IwiawTrYC3ohhiNgzkyTdjn3R8ysbYgk/edit?usp=sharing
>
> When debugging JavaScript, it’s helpful to know the type of
> a variable, parameter, and return values. JavaScript is
> dynamically typed, and for complex
> source code it’s often hard to infer types. With type profiling, we
> can provide type information to JavaScript developers.
>
> This CL is a proof of concept. It collects type profile for
> assignments and simply prints the types to stdout.
>
> The output looks something like this:
>
> #my_var1
>   #Object
>   #number
>   #string
>   #number
>   #undefined
>   #string
>   #Object
>   #Object
>
>
> We use an extra slot in the feedback vector of assignments to
> carry the list of types for that assignment. The extra slot is
> only added when the flag --type-profile is given.
>
>
> Missing work:
> * Collect data for parameters and return values (currently only assignments).
> * Remove duplicates from the list of collected types and use a common base class.
> * Add line numbers or source position instead of the variable name.
>
>
>
> BUG=v8:5935
>
> Review-Url: https://codereview.chromium.org/2707873002
> Cr-Original-Commit-Position: refs/heads/master@{#43791}
> Committed: https://chromium.googlesource.com/v8/v8/+/0332bebde99d0f9a5a8326382f5f37cc26224ae0
> Review-Url: https://codereview.chromium.org/2707873002
> Cr-Commit-Position: refs/heads/master@{#43804}
> Committed: https://chromium.googlesource.com/v8/v8/+/6cf880f4b84c533d4bb139d33c1369e309d1c579

TBR=yangguo@chromium.org,mvstanton@chromium.org,rmcilroy@chromium.org,mstarzinger@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5935

Review-Url: https://codereview.chromium.org/2754573002
Cr-Commit-Position: refs/heads/master@{#43805}

Collect type information for JavaScript variables and display it
in Chrome DevTools.
Design Doc: https://docs.google.com/a/google.com/document/d/1O1uepXZXBI6IwiawTrYC3ohhiNgzkyTdjn3R8ysbYgk/edit?usp=sharing

When debugging JavaScript, it’s helpful to know the type of
a variable, parameter, and return values. JavaScript is
dynamically typed, and for complex
source code it’s often hard to infer types. With type profiling, we
can provide type information to JavaScript developers.

This CL is a proof of concept. It collects type profile for
assignments and simply prints the types to stdout.

The output looks something like this:

#my_var1
  #Object
  #number
  #string
  #number
  #undefined
  #string
  #Object
  #Object

We use an extra slot in the feedback vector of assignments to
carry the list of types for that assignment. The extra slot is
only added when the flag --type-profile is given.

Missing work:
* Collect data for parameters and return values (currently only assignments).
* Remove duplicates from the list of collected types and use a common base class.
* Add line numbers or source position instead of the variable name.

BUG=v8:5935

Review-Url: https://codereview.chromium.org/2707873002
Cr-Original-Commit-Position: refs/heads/master@{#43791}
Committed: https://chromium.googlesource.com/v8/v8/+/0332bebde99d0f9a5a8326382f5f37cc26224ae0
Review-Url: https://codereview.chromium.org/2707873002
Cr-Commit-Position: refs/heads/master@{#43804}

These tests fail with the new asm.js parser, because they are invalid under
a more strict reading of the spec.

NOTE: These also fail to validate when run in Firefox.

BUG=v8:4203
BUG=v8:6090
R=aseemgarg@chromium.org,eholk@chromium.org

Review-Url: https://codereview.chromium.org/2745393002
Cr-Commit-Position: refs/heads/master@{#43803}

Used by ReduceJSEqualTypeOf, and will also be used to lower a new 
TestTypeof bytecode in a followup CL.

BUG=v8:5267

Change-Id: I990aa6ac8ac0b9bd01080dda1764c5bfe3a4d7cf
Reviewed-on: https://chromium-review.googlesource.com/454797Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43802}

The wasm interpreter entry is only called from wasm code. Hence the
flag is cleared unconditinally before executing in the interpreter.
Note that the interpreter does not use trap handling. It can on the
other hand call to JS functions, hence the flag should not be set while
executing in the interpreter.
The flag is reset when returning from the interpreter.

This CL avoids test failures in follow-up CLs which emerged after
rebasing on the trap handler CL of eholk.

R=titzer@chromium.org, ahaas@chromium.org
CC=eholk@chromium.org
BUG=v8:5822, v8:5277

Change-Id: I8106e3a92bd9fd6159c785a718bed2d23cb3d593
Reviewed-on: https://chromium-review.googlesource.com/454676
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43801}

BUG=chromium:691875
R=gsathya@chromium.org

Review-Url: https://codereview.chromium.org/2747733002
Cr-Commit-Position: refs/heads/master@{#43800}

Avoiding runtime call overhead.

BUG=v8:5269

Review-Url: https://codereview.chromium.org/2717203002
Cr-Commit-Position: refs/heads/master@{#43799}

Revert of Collect type profile for DevTools. (patchset #39 id:730001 of https://codereview.chromium.org/2707873002/ )

Reason for revert:
gcc bot has problems with this: https://build.chromium.org/p/client.v8/builders/V8%20Linux%20gcc%204.8/builds/11858

Original issue's description:
> Collect type profile for DevTools
>
> Collect type information for JavaScript variables and display it
> in Chrome DevTools.
> Design Doc: https://docs.google.com/a/google.com/document/d/1O1uepXZXBI6IwiawTrYC3ohhiNgzkyTdjn3R8ysbYgk/edit?usp=sharing
>
> When debugging JavaScript, it’s helpful to know the type of
> a variable, parameter, and return values. JavaScript is
> dynamically typed, and for complex
> source code it’s often hard to infer types. With type profiling, we
> can provide type information to JavaScript developers.
>
> This CL is a proof of concept. It collects type profile for
> assignments and simply prints the types to stdout.
>
> The output looks something like this:
>
> #my_var1
>   #Object
>   #number
>   #string
>   #number
>   #undefined
>   #string
>   #Object
>   #Object
>
>
> We use an extra slot in the feedback vector of assignments to
> carry the list of types for that assignment. The extra slot is
> only added when the flag --type-profile is given.
>
>
> Missing work:
> * Collect data for parameters and return values (currently only assignments).
> * Remove duplicates from the list of collected types and use a common base class.
> * Add line numbers or source position instead of the variable name.
>
>
>
> BUG=v8:5935
>
> Review-Url: https://codereview.chromium.org/2707873002
> Cr-Commit-Position: refs/heads/master@{#43791}
> Committed: https://chromium.googlesource.com/v8/v8/+/0332bebde99d0f9a5a8326382f5f37cc26224ae0

TBR=yangguo@chromium.org,mvstanton@chromium.org,rmcilroy@chromium.org,mstarzinger@chromium.org,franzih@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5935

Review-Url: https://codereview.chromium.org/2749673003
Cr-Commit-Position: refs/heads/master@{#43798}

Nested arrow functions can have the same end positions, so
the end position is unsuitable to decide whether a scope is
an inner function scope.

BUG=chromium:696202
R=jgruber@chromium.org, kozyatinskiy@chromium.org

Review-Url: https://codereview.chromium.org/2751573003
Cr-Commit-Position: refs/heads/master@{#43797}

Change-Id: I622c3aca07580051c84c86cf895c23af70c11294
Reviewed-on: https://chromium-review.googlesource.com/453021Reviewed-by: Caitlin Potter <caitp@igalia.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43796}

- Implements vuzp, vtrn instructions for q-registers.
- Refactors vmvn, vswp to use common unary op helper fn.

LOG=N
BUG=v8:6020

Review-Url: https://codereview.chromium.org/2739033002
Cr-Commit-Position: refs/heads/master@{#43795}

Set undefined to the first argument (search element) if the first
argument is not given in %TypedArray%.prototype.indexOf or
%TypedArray%.prototype.includes

BUG=chromium:700894

Review-Url: https://codereview.chromium.org/2748113002
Cr-Commit-Position: refs/heads/master@{#43794}

This is a cleanup in preparation to implement calling imported
functions via the wasm interpreter.
For imported functions, we do not create entries in the
interpreter_code_ vector any more.

I also simplified the interface and removed unused or redundant return
values. More things are now DCHECKed instead of bailing out.

Also, we previously had two PushFrame methods: One is supposed to
initialize the interpreter from external code (i.e. adds the first
frame to the stack), the other one is used to push new frames on the
frame stack for called functions. This CL renames the first to
InitFrame, and makes it use the second one. The other remaining user is
the DoCall method.

R=titzer@chromium.org
BUG=v8:5822

Change-Id: Id09ff1e3256428fbd8c955e4664507a0c3167e53
Reviewed-on: https://chromium-review.googlesource.com/453482
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43793}

This enforces the prefix for v8 and chromium, as otherwise the links don't work in code review. Also prevents using html links to not confuse bugdroid.

NOTRY=true

Change-Id: Iaf3b97c9a7d7a87c27736d4b1f8c286daaffd452
Reviewed-on: https://chromium-review.googlesource.com/454796
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43792}

Collect type information for JavaScript variables and display it
in Chrome DevTools.
Design Doc: https://docs.google.com/a/google.com/document/d/1O1uepXZXBI6IwiawTrYC3ohhiNgzkyTdjn3R8ysbYgk/edit?usp=sharing

When debugging JavaScript, it’s helpful to know the type of
a variable, parameter, and return values. JavaScript is
dynamically typed, and for complex
source code it’s often hard to infer types. With type profiling, we
can provide type information to JavaScript developers.

This CL is a proof of concept. It collects type profile for
assignments and simply prints the types to stdout.

The output looks something like this:

#my_var1
  #Object
  #number
  #string
  #number
  #undefined
  #string
  #Object
  #Object

We use an extra slot in the feedback vector of assignments to
carry the list of types for that assignment. The extra slot is
only added when the flag --type-profile is given.

Missing work:
* Collect data for parameters and return values (currently only assignments).
* Remove duplicates from the list of collected types and use a common base class.
* Add line numbers or source position instead of the variable name.

BUG=v8:5935

Review-Url: https://codereview.chromium.org/2707873002
Cr-Commit-Position: refs/heads/master@{#43791}

NOTRY=true

Change-Id: Idfcc2481ae65f8098ecc94c20f992f3f3b874b8c
Reviewed-on: https://chromium-review.googlesource.com/454716Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43790}

Review-Url: https://codereview.chromium.org/2749843002
Cr-Commit-Position: refs/heads/master@{#43789}

BUG=

Change-Id: I62c570ee929b8fbbba99acabd2d149dde99887e5
Reviewed-on: https://chromium-review.googlesource.com/454041Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43788}

This reverts commit 822aef29.

Reason for revert: Makes getters-on-elements flaky on many bots. E.g.:
https://build.chromium.org/p/client.v8/builders/V8%20Linux/builds/16848/steps/Check%20-%20isolates%20%28flakes%29/logs/getters-on-elements

Bisected locally and tested with:
tools/run-tests.py --gn --variants=asm_wasm mjsunit/getters-on-elements --isolates --random-seed-stress-count=500

Original change's description:
> [compiler] Mark shared functions which have an optimization job
> 
> Marking shared functions for tier-up was optimizing the functions
> non-concurrently, to avoid the case where the same shared function is
> optimized concurrently by multiple JS functions. This was particularly a
> problem for small functions, which (if called in a loop) could get
> marked for optimisation quite quickly.
> 
> In this CL, the shared function is instead marked as having an active
> optimization job running, and these do not spawn a compilation job.
> 
> BUG=693590
> 
> Change-Id: I3df93fbf9cec7eda8229fcf416d7c429c06bec86
> Reviewed-on: https://chromium-review.googlesource.com/446836
> Commit-Queue: Leszek Swirski <leszeks@chromium.org>
> Reviewed-by: Michael Stanton <mvstanton@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#43778}

TBR=mvstanton@chromium.org,leszeks@chromium.org,hablich@chromium.org,v8-reviews@googlegroups.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=693590

Change-Id: If7dbdf3de302ec595c44e7f4795554db7674f22f
Reviewed-on: https://chromium-review.googlesource.com/454042Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43787}

R=rmcilroy@chromium.org,mlippautz@chromium.org
BUG=v8:6069

Change-Id: Iea0134ef3a0252f5a6f4ae2154218776dc6ff96d
Reviewed-on: https://chromium-review.googlesource.com/453960Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Jochen Eisinger <jochen@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43786}

BUG=chromium:700883

Review-Url: https://codereview.chromium.org/2750803002
Cr-Commit-Position: refs/heads/master@{#43785}

BUG=v8:6093

Change-Id: Icdc0706a3af23fbf538021a7e80fedaf0b5ae866
Reviewed-on: https://chromium-review.googlesource.com/453699
Commit-Queue: Wiktor Garbacz <wiktorg@google.com>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43784}

IsString should not count FIRST_NON_STRING_TYPE as a string type.

BUG=

Change-Id: I093945763c3d2b56de5b4b5745ba207fe2d8b5d1
Reviewed-on: https://chromium-review.googlesource.com/453899Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43783}

BUG=v8:6093

Change-Id: I7268abd56769d4cbaefdaa901c532871837cc47e
Reviewed-on: https://chromium-review.googlesource.com/452340Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Wiktor Garbacz <wiktorg@google.com>
Cr-Commit-Position: refs/heads/master@{#43782}