R=mstarzinger@chromium.org

Review-Url: https://codereview.chromium.org/2650193002
Cr-Original-Commit-Position: refs/heads/master@{#42892}
Committed: https://chromium.googlesource.com/v8/v8/+/eef855a1dc956e9db03ec09abca1d732d379861b
Review-Url: https://codereview.chromium.org/2650193002
Cr-Commit-Position: refs/heads/master@{#43360}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/769428e..8b6a679

Rolling v8/test/wasm-js: https://chromium.googlesource.com/external/github.com/WebAssembly/spec/+log/193fcb4..bfb1fc4

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/71c4c9a..d9036c9

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/799a6a3..8da96ea

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: I3128c72b8d2760996a652be6e52fbc0831fdc686
Reviewed-on: https://chromium-review.googlesource.com/446156Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43359}

This is a speculative fix, but I believe it might work.

Idea is to keep `start_from` as a double while establishing an appropriate
index to begin iteration. This should keep -Infinity intact rather than
converting it to a positive high value, which would break the algorithm.
This is similar to what had been implemented on the fast path before it was
changed to send non-Smis to the slow path.

BUG=v8:5986
R=bmeurer@chromium.org, cbruni@chromium.org, machenbach@chromium.org, adamk@chromium.org

Change-Id: I9965fd2e75a8972f3f1c7a18e51bd580030a66ea
Reviewed-on: https://chromium-review.googlesource.com/445857
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43358}

Review-Url: https://codereview.chromium.org/2658933004
Cr-Commit-Position: refs/heads/master@{#43357}

Port fd596007

Original Commit Message:

    Use an opaque format for the frame type marker on the stack, where the
    marker is simply shifted left by 1 instead of being a Smi. This allows
    us to generate simpler code for frame initialisation, as we can push a
    smaller value, decreasing the prologue by 4 bytes and one instruction.

R=leszeks@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2709483007
Cr-Commit-Position: refs/heads/master@{#43356}

R=joransiu@ca.ibm.com, bjaideep@ca.ibm.com, machenbach@chromium.org, jkummerow@chromium.org, jochen@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2707103002
Cr-Commit-Position: refs/heads/master@{#43355}

This is such a mis-use of the API that it's important to fail fast:
this patch was prompted by a bug report from a Node.js developer
trying to use CompileModule() without passing a properly
module-tagged ScriptOrigin.

R=jochen@chromium.org, neis@chromium.org
BUG=v8:1569

Review-Url: https://codereview.chromium.org/2695713014
Cr-Commit-Position: refs/heads/master@{#43354}

Test the wasm interpreter entry stub by creating two wasm functions A
and B, make A pass arguments to B, then redirect B to be executed in the
interpreter.
Test different number and types or arguments.

BUG=v8:5822
R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2651793003
Cr-Commit-Position: refs/heads/master@{#43353}

The limit needs to be checked before casting the length to int in
ModuleWireBytes.

R=titzer@chromium.org
BUG=694433

Review-Url: https://codereview.chromium.org/2705233002
Cr-Commit-Position: refs/heads/master@{#43352}

In the upcoming concurrent marking protocol the main thread will have to
mark objects before performing unsafe layout change.

This patch is an experiment for evaluating memory the impact of marking
an object on layout change.

BUG=chromium:694255

Review-Url: https://codereview.chromium.org/2706213002
Cr-Commit-Position: refs/heads/master@{#43351}

Native resources allocated by v8, as internal implementation detail,
and held by a Foreign object, must be released when the Isolate is
torn down. Example: wasm::WasmModule allocated by wasm compile, and
held throughout the lifetime of the WebAssembly.Module object.

This change:
- Extends Managed<CppType> with a mechanism for doing just that
- Separates the role of Managed<CppType> to be strictly an owner of
the lifetime of the native resource. For cases where that's not
desirable, we can polymorphically use Foregin.
- moves managed.h out of wasm, since it's not wasm-specific.

BUG=680065

Review-Url: https://codereview.chromium.org/2676513008
Cr-Commit-Position: refs/heads/master@{#43350}

This should make http://crbug.com/694535 quiet.

BUG=chromium:694535
NOTRY=true
TBR=mstarzinger@chromium.org,jarin@chromium.org

Change-Id: I268c810662b274b45842aa22d840330b5c984277
Reviewed-on: https://chromium-review.googlesource.com/445645Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43349}

- Adds new machine types SimdBool4/8/16 for the different boolean vector types.
- Adds a kSimdMaskRegisters flag for each platform. These are all false for now.
- Removes Create, ExtractLane, ReplaceLane, Equal, NotEqual, Swizzle and Shuffle
  opcodes from the Boolean types. These are unlikely to be well supported natively,
  and can be synthesized using Select.
- Changes the signature of Relational opcodes to return boolean vectors.
- Changes the signature of Select opcodes to take boolean vectors.
- Updates the ARM implementation of Relational and Select opcodes.

LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2700813002
Cr-Commit-Position: refs/heads/master@{#43348}

Use an opaque format for the frame type marker on the stack, where the
marker is simply shifted left by 1 instead of being a Smi. This allows
us to generate simpler code for frame initialisation, as we can push a
smaller value, decreasing the prologue by 4 bytes and one instruction.

Drive-by: Use the same format for JsFrameMarker.

Change-Id: I812dde9b37869fe20de4148a665d06cf23ce7372
Reviewed-on: https://chromium-review.googlesource.com/443426Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Daniel Clifford <danno@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43347}

Exclude memory reducing scenarios and apply minimum percentage to absolute
sizes wrt. capacity rather then relative survival rate.

R=ulan@chromium.org
BUG=chromium:693413

Change-Id: I30cac99a2ce72227e269d72f52a459d4be6234a5
Reviewed-on: https://chromium-review.googlesource.com/445737Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43346}

FCG implemented an optimziation which could avoid emitting a memento if the
memento was only needed for transitioning. This optimization is currently
turned off as we always run with pretenuring. Since this optimization will not
be ported to Ignition for now, we just remove the support from FCG.

Disabling allocation site pretenuring will then not make FCG and Iginition
diverge in their behavior.

BUG=chromium:693413

Change-Id: I69aea73426fc69d48e1fe6ed13caaf28f9cfb32f
Reviewed-on: https://chromium-review.googlesource.com/445258
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43345}

This fixes a missing name check for keyed property loads targeting the
global object where the feedback was warmed up with a single name. This
affects {JSLoadProperty} nodes only, syntactic global property loads via
the {JSLoadGlobal} operator are not affected.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-694416
BUG=chromium:694416

Change-Id: I54aa3f27eaa72630539f02602ec7642b04835b27
Reviewed-on: https://chromium-review.googlesource.com/445224Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43344}

Decouples return value handling from DebugScope when handling nested break
statements. Return values are handled in ReturnValueScope. This would correctly
reset the return_values when exiting the break statements.

BUG=v8:688950

Review-Url: https://codereview.chromium.org/2702343003
Cr-Commit-Position: refs/heads/master@{#43343}

During concurrent marking we need special handling of object layout
changes that remove tagged in-object fields or replaces them with
untagged in-object fields.

This patch adds a function for notifying object layout changes and
verification code that is triggered on each map change in runtime.

BUG=chromium:694255

Review-Url: https://codereview.chromium.org/2702303002
Cr-Commit-Position: refs/heads/master@{#43342}

It turns out that the default constructor of allocators used in
standard containers is still needed in MSVS 2015.
This CL defines the constructor only when compiling on windows.

R=bbudge@chromium.org

Review-Url: https://codereview.chromium.org/2708593004
Cr-Commit-Position: refs/heads/master@{#43341}

Use the type of the RHS to compute a more precise output type.  In
particular, if the RHS is, say, 1, we now know that the result is a
subtype of Unsigned31.

R=jarin@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2706763003
Cr-Commit-Position: refs/heads/master@{#43340}

R=jarin@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2703113003
Cr-Commit-Position: refs/heads/master@{#43339}

Currently, the default name for wasm functions in generated code is 'wasm', tag wasm functions with the index into the function table to identify functions. Snippets of sample output with --print-code below.

Before:
--- Code ---
kind = WASM_FUNCTION
name = wasm
compiler = turbofan

After:
--- Code ---
kind = WASM_FUNCTION
name = wasm#200
compiler = turbofan

R=mtrofin@chromium.org

Review-Url: https://codereview.chromium.org/2690113012
Cr-Original-Commit-Position: refs/heads/master@{#43296}
Committed: https://chromium.googlesource.com/v8/v8/+/5fc3ac29e4d942ccb4c45f6cdcee75d0b394b296
Review-Url: https://codereview.chromium.org/2690113012
Cr-Commit-Position: refs/heads/master@{#43338}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/3e739fd..769428e

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/84a7af6..71c4c9a

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: I238047fb122635854895bc7a6cc3c5fae9c00790
Reviewed-on: https://chromium-review.googlesource.com/445456Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43337}

Two controls, one for instantiation and one for compilation. They allow
the embedder (e.g. Chrome) check properties of the parameters of those
two operations, and decide if they are allowed to continue.

For example, Chrome may now decline compilation of certain size buffers,
in synchronous cases; same for instantiation (where the buffer size
refers to the size of the buffer containing wasm wire bytes)

BUG=v8:5981

Review-Url: https://codereview.chromium.org/2699843003
Cr-Original-Commit-Position: refs/heads/master@{#43295}
Committed: https://chromium.googlesource.com/v8/v8/+/d9bc0ffb16e633d52d7bcfd547a6125f0e4dfb87
Review-Url: https://codereview.chromium.org/2699843003
Cr-Commit-Position: refs/heads/master@{#43336}

This patch refactors the Atomics builtins so that they are implemented
as C++ builtins rather than experimental JS builtins. Previously, each
of these functions called out to a runtime function, so no significant
change in performance is anticipated. The goal of this patch is to
remove the last user of experimental JS builtins so that the mechanism
can be removed, for performance reasons. The patch includes a drive-by
fix of a check-fail. For the most part, the patch is just moving code
without modification from runtime-atomics.cc to
builtins-sharedarraybuffer.cc .

BUG=v8:5880

Review-Url: https://codereview.chromium.org/2698813004
Cr-Commit-Position: refs/heads/master@{#43335}

This reverts commit 9a407a43.

BUG=chromium:693413

Change-Id: I469dbba6b45982f3a083b30546c60e5dacc5d8a2
Reviewed-on: https://chromium-review.googlesource.com/445198
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43334}

Use TF_BUILTIN() to implement ArrayIncludes(). It's easier on the eyes and
easier to read.

BUG=v8:3575
R=cbruni@chromium.org, ishell@chromium.org

Change-Id: I9cbe395829f0fcc7d01ba28ed7b5a2007c52cae3
Reviewed-on: https://chromium-review.googlesource.com/444830
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43333}

R=clemensh@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2703243002
Cr-Commit-Position: refs/heads/master@{#43332}

This reverts commit 17ef406d.

Reason for revert: <INSERT REASONING HERE>

Original change's description:
> [heap] Add histogram counter for young generation handling
> 
> BUG=chromium:693413
> 
> Change-Id: I6c6bc62e7f2c702be2462e4b0c3704fabf44f9d2
> Reviewed-on: https://chromium-review.googlesource.com/445156
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#43316}

TBR=ulan@chromium.org,mlippautz@chromium.org,hpayer@chromium.org,v8-reviews@googlegroups.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:693413

Change-Id: I38b293d6594278370ec0c5cb20234811b48086f6
Reviewed-on: https://chromium-review.googlesource.com/445179
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43331}

This reverts commit 2c7f32e2.

Reason for revert: <INSERT REASONING HERE>

Original change's description:
> [heap] Add prefix for young generation handling use counter
> 
> R=​ulan@chromium.org
> BUG=chromium:693413
> 
> Change-Id: Ie8e6a5e20e904b81228b67f33c976569e305872c
> Reviewed-on: https://chromium-review.googlesource.com/445157
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#43319}

TBR=ulan@chromium.org,mlippautz@chromium.org,v8-reviews@googlegroups.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:693413

Change-Id: If5d545d98f61931301ccf4166aa2acab82bdf4ca
Reviewed-on: https://chromium-review.googlesource.com/445178Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43330}

BUG=

Review-Url: https://codereview.chromium.org/2710513003
Cr-Commit-Position: refs/heads/master@{#43329}

Handle eval in default parameters.

BUG=v8:5516
R=vogelheim@chromium.org

Change-Id: Ib6543a4aef9a3cc9636e65d0337bc269c8a079dc
Reviewed-on: https://chromium-review.googlesource.com/444747
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43328}

qNaN and sNaN values have different binary representation on MIPS
compared to ARM/x86 architectures. We are skipping these tests because
we can't provide specific NaNs encodings from ARM/x86 architectures.

BUG=

Review-Url: https://codereview.chromium.org/2702213003
Cr-Commit-Position: refs/heads/master@{#43327}

This reverts commit f967d3e9.

Reason for revert: Tanks Mandreel again. Needs investigation.

Original change's description:
> [turbofan] Handle comparison operations in early lowering.
> 
> This handles comparison operations (equality and relational) having
> number feedback during the early type-hint lowering (i.e. during graph
> construction).
> 
> R=​bmeurer@chromium.org
> 
> Change-Id: I97afd6c0d78a790ce38b731f2532ca18d812a32c
> Reviewed-on: https://chromium-review.googlesource.com/444766
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#43315}

TBR=mstarzinger@chromium.org,bmeurer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Change-Id: Iec335827fe841ac6f1bd45ce095d0a741b2ff5b5
Reviewed-on: https://chromium-review.googlesource.com/445177Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43326}

This extends the matching of arithmetic operations against the loop
induction variable to speculative number operations (on top of the
existing JS-level operations). This is needed now that lowering to
speculative operations is done during graph construction.

R=jarin@chromium.org
BUG=chromium:693035

Change-Id: I7c3f71af92b5c059f1d7b3b7f2d3b4a73d7dc43d
Reviewed-on: https://chromium-review.googlesource.com/445196Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43325}

All patching logic is now bundled in one compilation unit.
The CodeSpecialization object is set up by all relocation and patching
that should be applied, and then be run on individual code objects or
the whole instance in one go. We hence only need to iterate all
relocation tables exactly once at instantiation.
Also, we do not patch contexts any more since we do not embed them in
generated code any more.

R=titzer@chromium.org
BUG=v8:5991

Review-Url: https://codereview.chromium.org/2696143006
Cr-Commit-Position: refs/heads/master@{#43324}

Take runtime path if startIndex parameter requires a ToInteger() call,
which can modify the elements kind of the receiver.

This removes a stub call from the builtin, and simplifies code slightly.

BUG=v8:5986
R=bmeurer@chromium.org, cbruni@chromium.org

Change-Id: Id238a81ab8ba28621858004b34d00a4356b8037f
Reviewed-on: https://chromium-review.googlesource.com/445006Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Cr-Commit-Position: refs/heads/master@{#43323}

The generated code for JSToWasm wrappers only depends on the signature
of the exported function. Hence, we can reuse the generated code and
just patch the reference to the called wasm code.

For the unity-wasm benchmark, we reach a hit rate of 98.07% for this
cache, and only 395 instead of 20471 wrappers are compiled. This brings
down instantiation time from 2.9s to 1.6s on a MBP.

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2705993002
Cr-Commit-Position: refs/heads/master@{#43322}

[turbofan] escape analysis bugfixes that got reverted with https://codereview.chromium.org/2680973013/

R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2701403003
Cr-Commit-Position: refs/heads/master@{#43321}