BUG= https://bugs.chromium.org/p/v8/issues/detail?id=4203

Review-Url: https://codereview.chromium.org/2200213002
Cr-Commit-Position: refs/heads/master@{#38259}

Revert of Put Scopes into temporary Zone (patchset #12 id:220001 of https://codereview.chromium.org/2193793002/ )

Reason for revert:
Broke Node.js tests (test-require-dot etc.)

Original issue's description:
> Put Scopes into temporary Zone
>
> When parsing a eagerly-parsed-but-lazily-compiled function, we
> used to put some of its AST nodes into a discardable Zone. This
> CL puts the function Scope, its inner Scopes and the related AST
> nodes (Declarations, VariableProxys) into the temporary Zone
> too. This reduces peak memory usage and enables future work to
> keep the temporary Zone around for later compilation.
>
> BUG=
>
> Committed: https://crrev.com/eaebdd858b466057ccc39894a172c9b66868e8f7
> Cr-Commit-Position: refs/heads/master@{#38232}

TBR=adamk@chromium.org,titzer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review-Url: https://codereview.chromium.org/2205013002
Cr-Commit-Position: refs/heads/master@{#38258}

This prepares for adding the ignition_staging variant to the
default variant set.

BUG=v8:5238

Review-Url: https://codereview.chromium.org/2205883002
Cr-Commit-Position: refs/heads/master@{#38257}

It's shipped in M52.

R=caitp@igalia.com, littledan@chromium.org

Review-Url: https://codereview.chromium.org/2203843002
Cr-Commit-Position: refs/heads/master@{#38256}

BUG=v8:4561

Review-Url: https://codereview.chromium.org/2190973003
Cr-Commit-Position: refs/heads/master@{#38255}

This is not referenced anymore by the infrastructure after:
https://codereview.chromium.org/2202113003/

BUG=v8:5238

Review-Url: https://codereview.chromium.org/2203023003
Cr-Commit-Position: refs/heads/master@{#38254}

This adds a gyp/gn variable to control printing to stdout
on Android. This is false by default and true for all
v8 stand-alone android bots.

BUG=chromium:629806

Review-Url: https://codereview.chromium.org/2183063002
Cr-Commit-Position: refs/heads/master@{#38253}

Review-Url: https://codereview.chromium.org/2203573004
Cr-Commit-Position: refs/heads/master@{#38252}

Review-Url: https://codereview.chromium.org/2197393003
Cr-Commit-Position: refs/heads/master@{#38251}

This completely removes translation of exception handler predictions
from the graph IR. We now rely on the runtime using deoptimization
infomation via {FrameSummary} for predictions in optimized code.

R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2207533002
Cr-Commit-Position: refs/heads/master@{#38250}

We no longer need NeanderObject, the only user left was the message listener
machanism which could be replace by direct uses of FixedArrays.

BUG=chromium:630217

Review-Url: https://codereview.chromium.org/2195243003
Cr-Commit-Position: refs/heads/master@{#38249}

It should be enough to specify --variants=... with the
desired set of variants. The stress/nostress shortcuts
might get confusing soon, as we intend to move the stress
option out of the developer default set.

BUG=v8:5238

Review-Url: https://codereview.chromium.org/2195373002
Cr-Commit-Position: refs/heads/master@{#38248}

R=mstarzinger@chromium.org

Review-Url: https://codereview.chromium.org/2197183002
Cr-Commit-Position: refs/heads/master@{#38247}

BUG=

Review-Url: https://codereview.chromium.org/2201073002
Cr-Commit-Position: refs/heads/master@{#38246}

Review-Url: https://codereview.chromium.org/2204873003
Cr-Commit-Position: refs/heads/master@{#38245}

Review-Url: https://codereview.chromium.org/2204893002
Cr-Commit-Position: refs/heads/master@{#38244}

Revert of [heap] Re-enable black allocation when finalizing marking. (patchset #1 id:1 of https://codereview.chromium.org/2202993002/ )

Reason for revert:
Crashes on tree.

Original issue's description:
> [heap] Re-enable black allocation when finalizing marking.
>
> BUG=chromium:630386
> LOG=n
>
> Committed: https://crrev.com/2c75cfd731e11daa649faf2e91cbb84767b11f8e
> Cr-Commit-Position: refs/heads/master@{#38240}

TBR=ulan@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:630386

Review-Url: https://codereview.chromium.org/2204593005
Cr-Commit-Position: refs/heads/master@{#38243}

This is a simple cleanup to use the recently added CheckMaps operator
instead of the hand-crafted map check sequence.

R=epertoso@chromium.org

Review-Url: https://codereview.chromium.org/2199263002
Cr-Commit-Position: refs/heads/master@{#38242}

We cannot just blindly make a representation selection for Phi or Select
based on the truncations, but we also need to consider the type of the
inputs (or actually of the Phi/Select node itself). We can only use
Word32 representation based on Word32 truncation if the inputs are
Number or Oddball, same for Float64.

R=epertoso@chromium.org
BUG=v8:5255

Review-Url: https://codereview.chromium.org/2206553002
Cr-Commit-Position: refs/heads/master@{#38241}

BUG=chromium:630386
LOG=n

Review-Url: https://codereview.chromium.org/2202993002
Cr-Commit-Position: refs/heads/master@{#38240}

BUG=

Review-Url: https://codereview.chromium.org/2205853002
Cr-Commit-Position: refs/heads/master@{#38239}

Without this fix, two rules [PASS, MODIFIER] and [FAIL]
would be joined as [PASS, MODIFIER, FAIL], undermining the
intention of the second rule to mark a test as failing.

BUG=v8:4680,v8:4900

Review-Url: https://codereview.chromium.org/2201033002
Cr-Commit-Position: refs/heads/master@{#38238}

R=machenbach@chromium.org

Review-Url: https://codereview.chromium.org/2207503002
Cr-Commit-Position: refs/heads/master@{#38237}

The client can use scriptId + lineNumber + columnNumber
to uniquelly identify the call site.

Review-Url: https://codereview.chromium.org/2199003003
Cr-Commit-Position: refs/heads/master@{#38236}

This adds support for lowering keyed access to JSTypedArray objects to
element loads and stores instead of IC calls. There's still a lot of
room for improvement, but the improvements can be done incrementally
later.

We add a dedicated UnsafePointerAdd operator, which sits in the effect
chain, and does the (GC invisible) computation of addresses that are
potentially inside HeapObjects. Also there's now a dedicated Retain
operator, which ensures that we retain a certain tagged value, which is
necessary to ensure that we keep a JSArrayBuffer alive as long as we
might still potentially access elements in its backing store.

R=epertoso@chromium.org

Review-Url: https://codereview.chromium.org/2203693002
Cr-Commit-Position: refs/heads/master@{#38235}

This type is not supposed to be constructable by users. Internally, we
use CallSiteUtils::Construct to create CallSite objects; and we simply
map a thrower builtin as the public CallSite constructor.

R=yangguo@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2201823002
Cr-Commit-Position: refs/heads/master@{#38234}

This makes sure we are not inserting {OsrPoll} instructions for any
statements that are not actually loops and have no back edges. Without
back edges the {BytecodeGraphBuilder} is unable to deduce loop ranges
and hence cannot construct a graph for OSR entry.

R=neis@chromium.org
TEST=mjsunit/regress/regress-5252
BUG=v8:5252

Review-Url: https://codereview.chromium.org/2200733002
Cr-Commit-Position: refs/heads/master@{#38233}

When parsing a eagerly-parsed-but-lazily-compiled function, we
used to put some of its AST nodes into a discardable Zone. This
CL puts the function Scope, its inner Scopes and the related AST
nodes (Declarations, VariableProxys) into the temporary Zone
too. This reduces peak memory usage and enables future work to
keep the temporary Zone around for later compilation.

BUG=

Review-Url: https://codereview.chromium.org/2193793002
Cr-Commit-Position: refs/heads/master@{#38232}

When we narrow a signed32 comparison to uint8 or uint16 representation,
we also need to change the condition to unsigned comparisons otherwise
the comparison will be done on int16/int8 which interprets the narrowed
bits wrong.

R=epertoso@chromium.org
BUG=v8:5254

Review-Url: https://codereview.chromium.org/2202803003
Cr-Commit-Position: refs/heads/master@{#38231}

BUG=

Review-Url: https://codereview.chromium.org/2195313003
Cr-Commit-Position: refs/heads/master@{#38230}

Use CodeStubAssembler functions instead of LoadObjectField with
the offset.

BUG=

Review-Url: https://codereview.chromium.org/2198133002
Cr-Commit-Position: refs/heads/master@{#38229}

BUG=

Review-Url: https://codereview.chromium.org/2200713002
Cr-Commit-Position: refs/heads/master@{#38228}

Replace hydrogen stub for typeof with TurboFan stub.

BUG=chromium:608675

Review-Url: https://codereview.chromium.org/2195863002
Cr-Commit-Position: refs/heads/master@{#38227}

Revert of [builtins] implement Array.prototype.includes in TurboFan (patchset #20 id:380001 of https://codereview.chromium.org/2146293003/ )

Reason for revert:
[Sheriff] Breaks:
https://build.chromium.org/p/client.v8.ports/builders/V8%20Arm%20-%20builder/builds/2592

Original issue's description:
> [builtins] implement Array.prototype.includes in TurboFan
>
> BUG=v8:5162
> R=bmeurer@chromium.org, ishell@chromium.org
>
> Committed: https://crrev.com/a488b5d8eb111a4883dc400bd826d079420edd68
> Cr-Commit-Position: refs/heads/master@{#38223}

TBR=adamk@chromium.org,bmeurer@chromium.org,cbruni@chromium.org,danno@chromium.org,ishell@chromium.org,littledan@chromium.org,caitp@igalia.com
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5162

Review-Url: https://codereview.chromium.org/2202163002
Cr-Commit-Position: refs/heads/master@{#38226}

Cr-Commit-Position: refs/heads/master@{#38225}

Rolling v8/build to a3a00fec14304015b590b283ba8ef6227aad4f53

Rolling v8/tools/mb to 65caad70eb36f22f3fcac6daa2f82365c0521657

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2199203003
Cr-Commit-Position: refs/heads/master@{#38224}

BUG=v8:5162
R=bmeurer@chromium.org, ishell@chromium.org

Review-Url: https://codereview.chromium.org/2146293003
Cr-Commit-Position: refs/heads/master@{#38223}

These are internal fields of the JSBoundFunction class.

Review-Url: https://codereview.chromium.org/2193993002
Cr-Commit-Position: refs/heads/master@{#38222}

The initialization of static variables that were used originally caused
a data race because multiple threads tried to initialize the variables
at the same time. The use of a LazyInstance guarantees that the
variables get initialized exactly once.

The same problem also existed in c-linkage.cc. There I fixed the problem
by using a local variable instead of a static variable.

BUG=v8:5242
R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2202433003
Cr-Commit-Position: refs/heads/master@{#38221}

BUG=

Review-Url: https://codereview.chromium.org/2202633002
Cr-Commit-Position: refs/heads/master@{#38220}