BUG=chromium:694255

Review-Url: https://codereview.chromium.org/2852953004
Cr-Commit-Position: refs/heads/master@{#45030}

TBR=jochen@chromium.org
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true

Change-Id: I79b1f4a599f4f74c7fa077532ca1ba8ada139ede
Reviewed-on: https://chromium-review.googlesource.com/493289Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45029}

R=machenbach@chromium.org
NOTRY=true
NOTREECHECKS=true

Bug: 
Change-Id: Ib6d3768a9e0cfb9ea5fdcece25325e8d498520af
Reviewed-on: https://chromium-review.googlesource.com/493288Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45028}

This reverts commit c5ad9c6d.

Reason for revert: Fails on gc stress:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/builds/12661

Original change's description:
> [TypeFeedbackVector] Store optimized code in the vector
> 
> Since the feedback vector is itself a native context structure, why
> not store optimized code for a function in there rather than in
> a map from native context to code? This allows us to get rid of
> the optimized code map in the SharedFunctionInfo, saving a pointer,
> and making lookup of any optimized code quicker.
> 
> Original patch by Michael Stanton <mvstanton@chromium.org>
> 
> BUG=v8:6246
> 
> Change-Id: I60ff8c408c3001bc272b4b198c9cbaea2872a9e5
> Reviewed-on: https://chromium-review.googlesource.com/476891
> Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
> Reviewed-by: Michael Stanton <mvstanton@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#45022}

TBR=ulan@chromium.org,rmcilroy@chromium.org,yangguo@chromium.org,mvstanton@chromium.org,jarin@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:6246

Change-Id: I9cd5735b03898cae6ae7adea0f19d32fceb31619
Reviewed-on: https://chromium-review.googlesource.com/493287Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45027}

Remains to port these fixes over to gyp.

R=machenbach@chromium.org, jkummerow@chromium.org, mstarzinger@chromium.org
BUG=v8:6325

Change-Id: I3bebbc6d0ec52fcb60e3d51acd27e616f51d3dbb
Reviewed-on: https://chromium-review.googlesource.com/490108
Commit-Queue: Jochen Eisinger <jochen@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45026}

If an embedder doesn't re-use templates, we'll otherwise run out of
memory.

BUG=v8:6336
R=cbruni@chromium.org

Change-Id: Ib70054d3e9d12a6a606f0c4e35233edc69253c49
Reviewed-on: https://chromium-review.googlesource.com/493166Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Jochen Eisinger <jochen@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45025}

BUG=v8:6113,v8:6325

Review-Url: https://codereview.chromium.org/2853783003
Cr-Commit-Position: refs/heads/master@{#45024}

The test and associated bug have been fixed a while ago.

BUG=chromium:336820,v8:6325

Review-Url: https://codereview.chromium.org/2851343002
Cr-Commit-Position: refs/heads/master@{#45023}

Since the feedback vector is itself a native context structure, why
not store optimized code for a function in there rather than in
a map from native context to code? This allows us to get rid of
the optimized code map in the SharedFunctionInfo, saving a pointer,
and making lookup of any optimized code quicker.

Original patch by Michael Stanton <mvstanton@chromium.org>

BUG=v8:6246

Change-Id: I60ff8c408c3001bc272b4b198c9cbaea2872a9e5
Reviewed-on: https://chromium-review.googlesource.com/476891
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45022}

Currently used for observing moves for profiling. In the future this
will be used to transfer colors for the minor MC too.

BUG=chromium:651354

Review-Url: https://codereview.chromium.org/2846043003
Cr-Commit-Position: refs/heads/master@{#45021}

Give the IC one more chance to get itself into a state that's in
line with Turbofan's capabilities and the following assertOptimized
expectation.

BUG=v8:6101,v8:6325

Review-Url: https://codereview.chromium.org/2848193003
Cr-Commit-Position: refs/heads/master@{#45020}

This ensures exceptions thrown during parsing are properly propagated
into the surrounding {v8::TryCatch} block. Otherwise running more than
one test input in the same Isolate can fail due to pending exceptions. 

R=jochen@chromium.org
BUG=chromium:715037

Change-Id: Iaa5735515dc097d8cb12dcf8672451f3c9503440
Reviewed-on: https://chromium-review.googlesource.com/490047
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45019}

This commit adds a getter for the private is_verbose_ member.
The use case for this comes from Node.js where the ability to avoid
calling FatalException if the TryCatch is verbose would be nice to have.

BUG=

Review-Url: https://codereview.chromium.org/2840803002
Cr-Commit-Position: refs/heads/master@{#45018}

As jobs are picked up in the same order by background tasks as they are
when FinishAll is called it may happen that the main thread just waits
for background threads without doing any work. So first run jobs, that
are not running in background, to completion and then wait for remaining
jobs to finish.

BUG=v8:6093

Change-Id: Ica83db2a504771b633cfdfc4e95e1ac8e43111d6
Reviewed-on: https://chromium-review.googlesource.com/488244Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Wiktor Garbacz <wiktorg@google.com>
Cr-Commit-Position: refs/heads/master@{#45017}

While parsing top-level code eager functions are skipped just like lazy
ones, but also a parse task is created for each.

The parse tasks are run by the compiler dispatcher and can be executed
either on background thread or in idle time.
After parsing of top-level code finishes it waits for all unfinished
parser tasks - possibly picking up and executing them on current thread.
Afterwards parse task results are stitched together with top-level AST,
in case of failures eager functions are treated just like lazy -
parsing/compilation is retriggered for them in the runtime and proper
errors are generated (performance is not optimized for error case at
all).

BUG=v8:6093

Change-Id: Ie6508211a04b90becfe44139cce1c8ecec386b6e
Reviewed-on: https://chromium-review.googlesource.com/486725Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Commit-Queue: Wiktor Garbacz <wiktorg@google.com>
Cr-Commit-Position: refs/heads/master@{#45016}

ErrorThrower is not concurrency safe, thus we should not use it from
background tasks. Instead, allocate an ErrorThrower whenever we
actually want (or might) throw.
Pass the ErrorThrower from step 4 to step 5 explicitly.

R=ahaas@chromium.org, mtrofin@chromium.org

Change-Id: Ifb6b16cab7939ec9c81e4f2db59ee42d5ddd7f85
Reviewed-on: https://chromium-review.googlesource.com/489501
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45015}

In the simulators, the ExternalReference constructor rewrites external
addresses, which involves mutating a linked list rooted in the isolate.

We already construct external references concurrently (at least in Turbofan),
but the list mutation was not thread-safe (though no crashes are known). This
CL adds the necessary locking.

BUG=v8:6048

Review-Url: https://codereview.chromium.org/2852983002
Cr-Commit-Position: refs/heads/master@{#45014}

BUG=v8:6093

Change-Id: I365fbd7c3f33e2de47e0a84ee3ea631b4ffa6d35
Reviewed-on: https://chromium-review.googlesource.com/488243Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Commit-Queue: Wiktor Garbacz <wiktorg@google.com>
Cr-Commit-Position: refs/heads/master@{#45013}

As required by #sec-built-in-function-objects.
They were strict functions before (see
e2f1c269), but that got lost when they
were ported to ASM builtins.
This makes optimized and non-optimized code agree on the same behavior
in regress-105.js.

BUG=v8:105,v8:5778,v8:6325

Review-Url: https://codereview.chromium.org/2848313004
Cr-Commit-Position: refs/heads/master@{#45012}

Bug: chromium:716804
Change-Id: I0ef5169e2af34ec2d794c99e99d9e31035599744
Reviewed-on: https://chromium-review.googlesource.com/493146
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45011}

BUG=v8:6325

Change-Id: I5a638c47b33d6e75d31f020c499ffd084348fea4
Reviewed-on: https://chromium-review.googlesource.com/489505
Commit-Queue: Wiktor Garbacz <wiktorg@google.com>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Daniel Clifford <danno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45010}

This is for https://crrev.com/2851953002/

BUG= chromium:716359

Review-Url: https://codereview.chromium.org/2853783002
Cr-Commit-Position: refs/heads/master@{#45009}

Bug:v8:6325

Change-Id: Ic829561c013673137c405538c6d7d854b07c36d3
Reviewed-on: https://chromium-review.googlesource.com/490110Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Franziska Hinkelmann <franzih@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45008}

BUG=

Review-Url: https://codereview.chromium.org/2806313002
Cr-Commit-Position: refs/heads/master@{#45007}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/3b48c72..4a81c96

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/1c3f4b9..9300a23

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: I47fa12dafc25c48be4f86c8d4324474be3019ec3
Reviewed-on: https://chromium-review.googlesource.com/492846Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45006}

 - Ops: S128Load, S128Store, S128And, S128Or, S128Xor, S128Not, I32x4AddHoriz, I16x8AddHoriz
 - Add x64 assembler support for - phaddd, phaddw, pand, por
 - Enable tests for Globals, other tests applicable to x64 apart from tests for implemented ops

BUG=v8:6020

R=bbudge@chromium.org, bmeurer@chromium.org, zvi.rackover@intel.com

Review-Url: https://codereview.chromium.org/2849463003
Cr-Commit-Position: refs/heads/master@{#45005}

R=bbudge@chromium.org,gdeepti@chromium.org,mtrofin@chromium.org
BUG=v8:6020

Review-Url: https://codereview.chromium.org/2843523002
Cr-Commit-Position: refs/heads/master@{#45004}

getPossibleBreakpoints implementation can enforce function compilation which potentially can produce syntax error, we need to have a context to correctly report this error.

BUG=chromium:715334
R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2851853002
Cr-Commit-Position: refs/heads/master@{#45003}

BUG=v8:6325

R=bradnelson@chromium.org

Review-Url: https://codereview.chromium.org/2844163006
Cr-Commit-Position: refs/heads/master@{#45002}

This makes the size of the class smaller by 8 bytes on 64-bit. I looked at the usage
pattern. Even though it seems the number of instances doesn't get higher
than a few thousand, this class is still very hot because it is constructed and
passed by value a lot. So perhaps reducing the size would make passing this
class by value or growing arrays more optimal and might save some cycles.

Before:
    class v8::internal::compiler::Constant [sizeof = 24] {
      [sizeof=4] v8::internal::compiler::Constant::Type type_
      <padding> (4 bytes)
      [sizeof=8] __int64 value_
      [sizeof=4] v8::internal::RelocInfo::Mode rmode_
      <padding> (4 bytes)
    }

After:
    class v8::internal::compiler::Constant [sizeof = 16] {
      [sizeof=4] v8::internal::compiler::Constant::Type type_
      [sizeof=4] v8::internal::RelocInfo::Mode rmode_
      [sizeof=8] __int64 value_
    }

BUG=chromium:710933

Review-Url: https://codereview.chromium.org/2841343002
Cr-Commit-Position: refs/heads/master@{#45001}

The error thrower did allocate the exception at the moment the error was
detected. For async compilation, this meant in another step than when
it was actually thrown. Since the HandleScope of the exception already
died at that point, this would have lead to memory errors.

With this refactoring, we only store the information needed to generate
the exception in the ErrorThrower, and only generate the exception
object once it is actually needed.

With regression test.

R=ahaas@chromium.org, mtrofin@chromium.org
Also-by: ahaas@chromium.org

Change-Id: Iffcab1f8d1cf5925e3643fcf0729ba9a84c7d277
Reviewed-on: https://chromium-review.googlesource.com/490085
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45000}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/853f22f..3b48c72

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/fa1d11d..1c3f4b9

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: Id2423842f165fdf342fc28453b7a5c80b1ebe9fe
Reviewed-on: https://chromium-review.googlesource.com/490730Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44999}

This CL changes certain frequently-called Array builtins to use CodeStubArguments
rather than peek at the stack frames above array builtins to determine if options
arguments have been passed into them.

Previous failure likely due to unfortunate/unluckily timed GC that moved due to
changed timing/allocation from this CL. Test mitigation for allocation-site-info.js
included.

BUG=v8:1956
LOG=N

Review-Url: https://codereview.chromium.org/2829093004
Cr-Commit-Position: refs/heads/master@{#44998}

Revert of [turbofan] Avoid going through ArgumentsAdaptorTrampoline for CSA/C++ builtins (patchset #8 id:140001 of https://codereview.chromium.org/2829093004/ )

Reason for revert:
Still fails. Likely has to do with gc heap size for allocation site tests, mitigation pending...

Original issue's description:
> [turbofan] Reland: Avoid going through ArgumentsAdaptorTrampoline for select CSA array builtins
>
> This CL changes certain frequently-called Array builtins to use CodeStubArguments
> rather than peek at the stack frames above array builtins to determine if options
> arguments have been passed into them.
>
> Previous failure cannot be reproed with failing config. Flake?
>
> BUG=v8:1956
> LOG=N
>
> Review-Url: https://codereview.chromium.org/2829093004
> Cr-Commit-Position: refs/heads/master@{#44996}
> Committed: https://chromium.googlesource.com/v8/v8/+/7ca381e84792b83581d0199dfae2888781785273

TBR=mvstanton@chromium.org,ishell@chromium.org,bmeurer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:1956

Review-Url: https://codereview.chromium.org/2851063002
Cr-Commit-Position: refs/heads/master@{#44997}

This CL changes certain frequently-called Array builtins to use CodeStubArguments
rather than peek at the stack frames above array builtins to determine if options
arguments have been passed into them.

Previous failure cannot be reproed with failing config. Flake?

BUG=v8:1956
LOG=N

Review-Url: https://codereview.chromium.org/2829093004
Cr-Commit-Position: refs/heads/master@{#44996}

Revert of [turbofan] Avoid going through ArgumentsAdaptorTrampoline for CSA/C++ builtins (patchset #8 id:140001 of https://codereview.chromium.org/2829093004/ )

Reason for revert:
Nosnap failure

Original issue's description:
> [turbofan] Avoid going through ArgumentsAdaptorTrampoline for select CSA/C++ builtins
>
> This CL changes certain frequently-called Array builtins to use CodeStubArguments
> rather than peek at the stack frames above array builtins to determine if options
> arguments have been passed into them.
>
> BUG=v8:1956
> LOG=N
>
> Review-Url: https://codereview.chromium.org/2829093004
> Cr-Commit-Position: refs/heads/master@{#44994}
> Committed: https://chromium.googlesource.com/v8/v8/+/680356278ddc7577e3b967fcc92055522ce00856

TBR=mvstanton@chromium.org,ishell@chromium.org,bmeurer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:1956

Review-Url: https://codereview.chromium.org/2851703005
Cr-Commit-Position: refs/heads/master@{#44995}

This CL changes certain frequently-called Array builtins to use CodeStubArguments
rather than peek at the stack frames above array builtins to determine if options
arguments have been passed into them.

BUG=v8:1956
LOG=N

Review-Url: https://codereview.chromium.org/2829093004
Cr-Commit-Position: refs/heads/master@{#44994}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/02044bf..853f22f

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/9c9ac13..fa1d11d

Rolling v8/third_party/instrumented_libraries: https://chromium.googlesource.com/chromium/src/third_party/instrumented_libraries/+log/05d5695..0ad2bcb

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: I0621ed2aba116528d4699e8407d20b16c6cd8ae9
Reviewed-on: https://chromium-review.googlesource.com/490867Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44993}

This reverts commit 4968b2c4.

Reason for revert: Speculative revert for severe perf regression
https://bugs.chromium.org/p/chromium/issues/detail?id=716468#c3

Original change's description:
> [intl] Switch to using declared accessors
> 
> This patch cleans up the Intl code by switching to using declared
> accessors, rather than embedder fields, for holding references to
> ICU objects. Additionally:
> - Rename classes to be more similar to how other classes are named
> - Make some unreachable paths into check-fails, rather than throwing
>   JS exceptions
> - Move some macros from objects-inl.h into object-macros.h, to allow
>   the implementation here to not touch objects.h
> - Some setup logic is moved from runtime-i18n.cc to i18n.cc.
> 
> This patch leaves type tags as they are; a future patch should move
> from a special Intl type tagging system to object types as other system
> objects use. Future patches should also move more logic to i18n.cc
> 
> BUG=v8:5402,v8:5751,v8:6057
> CQ_INCLUDE_TRYBOTS=master.tryserver.v8:v8_linux_noi18n_rel_ng
> 
> Change-Id: Ia9cbb25cf8f52662e3deb15e64179d792c10842c
> Reviewed-on: https://chromium-review.googlesource.com/479651
> Commit-Queue: Daniel Ehrenberg <littledan@chromium.org>
> Reviewed-by: Adam Klein <adamk@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#44804}

TBR=adamk@chromium.org,marja@chromium.org,mstarzinger@chromium.org,littledan@chromium.org,jwolfe@igalia.com
# Not skipping CQ checks because original CL landed > 1 day ago.
BUG=v8:5402,v8:5751,v8:6057
CQ_INCLUDE_TRYBOTS=master.tryserver.v8:v8_linux_noi18n_rel_ng

Change-Id: I7a45d7def1f1de0f21e3efb7de9b31f6bcfea46d
Reviewed-on: https://chromium-review.googlesource.com/490328Reviewed-by: Daniel Ehrenberg <littledan@chromium.org>
Commit-Queue: Daniel Ehrenberg <littledan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44992}

The current test/fuzzer/wasm directory is used for two things:
1) as the corpus directory for clusterfuzz
2) to test in v8 that the fuzzer runs correctly.

With the newly added files from the wasm spec tests this directory grew
quite big and adds unnecessary load on the trybots. Therefore I want to
do the following steps:
1) In this CL for V8: create a new directory for the clusterfuzz corpus
2) In chromium: use the new corpus directory
3) In v8: clean up the old directory to use it on the trybots.

R=bradnelson@chromium.org
CC=mmoroz@chromium.org

Change-Id: If690022558bb5780edf5a3649fb9745ef9c7407a
Reviewed-on: https://chromium-review.googlesource.com/490367
Commit-Queue: Brad Nelson <bradnelson@chromium.org>
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44991}