BUG=chromium:635948
R=dgozman@chromium.org,alph@chromium.org

Review-Url: https://codereview.chromium.org/2336023002
Cr-Commit-Position: refs/heads/master@{#39363}

Going forward we may relax this, but it is a conscious decision to be made.

BUG=chromium:635948
R=dgozman@chromium.org,alph@chromium.org

Review-Url: https://codereview.chromium.org/2337523003
Cr-Commit-Position: refs/heads/master@{#39362}

This change avoids needing to keep around an unused compiled
module. Instead, the result of compiling the wasm bytes is
given to the first instance. The module object and that instance object
point to the same compiled module. Instances are, then, cloned from
the compiled module the module object points to. When an instance is
collected, we make sure that the module object still has a clone
available, and, if the last instance is GC-ed, we also reset the compiled
module so that it does not reference its heap, so that it (==heap) may
be collected.

This is achieved by linking the clones in a double-linked list and
registering a finalizer for each. When we create an instance, we tie it
in the front of the list, making the module object point to it (O(1)). When
the finalizer is called, we relink the list over the dying object (O(1)). The
costliest operation is finalizing the last instance, since we need to visit
all wasm functions and reset heap references.

BUG=v8:5316

Committed: https://crrev.com/01f5af515728aebe6c5246f4f7dd6c573e8748af
Review-Url: https://codereview.chromium.org/2305903002
Cr-Original-Commit-Position: refs/heads/master@{#39153}
Cr-Commit-Position: refs/heads/master@{#39361}

Moved the compilation/instantiation pipeline to work off the
module object (JSObject), making the compiled module data (the
FixedArray) an implementation detail. This:
- simplifies the code by removing duplicate decode->compile->instantiate
sequences
- sets up the stage for "dressing up" the runtime model with
stronger typed APIs
- helps relanding this CL: https://codereview.chromium.org/2305903002/.
  It turns out that GCs during the cloning/instantiation events cause
trouble, and centering the source of truth on the module object helps
address this issue.

In the process, clarified cctest setup for wasm-capable isolates,
and changed signatures for consistency (using ModuleOrigin througout).

BUG=

Review-Url: https://codereview.chromium.org/2320723005
Cr-Commit-Position: refs/heads/master@{#39360}

The raw pointer to the parameter_map might get stale in case of accessors present on
the arguments object.
Drive-by-fix: use nullptr instead of the_hole with isolate access.

BUG=chromium:645680

Review-Url: https://codereview.chromium.org/2332503002
Cr-Commit-Position: refs/heads/master@{#39359}

BUG=chromium:645851

Review-Url: https://codereview.chromium.org/2332633002
Cr-Commit-Position: refs/heads/master@{#39358}

The whitelist is populated with those inline intrinsics that are lowered
in JSIntrinsicInlining and were not previously blacklisted. Thus the only
additional FrameStates this CL adds are those where the caller tries to
call the INLINE version of an intrinsic but ends up calling the RUNTIME
version instead.

R=bmeurer@chromium.org
BUG=chromium:644631

Review-Url: https://codereview.chromium.org/2331543002
Cr-Commit-Position: refs/heads/master@{#39357}

Backtrace() and backtrace_symbols() API are not supported on
AIX and there are no user-mode equivalent API for the same.
For now, disabling the call to those API.
Currently this is preventing V8 to build on AIX.
This debug functionality was added in
https://codereview.chromium.org/2248393002

R=rmcilroy@chromium.org

BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2324453002
Cr-Commit-Position: refs/heads/master@{#39356}

Rolling v8/base/trace_event/common to 26eac53e73b09625e9b8f783b479e54fcae85f58

Rolling v8/build to 9d601d07a9adaa2719d114290e79084d429a7dab

Rolling v8/third_party/WebKit/Source/platform/inspector_protocol to f9c1216417fe8e8f99d861a4d9cf360ae1d8645e

Rolling v8/tools/clang to 4ac706a04b38c05a8012257dc657e069134902c7

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2331963002
Cr-Commit-Position: refs/heads/master@{#39355}

BUG=v8:5269

Review-Url: https://codereview.chromium.org/2322373002
Cr-Commit-Position: refs/heads/master@{#39354}

Reland "[heap] Fix a formatting bug in --trace-incremental-marking. (patchset #2 id:20001 of https://codereview.chromium.org/2324623004/ )"

This reverts commit 6c2a217e.

The performance regression in crbug.com/645411 was not caused
by the original CL.

TBR=mlippautz@chromium.org

Review-Url: https://codereview.chromium.org/2329983002
Cr-Commit-Position: refs/heads/master@{#39353}

This adds partial support of exports to the runtime system and
to the interpreter. It introduces a new HeapObject JSModule that
maps each of the module's export names to a Cell containing the
exported value.

Several aspects of this implementation are subject to change in
follow-up CLs.

BUG=v8:1569

Committed: https://crrev.com/241a0412eed919395a2e163b30b9b66071ce5c17
Review-Url: https://codereview.chromium.org/2302783002
Cr-Original-Commit-Position: refs/heads/master@{#39341}
Cr-Commit-Position: refs/heads/master@{#39352}

With this CL the wasm-code-fuzzer first decodes and interprets the test
case generated by the fuzzer. It then compiles the test case, but only
executes the compiled instance if the interpretation of the test case
was successful. If the compiled instance is executed, then the result of
the execution is compared with the result of the interpretation.

Additionally this CL refactors the CompileAndRunWasmModule function in
wasm-module.cc to resuse code in the call to the interpreter.

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2321443002
Cr-Commit-Position: refs/heads/master@{#39351}

BUG=v8:5269

Review-Url: https://codereview.chromium.org/2325013003
Cr-Commit-Position: refs/heads/master@{#39350}

We shall not mix AVX and SSE instructions as that can cause performance
regressions in some areas, so make sure to emit vsqrtsd instead of
sqrtsd when AVX is enabled.

R=ahaas@chromium.org

Review-Url: https://codereview.chromium.org/2335603002
Cr-Commit-Position: refs/heads/master@{#39349}

This patch changes incremental marking work scheduling from combination
of idle/delayed tasks to ordinary short-running tasks and moves
more marking work from V8.Execute to tasks by accounting how much
bytes were marked in tasks.

BUG=chromium:616434
LOG=NO

Review-Url: https://codereview.chromium.org/2321553002
Cr-Commit-Position: refs/heads/master@{#39348}

CQ_INCLUDE_TRYBOTS=master.tryserver.v8:v8_linux_noi18n_rel_ng

BUG=v8:5364

Review-Url: https://codereview.chromium.org/2313393005
Cr-Commit-Position: refs/heads/master@{#39347}

Rework Runtime::FunctionForName to take a c-string instead of a v8::String
so that the parser can parse native syntax runtime calls without doing
on-the-fly internalization.

Also adds a c-string variant of IntrinsicIndexForName for the same reasons.

BUG=v8:5215,chromium:634953

Review-Url: https://codereview.chromium.org/2324803002
Cr-Commit-Position: refs/heads/master@{#39346}

Revert of [modules] Basic support of exports (patchset #10 id:180001 of https://codereview.chromium.org/2302783002/ )

Reason for revert:
Failures related to deopt.

Original issue's description:
> [modules] Basic support of exports
>
> This adds partial support of exports to the runtime system and
> to the interpreter. It introduces a new HeapObject JSModule that
> maps each of the module's export names to a Cell containing the
> exported value.
>
> Several aspects of this implementation are subject to change in
> follow-up CLs.
>
> BUG=v8:1569
>
> Committed: https://crrev.com/241a0412eed919395a2e163b30b9b66071ce5c17
> Cr-Commit-Position: refs/heads/master@{#39341}

TBR=adamk@chromium.org,rmcilroy@chromium.org,ulan@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:1569

Review-Url: https://codereview.chromium.org/2328283002
Cr-Commit-Position: refs/heads/master@{#39345}

R=rmcilroy@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2331913002
Cr-Commit-Position: refs/heads/master@{#39344}

Migrate ToNumber platform builtin to TurboFan. Also move
NonNumberToNumber builtin implementation to helper function.

BUG=v8:5049

Review-Url: https://codereview.chromium.org/2327703003
Cr-Commit-Position: refs/heads/master@{#39343}

CQ_INCLUDE_TRYBOTS=master.tryserver.v8:v8_linux_noi18n_rel_ng

BUG=v8:5364

Committed: https://crrev.com/7f84a6a2e7000bebba49354b4648346ff606ca34
Review-Url: https://codereview.chromium.org/2315343002
Cr-Original-Commit-Position: refs/heads/master@{#39331}
Cr-Commit-Position: refs/heads/master@{#39342}

This adds partial support of exports to the runtime system and
to the interpreter. It introduces a new HeapObject JSModule that
maps each of the module's export names to a Cell containing the
exported value.

Several aspects of this implementation are subject to change in
follow-up CLs.

BUG=v8:1569

Review-Url: https://codereview.chromium.org/2302783002
Cr-Commit-Position: refs/heads/master@{#39341}

It is invalid for OSR deconstruction to leave a graph with a node
representing the OSR normal entry (and no OSR loop entry). Subsequent
lowering phases will not handle {OsrNormalEntry} operators and hence
will lead to serious clogging further down the pipeline.

R=bmeurer@chromium.org
BUG=chromium:641893

Review-Url: https://codereview.chromium.org/2336543002
Cr-Commit-Position: refs/heads/master@{#39340}

With this CL the AstDecoder produces an error if it encounters a
grow_memory instruction in an asmjs module. Additionally asmjs
instructions are not allowed anymore in wasm modules.

BUG=chromium:644674
R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2324733002
Cr-Commit-Position: refs/heads/master@{#39339}

No longer disable TurboFan for functions with eval, but only disable
Crankshaft in those cases.

R=mstarzinger@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2334633002
Cr-Commit-Position: refs/heads/master@{#39338}

This patch moves the following parsing method to ParserBase:

- ParseSwitchStatement

It also removes ParseCaseClause and merges it with ParseSwitchStatement,
mainly to avoid the complexity of introducing one more abstract typedef
to be shared between parser implementations, but also because the merged
ParseSwitchStatement is now only 59 lines.

R=adamk@chromium.org, marja@chromium.org
BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2324843005
Cr-Commit-Position: refs/heads/master@{#39337}

R=mvstanton@chromium.org

Review-Url: https://codereview.chromium.org/2335533002
Cr-Commit-Position: refs/heads/master@{#39336}

Compare the whole word on 64-bit architectures with the kHoleNanInt64 value
since comparing only upper part produces slightly worse code on x64.
Currently TurboFan is not able to fold (array + ((const1 + index*scale) + const))
into single addressing mode: (array + (const + index*scale)).

BUG=chromium:645414

Review-Url: https://codereview.chromium.org/2322283002
Cr-Commit-Position: refs/heads/master@{#39335}

R=mvstanton@chromium.org

Review-Url: https://codereview.chromium.org/2326493002
Cr-Commit-Position: refs/heads/master@{#39334}

Remove the "Entry"/"Entries" suffix as it doesn't add any information and
ModuleInfoEntry would clash with another name being introduced soon.

R=adamk@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2300373002
Cr-Commit-Position: refs/heads/master@{#39333}

Revert of [builtins] Move StringNormalize to a cpp builtin. (patchset #10 id:180001 of https://codereview.chromium.org/2315343002/ )

Reason for revert:
Tests fail when i18n is switched off, trybots do not run this configuration

Original issue's description:
> [builtins] Move StringNormalize to a cpp builtin.
>
> BUG=v8:5364
>
> Committed: https://crrev.com/7f84a6a2e7000bebba49354b4648346ff606ca34
> Cr-Commit-Position: refs/heads/master@{#39331}

TBR=bmeurer@chromium.org,franzih@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5364

Review-Url: https://codereview.chromium.org/2335553002
Cr-Commit-Position: refs/heads/master@{#39332}

BUG=v8:5364

Review-Url: https://codereview.chromium.org/2315343002
Cr-Commit-Position: refs/heads/master@{#39331}

The use of the address of a local variable causes problems with asan,
see https://build.chromium.org/p/tryserver.v8/builders/v8_linux64_asan_rel_ng_triggered/builds/7803

R=jochen@chromium.org

Review-Url: https://codereview.chromium.org/2317253006
Cr-Commit-Position: refs/heads/master@{#39330}

  - Using realloc is still unsafe as the allocator, using array_buffer_allocator
  - Fixing tests to avoid overlapping stores, adding more tests

BUG=v8:5344

R=ahaas@chromium.org, mlippautz@chromium.org

Review-Url: https://codereview.chromium.org/2319983002
Cr-Commit-Position: refs/heads/master@{#39329}

The logic to test whether we already reached --max_inlining_levels
when inlining into some optimized function only checked specifically
for FrameStateType::kJavaScriptFunction, and thereby didn't properly
account for FrameStateType::kInterpretedFunction, which is what we
see when we come in via the bytecode pipeline.

Review-Url: https://codereview.chromium.org/2329923002
Cr-Commit-Position: refs/heads/master@{#39328}

Both legacy and AVX versions

BUG=

Review-Url: https://codereview.chromium.org/2328843003
Cr-Commit-Position: refs/heads/master@{#39327}

This patch moves the following parsing methods to ParserBase:

- ParseDoExpression
- ParseDoWhileStatement
- ParseWhileStatement
- ParseThrowStatement

R=adamk@chromium.org, marja@chromium.org
BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2321103002
Cr-Commit-Position: refs/heads/master@{#39326}

This patch moves the following parsing methods to ParserBase:

- ParseExpressionOrLabelledStatement
- ParseIfStatement
- ParseContinueStatement
- ParseBreakStatement
- ParseReturnStatement
- ParseWithStatement

R=adamk@chromium.org, marja@chromium.org
BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2323763002
Cr-Commit-Position: refs/heads/master@{#39325}

BUG=v8:5089

Review-Url: https://codereview.chromium.org/2329053002
Cr-Commit-Position: refs/heads/master@{#39324}