We can't have "main" in a static library. so just include the small
fuzzer.cc in all simple fuzzers

BUG=none
R=machenbach@chromium.org,vogelheim@chromium.org

Review-Url: https://codereview.chromium.org/2608243005
Cr-Commit-Position: refs/heads/master@{#42086}

We need to check both sides for abstract equality of receivers in optimized
code, otherwise we don't handle implicit conversions and undetectable
objects correctly.

R=jarin@chromium.org
BUG=v8:5802

Review-Url: https://codereview.chromium.org/2612213002
Cr-Commit-Position: refs/heads/master@{#42085}

BUG=v8:5215
R=marja@chromium.org,vogelheim@chromium.org

Review-Url: https://codereview.chromium.org/2608163006
Cr-Commit-Position: refs/heads/master@{#42084}

BUG=

Review-Url: https://codereview.chromium.org/2613723002
Cr-Commit-Position: refs/heads/master@{#42083}

Add a feedback vector slot for computed property names in object
and class literals. Introduce new slot kind for storing
computed property names.

Change StaDataPropertyInLiteral to use the accumulator (again), so
we don't exceed Bytecodes::kMaxOperands.

We assume that most computed property names are
symbols. Therefore we should see performance
improvements, even if we deal with monomorphic ICs only.

This CL only collects feedback but does not use
it in Reduce() yet.

BUG=v8:5624

Review-Url: https://codereview.chromium.org/2587393006
Cr-Commit-Position: refs/heads/master@{#42082}

  port 72c37076(r42034)

  original commit message:
  Currently the CompileLazy builtin checks the SFI expliciltly for FCG code. This means
  if the SFI has bytecode we have to go through to the runtime to install the
  interpreter entry trampoline into the JSFunction object.

  Modify the builtin to always put the SFI code object into the JSFunction unless it's
  the lazy compile stub on the SFI as well.

BUG=

Review-Url: https://codereview.chromium.org/2614533003
Cr-Commit-Position: refs/heads/master@{#42081}

  port d3ed71ed(r42021)

  original commit message:
  Don't fallback to the %StrictEqual / %Equal runtime functions for the
  generic CompareIC slow path, but use the (new) StrictEqual and Equal
  builtins instead. This avoids a performance cliff when mixing input
  types for strict equality sites.

BUG=

Review-Url: https://codereview.chromium.org/2612693002
Cr-Commit-Position: refs/heads/master@{#42080}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/dd74acb..9cde9c9

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/a067dd2..9e6944a

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/432074b..0ec6dce

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2617683002
Cr-Commit-Position: refs/heads/master@{#42079}

For benchmarks with multiple measurements (e.g. runtime, compile
time, generated code size), in case of error, we'd get only the
last portion of the name ("Compile"), which is ambiguous and makes
debugging dificult. This change includes the full name, e.g.
"Unity/Physics/Compile".

BUG=

Review-Url: https://codereview.chromium.org/2615623003
Cr-Commit-Position: refs/heads/master@{#42078}

R=joransiu@ca.ibm.com, bjaideep@ca.ibm.com
BUG=

Review-Url: https://codereview.chromium.org/2615683003
Cr-Commit-Position: refs/heads/master@{#42077}

This lets us share Builtins::kReturnReceiver, so should
every-so-slightly reduce the size of the context snapshot.

R=gsathya@chromium.org

Review-Url: https://codereview.chromium.org/2614623003
Cr-Commit-Position: refs/heads/master@{#42076}

Add a more low level BranchIfFastPath to take the native_context and
promise_fun as args and change the existing one to use this.

BUG=v8:5343

Review-Url: https://codereview.chromium.org/2592933004
Cr-Commit-Position: refs/heads/master@{#42075}

R=gsathya@chromium.org

Review-Url: https://codereview.chromium.org/2615733002
Cr-Commit-Position: refs/heads/master@{#42074}

BUG=v8:5343

Review-Url: https://codereview.chromium.org/2614603003
Cr-Commit-Position: refs/heads/master@{#42073}

This moves the initialization of [[HomeObject]] for constructors from
the %DefineClass runtime function into the bytecode generator, and
makes it conditional (resolving an old TODO). As part of this refactor,
avoid a load of "prototype" by returning the class prototype from
%DefineClass.

This is one of many steps in moving more of class definition into
bytecode.

R=rmcilroy@chromium.org

Review-Url: https://codereview.chromium.org/2610683003
Cr-Commit-Position: refs/heads/master@{#42072}

Remove a bunch of unnecessary v8:: prefixes in include/v8.h.
Some are still necessary for disambiguation purposes (e.g., between
bool Value() and v8::Value, or between v8::Isolate and
v8::internal::Isolate), but many aren't.

BUG=None

Review-Url: https://codereview.chromium.org/2605103003
Cr-Commit-Position: refs/heads/master@{#42071}

This removes all the promise allocation related methods from the CSA
and moves them PromiseBuiltinsAssembler with some edits.

BUG=v8:5343

Review-Url: https://codereview.chromium.org/2604273003
Cr-Commit-Position: refs/heads/master@{#42070}

R=adamk@chromium.org, littledan@chromium.org

BUG=v8:5343

Review-Url: https://codereview.chromium.org/2609853004
Cr-Commit-Position: refs/heads/master@{#42069}

BUG=v8:5215
R=marja@chromium.org,vogelheim@chromium.org

Review-Url: https://codereview.chromium.org/2615603002
Cr-Commit-Position: refs/heads/master@{#42068}

Ignition does not emit any byte code for some literal expression
statements, so avoid testing for it.

R=rmcilroy@chromium.org
BUG=v8:5757

Review-Url: https://codereview.chromium.org/2612013002
Cr-Commit-Position: refs/heads/master@{#42067}

R=bmeurer@chromium.org
BUG=chromium:677757

Review-Url: https://codereview.chromium.org/2606383005
Cr-Commit-Position: refs/heads/master@{#42066}

It's unnecessarily to first lookup and then insert.

BUG=v8:5501

Review-Url: https://codereview.chromium.org/2608333003
Cr-Commit-Position: refs/heads/master@{#42065}

BUG=chromium:670981
LOG=N
R=ishell@chromium.org

Review-Url: https://codereview.chromium.org/2609973002
Cr-Commit-Position: refs/heads/master@{#42064}

Recognize the special

  NumberFloor(NumberDivide(lhs, rhs))

subgraph in TypedOptimization, where both lhs and rhs are in the
Unsigned32 range, and the result is a PlainNumber, and replace the
NumberFloor with a NumberToUint32 truncation.

This could be done in a cleaner way if we have a dedicated type for all
double values in the Unsigned32 range, but that would complicate the
type system quite a bit.

R=jarin@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2614663002
Cr-Commit-Position: refs/heads/master@{#42063}

BUG=v8:5215
R=marja@chromium.org,vogelheim@chromium.org

Review-Url: https://codereview.chromium.org/2612753002
Cr-Commit-Position: refs/heads/master@{#42062}

mjsunit/big-object-literal will exhaust the stack in debug builds,
due to different compiler settings. It will work in optdebug.
This disables for both. Adding an 'optdebug' test to .status files
is easy, but I don't want to contribute to the 'mode x variant explosion'.

R=jochen@chromium.org
CC=franzih@chromium.org, machenbach@chromium.org

Review-Url: https://codereview.chromium.org/2609193002
Cr-Commit-Position: refs/heads/master@{#42061}

BUG=v8:5267
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2612763002
Cr-Commit-Position: refs/heads/master@{#42060}

Also rule out -0 for NumberDivide if possible, and rule out NaN and -0
for NumberFloor if possible.

R=jarin@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2609373002
Cr-Commit-Position: refs/heads/master@{#42059}

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2616613002
Cr-Commit-Position: refs/heads/master@{#42058}

See https://github.com/tc39/ecma262/pull/747.

R=adamk@chromium.org
BUG=v8:1569

Review-Url: https://codereview.chromium.org/2603193002
Cr-Commit-Position: refs/heads/master@{#42057}

This CL simplifies the relation between the wasm graph builder, the
wasm decoder, and the wasm module they work on.

BUG=

Review-Url: https://codereview.chromium.org/2612643002
Cr-Commit-Position: refs/heads/master@{#42056}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/bdc04ca..dd74acb

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/9ddf248..a067dd2

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2609853005
Cr-Commit-Position: refs/heads/master@{#42055}

This behavior changed recently. SharedArrayBuffers should not be put in the
transfer list, because they are not detached, and that is the meaning of being
in the transfer list.

This is the V8 side of the change, the Blink side will come next.

Reland of https://codereview.chromium.org/2570433005, it was reverted because
of a Blink-side test failure which has been temporarily disabled; see
https://codereview.chromium.org/2590003002.

BUG=https://bugs.chromium.org/p/chromium/issues/detail?id=676063

Review-Url: https://codereview.chromium.org/2594793005
Cr-Commit-Position: refs/heads/master@{#42054}

NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2608183003
Cr-Commit-Position: refs/heads/master@{#42053}

-- Removes remaning debug from promise.js and moves it to c++
-- Changes debug_id to be a smi in PromiseReactionJobInfo and
   PromiseResolveThenableJobInfo.
-- Changes debug_name to be a smi in PromiseReactionJobInfo and
   PromiseResolveThenableJobInfo.
-- Adds PromiseDebugActionName and PromiseDebugActionType enums
-- Adds PromiseDebugActionNameToString and
   PromiseDebugActionTypeToString helper methods
-- Changes variable `status` to be int in runtime functions.
-- Changes debug_id to start from 1, not 0 for easier bookkeeping.

BUG=v8:5343

Review-Url: https://codereview.chromium.org/2606093002
Cr-Commit-Position: refs/heads/master@{#42052}

These maps contain exactly the same information as the strict maps, so
this frees up a few pointers of native context space, gets rid of some
branches in FastNewClosure, and adds missing poisoned properties tests
for async functions.

BUG=v8:2355, v8:4483
R=adamk@chromium.org, bmeurer@chromium.org, littledan@chromium.org

Review-Url: https://codereview.chromium.org/2608333002
Cr-Commit-Position: refs/heads/master@{#42051}

R=joransiu@ca.ibm.com, bjaideep@ca.ibm.com
BUG=

Review-Url: https://codereview.chromium.org/2611773003
Cr-Commit-Position: refs/heads/master@{#42050}

This is another attempt at solving v8:5736; the previous one (r 41723)
regressed code load.

BUG=v8:5736
R=adamk@chromium.org

Review-Url: https://codereview.chromium.org/2583163002
Cr-Commit-Position: refs/heads/master@{#42049}

Per spec change in https://github.com/tc39/ecma262/pull/724, this adds
the exception thrown when a TypedArray's array buffer is detached at
some point during iteration, after the iterator has already been
created.

BUG=v8:5388
R=littledan@chromium.org, bmeurer@chromium.org, petermarshall@chromium.org

Review-Url: https://codereview.chromium.org/2609913002
Cr-Commit-Position: refs/heads/master@{#42048}

TBR=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2609663002
Cr-Commit-Position: refs/heads/master@{#42047}