Bug: v8:6391
Change-Id: If63078c756d9cfb00e515fae005755c4ed8b12f7
Reviewed-on: https://chromium-review.googlesource.com/512803Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45549}

The test OneByteArrayJoin failed on MIPS64 in debug mode after
https://chromium-review.googlesource.com/c/489946/ with error messages
"allocation failure GC in old space requested" and
"Fatal javascript OOM in CALL_AND_RETRY_LAST". Successful test execution
is possible on two ways: with flag --max_old_space_size=7 or with
modification in the test (constraints.set_max_old_space_size(7)).

TEST=cctest/test-strings/OneByteArrayJoin
BUG=

Review-Url: https://codereview.chromium.org/2907803002
Cr-Commit-Position: refs/heads/master@{#45548}

This reverts commit 7a9cc704.

Reason for revert: Changes layout tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/15882

This is about:
inspector/sources/debugger/source-frame-inline-breakpoint-decorations.html

Original change's description:
> [inspector] moved var initialization break location before init expression
> 
> This CL improves break locations for expressions like 'var a = <expr>'. Without CL we use <expr> position as break location for initialization statement, with this CL we use position of first character after '=' as position.
> Benefits (see test for details):
> - only one break in expressions which includes mix of property lookup and calls, e.g. var p = Promise.resolve().then(x => x * 2),
> - removed redundant break location for expressions like: let { x, y } = { x: 1, y: 2}.
> 
> Bug: v8:5909
> Change-Id: I039d911903a2826c9859710a63ab0462c992e11b
> Reviewed-on: https://chromium-review.googlesource.com/513926
> Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
> Reviewed-by: Marja Hölttä <marja@chromium.org>
> Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#45530}

TBR=dgozman@chromium.org,marja@chromium.org,kozyatinskiy@chromium.org
# Not skipping CQ checks because original CL landed > 1 day ago.
Bug: v8:5909

Change-Id: Ibf84401e8050d3c84db219d983de2c6bba0f697f
Reviewed-on: https://chromium-review.googlesource.com/518102Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45547}

This allows embedders to delay initialization of the module system until after
the isolate was created.

BUG=v8:6428
R=gsathya@chromium.org

Review-Url: https://codereview.chromium.org/2897103002
Cr-Commit-Position: refs/heads/master@{#45546}

The memcpy and memmove externals can end up at the same address; see bug for
details.

BUG=chromium:726896

Review-Url: https://codereview.chromium.org/2906193002
Cr-Commit-Position: refs/heads/master@{#45545}

... to make AsyncFunction subclassing work.

Bug: chromium:725537
Change-Id: I7edf4891e14e01567046e7536b3aa93877111448
Reviewed-on: https://chromium-review.googlesource.com/517087
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45544}

... which caused assertion failures in --enable-slow-asserts mode.
The surrounding code treated the constructor value properly so regression
test is not necessary.

Bug: chromium:726622
Change-Id: Icd43d9117a1125bec8feca8eca5708993de2c3ef
Reviewed-on: https://chromium-review.googlesource.com/516626Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45543}

BUG=v8:6243

Change-Id: Ia6dfa407591d1b06d5b014627bb44413540aecb3
Reviewed-on: https://chromium-review.googlesource.com/516984Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45542}

Bug: 
Change-Id: I56f41392a2c3bbd203553e3fb386f8b7234d5e75
Reviewed-on: https://chromium-review.googlesource.com/516624Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45541}

Which I introduced in:

c15b3ffc [arm] Share constant pool entries in snapshot.

BUG=chromium:725714

Review-Url: https://codereview.chromium.org/2905643002
Cr-Commit-Position: refs/heads/master@{#45540}

All other properties in the boilerplate are data fields, so we can avoid additional checks.

Bug: 
Change-Id: Ie494329332b0ba646515850b6d267fb05735f0ea
Reviewed-on: https://chromium-review.googlesource.com/517044Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45539}

This removes a lot of special handling for the predictable platform.
Instead of executing spawned foreground and background tasks
immediately (i.e. inside the scope that spawns the tasks), just add
both to the foreground task queue.

This avoids existing special handling for predictable mode in wasm
async compilation, and should fix current failures on the predictable
bot.

BUG=v8:6427

Change-Id: Idbaa764a3dc8c230c29f3937d885e12174691ac4
Reviewed-on: https://chromium-review.googlesource.com/509694Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45538}

Bug: chromium:726636
Change-Id: Ied6af8c969ed05b7a334238b30930658af060e7d
Reviewed-on: https://chromium-review.googlesource.com/516734Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45537}

This speeds up fast-mode object copying by ~2x and __proto__:null cases by ~20x.

Bug: 
Change-Id: Ic3893ae4c87063f0c8c524ef55c0e786b7a87192
Reviewed-on: https://chromium-review.googlesource.com/516983
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45536}

This CL removes the isolate_ property from the Cancelable class. The
isolate is actually not used in the class itself, only in sub-classes
which can store the isolate themselves.

R=jochen@chromium.org, mlippautz@chromium.org

Change-Id: If102fdea41b81fb3cb25782728f7fcbce9642815
Reviewed-on: https://chromium-review.googlesource.com/516704Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45535}

- This won't save a bit, since the enum is not a flags enum and there is
  still room for another value.
- While it may be possible to eliminate this value, the code to init
  and check for invalid becomes much more complex. Unallocated operands
  are currently created with invalid vreg code, so we also have to check
  the policy.

BUG=v8:6325

Review-Url: https://codereview.chromium.org/2904603004
Cr-Commit-Position: refs/heads/master@{#45534}

- Removes set_virtual_register method. InstructionOperands are immutable.
- Adds a new ctor to copy an UnallocatedOperand with a new vreg.
- Removes some DCHECKs in UnallocatedOperand that are always true. To
  make sure, make UnallocatedOperand final.
- Cleans up some comments on UnallocatedOperand Lifetime enum.

BUG=v8:6325

Review-Url: https://codereview.chromium.org/2897203002
Cr-Commit-Position: refs/heads/master@{#45533}

R=joransiu@ca.ibm.com, bjaideep@ca.ibm.com

Bug: 
Change-Id: I73c44a0dd93e3925dbe895a477175d255edbed56
Reviewed-on: https://chromium-review.googlesource.com/514123Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#45532}

Fix 233b6926

With the introduction of upfront deopt table generation, case where
deoptimization tables have more than 8000 entries become much more common
and bugs started to appear.

This CL fixes the issue, but it is far from perfect. We had to
increase number of instruction per table entry from 2 to 3 in
order to accommodate larger tables.

TEST=mjsunit/array-sort,mjsunit/json,mjsunit/md5
BUG=

Review-Url: https://codereview.chromium.org/2901393003
Cr-Commit-Position: refs/heads/master@{#45531}

This CL improves break locations for expressions like 'var a = <expr>'. Without CL we use <expr> position as break location for initialization statement, with this CL we use position of first character after '=' as position.
Benefits (see test for details):
- only one break in expressions which includes mix of property lookup and calls, e.g. var p = Promise.resolve().then(x => x * 2),
- removed redundant break location for expressions like: let { x, y } = { x: 1, y: 2}.

Bug: v8:5909
Change-Id: I039d911903a2826c9859710a63ab0462c992e11b
Reviewed-on: https://chromium-review.googlesource.com/513926
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45530}

- Increase FPUregisters_[] element size to 128b in order to support MSA regs
- Add skeleton for MSA instr. decoding in mips32 and mips64 simulator
- Add support for fill.df, copy_u.df and copy_s.df MSA instructions
- Assembler test for fill.df, copy_u.df and copy_s.df

BUG=

Review-Url: https://codereview.chromium.org/2799923002
Cr-Commit-Position: refs/heads/master@{#45529}

This reverts commit 92cfe00c.

Reason for revert: Breaking all the clusterfuzz builders with error message:
group @"./mksnapshot.rsp" ./libv8_libbase.so ./libv8_libplatform.so ./libicui18n.so ./libicuuc.so ./libc++.so -Wl,--end-group   -ldl -lrt 
../../buildtools/third_party/libc++/trunk/include/string:1831: error: undefined reference to 'std::__1::__basic_string_common<true>::__throw_length_error() const'
../../buildtools/third_party/libc++/trunk/include/vector:930: error: ...

e.g.: https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20ASAN%20-%20debug%20builder/builds/16157/steps/compile/logs/stdio

Original change's description:
> Update V8 DEPS.
> 
> Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/5488ca8..3532f27
> 
> Rolling v8/buildtools: https://chromium.googlesource.com/chromium/buildtools/+log/98f00fa..57c9408
> 
> Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/51b3178..518df53
> 
> Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/05f3060..f294e27
> 
> TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org
> 
> Change-Id: I8e154bcc89d8cdc292409a15dc4081666941c959
> Reviewed-on: https://chromium-review.googlesource.com/514762
> Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
> Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#45527}

TBR=v8-autoroll@chromium.org,machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Change-Id: I2c06ebf13219c92b4fa8891743c9dd9f23e91fcf
Reviewed-on: https://chromium-review.googlesource.com/515462Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45528}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/5488ca8..3532f27

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/buildtools/+log/98f00fa..57c9408

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/51b3178..518df53

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/05f3060..f294e27

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: I8e154bcc89d8cdc292409a15dc4081666941c959
Reviewed-on: https://chromium-review.googlesource.com/514762Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45527}

Creates a new class StatsCounterThreadSafe to be used by counters that
can be updated when compiling/decoding etc. are done using workers.

Does this by using a mutex on all opreations.

Also updates the StatsCounterThreadSafe constructor to force counter
initialization, as well as method Reset(). In addition, whenever the
method StatsTable::SetCounterFunction() is called (from the main
thread), it forces counter initialization for all thread safe stats
counters.

BUG=v8:6361

Review-Url: https://codereview.chromium.org/2887193002
Cr-Commit-Position: refs/heads/master@{#45526}

Compilation failure is result to overloaded-virtual warning
treated as error.

BUG=

Review-Url: https://codereview.chromium.org/2895923002
Cr-Commit-Position: refs/heads/master@{#45525}

A few tests that would be good to have to verify that the known manifestations
of this bug are resolved.

Previously, the async generator and async function tests would crash. The other
ones never did, but still resulted in the register overwite bug.

BUG=v8:6322
R=adamk@chromium.org

Change-Id: Ic2238227629077de5671d67d18b3bfe018dd23f4
Reviewed-on: https://chromium-review.googlesource.com/514230Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Cr-Commit-Position: refs/heads/master@{#45524}

R=joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2905683002
Cr-Commit-Position: refs/heads/master@{#45523}

Rather than trying to pre-calculate the number of contexts required during
scope analysis, instead just allocate context registers in the register
allocator. This reduces frame size a bit due to reusing of registers when
the context isn't pushed.

 BUG=v8:6322, chromium:716265

Change-Id: I145e38fcb3797a3b86c91e90ea9326a6e55b9b89
Reviewed-on: https://chromium-review.googlesource.com/514087Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45522}

Revert of [turbofan] Speculatively optimize string character access. (patchset #1 id:1 of https://codereview.chromium.org/2905623003/ )

Reason for revert:
Changes layout tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/15867

See:
https://github.com/v8/v8/wiki/Blink-layout-tests

Original issue's description:
> [turbofan] Speculatively optimize string character access.
>
> Add a protector cell for string bounds checks that is being used to
> protect speculative bounds for String.prototype.charCodeAt and
> String.prototype.charAt in TurboFan (and Crankshaft). This way we don't
> have the diamond in optimized code, which stands in the way of other
> optimizations for charCodeAt that are currently being worked on by
> petermarshall@.
>
> BUG=v8:6391
> TBR=mlippautz@chromium.org
> R=petermarshall@chromium.org
>
> Review-Url: https://codereview.chromium.org/2905623003
> Cr-Commit-Position: refs/heads/master@{#45514}
> Committed: https://chromium.googlesource.com/v8/v8/+/9d8bd0551657d60c66b2f96544eecedfba1cba8a

TBR=petermarshall@chromium.org,mlippautz@chromium.org,bmeurer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:6391

Review-Url: https://codereview.chromium.org/2900333002
Cr-Commit-Position: refs/heads/master@{#45521}

TBR=machenbach@chromium.org

Bug: 
Change-Id: I916d52297bd81c5015fcd3185105dcb0d0a3d78f
Reviewed-on: https://chromium-review.googlesource.com/513906Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Commit-Queue: Daniel Vogelheim <vogelheim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45520}

This reverts commit ee3729d2.

Reason for revert: The initial commit required https://chromium-review.googlesource.com/c/510021/ also land on the Blink side. I mistakenly thought it did.

Original change's description:
> Revert "[wasm] Remove override-ability from async compile and instantiate."
> 
> This reverts commit 2869dd55.
> 
> Reason for revert: Breaks:
> https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/15850
> 
> See also:
> https://github.com/v8/v8/wiki/Blink-layout-tests
> 
> Original change's description:
> > [wasm] Remove override-ability from async compile and instantiate.
> > 
> > We're now using explicit APIs.
> > 
> > Bug: 
> > Change-Id: I4a4248e44543f6e7dfcbdc66456e610fb98ff5ee
> > Reviewed-on: https://chromium-review.googlesource.com/513406
> > Commit-Queue: Brad Nelson <bradnelson@chromium.org>
> > Reviewed-by: Brad Nelson <bradnelson@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#45500}
> 
> TBR=bradnelson@chromium.org,mtrofin@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> 
> Bug: 
> Change-Id: Ie7c2db40279bd07c535c20afaa1cea51b680fe65
> Reviewed-on: https://chromium-review.googlesource.com/513862
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#45502}

TBR=bradnelson@chromium.org,machenbach@chromium.org,mtrofin@chromium.org,v8-reviews@googlegroups.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Bug: 
Change-Id: Ib826b590b5d362d005460fcebdc6800c8d6c5f63
Reviewed-on: https://chromium-review.googlesource.com/513496Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
Commit-Queue: Mircea Trofin <mtrofin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45519}

Bug: chromium:725201
Change-Id: Ic75f4080b8ef28e64b471887871c526c0bac316b
Reviewed-on: https://chromium-review.googlesource.com/514004Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45518}

Change-Id: I5e725f984178c2c9d48ba48c1270faea1b63ff3e
Reviewed-on: https://chromium-review.googlesource.com/513943Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45517}

Missing parentheses are causing compilation failures, added them.

BUG=

Review-Url: https://codereview.chromium.org/2906433002
Cr-Commit-Position: refs/heads/master@{#45516}

In particular, local variables should be allocated on stack (in bytecode register), and stored/loaded to the generator object on generator suspend/resume.

The CL is based on @adamk's change to scoping/parsers (https://chromium-review.googlesource.com/c/498538/), I only made the debugger cope with this change.

I should note that the CL changes the scope type of suspended generators from ScopeType.Closure to ScopeType.Local. In the future we might want to introduce ScopeType.SuspendedGenerator to make the distinction explicit.

Some of the changes in the tests have been made because the debugger functions do not return scopes of closed generators anymore. Generators should be allowed to throw away their internal state when they finish.

BUG=v8:6368

Review-Url: https://codereview.chromium.org/2898163002
Cr-Commit-Position: refs/heads/master@{#45515}

Add a protector cell for string bounds checks that is being used to
protect speculative bounds for String.prototype.charCodeAt and
String.prototype.charAt in TurboFan (and Crankshaft). This way we don't
have the diamond in optimized code, which stands in the way of other
optimizations for charCodeAt that are currently being worked on by
petermarshall@.

BUG=v8:6391
TBR=mlippautz@chromium.org
R=petermarshall@chromium.org

Review-Url: https://codereview.chromium.org/2905623003
Cr-Commit-Position: refs/heads/master@{#45514}

- Create getters for number of tasks for all parallel stages
- Count slots for the minor MC and limit tasks by the overall number of slots.
- Cleanup existing getters.

Bug: chromium:651354
Change-Id: I9f67cca4474cbe1800faff4a549fbec019b096ce
Reviewed-on: https://chromium-review.googlesource.com/512862
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45513}

Add support for I8x16Add, I8x16AddSaturateS, I8x16Sub, I8x16SubSaturateS,
I8x16Mul, I8x16MaxS, I8x16MinS, I8x16Eq, I8x16Ne, I8x16LtS,
I8x16LeS, I8x16ShrU, I8x16AddSaturateU, I8x16SubSaturateU, I8x16MaxU,
I8x16MinU, I8x16LtU, I8x16LeU, S128And, S128Or, S128Xor, S128Not for
mips32 and mips64 architectures.

BUG=

Review-Url: https://codereview.chromium.org/2798853003
Cr-Commit-Position: refs/heads/master@{#45512}

This removes the need for certain context scopes to skip popping the
context register. For the {incoming_context} the flag was already
obsolete, because its destructor would only run once the basic block
ended with a return. For {local_function_context} the same holds now
by moving handling of implicit returns into the body visitor.

R=rmcilroy@chromium.org

Change-Id: Icceaab1b30d7223b2b2f87a092a6580be7d7d675
Reviewed-on: https://chromium-review.googlesource.com/513963Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45511}

This is safe since we already take the page lock.

Bug: 
Change-Id: Id7797ef66c387be150064cda1213c1f2b75d31d3
Reviewed-on: https://chromium-review.googlesource.com/514003Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45510}