We have been assuming in several places that ContainsDot or ToInt32 is
sufficient to check a value is a valid double or int.
Refactoring all the checks to one place and making them cope with booleans
or other unexpected types being present.

BUG=672044
R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2555323003
Cr-Commit-Position: refs/heads/master@{#41595}

Use of eval in a function wraps it in a context.
This throws off assumptions not checked until later,
which is at odds with incremental validation and conversion.
Check that module parameters are PARAMETER location early.

BUG=672045
R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2558813004
Cr-Commit-Position: refs/heads/master@{#41594}

needs finalization and allocation limit is reached.

BUG=

Review-Url: https://codereview.chromium.org/2561103002
Cr-Commit-Position: refs/heads/master@{#41593}

BUG=chromium:648568, chromium:669920

Review-Url: https://codereview.chromium.org/2548213004
Cr-Commit-Position: refs/heads/master@{#41592}

https://github.com/ibmruntimes/v8/issues/27

R=joransiu@ca.ibm.com, bjaideep@ca.ibm.com
BUG=

Review-Url: https://codereview.chromium.org/2561673002
Cr-Commit-Position: refs/heads/master@{#41591}

BUG=

Review-Url: https://codereview.chromium.org/2555223002
Cr-Commit-Position: refs/heads/master@{#41590}

Wrap the liveness bitvectors from the bytecode liveness analysis with a
helper class, which makes the register/accumulator bits explicit.

Review-Url: https://codereview.chromium.org/2552723004
Cr-Commit-Position: refs/heads/master@{#41589}

Aside from the default snapshot, there is no need for additional context
snapshots to have the ability to replace the global proxy and global object
after deserialization. Changes include:
 - Changes to the API to better distinguish default context snapshot from
   additional context snapshots.
 - Disallow global handles when creating snapshots.
 - Allow extensions when creating snapshots.

This solves the issue of not being able to having accessors and interceptors on
the global object of contexts to be serialized.

R=jochen@chromium.org, peria@chromium.org
BUG=chromium:617892

Review-Url: https://codereview.chromium.org/2557743003
Cr-Commit-Position: refs/heads/master@{#41588}

R=jochen@chromium.org
BUG=chromium:617892

Review-Url: https://codereview.chromium.org/2561783002
Cr-Commit-Position: refs/heads/master@{#41587}

Drive-by-fix: support directly loading the results.json from chromeperf.

BUG=chromium:672024
NO_TRY=true

Review-Url: https://codereview.chromium.org/2555693007
Cr-Commit-Position: refs/heads/master@{#41586}

All accessor IC stubs now pass the verification.

BUG=

Review-Url: https://codereview.chromium.org/2556123002
Cr-Commit-Position: refs/heads/master@{#41585}

The patch was reverted due to a bug - we failed to evict OSR-optimized
code in the case where the SharedFunctionInfo OptimizedCodeMap was
empty/cleared.

Since we OSR code rarely, it makes sense to store it and look for it on the native context rather than the SharedFunctionInfo. This makes the OptimizedCodeMap data structure more space efficient, as it doesn't have to store an ast ID for the OSR entry point.

Review-Url: https://codereview.chromium.org/2561083002
Cr-Commit-Position: refs/heads/master@{#41584}

BUG=v8:5723

Review-Url: https://codereview.chromium.org/2555263002
Cr-Commit-Position: refs/heads/master@{#41583}

This CL attempts to set the maybe-assigned flag for variables that are written
to as part of a destructuring or loop header.

For instance, in the following two cases we now mark x as maybe-assigned.

a) [x] = [1];
b) for (x of [1,2,3]) {};

There's more work to do here, this is just a first step.

R=adamk@chromium.org, mstarzinger@chromium.org
BUG=v8:5636

Review-Url: https://codereview.chromium.org/2562443003
Cr-Commit-Position: refs/heads/master@{#41582}

Using x&(x-1) to check for power of two masks usable at runtime
speeds up the life benchmark.

Borrowing this from SimplifiedLowering for the AsmJsRemS internal
wasm opcode.

Leaving this out for general wasm as we should be doing this optimization
in LLVM.

BUG=v8:4203
TEST=None
R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2556963005
Cr-Commit-Position: refs/heads/master@{#41581}

Speeds up some benchmarks that make heavy use of derived constructors.

BUG=chromium:672075

Review-Url: https://codereview.chromium.org/2557963004
Cr-Commit-Position: refs/heads/master@{#41580}

R=bmeurer@chromium.org,titzer@chromium.org

Review-Url: https://codereview.chromium.org/2557693006
Cr-Commit-Position: refs/heads/master@{#41579}

Currently when the number passed to TryNumberToSize is 1 << 64,
it gets away with a bug caused by rounding of mantissa.
Then the number will be casted to 0 and TryNumberToSize
will return true. This patch fix this by making the range check
more accurate.

BUG=v8:5712

Review-Url: https://codereview.chromium.org/2548243004
Cr-Commit-Position: refs/heads/master@{#41578}

R=adamk@chromium.org, mstarzinger@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2554363002
Cr-Commit-Position: refs/heads/master@{#41577}

BUG=672047
R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2555203002
Cr-Commit-Position: refs/heads/master@{#41576}

As of https://github.com/tc39/ecma262/commit/13906140a, the spec
now returns true when [[SetPrototypeOf]] is invoked with null
on a module namespace object.

R=neis@chromium.org
BUG=v8:1569

Review-Url: https://codereview.chromium.org/2557923004
Cr-Commit-Position: refs/heads/master@{#41575}

We were losing the stats for the first instance. Recording them
as soon as code objects are produced. This way, we have them available
for compile-only benchmarks.

Review-Url: https://codereview.chromium.org/2556963003
Cr-Commit-Position: refs/heads/master@{#41574}

First step towards making arguments and rest parameters optimizable by
splitting the allocations for the actual object and the elements. The
object allocations can already be escape analyzed this way, the elements
would need special support in the deoptimizer and the escape analysis,
but that can be done as a second separate step.

R=jarin@chromium.org
BUG=v8:5726

Review-Url: https://codereview.chromium.org/2557283002
Cr-Commit-Position: refs/heads/master@{#41573}

Yes. I thought I was being smart. And yes. It's just a one-liner.

TBR=cbruni@chromium.org
BUG=chromium:672009

Review-Url: https://codereview.chromium.org/2555213005
Cr-Commit-Position: refs/heads/master@{#41572}

Revert of Store OSR'd optimized code on the native context. (patchset #8 id:140001 of https://codereview.chromium.org/2549753002/ )

Reason for revert:
Speculative revert WebGL breakage reported in https://bugs.chromium.org/p/chromium/issues/detail?id=672367

Original issue's description:
> Store OSR'd optimized code on the native context.
>
> Since we OSR code rarely, it makes sense to store it and look for it on the native context rather than the SharedFunctionInfo. This makes the OptimizedCodeMap data structure more space efficient, as it doesn't have to store an ast ID for the OSR entry point.
>
> BUG=
>
> Committed: https://crrev.com/378b6b22fb7925ac5b672335a54599f5739e7758
> Cr-Commit-Position: refs/heads/master@{#41554}

TBR=mstarzinger@chromium.org, mvstanton@chromium.org, ulan@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2562623003
Cr-Commit-Position: refs/heads/master@{#41571}

BUG=v8:5725

Review-Url: https://codereview.chromium.org/2559933002
Cr-Commit-Position: refs/heads/master@{#41570}

-- Moves promiseHasHandlerSymbol to inobject property
-- Ports PromiseResolveClosure to TF
-- Fix a non spec async-await test which fails now because we do a map
check for native promise check (instead of IsPromise). Changing the
constructor (in the test) invalidates the map check.

This patch results in a 7.1% performance improvement in the bluebird
benchmark (over 5 runs).

BUG=v8:5343

Review-Url: https://codereview.chromium.org/2541283002
Cr-Commit-Position: refs/heads/master@{#41569}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/788dcd7..53448a6

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/415a532..11d3d44

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/7f925e3..caccf42

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2555223003
Cr-Commit-Position: refs/heads/master@{#41568}

jasongin@ created this patch.
https://github.com/jasongin/nodejs/commit/dcc50445a364664586164f42f9250732bd372982
This patch adds the support to emit a trace event by using a comma-separated
list of categories, so that the trace event will be emitted if there is at least
one category is enabled in the categories list.

TBR=jochen@chromium.org

Review-Url: https://codereview.chromium.org/2558193002
Cr-Commit-Position: refs/heads/master@{#41567}

Due to the isOwn check, functions inherited through prototype will not be
included in a preview.

BUG=645053

Review-Url: https://codereview.chromium.org/2554623003
Cr-Commit-Position: refs/heads/master@{#41566}

Getter properties are not currently included in the protocol's
Runtime.ObjectPreview. DevTools currently shows getter properties
when evaluating arrays in the console, and this CL brings them into
the preview generated for RemoteObjects.

Corresponding DevTools CL: https://codereview.chromium.org/2521513006/

BUG=666882

Review-Url: https://codereview.chromium.org/2508423002
Cr-Commit-Position: refs/heads/master@{#41565}

Previously we created 3 FixedArrays and then filled them up with
values. This meant that during the creation of the second and third
FixedArray, there were one and two FixedArrays respectively, without
any values in it which broke the FixedArrayVerify.

This patch fills each FixedArray with the correct values before
creating new ones.

BUG=chromium:672051

Review-Url: https://codereview.chromium.org/2554323003
Cr-Commit-Position: refs/heads/master@{#41564}

We're still collecting use counter data for this situation.

BUG=v8:4973
CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_trusty_blink_rel

Review-Url: https://codereview.chromium.org/2510873005
Cr-Commit-Position: refs/heads/master@{#41563}

Port 378b6b22

Original Commit Message:

    Since we OSR code rarely, it makes sense to store it and look for
    it on the native context rather than the SharedFunctionInfo.
    This makes the OptimizedCodeMap data structure more space efficient,
    as it doesn't have to store an ast ID for the OSR entry point.

R=mvstanton@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2557113002
Cr-Commit-Position: refs/heads/master@{#41562}

BUG=

Review-Url: https://codereview.chromium.org/2560893002
Cr-Commit-Position: refs/heads/master@{#41561}

When an octal escape sequence is in a string in strict mode:
- Octal literals are not allowed in strict mode.
+ Octal escape sequences are not allowed in strict mode.

When an octal escape sequence is in a template string:
- Octal literals are not allowed in template strings.
+ Octal escape sequences are not allowed in template strings.

BUG=v8:4973
CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_trusty_blink_rel

Review-Url: https://codereview.chromium.org/2551633002
Cr-Commit-Position: refs/heads/master@{#41560}

This patch introduces:

1. ICStats class to store ic statistics items produced by V8,
2. A disabled by default tracing category v8.ic_stats,
3. An trace event V8.ICStats that contains ic statistics items in args,

We store ic statistics items in an array until the array is full to reduce
the number of trace events.

TBR=jkummerow@chromium.org,ishell@chromium.org

Review-Url: https://codereview.chromium.org/2503183002
Cr-Commit-Position: refs/heads/master@{#41559}

marking needs finalization.

TBR=mlippautz@chromium.org
BUG=chromium:671994,chromium:670675

Review-Url: https://codereview.chromium.org/2560813002
Cr-Commit-Position: refs/heads/master@{#41558}

The asm.js spec requires exports to be identifiers,
this was DCHECKED in the asm-wasm-builder, but not the typer.

BUG=672046
R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2552913004
Cr-Commit-Position: refs/heads/master@{#41557}

When v8 fails an access check, it invokes a helper to try to see if it
can service the request via an access check interceptor. Invoking the
access check interceptor can throw an exception (e.g. a SecurityError).

Unfortunately, the failed access check property helpers and the
interceptor helpers don't agree on how to propagate the exception: if
the interceptor helper detects a scheduled exception, it promotes the
exception to a pending exception and returns to the failed access check
property helper.

The failed access check property helper also has an early return in
case of a scheduled exception. However, this doesn't work, as the
previously thrown exception is no longer scheduled, as it's been
promoted to a pending exception. Thus, the failed access check property
helper always end up calling the failed access check callback as well.
Since Blink's implementation of the failed access check callback also
throws an exception, this conflicts with the previously-thrown,
already-pending exception.

With this patch, the failed access check property helpers check for a
pending exception rather than a scheduled exception after invoking the
interceptor, so the exception can be propagated correctly.

BUG=v8:5715
R=yangguo@chromium.org,jochen@chromium.org

Review-Url: https://codereview.chromium.org/2550423002
Cr-Commit-Position: refs/heads/master@{#41556}