R=machenbach@chromium.org
BUG=v8:6408

Change-Id: I3c785acd30d8feb0541e9acdf0c44225a01cb71c
Reviewed-on: https://chromium-review.googlesource.com/533154Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45936}

For unknown Argument object Maps we have to expect that constants fields
are kept on the Map.

Bug: chromium:729597
Change-Id: I110f77455ce434a431c8de27d021b1a5deb86f30
Reviewed-on: https://chromium-review.googlesource.com/532900Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45935}

This completes refactoring started in 0a355777.

Bug: v8:6474
Change-Id: Ia2ea66e10e4f1d55551fe145f67f4021ae254b23
Reviewed-on: https://chromium-review.googlesource.com/532997
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45934}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/05cc70d..4280b28

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/e6b02f2..597f96e

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/fbd95a5..b7068ad

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: I338f86ce6466baded9fcbaea5ed0c00739a661b3
Reviewed-on: https://chromium-review.googlesource.com/535313Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45933}

Revert of [wasm] Increase WebAssembly.Memory maximum size to ~2GB (patchset #10 id:200001 of https://codereview.chromium.org/2903153002/ )

Reason for revert:
gc stress failure:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20gc%20stress/builds/11122

Original issue's description:
> [wasm] Increase WebAssembly.Memory maximum size to 2GB
>
> BUG=v8:6478, chromium:729768
>
> R=bradnelson@chromium.org, eholk@chromium.org
>
> Review-Url: https://codereview.chromium.org/2903153002
> Cr-Commit-Position: refs/heads/master@{#45931}
> Committed: https://chromium.googlesource.com/v8/v8/+/7e6ed62071d2756688a23bd6dac096b0d4660b5d

TBR=bradnelson@chromium.org,eholk@chromium.org,gdeepti@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:6478, chromium:729768

Review-Url: https://codereview.chromium.org/2935243002
Cr-Commit-Position: refs/heads/master@{#45932}

BUG=v8:6478, chromium:729768

R=bradnelson@chromium.org, eholk@chromium.org

Review-Url: https://codereview.chromium.org/2903153002
Cr-Commit-Position: refs/heads/master@{#45931}

It is only attached to the global object if the --harmony-sharedarraybuffer
flag is enabled, but this allows more objects to be added to the snapshot which
seems to reduce the amount of heap memory used per context.

Bug: chromium:724053
Change-Id: I5d1115a0e3ed9abf41cb3ab80d19d622cbef7b93
Reviewed-on: https://chromium-review.googlesource.com/534594Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Ben Smith <binji@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45930}

- Eliminates S32x4Shuffle, S16x8Shuffle opcodes. All shuffles are subsumed
  by S8x16Shuffle. This aligns us with the latest WASM SIMD spec.

LOG=N
BUG=v8:6020

Review-Url: https://codereview.chromium.org/2923103003
Cr-Commit-Position: refs/heads/master@{#45929}

LOG=N
BUG=v8:6020

Review-Url: https://codereview.chromium.org/2928853002
Cr-Commit-Position: refs/heads/master@{#45928}

Builtins::kReturnReceiver is used for the Symbol.iterator function on
iterators, and just returns the iterator itself. For example, for-of
or yield* with a generator will first call generator[Symbol.iterator](),
which simply returns the generator itself. Inlining this particular
builtin into TurboFan is trivial and avoids that call completely,
enabling more possibilities for LoadElimination and EscapeAnalysis
to get rid of even more checks in common generator code.

BUG=v8:6344,v8:6351,v8:6354
R=jgruber@chromium.org

Review-Url: https://codereview.chromium.org/2938683002
Cr-Commit-Position: refs/heads/master@{#45927}

Change-Id: Ie79607b16270a50ef74261ee8e34a3f1321454c1
Reviewed-on: https://chromium-review.googlesource.com/534233Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45926}

Port the baseline implementation of Object.prototype.isPrototypeOf to
the CodeStubAssembler, sharing the existing prototype chain lookup logic
with the instanceof / OrdinaryHasInstance implementation. Based on that,
do the same in TurboFan, introducing a new JSHasInPrototypeChain
operator, which encapsulates the central prototype chain walk logic.

This speeds up Object.prototype.isPrototypeOf by more than a factor of
four, so that the code

  A.prototype.isPrototypeOf(a)

is now performance-wise on par with

  a instanceof A

for the case where A is a regular constructor function and a is an
instance of A.

Since instanceof does more than just the fundamental prototype chain
lookup, it was discovered in Node core that O.p.isPrototypeOf would
be a more appropriate alternative for certain sanity checks, since
it's less vulnerable to monkey-patching. In addition, the Object
builtin would also avoid the performance-cliff associated with
instanceof (due to the Symbol.hasInstance hook), as for example hit
by https://github.com/nodejs/node/pull/13403#issuecomment-305915874.
The main blocker was the missing performance of isPrototypeOf, since
it was still a JS builtin backed by a runtime call.

This CL also adds more test coverage for the
Object.prototype.isPrototypeOf builtin, especially when called from
optimized code.

CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_chromium_rel_ng
BUG=v8:5269,v8:5989,v8:6483
R=jgruber@chromium.org

Review-Url: https://codereview.chromium.org/2934893002
Cr-Commit-Position: refs/heads/master@{#45925}

They were already implemented mostly in C++ (only error/negative
cases were handled in script), so this is mostly just a cleanup.
Only the constructors remain in script after this CL.

Bug: v8:6354
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I5b3579337a8e33dc30d49c2da5cfd42baec697bb
Reviewed-on: https://chromium-review.googlesource.com/531670Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45924}

Bug: chromium:724947
Change-Id: I287677b2cf18154bcbc0d0a5b15d12455d73d0c3
Reviewed-on: https://chromium-review.googlesource.com/534153Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45923}

Bug: v8:6461
Change-Id: Iafabf2d53aa6492b78a9e5ae683f010453bb195d
Reviewed-on: https://chromium-review.googlesource.com/533014Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45922}

TracingCpuProfiler test updates the current plaform while
concurrent marking is running.

This patch also disables stress-incremental-marking for
mjsunit/regress-430201.

BUG=chromium:694255

Change-Id: I85ff538c47bce0300cde3204989ef3f9512b805f
Reviewed-on: https://chromium-review.googlesource.com/533873Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45921}

Bug: 
Change-Id: I5ea0e072c3ac100a6f3bed62a9a4d2c11d2b7c9a
Reviewed-on: https://chromium-review.googlesource.com/533414
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45920}

Help the compiler a bit by moving the loads into the ctor.

Bug: 
Change-Id: I62deff0ee7252ea78dfec380e791ec958886005d
Reviewed-on: https://chromium-review.googlesource.com/533534Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45919}

Bug: chromium:731351
Change-Id: I810986cba2f575da9de2c4bb70c250784148eeb5
Reviewed-on: https://chromium-review.googlesource.com/532634
Commit-Queue: Mircea Trofin <mtrofin@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45918}

Introduce DEFINE_FIELD_OFFSET_CONSTANTS macro for defining a contiguous
sequence of field offsets.
In addition, this CL turns last two Smi fields to int fields.

Bug: v8:6470
Change-Id: I12a6ad8d7b444772dbc01bba6734080f1d5eccdc
Reviewed-on: https://chromium-review.googlesource.com/532913Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45917}

Bug: 
Change-Id: Ia347ed26ae93730a6bc58bcd6f5edb19b8ded5a9
Reviewed-on: https://chromium-review.googlesource.com/533413
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45916}

The GC performed in GetLoadedScripts currently finalizes incremental
marking, which fails in some tests due to floating garbage.

BUG=chromium:694255

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Ic1fdd2fb123c02ed7bea4c9fb53024574758b536
Reviewed-on: https://chromium-review.googlesource.com/533334Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45915}

Use the flags to configure the maximum semi-space size instead.

BUG=

Review-Url: https://codereview.chromium.org/2941473003
Cr-Commit-Position: refs/heads/master@{#45914}

This patch also fixes several cctests that require manual GC.

BUG=chromium:694255

Change-Id: Ida93ed2498a6c5b0187ee78d2b1da27d2ff1906a
Reviewed-on: https://chromium-review.googlesource.com/533233
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45913}

The new fuzzer takes the fuzzer input as module bytes and compiles them
with WebAssembly asynchronous compilation.

R=mtrofin@chromium.org

Change-Id: I9740edec68e26c04d011d85c68521e340be13c4c
Reviewed-on: https://chromium-review.googlesource.com/506156
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45912}

The function that generated a pre-shifted immediate didn't account for the
instruction with post-shift being unencodable. Fix this by passing
information about the target instruction, and use it to limit the application
of pre-shift.

BUG=chromium:725858

Change-Id: Ia0f70b2ea057975d90162aa6889f15b553acd321
Review-Url: https://codereview.chromium.org/2922173004
Cr-Commit-Position: refs/heads/master@{#45911}

Bug: 
Change-Id: I1a7bd12b39678c926cc74729cc0005e01c487bd9
Reviewed-on: https://chromium-review.googlesource.com/532901Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45910}

Since we require C++11 support now, there is no need to use
__attribute__ or __declspec, all compilers should support the
[[noreturn]] attribute.

R=jarin@chromium.org
BUG=v8:6474

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I6c478c69658fd23c1c8ca468fbf3c6a36474ef66
Reviewed-on: https://chromium-review.googlesource.com/529072Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45909}

There exists a hidden assumption in V8 that neither foreground nor
background tasks own any memory. For asynchronous WebAssembly
compilation this assumption was wrong, which causes crashes when V8 shut
down before the compilation finished.

With this CL I change the way asynchrous compilation happens. In the
existing implementation each compilation stage provided its own task
which could be spawned either in foreground or background. With this CL
each stage only provides a state, and a generic CompileTask executes on
that state. There exists exactly one state at a time.

To have exactly one state at a time I combined the stages
ExecuteCompilationUnits and FinishCompilationUnits to a single stage. In
addition I removed the WaitForBackgroundTasks stage and added a
CancelableTaskManager to the AsyncCompileJob instead to do the waiting.

BUG=v8:6436
R=clemensh@chromium.org, mtrofin@chromium.org

Change-Id: I2eb61f74235c65524ce720c474eaf99ae7472c81
Reviewed-on: https://chromium-review.googlesource.com/532993
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45908}

Bug: v8:5717
Change-Id: I0e900b46a314a272206798aab8af5ccbb7f91fd3
Reviewed-on: https://chromium-review.googlesource.com/528315Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45907}

Review-Url: https://codereview.chromium.org/2936813002
Cr-Commit-Position: refs/heads/master@{#45906}

This gives the embedder more context for deciding whether code
generation should be allowed or not, or they can chose to include the
code in a report.

BUG=chromium:732736
R=ahaas@chromium.org

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Ibbaa3d0574319d290f15565be3eed2ee4d3dda36
Reviewed-on: https://chromium-review.googlesource.com/532875
Commit-Queue: Jochen Eisinger <jochen@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45905}

Use the simpler variant (that defaults to UndefinedConstant()) when
possible.

Bug: v8:6474
Change-Id: I46c6d5c2ffb98cb05f2db003d159dcd9113db085
Reviewed-on: https://chromium-review.googlesource.com/532977Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45904}

This reverts commit e39c9e02.

Reason for revert: Breaks https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20debug/builds/15561

Original change's description:
> [compiler] Drive optimizations with feedback vector
> 
> For interpreted functions, use the optimized code slot in the feedback vector
> to store an optimization marker (optimize/in optimization queue) rather than
> changing the JSFunction's code object. Then, adapt the self-healing mechanism
> to also dispatch based on this optimization marker. Similarly, replace SFI
> marking with optimization marker checks in CompileLazy.
> 
> This allows JSFunctions to share optimization information (replacing shared
> function marking) without leaking this information across native contexts. Non
> I+TF functions (asm.js or --no-turbo) use a CheckOptimizationMarker shim which
> generalises the old CompileOptimized/InOptimizationQueue builtins and also
> checks the same optimization marker as CompileLazy and
> InterpreterEntryTrampoline.
> 
> Change-Id: I6826bdde7ab9a919cdb6b69bc0ebc6174bcb91ae
> Reviewed-on: https://chromium-review.googlesource.com/509716
> Commit-Queue: Leszek Swirski <leszeks@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#45901}

TBR=rmcilroy@chromium.org,mstarzinger@chromium.org,leszeks@chromium.org
No-Presubmit: true
No-Tree-Checks: true
No-Try: true

Change-Id: Ib6c2b4d90fc5f659a6dcaf3fd30321507ca9cb94
Reviewed-on: https://chromium-review.googlesource.com/532916Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45903}

This CL
- removes InternalizeStringIfExists/LookupStringIfExists
- makes the distinction between hash_field and hash clear to AstRawString

Bug: 
Change-Id: Ia98c2236be4154a7db2741f2cf73681cfdcf03c7
Reviewed-on: https://chromium-review.googlesource.com/532954
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45902}

For interpreted functions, use the optimized code slot in the feedback vector
to store an optimization marker (optimize/in optimization queue) rather than
changing the JSFunction's code object. Then, adapt the self-healing mechanism
to also dispatch based on this optimization marker. Similarly, replace SFI
marking with optimization marker checks in CompileLazy.

This allows JSFunctions to share optimization information (replacing shared
function marking) without leaking this information across native contexts. Non
I+TF functions (asm.js or --no-turbo) use a CheckOptimizationMarker shim which
generalises the old CompileOptimized/InOptimizationQueue builtins and also
checks the same optimization marker as CompileLazy and
InterpreterEntryTrampoline.

Change-Id: I6826bdde7ab9a919cdb6b69bc0ebc6174bcb91ae
Reviewed-on: https://chromium-review.googlesource.com/509716
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45901}

These CL skips the tests the same way it is done on ARM.

Bug: 
Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng
Change-Id: I03b5b6cb2c69a4838c649ce7beee6283f3324e6d
Reviewed-on: https://chromium-review.googlesource.com/532876Reviewed-by: Daniel Ehrenberg <littledan@chromium.org>
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@imgtec.com>
Cr-Commit-Position: refs/heads/master@{#45900}

Also only use unique bug numbers in generated commit message.

NOTRY=true

Bug: v8:6482
Change-Id: Ie0d14640053bacb907d18e6ccb5b4d0b6ecbf661
Reviewed-on: https://chromium-review.googlesource.com/532914Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45899}

context_name pointer can be changed after GC triggered by AddProperty.

R=ishell@chromium.org

Bug: chromium:732717
Change-Id: Ie8e2497fa9f3bac80e0ad68153956e382731e284
Reviewed-on: https://chromium-review.googlesource.com/532994
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45898}

Double element types were much slower than Smi/Object previously.
We can box each double in a HeapNumber and push them into a new
FixedArray to save going into the runtime.

Bug: v8:4826, chromium:704966
Change-Id: I7f15d0d636a52760daefed722265c696c1ebb13e
Reviewed-on: https://chromium-review.googlesource.com/531004
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45897}