BUG=chromium:695236
R=dgozman@chromium.org,yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2710953004
Cr-Commit-Position: refs/heads/master@{#43457}

BUG=

R=bjaideep@ca.ibm.com, jyan@ca.ibm.com, joransiu@ca.ibm.com

Review-Url: https://codereview.chromium.org/2712193002
Cr-Commit-Position: refs/heads/master@{#43456}

This will randomly break compilation units that don't happen to #define
DCHECK before v8-util.h is included.

BUG=chromium:688155

Change-Id: I7abdaf87c8bb7aca995d9e6e7ef8b4faff0dc50c
Reviewed-on: https://chromium-review.googlesource.com/447002Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Daniel Cheng <dcheng@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43455}

Make MarkerIs[Not]FrameType actually use their argument instead of a
fixed value for the stack frame type.

Review-Url: https://codereview.chromium.org/2709953002
Cr-Commit-Position: refs/heads/master@{#43454}

Inline the Array.isArray builtin during typed lowering, which generates
ideal code for the common case (non-JSProxy arg), and use the existing
%ArrayIsArray runtime function for the JSProxy case just like in baseline.

BUG=v8:5267
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2719023002
Cr-Commit-Position: refs/heads/master@{#43453}

When an instance of a constructor goes dictionary mode, this changes the initial map
of that constructor to also be in dictionary mode. This avoids spurious hidden class
creation, that also results in IC misses.

BUG=

Change-Id: I0e70f822ac345d0224f2092ec473621a603d4cc5
Reviewed-on: https://chromium-review.googlesource.com/446361Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43452}

BUG=chromium:688734

Change-Id: If5dd370971cb02c4463fa20a489d0fa60b0423c4
Reviewed-on: https://chromium-review.googlesource.com/446845Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43451}

R=titzer@chromium.org, ahaas@chromium.org

Review-Url: https://codereview.chromium.org/2714403004
Cr-Commit-Position: refs/heads/master@{#43450}

Skip parallel compilation if less than two functions need to be
compiled, and skip over imported functions instead of adding nullptrs
for them to the compilation_units_ vector.

R=titzer@chromium.org, ahaas@chromium.org

Review-Url: https://codereview.chromium.org/2718053002
Cr-Commit-Position: refs/heads/master@{#43449}

In spec review, the Intl constructor fallback semantics ended
up changing a bit; this patch updates V8 to the newest semantics.

BUG=v8:4360,v8:4870

Review-Url: https://codereview.chromium.org/2618533002
Cr-Commit-Position: refs/heads/master@{#43448}

This extends the existing typer for JS-level comparisons to also be
applied on simplified-level number comparisons. Now that nodes having
such operators are introduced early during graph construction, precise
type information has become more important.

R=jarin@chromium.org
TEST=unittests/TyperTest

Change-Id: Ibcfda36cadf72381b3c63138dd8ad2f6b1f7fbba
Reviewed-on: https://chromium-review.googlesource.com/445879
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43447}

Compare function for std::sort should satisfy strict weak ordering
relation.

BUG=chromium:696251

Change-Id: I1c07e3bb1b012fd203bc059a21a75ae0fc61f5ac
Reviewed-on: https://chromium-review.googlesource.com/447036Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43446}

Nodes having the {Throw} operator are just used as terminators for
control-flow leaving the function body with an exception completion,
they turn into basic-block terminators within the schedule. Actually
raising an exception is done solely via runtime calls. Hence {Throw}
nodes no longer need any value input.

R=bmeurer@chromium.org

Change-Id: Id6d8e46b12c4b84f4e7a8ac96623c8efb1f27b26
Reviewed-on: https://chromium-review.googlesource.com/446501
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43445}

This should have been removed with 9e187e.

BUG=

Review-Url: https://codereview.chromium.org/2719013002
Cr-Commit-Position: refs/heads/master@{#43444}

Don't just blindly bake in CallIC feedback in the JSCallReducer,
but instead try to estimate first whether it makes sense to bake
it in (and risk potential eager deoptimization exits). We already
didn't use the CallIC feedback when the call target is a known
constant, but we should also not use it if the target is a
JSCreateClosure node or a Phi of known constants / JSCreateClosure
nodes.

R=jarin@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2721483003
Cr-Commit-Position: refs/heads/master@{#43443}

Change-Id: I10ca732853729564c59755648d5fb369fb49ce97
Reviewed-on: https://chromium-review.googlesource.com/446364Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43442}

BUG=chromium:693426
NOTRY=true
TBR=mstarzinger@chromium.org,jarin@chromium.org

Change-Id: If9e5611566660455543044ddff60acda1ee153ba
Reviewed-on: https://chromium-review.googlesource.com/446347Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43441}

BUG=chromium:685318
NOTRY=true
TBR=hablich@chromium.org

Change-Id: Ic5a6d721372ff93d1c2254bad0e8c1d9c0b0af94
Reviewed-on: https://chromium-review.googlesource.com/446344Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Aaron Gable <agable@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43440}

Calling AstNode::Print() from within gdb, e.g. during bytecode
generation, sometimes results in a CHECK failure due to handle
dereferencing being disallowed.  This is very frustrating.

Since this function is purely for debugging and not called anywhere in
the code base, I'm now explicitly adding an AllowHandleDereference scope
to it.

R=adamk@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2711003007
Cr-Commit-Position: refs/heads/master@{#43439}

BUG=v8:6005
R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2715793004
Cr-Commit-Position: refs/heads/master@{#43438}

BUG=chromium:662424,chromium:696247
NOTRY=true
TBR=mstarzinger@chromium.org

Change-Id: I8ff62f16267efc20b1f612300498cc0b994c9a58
Reviewed-on: https://chromium-review.googlesource.com/446346Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43437}

BUG=chromium:689877
NOTRY=true
R=yangguo@chromium.org,jgruber@chromium.org

Change-Id: Ic11826510a0c9484832f62aaa8f2078b3088ecc5
Reviewed-on: https://chromium-review.googlesource.com/446395Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43436}

BUG=chromium:695416

Change-Id: Ied3a389d0dfb0132c798bc85e10f7b1fd4432eb4
Reviewed-on: https://chromium-review.googlesource.com/446343Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43435}

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/246a39a..47b9857

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: Ia6870fe800590533b799e96437db0a275284454f
Reviewed-on: https://chromium-review.googlesource.com/446640Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43434}

Currently, ArrayIncludes handles the hypothetical case of an array with
a fast ElementsKind and non-SMI length. This should not happen (and is checked
against in JSArray::JSArrayVerify of objects_debug.cc).

Therefore this CL replaces that handling with a CSA_ASSERT that the length is
indeed SMI.

The CL also simplifies loading of the (SMI) length on 64 bit architectures by
using LoadAndUntagObjectField instead of LoadObjectField+SmiToWord.

BUG=v8:5985

Review-Url: https://codereview.chromium.org/2714193002
Cr-Commit-Position: refs/heads/master@{#43433}

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/buildtools/+log/94cdccb..7e53759

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: I0e85f180a129e1436aaddc1157566e173213f675
Reviewed-on: https://chromium-review.googlesource.com/447016Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43432}

Currently, Generate_ArrayIndexOf handles the hypothetical case of an array with
a fast ElementsKind and non-SMI length. This should not happen (and is checked
against in JSArray::JSArrayVerify of objects_debug.cc).

Therefore this CL replaces that handling with a CSA_ASSERT that the length is
indeed SMI.

The CL also simplifies loading of the (SMI) length on 64 bit architectures by
using LoadAndUntagObjectField instead of LoadObjectField+SmiToWord.

The CL does not add new tests, because test/mjsunit/array-length.js should
cover this already.

BUG=v8:5985

Review-Url: https://codereview.chromium.org/2714173002
Cr-Commit-Position: refs/heads/master@{#43431}

- Renames Create ops to Splat.
- Adds machine operators to initialize all SIMD machine types.
  Boolean vector types may need initialization, so provide zero
  operators.

LOG=N
BUG=v8:4124,695330

Review-Url: https://codereview.chromium.org/2719483002
Cr-Commit-Position: refs/heads/master@{#43430}

Node.js doesn't build because v8_extra_library_files is
used but not defined in v8.gyp.

We can probably clean up the build file and properly
delete v8_extra_library_files, just want to get the integration
build green again.

TBR=adamk@chromium.org

BUG=

Review-Url: https://codereview.chromium.org/2720483002
Cr-Commit-Position: refs/heads/master@{#43429}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/eefc9cc..c7c2db6

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/buildtools/+log/7e53759..94cdccb

Rolling v8/test/wasm-js: https://chromium.googlesource.com/external/github.com/WebAssembly/spec/+log/ac398e4..b8b919e

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/794fff6..246a39a

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/4e912d5..9913fb1

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: Ia8484e1bccf276c89b032201f3aecbe2699ea55f
Reviewed-on: https://chromium-review.googlesource.com/445987Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43428}

- If no comparison function is given for %TypedArray%.prototype.sort,
sort the typedarray using std::sort in C++. This gets 20 times more
benchmark score in Float64Array.
- Move ValidateTypedArray in builtin-typedarray.cc to static inline
method of JSTypedArray class.

BUG=v8:5953

Review-Url: https://codereview.chromium.org/2693043009
Cr-Commit-Position: refs/heads/master@{#43427}

R=dgozman@chromium.org, pfeldman@chromium.org
BUG=v8:5808

Review-Url: https://codereview.chromium.org/2715833003
Cr-Commit-Position: refs/heads/master@{#43426}

It looks like https://codereview.chromium.org/2705293004 changes available space in heap on OOM notification and it produces crash on one of the ports try bot [1].
This test should be more reliable.

[1] https://build.chromium.org/p/client.v8.ports/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20nosnap%20-%20debug

BUG=v8:6018
TBR=dgozman@chromium.org
NOTREECHECKS=true

Review-Url: https://codereview.chromium.org/2714253002
Cr-Commit-Position: refs/heads/master@{#43425}

This reverts commit d2c093bc.

Reason for revert: looks like it brokes try bot [1].

[1] https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20debug

Original change's description:
> [heap] Support for minor MC marking during incremental marking
> 
> BUG=chromium:651354
> 
> Change-Id: Ia8511723b17936b78b33ea685704237c100648e1
> Reviewed-on: https://chromium-review.googlesource.com/439285
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Hannes Payer <hpayer@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#43422}

TBR=ulan@chromium.org,hpayer@chromium.org,mlippautz@chromium.org,hablich@chromium.org,v8-reviews@googlegroups.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:651354

Change-Id: Ib5bada3ecf9d687568668b9a4ef4682bb665b8e1
Reviewed-on: https://chromium-review.googlesource.com/446977Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43424}

Currently try bots [1] are failing on these tests and no CLs can be landed to V8. It looks like these tests were added recently.
Based on https://bugs.chromium.org/p/v8/issues/detail?id=6015, it's known issue in V8 implementation, so mark them as needs investigation.

[1] https://build.chromium.org/p/tryserver.v8/builders/v8_linux64_asan_rel_ng_triggered/builds/16490/steps/Test262%20-%20no%20variants

BUG=v8:6015,v8:6016
TBR=adamk@chromium.org,littledan@chromium.org
NOTREECHECKS=true

Review-Url: https://codereview.chromium.org/2717773002
Cr-Commit-Position: refs/heads/master@{#43423}

BUG=chromium:651354

Change-Id: Ia8511723b17936b78b33ea685704237c100648e1
Reviewed-on: https://chromium-review.googlesource.com/439285
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43422}

BUG=

R=bjaideep@ca.ibm.com, jyan@ca.ibm.com, joransiu@ca.ibm.com

Review-Url: https://codereview.chromium.org/2710153002
Cr-Commit-Position: refs/heads/master@{#43421}

We don't call any of v8::Debug methods in src/inspector codebase and should use debug-interface.h instead.

BUG=none
R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2710243002
Cr-Original-Commit-Position: refs/heads/master@{#43398}
Committed: https://chromium.googlesource.com/v8/v8/+/838b1a8841aba0c421b413c01b0fbd3c024c2249
Review-Url: https://codereview.chromium.org/2710243002
Cr-Commit-Position: refs/heads/master@{#43420}

Introduce a new Object to allow GetIterator("async") to function when the
iterable does not have a Symbol.asyncIterator method.

This patch has been split out from https://codereview.chromium.org/2622833002/
and incorporates test cases.

BUG=v8:5855, v8:4483
R=jgruber@chromium.org, rmcilroy@chromium.org, neis@chromium.org
TBR=hpayer@chromium.org, bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2645313003
Cr-Commit-Position: refs/heads/master@{#43419}

Now that no harmony-flagged features are implemented in experimental
JS, most of this is simply dead code.

As PostExperimentals() is no longer needed, I also removed the use of
Import() in the debug context, allowing the deletion of PostDebug()
along with PostExperimentals(); cleanup code is moved to the
end of PostNatives.

Also gets rid of some longer-dead code in prologue.js related to
TypedArrays, and some duplicate code for setting up SharedArrayBuffer
builtins.

Review-Url: https://codereview.chromium.org/2705293004
Cr-Commit-Position: refs/heads/master@{#43418}