Also fix a bogus test.

R=bmeurer@chromium.org

Bug: v8:5940
Change-Id: I6e201ce35f9021e12d1e4b6127d4accc1425cdb9
Reviewed-on: https://chromium-review.googlesource.com/870596
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50674}

No-try: true
Bug: v8:7266
Change-Id: I8b8ec94c1909e7404774afd576968cf843c043ff
Reviewed-on: https://chromium-review.googlesource.com/873033Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50673}

This reverts commit db129b65.

Reason for revert: blocks roll: https://chromium-review.googlesource.com/c/chromium/src/+/873150

Original change's description:
> [turbofan] Speculate on bounds checks for String#charAt and String#charCodeAt.
> 
> With the new builtin optimization guard we can just speculatively assume
> that the index passed to String#charAt and String#charCodeAt (in optimized
> code) is going to be within the valid range for the receiver. This is
> what Crankshaft used to do, and it avoids Smi checks on the result for
> String#charCodeAt, since it can no longer return NaN.
> 
> This gives rise to further optimizations of these builtins (i.e. to
> completely avoid the tagging of char codes), and by itself already
> improves the regression test originally reported from 650ms to
> 610ms.
> 
> Bug: v8:7127, v8:7326
> Change-Id: Ia25a555c5c1a48d229c094b1ecd2487eec81e390
> Reviewed-on: https://chromium-review.googlesource.com/872850
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#50667}

TBR=yangguo@chromium.org,bmeurer@chromium.org

Change-Id: I6d393a0797cac2fdfd67487a26ac1b178bd52813
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7127, v8:7326
Reviewed-on: https://chromium-review.googlesource.com/873355Reviewed-by: Michael Hablich (vacation) <hablich@chromium.org>
Commit-Queue: Michael Hablich (vacation) <hablich@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50672}

This is needed to easily port the constructor dispatcher to CSA.

Bug: v8:7102
Change-Id: I9672416495940ca12088a2980a9ecc61364aef9d
Reviewed-on: https://chromium-review.googlesource.com/785630Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50671}

This fuzzer randomly generates calls to regexp builtins, runs each on
the slow and fast path, and verifies that their result is the same.

Change-Id: Ia91b0c8afcdaf64835a9bb7b9a470610fbb75fc8
Reviewed-on: https://chromium-review.googlesource.com/833922
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50670}

R=machenbach@chromium.org

Bug: v8:6105
Change-Id: Ie4a9ade13e280153c7ed55af03f9ff4c2d3cdd09
Reviewed-on: https://chromium-review.googlesource.com/873010
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50669}

Allow exporting the current selection as CSV.

No-try: true
Bug: v8:7266
Change-Id: Idd275e749506d2a195a132efa5ec08ebb21ca72f
Reviewed-on: https://chromium-review.googlesource.com/870781Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50668}

With the new builtin optimization guard we can just speculatively assume
that the index passed to String#charAt and String#charCodeAt (in optimized
code) is going to be within the valid range for the receiver. This is
what Crankshaft used to do, and it avoids Smi checks on the result for
String#charCodeAt, since it can no longer return NaN.

This gives rise to further optimizations of these builtins (i.e. to
completely avoid the tagging of char codes), and by itself already
improves the regression test originally reported from 650ms to
610ms.

Bug: v8:7127, v8:7326
Change-Id: Ia25a555c5c1a48d229c094b1ecd2487eec81e390
Reviewed-on: https://chromium-review.googlesource.com/872850Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50667}

This reverts commit 183bc643.

Reason for revert: https://logs.chromium.org/v/?s=chromium%2Fbb%2Fclient.v8%2FV8_Linux_-_debug%2F18780%2F%2B%2Frecipes%2Fsteps%2FCheck_-_extra%2F0%2Flogs%2Fmemory-size%2F0

Original change's description:
> [wasm] Fix page size constant + test limits on max pages.
> 
> BUG=chromium:801604
> R=​bbudge@chromium.org,titzer@chromium.org
> 
> Change-Id: I5fa57d5f8ea288d7aef7d466cbf11df46c4dcd1d
> Reviewed-on: https://chromium-review.googlesource.com/869468
> Reviewed-by: Ben Titzer <titzer@chromium.org>
> Reviewed-by: Bill Budge <bbudge@chromium.org>
> Commit-Queue: Brad Nelson <bradnelson@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#50665}

TBR=bradnelson@chromium.org,bbudge@chromium.org,titzer@chromium.org

Change-Id: I2b5a51f1a94e862f8ac4455d466e23d26c220202
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:801604
Reviewed-on: https://chromium-review.googlesource.com/872950Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50666}

BUG=chromium:801604
R=bbudge@chromium.org,titzer@chromium.org

Change-Id: I5fa57d5f8ea288d7aef7d466cbf11df46c4dcd1d
Reviewed-on: https://chromium-review.googlesource.com/869468Reviewed-by: Ben Titzer <titzer@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Brad Nelson <bradnelson@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50665}

This reverts commit e97daee2.

Bug: chromium:803046,chromium:774108,v8:6792
Change-Id: I15ee3c109b22fa9fe9658c93bd73cb4454310df5
Reviewed-on: https://chromium-review.googlesource.com/870837Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50664}

The calls in Chromium were removed in https://crrev.com/c/865160.

Bug: v8:7269, v8:7273, v8:7274
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Id68649c479483679bf97bc66c14ce8dfa3f7d05c
Reviewed-on: https://chromium-review.googlesource.com/868459Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50663}

This patch does not add any functionality, it just parses the private
fields. Adds a new harmony flag as well.


Bug: v8:5368
Change-Id: I71ce11868f458571eb57a4bc922223931ce5baa8
Reviewed-on: https://chromium-review.googlesource.com/862526Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50662}

We need to maintain TypeGuard nodes until the EffectControlLinearizer, because they can protect partial operations from floating above a check. In the linked bug, it was a DeadValue node that got scheduled too early.

In LoadElimination and EscapeAnalysis, the inserted TypeGuard nodes might depend on map checks on the effect chain. Thus TypeGuard has to be an effect chain node too.

Bug: chromium:800929
Change-Id: Icdcff96a2273d96b7f8cd6f85511ad62c1cb129a
Reviewed-on: https://chromium-review.googlesource.com/860405Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50661}

This is the first in a series of CLs that will separate the JS API
from the implementation of WebAssembly by bottlenecking interactions
through the WasmEngine. In the long run, the JS API and much of V8
should rely only on the WasmEngine interface, which will represent
the "public interface" for embedding WebAssembly.

Next: hide compilation-related methods behind WasmEngine.
Bug: v8:7316
Change-Id: I93404f0dc8a201ae99d30b4c1ca34606e3dddbca
Reviewed-on: https://chromium-review.googlesource.com/868590
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50660}

NOTRY=true

Bug: v8:6917
Change-Id: I08a09ba6f39fc3be7a11e520d2a59ced1354f892
Reviewed-on: https://chromium-review.googlesource.com/868291Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50659}

NOTRY=true
TBR=hpayer@chromium.org

Bug: v8:7012
Change-Id: If8517c27871af17a979d2766cc7f21b94035caa8
Reviewed-on: https://chromium-review.googlesource.com/870550Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50658}

Bug: v8:6917
Change-Id: I0b81ebfe289b459e30ad85a4a62ed244cbd20b65
Cq-Include-Trybots: luci.v8.try:v8_linux64_fyi_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/870123Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michał Majewski <majeski@google.com>
Cr-Commit-Position: refs/heads/master@{#50657}

This will switch on various testing features in sanitizer builds and
for correctness fuzzer builds.

Currently we group enabling the slow-path runtime flag and allocation
timeout for atomic gc stress, but more features could be added in the
future.

This will enable gc fuzzer, clusterfuzz and correctness fuzzer to use
both slow-path and atomic gc stress in release sanitizer builds.

Bug: v8:6972
Change-Id: I5cade68241a8a0711f8a388be7e1543aab0035fa
Reviewed-on: https://chromium-review.googlesource.com/869932
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50656}

For memory tracing, output a 'T' for Turbofan code and an 'L' for
Liftoff code. To do this, the WasmCodeWrapper now has some dispatch
functions which work for both on-the-heap and off-the-heap code.
We can probably refactor more code by having this mechanism.

Since the output of --wasm-trace-memory differs now between Turbofan
and Liftoff, the message test is split in two.

R=titzer@chromium.org
CC=mstarzinger@chromium.org

Bug: v8:6600
Change-Id: Ic5fd18c631f5c8aaad19d639df75b18098895b5a
Reviewed-on: https://chromium-review.googlesource.com/868214Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50655}

This is a workaround for false positive race reported by TSAN.

Bug: v8:7315
Change-Id: I55712010dc5386a58b5ef7d48043e474f4b89bb9
Reviewed-on: https://chromium-review.googlesource.com/869672Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50654}

Bug: v8:6917
Change-Id: I54f908609fadd88bb23bf9fc566d1e2f3ff5e18e
Cq-Include-Trybots: luci.v8.try:v8_linux64_fyi_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/870353
Commit-Queue: Michał Majewski <majeski@google.com>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50653}

This adds support for tracing memory operations in code compiled with
Liftoff. This is the first runtime call we emit from Liftoff code, so
part of this code can be reused for other runtime calls.

Drive-by: Reuse outer compilation zone (avoid one Zone allocation).

Bug: v8:6600, v8:7210
Change-Id: I8b22088d0685338d533d328cb371384210e0ed22
Reviewed-on: https://chromium-review.googlesource.com/864663Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50652}

Bug: v8:7239
Change-Id: I25d2926a974bdb99a45fe4df79c6a62a363f67cf
Reviewed-on: https://chromium-review.googlesource.com/867237Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Peter Wong <peter.wm.wong@gmail.com>
Cr-Commit-Position: refs/heads/master@{#50651}

Bug: v8:6917
Change-Id: I1a355bdfe3f873091a7d7c32a937a533a7d8b3d4
Cq-Include-Trybots: luci.v8.try:v8_linux64_fyi_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/867053
Commit-Queue: Michał Majewski <majeski@google.com>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50650}

Bug: v8:6917
Cq-Include-Trybots: luci.v8.try:v8_linux64_fyi_rel_ng;luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: I14c7e0a140bfe828ee8199606db36cab12be14ff
Reviewed-on: https://chromium-review.googlesource.com/868135
Commit-Queue: Michał Majewski <majeski@google.com>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50649}

No-try: true
Bug: v8:7266
Change-Id: I4a8b8a799d08834675522e9c1dde9ff90f9fc14e
Reviewed-on: https://chromium-review.googlesource.com/870034Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50648}

Bug: v8:6917
Change-Id: I0ee15a41b6028bdbf8448f066b0bc47a049ca587
Reviewed-on: https://chromium-review.googlesource.com/868154Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michał Majewski <majeski@google.com>
Cr-Commit-Position: refs/heads/master@{#50647}

Bug: v8:6917
Change-Id: If9c097548a5879d693174c73e9952db7b25ef2e7
Cq-Include-Trybots: luci.v8.try:v8_linux64_fyi_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/868437Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michał Majewski <majeski@google.com>
Cr-Commit-Position: refs/heads/master@{#50646}

Assembler::PopAndReturn expects an Integral type so convert argc from a
SMI if necessary.

On 64-bit architectures, convert 64-bit immediate pop values into
32-bit values. This is safe since the conversion checks that nothing
was truncated.

Also change CodeStubArguments unit tests to use PopAndReturn rather
than Return.

Change-Id: I91b47d2e81dc0504d185ad59752d638b1c3135a7
Reviewed-on: https://chromium-review.googlesource.com/867052Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50645}

The method {SpillAllRegisters} should really just spill registers, and
not also constants. Also, since more code is inlined into that method
now, we can optimize it to update register use counters only once in
the end, since no used register should be left after executing this
method.

R=titzer@chromium.org

Bug: v8:6600, chromium:802244
Change-Id: I737a1a87f8e912151062224952c4f5dffd43f802
Reviewed-on: https://chromium-review.googlesource.com/868022Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50644}

This is the implementation of crrev.com/c/866721 for ia32.

Drive-by change: Clean up the slot index calculation.

At the moment the slot index is encoded in the opcode. This, however,
sets an upper limit the slot index which is lower than what we want to
have (i.e. < 512). With this change we pass the slot index as an
immediate operand, which does not impose limits on the value it
contains.

R=titzer@chromium.org

Change-Id: I40adf8c6e62de28f8428492db6c5297252c1e2d1
Reviewed-on: https://chromium-review.googlesource.com/864642Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50643}

Since test processors create tests dynamically we cannot simply
count how many tests will be run. Instead we count only base tests
that we've loaded, before creating variants.

Bug: v8:6917
Change-Id: Ibc5b9a73f6afad423572afa575f477ca661a99d5
Cq-Include-Trybots: luci.v8.try:v8_linux64_fyi_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/868290
Commit-Queue: Michał Majewski <majeski@google.com>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50642}

Incremental marking job and concurrent marking tasks may be triggered
during heap tear down. The task scheduler may already be torn down at
this point. Avoid scheduling new tasks if tasks are disabled.

Bug: v8:7238
Change-Id: I3869a20dc8b4f38b26754872448952a9aadb6bd9
Reviewed-on: https://chromium-review.googlesource.com/868825Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ali Ijaz Sheikh <ofrobots@google.com>
Cr-Commit-Position: refs/heads/master@{#50641}

They were in the wrong order in PreParser, which caused problem for "function
arguments() { ... }".

BUG=chromium:801772

Change-Id: Ia04c8c8c0a5d641fd1db0746dc3312c83ebcaf24
Reviewed-on: https://chromium-review.googlesource.com/865900Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50640}

These operations don't need to access per-native context data and
cannot throw exceptions.

Bug: v8:5268, v8:5269
Change-Id: Id7fdbee2b39f96717de83b3cef5ab789424f8338
Reviewed-on: https://chromium-review.googlesource.com/779142
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50639}

Bug: v8:6105
Change-Id: Idfc10bdab9c69d2d5f751197e3df068406bd521a
Reviewed-on: https://chromium-review.googlesource.com/868131
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50638}

There maybe one more ScriptContext in script_context_table if mksnapshot
executed with embeded script.

R=yangguo@chromium.org

Bug: v8:7304
Change-Id: I6f431f76d4beae61a519c3acc3b856d1f7479740
Reviewed-on: https://chromium-review.googlesource.com/866630Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50637}

This adds a new simplified operator NumberToString, which just lowers to
a call to the NumberToString builtin, and hooks that up to the typed
lowering (addressing a long-standing TODO).

Drive-by-fix: Also remove the %NumberToString runtime entry, and just
always use the %NumberToStringSkipCache entry from CSA, since we only
go there if the cache lookup already failed.

Bug: v8:5267, v8:7109
Change-Id: I5ca698c98679653813088a404f1fd38903a73c0e
Reviewed-on: https://chromium-review.googlesource.com/779099
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50636}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/cd91c99..b3a78cd

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/7854862..b4826a5

Rolling v8/third_party/icu: https://chromium.googlesource.com/chromium/deps/icu/+log/f3d25bc..c8ca296

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: I0f5539c41e801702608498b2b1ef943bd3653cc6
Reviewed-on: https://chromium-review.googlesource.com/869392Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50635}