Bug: v8:8659
Change-Id: I7208589dcb5c40dd915a50517f83f3da646202be
Reviewed-on: https://chromium-review.googlesource.com/c/1402547Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58657}

For compilation we only need the NativeModule. Thus only create this
before compilation, create other runtime objects later.
This is a first step towards removing the deferred handles and
clustering all foreground work in one chunk after compilation.

R=ahaas@chromium.org

Bug: v8:7921, v8:8423
Change-Id: If62387d68ddf0f5e067adbaef5fbeca7178958a4
Reviewed-on: https://chromium-review.googlesource.com/c/1402544Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58656}

Port commit 4ab96a9a

Original message:
> Remove the use of a jump table in the prologue of the deopt entries
> and instead pass the bailout id explicitly in a register when calling
> the deopt entry routine from optimized code. This unifies the logic
> with the way the Arm64 code works. It saves the following amount of
> memory in code stubs:
>
>  - arm:  384KB
>  - ia32: 480KB
>  - x64:  240KB
>
> This could be offset by a slight increase in the size of optimized code
> for loading the immediate, however this impact should be minimal and
> will scale with the maximum number of bailout ids (e.g., the size of
> code will increase by one instruction per bailout id on Arm, therefore
> ~98,000 bailouts will be needed before the overhead is greater than
> the current fixed table size).
>
> Change-Id: I838604b48fa04cbd45320c7b9dac0de08fd8eb25
> Reviewed-on: https://chromium-review.googlesource.com/c/1398224
> Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#58636}

Change-Id: I4d070b90ebd4f9d4e82eaa74fe6d41c3a39d93e8
Reviewed-on: https://chromium-review.googlesource.com/c/1400848Reviewed-by: Sreten Kovacevic <skovacevic@wavecomp.com>
Commit-Queue: Sreten Kovacevic <skovacevic@wavecomp.com>
Cr-Commit-Position: refs/heads/master@{#58655}

OOMs in CSA code would trigger fairly arbitrary assertion failures on
some paths. This changes CSA::AllocateRaw to call
FatalProcessOutOfMemory (just like runtime methods).
CSA::AllocateFixedArray additionally checks for
FixedArray::kMaxLength.

This increases overall builtin code size on x64 release by 28K / 2.5%.

Bug: chromium:917561, chromium:848672
Change-Id: I757271264f396e0df8d8fe0570bad078075c27d5
Reviewed-on: https://chromium-review.googlesource.com/c/1400414
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58654}

.rodata usually hosts read only data. MSVC link.exe complains mismatch when
merging this read/write .rodata from embedded.S with .rodata from other object
file.

Bug: chromium:919180
Change-Id: I7789e42afe116cc4bf772e2cbb312d19e4ce7fe5
Reviewed-on: https://chromium-review.googlesource.com/c/1396361
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58653}

Bug: v8:8354
Change-Id: I20bb169695d7ecca739f14f9a3ddfafed0dcb964
Reviewed-on: https://chromium-review.googlesource.com/c/1393284Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Joyee Cheung <joyee@igalia.com>
Cr-Commit-Position: refs/heads/master@{#58652}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/121336d..117f6f1

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/c805793..3511bed

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/d16b51b..da90c53

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: Ie1ad71d68998fa7acfe59bbc04a7f5f2deea5a38
Reviewed-on: https://chromium-review.googlesource.com/c/1401816Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#58651}

Bug: v8:8656
Change-Id: I86f00d377ac99a065c4ecf02abed08ec4feb3686
Reviewed-on: https://chromium-review.googlesource.com/c/1401214Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58650}

Bug: v8:5368
Change-Id: I4142c4051e394f1a249421bf68da456381e390ae
Reviewed-on: https://chromium-review.googlesource.com/c/1401326Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58649}

Change-Id: I241565dea56db982a46eed8ecdd2fd2692c368ce
Reviewed-on: https://chromium-review.googlesource.com/c/1395800Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58648}

Bug: v8:7481
Change-Id: I2587de31faa4dee3ae6f3d5a1872161aae48d1d3
Reviewed-on: https://chromium-review.googlesource.com/c/1395321
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58647}

TC39 accept stable sort in Oct 2018

Bug: v8:7808
Change-Id: I2ad1bca62bda10838dc33acb109a5c937a3b1947
Reviewed-on: https://chromium-review.googlesource.com/c/1400401Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58646}

The spec changed in 7/2018 to treat -0 and 0 differently.
https://github.com/tc39/ecma402/pull/232

Bug: v8:7474, v8:8099
Change-Id: I77db4ae716b081b7628dc7ee253a463520c7f6e9
Reviewed-on: https://chromium-review.googlesource.com/c/1400403Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58645}

Most parallel moves do not actually require the heavy analysis in the
GapResolver since there is no overlap between source and destination
registers. Handle some of these cases by a fast-path to avoid the
quadratic behaviour in the general case.
The fast path is taken for about 2/3 of the non-empty parallel moves on
wasm workloads.

R=herhut@chromium.org, titzer@chromium.org

Bug: v8:8423
Change-Id: I026256fd6cf268f176fccc97f0f427e07629aeb3
Reviewed-on: https://chromium-review.googlesource.com/c/1400410
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Stephan Herhut <herhut@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58644}

Change-Id: Ifc71ae885b2a08b898ace7f75a8df0ca2b9c3a3d
Reviewed-on: https://chromium-review.googlesource.com/c/1275820
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Daniel Clifford <danno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58643}

TBR=machenbach@chromium.org

Bug: v8:8653

NOTRY=true

Change-Id: Ifb80024142491649e66114bed2179faa45365b73
Reviewed-on: https://chromium-review.googlesource.com/c/1400843
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58642}

These flakes can't be reproduced locally so we need more information
when they fail. Add some logging so that we can figure out why they
are breaking.

Bug: v8:8649, v8:8648
Change-Id: I2fb1384bb7592c6fc68c08952505e79329f00bec
Reviewed-on: https://chromium-review.googlesource.com/c/1400418
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58641}

R=jgruber@chromium.org

Bug: v8:7624
Change-Id: I357e0b9d497ebff03e0e41a3495621c5b4c63464
Reviewed-on: https://chromium-review.googlesource.com/c/1400402
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58640}

Within an inline stack we would have multiple copies of the exact same
CodeEntry object to represent an inline frame. We had one copy for every
time that the frame appeared in an inline stack. One CodeEntry can have
multiple inline stacks and each stack can have multiple inline frames.
In the common case, the stacks overlap and repeat frames.

This CL creates a single CodeEntry object to represent each inlined
function as an inline frame (for a given CodeEntry with inlinings). This
removes most of the duplication of inline CodeEntry objects. We still
have some duplication, e.g. if we inline bar() into foo() and foo2() but
they are not themselves inlined into anything, then we will have two
inline CodeEntry objects for bar(). Removing all duplication is harder
to achieve because the lifetime of the inlined frame CodeEntry is now no
longer tied to the inliner.

Get rid of the InlineEntry struct as it is now indentical to
CodeEntryAndLineNumber.

We store the list of canonical inline CodeEntry objects on the
CodeObject of the inlining function so that it can own the lifetimes of
inlined frames.

Also rename inline_locations_ to inline_stacks_ to be clearer.

Bug: v8:7719

Change-Id: Ied765b4cce7fd33f3290798331f1e6767cc42e8c
Reviewed-on: https://chromium-review.googlesource.com/c/1396086
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Alexei Filippov <alph@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58639}

Change-Id: Ie157933d32acf89ff3c1571c843f07ff6fd1c525
Reviewed-on: https://chromium-review.googlesource.com/c/1400782Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58638}

Bug: chromium:919710
Change-Id: I5a04e76fbc925a89b0ebe1916637f6ae5d109b24
Reviewed-on: https://chromium-review.googlesource.com/c/1400419Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58637}

Remove the use of a jump table in the prologue of the deopt entries
and instead pass the bailout id explicitly in a register when calling
the deopt entry routine from optimized code. This unifies the logic
with the way the Arm64 code works. It saves the following amount of
memory in code stubs:

 - arm:  384KB
 - ia32: 480KB
 - x64:  240KB

This could be offset by a slight increase in the size of optimized code
for loading the immediate, however this impact should be minimal and
will scale with the maximum number of bailout ids (e.g., the size of
code will increase by one instruction per bailout id on Arm, therefore
~98,000 bailouts will be needed before the overhead is greater than
the current fixed table size).

Change-Id: I838604b48fa04cbd45320c7b9dac0de08fd8eb25
Reviewed-on: https://chromium-review.googlesource.com/c/1398224
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58636}

Always precheck that the PreparseData has data before serializing it.

Drive-by-fix:
- rename preparsed_scope_data_builder_ to preparse_data_builder_

Change-Id: I8e709af8f69db44e03caa9132f06a7b8c906bfdb
Reviewed-on: https://chromium-review.googlesource.com/c/1387305Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58635}

This reverts commit ac2fb66b.

Reason for revert: Flakily crashes on several bots:
https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Win32/18524
https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Win64%20-%20msvc/6824
https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Linux64%20-%20internal%20snapshot/19766

Original change's description:
> [wasm] Remove finisher task
> 
> This removes the finisher task and instead finishes compilation units
> from the background.
> It also changes ownership of the AsyncCompileJob to be shared among all
> tasks that still operate on it. The AsyncCompileJob dies when the last
> reference dies.
> 
> R=​ahaas@chromium.org
> CC=​​​mstarzinger@chromium.org
> 
> Bug: v8:7921, v8:8423
> Change-Id: Id09378327dfc146459ef41bc97176a8716756ae4
> Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_rel
> Reviewed-on: https://chromium-review.googlesource.com/c/1335553
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#58630}

TBR=ahaas@chromium.org,clemensh@chromium.org

Change-Id: I6b332b66adaec8f713fb31f4c8517cae7ebb4645
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7921, v8:8423
Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_rel
Reviewed-on: https://chromium-review.googlesource.com/c/1400420Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58634}

Simple experiment that prefers free registers that are not used for
arguments to prevent cases where we allocate a free register without
hint and thereby block later uses of that register for no good
reason.

Bug: v8:8311
Change-Id: I95e96b150410e97937cb72d575ae6bece9ee08f9
Reviewed-on: https://chromium-review.googlesource.com/c/1397668Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Stephan Herhut <herhut@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58633}

R=titzer@chromium.org

Bug: v8:7581
Change-Id: I4725eada889cc8cf6a3ca537f05b1da2f5e83f2b
Reviewed-on: https://chromium-review.googlesource.com/c/1400413
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58632}

- Remove macros.py
- Inlines macros into d8.js
- Remove dead code (macros and message templates)
  from js2c.py
- Remove empty src/js directory

Bug: v8:7624
Change-Id: I8dfb69f2f8cb3746b67de816ffc8eb305cbcdee6
Reviewed-on: https://chromium-review.googlesource.com/c/1400150
Commit-Queue: Peter Wong <peter.wm.wong@gmail.com>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58631}

This removes the finisher task and instead finishes compilation units
from the background.
It also changes ownership of the AsyncCompileJob to be shared among all
tasks that still operate on it. The AsyncCompileJob dies when the last
reference dies.

R=ahaas@chromium.org
CC=​​mstarzinger@chromium.org

Bug: v8:7921, v8:8423
Change-Id: Id09378327dfc146459ef41bc97176a8716756ae4
Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_rel
Reviewed-on: https://chromium-review.googlesource.com/c/1335553Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58630}

Previously we'd always push variable proxies into the unresolved list of the
current scope, and possibly delete them from the list later in case they end up
being declarations. If variables become assigned, there were two ways to mark
them as such: The preparser would marked the variables tracked on the
PreParserExpression, and the parser would traverse the LHS AST to find and mark
all variables.

After this CL, if the scope already knows it's tracking declarations, the
variables are never added to the unresolved list in the first place. If the
scope is ambigous, it tracks the variable proxies on the side and only adds
them to the unresolved list if they end up being references rather than
declarations. The same list is now used to bulk mark all LHS variables as
assigned; uniformely for both the parser and the preparser.

In a next step we'll also use the scope to create declarations. That way we can
stop tracking variables_ on PreParserExpression altogether.

Change-Id: I6ada37006cc2e066731f29cd4ea314550fc7959f
Reviewed-on: https://chromium-review.googlesource.com/c/1397669
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58629}

Print all the mismatch failures in the bytecode rather than aborting at
the first mismatch.

R=rmcilroy

Change-Id: Id572ead5fdc4d126ac9a05942f940b0eaef7150f
Reviewed-on: https://chromium-review.googlesource.com/c/1400412
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58628}

Bug: v8:3770
Change-Id: I9214212454034cf1238cab43dc34d8d9f8ed2d37
Reviewed-on: https://chromium-review.googlesource.com/c/1398222Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58627}

Backend is split out, so remove backend owners from src/compiler. Also,
mention explicitly in src/compiler/backend that also all src/compiler
owners are owners there.

R=titzer@chromium.org

No-Try: true
Change-Id: I5409946f65bf27337b715af555083a4804fbb8dd
Reviewed-on: https://chromium-review.googlesource.com/c/1400411Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58626}

This CL adds support for anyref in WebAssembly.Global objects. Note
that the specification is not complete yet in this area.

I did the following changes:
- I renamed the `array_buffer` field of WasmGlobalObject to
  `untagged_buffer`
- I added an additional field of type FixedArray, `tagged_buffer`.
  - In the constructor of WasmGlobalObject I allocate either the former
    or the latter, but not both.
- In the WebAssembly.Global constructor I added special handling for
  the case where no initial value is provided. In that case I set the
  inital value to `null` and not to `undefined`.

R=titzer@chromium.org

Bug: v8:7581
Change-Id: I7e4855d7e6c04a9bcdc7ebd450caca5819d060e2
Reviewed-on: https://chromium-review.googlesource.com/c/1398226
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58625}

Change Object::GetPropertyNames/GetOwnPropertyNames from
V8_DEPRECATE_SOON to V8_DEPRECATED.

Bug: v8:7286, v8:8562
Change-Id: I2c601e6bf729e8fb68be8bc9a7b1618da61934af
Reviewed-on: https://chromium-review.googlesource.com/c/1393285Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58624}

If we have both f32 and f64 locals, we use the same register to hold
their zero value. On stack transfers, we might thus encounter the same
fp register with both the f32 and f64 type. Explicitly allow that case
to happen.

R=ahaas@chromium.org

Bug: chromium:918917, v8:6600
Change-Id: I6937008d38853fe2bdccd9715e1a2499cf6bf7c6
Reviewed-on: https://chromium-review.googlesource.com/c/1398225Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58623}

On ia32, the instruction selector uses movsx_b to compile the wasm
SignExtendWord8ToInt32 instruction. movsx_b requires a byte register
as input. However, not all allocatable registers on ia32 are. As we
cannot currently express constraints on subsets of registers, this
change now forces the input to movsx_b into eax.

Bug: chromium:919572
Change-Id: I39bd391974954ec9044940c3164398109eb78908
Reviewed-on: https://chromium-review.googlesource.com/c/1400409Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Stephan Herhut <herhut@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58622}

Only look 5 frames up the stack when looking for a DCHECK to move the
frame to to prevent excessive iteration especially after a stack
overflow.

Change-Id: I227c46596f09c9af0a47e6673d3165eaccb75163
Reviewed-on: https://chromium-review.googlesource.com/c/1400408Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58621}

Two uses in the API needed adaptation; all other uses have already
been subsumed by the new implementation (previously known as
NeverReadOnlySpaceObjectPtr, here renamed to NeverReadOnlySpaceObject).

Bug: v8:3770
Change-Id: Idf0e4a98a407b9afea22e8790da34cf017b892a5
Reviewed-on: https://chromium-review.googlesource.com/c/1397671
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58620}

StackHandlers form a chain, where the last element is nullptr,
so calling "handler->next()->foo()" is unsafe because "foo"
might see "this == nullptr".

Bug: v8:3770
Change-Id: Ic989384fa192e29d4d8cb76ff01b32173bf55fd9
Reviewed-on: https://chromium-review.googlesource.com/c/1400406Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58619}

Graph width is now managed by the Graph instead of the GraphView,
which simplifies some interfaces.

Change-Id: If78bc9a469cc8369bc75695a6612627103036bc8
Notry: true
Bug: v8:7327
Reviewed-on: https://chromium-review.googlesource.com/c/1398227Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58618}