This reverts commit 0f5ebcca.

Reason for revert: Still blocks rolling:
https://codereview.chromium.org/2857903002/

Original change's description:
> Make unittest link correctly again
> 
> Remains to port these fixes over to gyp.
> 
> R=​machenbach@chromium.org, jkummerow@chromium.org, mstarzinger@chromium.org
> BUG=v8:6325
> 
> Change-Id: I3bebbc6d0ec52fcb60e3d51acd27e616f51d3dbb
> Reviewed-on: https://chromium-review.googlesource.com/490108
> Commit-Queue: Jochen Eisinger <jochen@chromium.org>
> Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#45026}

TBR=jkummerow@chromium.org,machenbach@chromium.org,mstarzinger@chromium.org,jochen@chromium.org,clemensh@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:6325

Change-Id: Icb11e6e12cb6c7bd6c68677359596fee740b6531
Reviewed-on: https://chromium-review.googlesource.com/494467Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45049}

Test typedarray-arg-set-values-same-buffer-other-type fails on
big-endian platforms due to the issue in the test itself. The issue has
been reported to test262 maintainers, until resolved the test is skipped.

TEST=test262/built-ins/TypedArray/prototype/set/typedarray-arg-set-values-same-buffer-other-type
BUG=

Review-Url: https://codereview.chromium.org/2834093002
Cr-Commit-Position: refs/heads/master@{#45048}

The --wasm-interpret-all flag is mainly used for debugging. Combining it
with lazy compilation is unreasonable and would create a lot of special
cases in both code paths. Hence this CL disallows the combination of
these two flags by adding a negative flag implication.

R=rossberg@chromium.org
BUG=chromium:715216

Change-Id: I777e21d7e64f567e2728498dbb6f5b0709cd28f1
Reviewed-on: https://chromium-review.googlesource.com/494486Reviewed-by: Andreas Rossberg <rossberg@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45047}

Adds tests for Heap::IsUnmodifiedHeapObject that is used during
scavenge.

Bug:

Change-Id: Ide549a6616101cbd6ed17372ed1ed168c7a76fbd
Reviewed-on: https://chromium-review.googlesource.com/484539
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45046}

The warning triggers even if the attributes don't change - it's enough
to declare them multiple times. Given that the other compilers don't
complain, just disable the warning on gcc for now.

R=jkummerow@chromium.org,mtrofin@chromium.org
BUG=v8:6339
NOTRY=true

Change-Id: Ie0fcc4feeb8568d4ab74ac65f6887523f3cdcbf9
Reviewed-on: https://chromium-review.googlesource.com/494106
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45045}

I'd like to change the parser to not create those AST nodes in
the first place. To get there, I'm skipping visiting of those nodes
in the existing visitors.

With this change, there is only one visitor in asm-to-wasm left that
actually visits those nodes, and seemingly depends on it.

R=adamk@chromium.org
BUG=v8:6312

Change-Id: I0837fdd97cf4c1baefa2d7fd76eddd90ad00b1df
Reviewed-on: https://chromium-review.googlesource.com/493167Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Jochen Eisinger <jochen@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45044}

Bug: v8:6337
Change-Id: I7de330c77e5f4cbb2cd4bf327c8b60783e78880c
Reviewed-on: https://chromium-review.googlesource.com/493786
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45043}

This patch adds a concurrent marking deque that exposes the same interface
for the main thread as the existing marking deque.

The matching interface makes the concurrent marking deque a drop-in
replacement for the sequential marking deque without any change in
mark-compactor and incremental marker.

BUG=chromium:694255

Review-Url: https://codereview.chromium.org/2810893002
Cr-Commit-Position: refs/heads/master@{#45042}

Executing the |end| opcode of a loop assumed that the stack height was
being reset to the height at start of the loop. Hence we were ignoring
the arity of the loop.
During computation of the side table, the arity of the label associated
with the loop was explicitly set to 0, such that a |br| instruction to
that label would not transfer any values.
It turns out though that we need to remember the arity in order to
precompute the correct stack height when executing the |end| opcode of
a loop.
Also, add a regression test.

R=rossberg@chromium.org
BUG=chromium:716936

Change-Id: Ib3a559998f1ce5f8fcd7b94af1426637b3e48f86
Reviewed-on: https://chromium-review.googlesource.com/493286
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Rossberg <rossberg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45041}

During code review, `CASE` was renamed to `TFJ_CASE`, but one occurrence still refers to the old name. This patch fixes that.

Ref. 2c995c8c

R=danno@chromium.org
BUG=v8:1956
LOG=N

Review-Url: https://codereview.chromium.org/2854913002
Cr-Commit-Position: refs/heads/master@{#45040}

ErrorThrower::Reify() should only be called if an error is actually set.
This CL introduces a Reset() method to replace the obsolete (now
disallowed) usages.

R=mtrofin@chromium.org
BUG=chromium:717056

Change-Id: I41b989a9c7b33591ee26ec6d43540a38289ab54f
Reviewed-on: https://chromium-review.googlesource.com/493506Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45039}

CopyFixedArrayAndGrow can trigger GC, which can clean up
previous detached contexts, so storing the length of the
FixedArray across the allocation is unsafe.

BUG=v8:6282

Review-Url: https://codereview.chromium.org/2857633002
Cr-Commit-Position: refs/heads/master@{#45038}

The existing formula returns non-sense when the old top is greater than
the current top.

BUG=chromium:694255

Review-Url: https://codereview.chromium.org/2850373003
Cr-Commit-Position: refs/heads/master@{#45037}

BytecodeRegisterOptimizer had special handling for the case when parameters
is 0. This is not possible from valid javascript. It exists because some
tests do not take this into account. Fixed tests and removed the special
handling.

Also removed a TODO, which is already done here:
https://codereview.chromium.org/2227203002/

Bug: v8:4280,v8:6325
Change-Id: Idc17af12ad9292c13a6677aa4c8b88d21f4adf81
Reviewed-on: https://chromium-review.googlesource.com/490308
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45036}

The existing CHECK assumed that the source and destination could not
have the same buffer, but they actually can as long as the data
ranges do not overlap within the buffer. Change the check to look for
this more relaxed condition instead.

Moved the check outside of the memcpy case as well, given that it
should also apply for the slower, element-by-element copy as well.

Also use JSTypedArray::element_size() to get the element size instead
of the helper on the FixedTypedArrayBase. This lets us change that
helper back to private again.

Bug: chromium:717022

Change-Id: I2eca1df1e87444c5db397e0b7cf686cefe67d29c
Reviewed-on: https://chromium-review.googlesource.com/493147
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45035}

String inputs would end up in the fast-path, crashing because it
expected an array type. Add the fast path explicitly when the source is
a TypedArray, and let everything else fall back to the generic JS
implementation.

Bug: chromium:715971
Change-Id: Ieec28e93279047d403e00ed2676dc1eda193c033
Reviewed-on: https://chromium-review.googlesource.com/493226
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45034}

Previously, the parameter count for CSA-generated array builtins needed to be
specified both in the TFJ list of builtins as well as in the bootstrapper when
installing each builtin. This patch adds a utility function that returns the
arity of builtins, including CSA-generated array builtins, given the builtin's
name. This function is now used by the bootstrapper and thus removes the need
for the explicit duplication.

R=ishell@chromium.org
BUG=v8:1956
LOG=N

Review-Url: https://codereview.chromium.org/2852833002
Cr-Commit-Position: refs/heads/master@{#45033}

This introduces MarkingDeque::Update function that accepts a callback
and updates marking deque elements using the callback.

BUG=chromium:694255

Review-Url: https://codereview.chromium.org/2854063002
Cr-Commit-Position: refs/heads/master@{#45032}

Add a new flag --min-inlining-frequency, defaulting to 0.15, which
serves as a minimum threshold for callsites to be considered by the
TurboFan inlining heuristic. Call sites with a frequency below this
(i.e. a call site that is only hit every 10th invocation of the caller)
are not considered for inlining.

BUG=v8:4493,v8:5267
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2859433002
Cr-Commit-Position: refs/heads/master@{#45031}

BUG=chromium:694255

Review-Url: https://codereview.chromium.org/2852953004
Cr-Commit-Position: refs/heads/master@{#45030}

TBR=jochen@chromium.org
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true

Change-Id: I79b1f4a599f4f74c7fa077532ca1ba8ada139ede
Reviewed-on: https://chromium-review.googlesource.com/493289Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45029}

R=machenbach@chromium.org
NOTRY=true
NOTREECHECKS=true

Bug: 
Change-Id: Ib6d3768a9e0cfb9ea5fdcece25325e8d498520af
Reviewed-on: https://chromium-review.googlesource.com/493288Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45028}

This reverts commit c5ad9c6d.

Reason for revert: Fails on gc stress:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/builds/12661

Original change's description:
> [TypeFeedbackVector] Store optimized code in the vector
> 
> Since the feedback vector is itself a native context structure, why
> not store optimized code for a function in there rather than in
> a map from native context to code? This allows us to get rid of
> the optimized code map in the SharedFunctionInfo, saving a pointer,
> and making lookup of any optimized code quicker.
> 
> Original patch by Michael Stanton <mvstanton@chromium.org>
> 
> BUG=v8:6246
> 
> Change-Id: I60ff8c408c3001bc272b4b198c9cbaea2872a9e5
> Reviewed-on: https://chromium-review.googlesource.com/476891
> Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
> Reviewed-by: Michael Stanton <mvstanton@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#45022}

TBR=ulan@chromium.org,rmcilroy@chromium.org,yangguo@chromium.org,mvstanton@chromium.org,jarin@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:6246

Change-Id: I9cd5735b03898cae6ae7adea0f19d32fceb31619
Reviewed-on: https://chromium-review.googlesource.com/493287Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45027}

Remains to port these fixes over to gyp.

R=machenbach@chromium.org, jkummerow@chromium.org, mstarzinger@chromium.org
BUG=v8:6325

Change-Id: I3bebbc6d0ec52fcb60e3d51acd27e616f51d3dbb
Reviewed-on: https://chromium-review.googlesource.com/490108
Commit-Queue: Jochen Eisinger <jochen@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45026}

If an embedder doesn't re-use templates, we'll otherwise run out of
memory.

BUG=v8:6336
R=cbruni@chromium.org

Change-Id: Ib70054d3e9d12a6a606f0c4e35233edc69253c49
Reviewed-on: https://chromium-review.googlesource.com/493166Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Jochen Eisinger <jochen@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45025}

BUG=v8:6113,v8:6325

Review-Url: https://codereview.chromium.org/2853783003
Cr-Commit-Position: refs/heads/master@{#45024}

The test and associated bug have been fixed a while ago.

BUG=chromium:336820,v8:6325

Review-Url: https://codereview.chromium.org/2851343002
Cr-Commit-Position: refs/heads/master@{#45023}

Since the feedback vector is itself a native context structure, why
not store optimized code for a function in there rather than in
a map from native context to code? This allows us to get rid of
the optimized code map in the SharedFunctionInfo, saving a pointer,
and making lookup of any optimized code quicker.

Original patch by Michael Stanton <mvstanton@chromium.org>

BUG=v8:6246

Change-Id: I60ff8c408c3001bc272b4b198c9cbaea2872a9e5
Reviewed-on: https://chromium-review.googlesource.com/476891
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45022}

Currently used for observing moves for profiling. In the future this
will be used to transfer colors for the minor MC too.

BUG=chromium:651354

Review-Url: https://codereview.chromium.org/2846043003
Cr-Commit-Position: refs/heads/master@{#45021}

Give the IC one more chance to get itself into a state that's in
line with Turbofan's capabilities and the following assertOptimized
expectation.

BUG=v8:6101,v8:6325

Review-Url: https://codereview.chromium.org/2848193003
Cr-Commit-Position: refs/heads/master@{#45020}

This ensures exceptions thrown during parsing are properly propagated
into the surrounding {v8::TryCatch} block. Otherwise running more than
one test input in the same Isolate can fail due to pending exceptions. 

R=jochen@chromium.org
BUG=chromium:715037

Change-Id: Iaa5735515dc097d8cb12dcf8672451f3c9503440
Reviewed-on: https://chromium-review.googlesource.com/490047
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45019}

This commit adds a getter for the private is_verbose_ member.
The use case for this comes from Node.js where the ability to avoid
calling FatalException if the TryCatch is verbose would be nice to have.

BUG=

Review-Url: https://codereview.chromium.org/2840803002
Cr-Commit-Position: refs/heads/master@{#45018}

As jobs are picked up in the same order by background tasks as they are
when FinishAll is called it may happen that the main thread just waits
for background threads without doing any work. So first run jobs, that
are not running in background, to completion and then wait for remaining
jobs to finish.

BUG=v8:6093

Change-Id: Ica83db2a504771b633cfdfc4e95e1ac8e43111d6
Reviewed-on: https://chromium-review.googlesource.com/488244Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Wiktor Garbacz <wiktorg@google.com>
Cr-Commit-Position: refs/heads/master@{#45017}

While parsing top-level code eager functions are skipped just like lazy
ones, but also a parse task is created for each.

The parse tasks are run by the compiler dispatcher and can be executed
either on background thread or in idle time.
After parsing of top-level code finishes it waits for all unfinished
parser tasks - possibly picking up and executing them on current thread.
Afterwards parse task results are stitched together with top-level AST,
in case of failures eager functions are treated just like lazy -
parsing/compilation is retriggered for them in the runtime and proper
errors are generated (performance is not optimized for error case at
all).

BUG=v8:6093

Change-Id: Ie6508211a04b90becfe44139cce1c8ecec386b6e
Reviewed-on: https://chromium-review.googlesource.com/486725Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Commit-Queue: Wiktor Garbacz <wiktorg@google.com>
Cr-Commit-Position: refs/heads/master@{#45016}

ErrorThrower is not concurrency safe, thus we should not use it from
background tasks. Instead, allocate an ErrorThrower whenever we
actually want (or might) throw.
Pass the ErrorThrower from step 4 to step 5 explicitly.

R=ahaas@chromium.org, mtrofin@chromium.org

Change-Id: Ifb6b16cab7939ec9c81e4f2db59ee42d5ddd7f85
Reviewed-on: https://chromium-review.googlesource.com/489501
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45015}

In the simulators, the ExternalReference constructor rewrites external
addresses, which involves mutating a linked list rooted in the isolate.

We already construct external references concurrently (at least in Turbofan),
but the list mutation was not thread-safe (though no crashes are known). This
CL adds the necessary locking.

BUG=v8:6048

Review-Url: https://codereview.chromium.org/2852983002
Cr-Commit-Position: refs/heads/master@{#45014}

BUG=v8:6093

Change-Id: I365fbd7c3f33e2de47e0a84ee3ea631b4ffa6d35
Reviewed-on: https://chromium-review.googlesource.com/488243Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Commit-Queue: Wiktor Garbacz <wiktorg@google.com>
Cr-Commit-Position: refs/heads/master@{#45013}

As required by #sec-built-in-function-objects.
They were strict functions before (see
e2f1c269), but that got lost when they
were ported to ASM builtins.
This makes optimized and non-optimized code agree on the same behavior
in regress-105.js.

BUG=v8:105,v8:5778,v8:6325

Review-Url: https://codereview.chromium.org/2848313004
Cr-Commit-Position: refs/heads/master@{#45012}

Bug: chromium:716804
Change-Id: I0ef5169e2af34ec2d794c99e99d9e31035599744
Reviewed-on: https://chromium-review.googlesource.com/493146
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45011}

BUG=v8:6325

Change-Id: I5a638c47b33d6e75d31f020c499ffd084348fea4
Reviewed-on: https://chromium-review.googlesource.com/489505
Commit-Queue: Wiktor Garbacz <wiktorg@google.com>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Daniel Clifford <danno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45010}