Rolling v8/third_party/icu to 423fc7e1107fb08ccf007c4aeb76dcab8b2747c1

Rolling v8/tools/clang to 290301c180118e27755bfced176ff61bd0acb1b8

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1373683002

Cr-Commit-Position: refs/heads/master@{#30951}

Revert of JSObject::GetEnumProperty cleanup (patchset #2 id:20001 of https://codereview.chromium.org/1363293002/ )

Reason for revert:
Reverting, because of broken GC stress bots.

@cbruni: Sorry for the revert. I'm not entirely sure it's actually your CL; but policy is to revert speculatively if we can't determine an exact cause.

Original issue's description:
> JSObject::GetEnumProperty cleanup
>
> BUG=
>
> Committed: https://crrev.com/a00d47c802f93cf9835eafce4c9da2dd10b44f6a
> Cr-Commit-Position: refs/heads/master@{#30946}

TBR=jkummerow@chromium.org,cbruni@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1371673004

Cr-Commit-Position: refs/heads/master@{#30950}

BUG=

Review URL: https://codereview.chromium.org/1372623002

Cr-Commit-Position: refs/heads/master@{#30949}

Revert of [heap] Move large object space selection into AllocateRaw. (patchset #2 id:20001 of https://codereview.chromium.org/1373523002/ )

Reason for revert:
Breaks mac asan:
http://build.chromium.org/p/client.v8/builders/V8%20Mac64%20ASAN/builds/2895

According to auto bisect

Original issue's description:
> [heap] Move large object space selection into AllocateRaw.
>
> BUG=
>
> Committed: https://crrev.com/e4f7ebb000432cc2011ecaaa71a69e2e60f416f0
> Cr-Commit-Position: refs/heads/master@{#30938}

TBR=mlippautz@chromium.org,hpayer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1368833004

Cr-Commit-Position: refs/heads/master@{#30948}

Revert of "[heap] Add more tasks for parallel compaction" (patchset #4 id:100001 of https://codereview.chromium.org/1365743003/ )

Reason for revert:
failing again: https://chromegw.corp.google.com/i/client.v8/builders/V8%20Mac/builds/4505/steps/Mozilla%20%28flakes%29/logs/regress-416628

Original issue's description:
> Reland of "[heap] Add more tasks for parallel compaction"
>
> - We now compute the number of parallel compaction tasks, depending on the
>   evacuation candidate list, the number of cores, and some hard limit.
> - Free memory is moved over to compaction tasks (up to some limit)
> - Moving over memory is done by dividing the free list of a given space up among
>   other free lists. Since this is potentially slow we limit the maximum amount
>   of moved memory.
>
> This reverts commit bfccd518.
>
> BUG=chromium:524425
> LOG=N
>
> Committed: https://crrev.com/7e283d746a194ceaaca114e2ba17504653d6a109
> Cr-Commit-Position: refs/heads/master@{#30945}

TBR=hpayer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:524425

Review URL: https://codereview.chromium.org/1371653002

Cr-Commit-Position: refs/heads/master@{#30947}

BUG=

Review URL: https://codereview.chromium.org/1363293002

Cr-Commit-Position: refs/heads/master@{#30946}

- We now compute the number of parallel compaction tasks, depending on the
  evacuation candidate list, the number of cores, and some hard limit.
- Free memory is moved over to compaction tasks (up to some limit)
- Moving over memory is done by dividing the free list of a given space up among
  other free lists. Since this is potentially slow we limit the maximum amount
  of moved memory.

This reverts commit bfccd518.

BUG=chromium:524425
LOG=N

Review URL: https://codereview.chromium.org/1365743003

Cr-Commit-Position: refs/heads/master@{#30945}

BUG=chromium:490559
LOG=NO

Review URL: https://codereview.chromium.org/1352453004

Cr-Commit-Position: refs/heads/master@{#30944}

BUG=chromium:535160
LOG=n

Review URL: https://codereview.chromium.org/1361953003

Cr-Commit-Position: refs/heads/master@{#30943}

R=jochen@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1366173002

Cr-Commit-Position: refs/heads/master@{#30942}

Review URL: https://codereview.chromium.org/1359033002

Cr-Commit-Position: refs/heads/master@{#30941}

Make sure to always reference it indirectly. This allows us to make the vector
native-context dependent should we wish.

R=ishell@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1364373003

Cr-Commit-Position: refs/heads/master@{#30940}

This prevents the internal gc-idle-time-handler.h to be usable outisde
of the "heap" directory. The logic inside that component is only useful
within the GC and is now properly encapsulated.

R=ulan@chromium.org

Review URL: https://codereview.chromium.org/1368983002

Cr-Commit-Position: refs/heads/master@{#30939}

BUG=

Review URL: https://codereview.chromium.org/1373523002

Cr-Commit-Position: refs/heads/master@{#30938}

Looks like we never ran test262-es6 on mac. After merging
into test262 we've got these failures. Skipping for now.

BUG=v8:4437
LOG=n
NOTRY=true
NOTREECHECKS=true
TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1372603002

Cr-Commit-Position: refs/heads/master@{#30937}

BUG=v8:4254
LOG=n
NOTRY=true

Review URL: https://codereview.chromium.org/1365293002

Cr-Commit-Position: refs/heads/master@{#30936}

Review URL: https://codereview.chromium.org/1372533002

Cr-Commit-Position: refs/heads/master@{#30935}

This name makes it clear that the flag (also the variant in the Compiler)
is talking about specializing to the function context instead of i.e. the
native context.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1372513003

Cr-Commit-Position: refs/heads/master@{#30934}

This enables linter checking for "runtime/threadsafe_fn" violations
during presubmit and instead marks the few known exceptions that we
allow explicitly.

R=jochen@chromium.org

Review URL: https://codereview.chromium.org/1369673003

Cr-Commit-Position: refs/heads/master@{#30933}

This is from
https://chromium.googlesource.com/v8/v8/+/347fa90626a448e3535cf6aa100124dfd5b711ce

BUG=

Review URL: https://codereview.chromium.org/1365113003

Cr-Commit-Position: refs/heads/master@{#30932}

Revert of [heap] Move large object space selection into AllocateRaw. (patchset #1 id:1 of https://codereview.chromium.org/1360903004/ )

Reason for revert:
[Sheriff] Breaks:
http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap%20-%20debug%20-%202/builds/2080

And maybe (not sure):
http://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064%20%28dbg%29/builds/1529

Original issue's description:
> [heap] Move large object space selection into AllocateRaw.
>
> BUG=
>
> Committed: https://crrev.com/1403815bdbcbd3336b2d85291704640fada30ffe
> Cr-Commit-Position: refs/heads/master@{#30930}

TBR=mlippautz@chromium.org,hpayer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1368103002

Cr-Commit-Position: refs/heads/master@{#30931}

BUG=

Review URL: https://codereview.chromium.org/1360903004

Cr-Commit-Position: refs/heads/master@{#30930}

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1370663002

Cr-Commit-Position: refs/heads/master@{#30929}

Not resetting the allocation area after freeing it potentially results in
negative SizeOfObjects() because the area is accounted for as allocated while it
has already been freed.

BUG=

Review URL: https://codereview.chromium.org/1364303002

Cr-Commit-Position: refs/heads/master@{#30928}

Verifies consistency of node inputs and uses:
- node inputs should agree with the input count computed from the node's operator.
- effect inputs should have effect outputs (or be a sentinel).
- control inputs should have control outputs (or be a sentinel).
- frame state inputs should be frame states (or be a sentinel).
- if the node has control uses, it should produce control.
- if the node has effect uses, it should produce effect.
- if the node has frame state uses, it must be a frame state.

I also removed some tests, either because they did not seem to be useful (scheduler) or they tested dead functionality (diamond effect phi).

Review URL: https://codereview.chromium.org/1368913002

Cr-Commit-Position: refs/heads/master@{#30927}

mdb_v8, a post-mortem debugger for Node.js, now uses JSArrayBuffer's
backing_store property and JSArrayBufferView's byte_offset property to
get access to the content of Buffer instances in node (which are
Uint8Array instances). This change adds post-mortem metadata for these
two properties.

This change also fixes a typo in
inobject_properties_of_constructor_function_index_offset that was added
to gen-postmortem-metadata in a previous change. It should be named
inobject_properties_or_constructor_function_index instead.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1363403003

Cr-Commit-Position: refs/heads/master@{#30926}

The actual Function.prototype.toMethod was removed some time already,
but there were some stuff (esp. %ToMethod) left in the tree, including
tests for %ToMethod.  This code (and esp. the tests) cause trouble in
the process of moving bound functions away from JSFunction; so since
the code is unused anyway, we can as well remove it.

The original removal of Function.prototype.toMethod was in February
2015 in 68e48975.

R=jarin@chromium.org
BUG=v8:3330
LOG=n

Review URL: https://codereview.chromium.org/1366063002

Cr-Commit-Position: refs/heads/master@{#30925}

Rolling v8/tools/clang to 1f65dc9f9e1879a25d79a8bc46a12265532e4a0f

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1368903002

Cr-Commit-Position: refs/heads/master@{#30924}

port 9b12ec9a (r30919)

original commit message:

    This lowers JSCreateArgument nodes to call the ArgumentsAccessStub for
    help with materializing arguments objects when possible. Along the way
    this changes the calling convention of said stub to take parameters in
    registers instead of on the stack.

R=weiliang.lin@intel.com
BUG=

Review URL: https://codereview.chromium.org/1368873002

Cr-Commit-Position: refs/heads/master@{#30923}

Since https://codereview.chromium.org/366103005 the promise tests null out
various globals, to ensure the promise implementation doesn’t itself rely
on functions patchable by monkeys.

Unfortunately, doing so breaks test assertion failures which rely on
those globals.

This isn’t the ideal solution, but does improve the current state.

R=littledan@chromium.org,domenic@chromium.org
LOG=N
BUG=

Review URL: https://codereview.chromium.org/1370583002

Cr-Commit-Position: refs/heads/master@{#30922}

Once I improved byte accounting done for incremental mark in [1], there is some
code duplication that becomes apparent. This commit refactors the duplicated
code into a private method on NewSpace. This also makes it easy to add new
consumers of inline allocation steps in the future.

[1] https://codereview.chromium.org/1274453002/

R=hpayer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1351983002

Cr-Commit-Position: refs/heads/master@{#30921}

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1365963003

Cr-Commit-Position: refs/heads/master@{#30920}

This lowers JSCreateArgument nodes to call the ArgumentsAccessStub for
help with materializing arguments objects when possible. Along the way
this changes the calling convention of said stub to take parameters in
registers instead of on the stack.

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1348773002

Cr-Commit-Position: refs/heads/master@{#30919}

+ Add bytecodes for conditional and unconditional jumps.
+ Add bytecodes for test/compare operations.
+ Expose jumps in bytecode-array-builder and add BytecodeLabel class for
  identifying jump targets.
+ Add support for if..then...else in the bytecode-generator.
+ Implement jump bytecodes in the interpreter. Test/compare operations
  dependent on runtime call for comparisons.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1343363002

Cr-Commit-Position: refs/heads/master@{#30918}

NOTRY=true

Review URL: https://codereview.chromium.org/1365083002

Cr-Commit-Position: refs/heads/master@{#30917}

This introduces the NodeProperties::ChangeOp helper which guards node
operator changes so that additional checking can be done without any
additional dependencies being pulled into the Node class. For now only
the input count is checked, but additional checking might follow.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1366753003

Cr-Commit-Position: refs/heads/master@{#30916}

BUG=

Review URL: https://codereview.chromium.org/1370443002

Cr-Commit-Position: refs/heads/master@{#30915}

Revert of Remove register index/code indirection (patchset #17 id:320001 of https://codereview.chromium.org/1287383003/ )

Reason for revert:
Failures on greedy RegAlloc, Fuzzer

Original issue's description:
> Remove register index/code indirection
>
> Previous to this patch, both the lithium and TurboFan register
> allocators tracked allocated registers by "indices", rather than
> the register codes used elsewhere in the runtime. This patch
> ensures that codes are used everywhere, and in the process cleans
> up a bunch of redundant code and adds more structure to how the
> set of allocatable registers is defined.
>
> Some highlights of changes:
>
> * TurboFan's RegisterConfiguration class moved to V8's top level
>   so that it can be shared with Crankshaft.
> * Various "ToAllocationIndex" and related methods removed.
> * Code that can be easily shared between Register classes on
>   different platforms is now shared.
> * The list of allocatable registers on each platform is declared
>   as a list rather than implicitly via the register index <->
>   code mapping.
>
> Committed: https://crrev.com/80bc6f6e11f79524e3f1ad05579583adfd5f18b2
> Cr-Commit-Position: refs/heads/master@{#30913}

TBR=akos.palfi@imgtec.com,bmeurer@chromium.org,jarin@chromium.org,paul.lind@imgtec.com,titzer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1365073002

Cr-Commit-Position: refs/heads/master@{#30914}

Previous to this patch, both the lithium and TurboFan register
allocators tracked allocated registers by "indices", rather than
the register codes used elsewhere in the runtime. This patch
ensures that codes are used everywhere, and in the process cleans
up a bunch of redundant code and adds more structure to how the
set of allocatable registers is defined.

Some highlights of changes:

* TurboFan's RegisterConfiguration class moved to V8's top level
  so that it can be shared with Crankshaft.
* Various "ToAllocationIndex" and related methods removed.
* Code that can be easily shared between Register classes on
  different platforms is now shared.
* The list of allocatable registers on each platform is declared
  as a list rather than implicitly via the register index <->
  code mapping.

Review URL: https://codereview.chromium.org/1287383003

Cr-Commit-Position: refs/heads/master@{#30913}

Refactor the StackFrameIterator::ComputeType() method to look up the code object (if any) before looking at the magic markers.

This will allow per-code-kind logic more easily in the future (e.g. for WASM).

BUG=

Review URL: https://codereview.chromium.org/1350763004

Cr-Commit-Position: refs/heads/master@{#30912}