- I8x16Splat, I8x16ExtractLane, I8x16ReplaceLane
 - Binops: I8x16Add, I8x16AddSaturateS, I8x16Sub, I8x16SubSaturateS, I8x16MinS,
 I8x16MaxS, I8x16AddSaturateU, I8x16SubSaturateU, I8x16MinU, I8x16MaxU
 - Compare ops: I8x16Eq, I8x16Ne

BUG=v8:6020

R=bbudge@chromium.org, bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2829483002
Cr-Commit-Position: refs/heads/master@{#44706}

Bug: v8:5717
Change-Id: I999ea81f745a25a1f3a539e50594e597e64f5287
Reviewed-on: https://chromium-review.googlesource.com/481044Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44705}

It succeeds on my machine, at least, so marking pass/fail to avoid
unnecessary noise until the attached bug is resolved.

TBR=machenbach@chromium.org

Bug: v8:6252
Change-Id: I146eee0c464896e42058745096e929d221c04347
Reviewed-on: https://chromium-review.googlesource.com/480988Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44704}

When --harmony-strict-legacy-accessor-builtins is enabled, it brings
V8's behavior in line with the spec and more recent versions of
SpiderMonkey and JSC:
  - No implicit receiver coercion
  - Attempting to redefine a non-configurable property throws

Bug: v8:5070
Change-Id: I82b927538604136c0c550e19bcc606fbfea1377e
Reviewed-on: https://chromium-review.googlesource.com/478312Reviewed-by: Daniel Ehrenberg <littledan@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44703}

What will we get:
- console would be included into snapshot and allow us to reduce time that we spent in contextCreated function (~5 times faster),
- it allows us to make further small improvement of console methods, e.g. we can implement super quick return from console.assert if first argument is true,
- console calls are ~ 15% faster.

CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_chromium_rel_ng

BUG=v8:6175
R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2785293002
Cr-Original-Original-Original-Commit-Position: refs/heads/master@{#44353}
Committed: https://chromium.googlesource.com/v8/v8/+/55905f85d63d75aaa9313e51eb7bede754a8e41c
Review-Url: https://codereview.chromium.org/2785293002
Cr-Original-Original-Commit-Position: refs/heads/master@{#44355}
Committed: https://chromium.googlesource.com/v8/v8/+/cc74ea0bc4fe4a71fa53d08b62cc18d15e01fbb3
Review-Url: https://codereview.chromium.org/2785293002
Cr-Original-Commit-Position: refs/heads/master@{#44416}
Committed: https://chromium.googlesource.com/v8/v8/+/f5dc738cda0336929dcb8eb73b87fdcd01b7c685
Review-Url: https://codereview.chromium.org/2785293002
Cr-Commit-Position: refs/heads/master@{#44702}

Revert of [errors] Improve NotGeneric error message (patchset #3 id:40001 of https://codereview.chromium.org/2814043006/ )

Reason for revert:
Please schedule rebasing layout test first:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/15036

https://github.com/v8/v8/wiki/Blink-layout-tests

Original issue's description:
> [errors] Improve NotGeneric error message
>
> This changes the message from
>
> "method_name is not generic"
>
> to
>
> "method_name requires that 'this' be a primitive_name object"
>
> BUG=v8:6206
>
> Review-Url: https://codereview.chromium.org/2814043006
> Cr-Commit-Position: refs/heads/master@{#44683}
> Committed: https://chromium.googlesource.com/v8/v8/+/21b104e3b83569b52539ecaa83e68a3646065101

TBR=littledan@chromium.org,yangguo@chromium.org,jgruber@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:6206

Review-Url: https://codereview.chromium.org/2825123002
Cr-Commit-Position: refs/heads/master@{#44701}

+ additional fixes uncovered by bug, and addressed remaining feedback
from original CL (https://codereview.chromium.org/2806073002/).

Note that the regression test differs slightly from the bug reported one,
in that it catches the RangeError which will eventually be thrown due
to call stack size being exceeded.

BUG=chromium:712569

Review-Url: https://codereview.chromium.org/2825073002
Cr-Commit-Position: refs/heads/master@{#44700}

This switches the parser to use token positions (i.e. {Position})
instead of stream positions (i.e. {GetPosition}) everywhere. Access to
the latter is being removed as it is unsupported when the scanner is in
rewind state anyways. This prevents "skipping" a token when seeking.

R=bradnelson@chromium.org
BUG=v8:6127

Change-Id: I9c13dd20a981061a2bccc4fb57e5c57d2a64ac5c
Reviewed-on: https://chromium-review.googlesource.com/480300Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Commit-Queue: Brad Nelson <bradnelson@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44699}

IncrementalMarking has nine bytes of padding in 32-bit and 64-bit
builds. Fixing 32-bit builds just requires moving the one-byte
incremental_marking_job_ member. Fixing 64-bit requires moving the
four-byte state_ member. This change reduces the padding to one byte.

On 64-bit this reduces its size from 152 to 144. This also fits heap
granularity better. On 32-bit it goes from 96 to 88 bytes.

The initial padding was found with llvm-pdbdump.exe. The fix was
verified by compiling v8/src/assembler.cc with the undocumented
/d1reportSingleClassLayout option, like this:

    /d1reportSingleClassLayoutIncrementalMarking

The savings should apply on all platforms, or at worst should make no
difference except for improving alignment.

Thanks to zturner@ for some llvm-pdbdump improvements.

BUG=chromium:710933

Review-Url: https://codereview.chromium.org/2808473003
Cr-Commit-Position: refs/heads/master@{#44698}

BUG=v8:5807

Review-Url: https://codereview.chromium.org/2826593004
Cr-Commit-Position: refs/heads/master@{#44697}

Bug: v8:5717
Change-Id: I92c6d897ae7701e6c778590709f6f1c8a16295b0
Reviewed-on: https://chromium-review.googlesource.com/478591Reviewed-by: Franziska Hinkelmann <franzih@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44696}

BUG: v8/6251
Change-Id: I64e6ad220f05384e4cd549c1356fd713423c3044
Reviewed-on: https://chromium-review.googlesource.com/480072Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44695}

- separated V8StackTraceImpl and AsyncStackTrace,
- V8Debugger owns all AsyncStackTrace and cleanup half of them when limit is reached (first created - first cleaned),
- V8StackTraceImpl, AsyncStackTrace and async-task-related tables in V8Debugger have weak reference to other async stack traces.
- async tasks are cleared with related async stacks.

BUG=v8:6189
R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2816043006
Cr-Original-Commit-Position: refs/heads/master@{#44670}
Committed: https://chromium.googlesource.com/v8/v8/+/1bca73bc832c645138bd3e0306fcaa8bb44dad04
Review-Url: https://codereview.chromium.org/2816043006
Cr-Commit-Position: refs/heads/master@{#44694}

The feature is not quite ready for getting ClusterFuzzed.

BUG=v8:5516

Change-Id: I90a42f950727c8ecf46cb2987c9a459b2ba1f5a7
Reviewed-on: https://chromium-review.googlesource.com/480400
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44693}

This fixes the de-duplication logic used when writing the deoptimizer
translation of a frame-state containing {kArgumentsElementsState}. The
object counts as a captured object and participates in the numbering of
duplicated objects.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-711166
BUG=chromium:711166

Change-Id: I4a3b892017ab8217197e5f94c1a0975d0cd6979f
Reviewed-on: https://chromium-review.googlesource.com/476631
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44692}

Revert of Introduce mkgrokdump to update tools/v8heapconst.py. (patchset #19 id:350001 of https://codereview.chromium.org/2809653003/ )

Reason for revert:
http://build.chromium.org/p/client.v8/builders/V8%20Win64/builds/17063/steps/Check/logs/mkgrokdump

Original issue's description:
> Introduce mkgrokdump to update tools/v8heapconst.py.
>
> - Migrate make grokdump to GYP and GN
> - Move code from d8 into stand-alone execution
> - Add test case to ensure it's up-to-date
>
> Review-Url: https://codereview.chromium.org/2809653003
> Cr-Commit-Position: refs/heads/master@{#44687}
> Committed: https://chromium.googlesource.com/v8/v8/+/0cc0c130fa56f129c90c2a74cb01bda85df5e42a

TBR=mstarzinger@chromium.org,machenbach@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2824853003
Cr-Commit-Position: refs/heads/master@{#44691}

LOG=N
BUG=v8:6020

Review-Url: https://codereview.chromium.org/2808233002
Cr-Commit-Position: refs/heads/master@{#44690}

BUG=v8:5516

Change-Id: Ie2e41ffa82c63788e285641232a5d555155b0d13
Reviewed-on: https://chromium-review.googlesource.com/480239
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44689}

BUG=v8:6262
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2821273002
Cr-Commit-Position: refs/heads/master@{#44688}

- Migrate make grokdump to GYP and GN
- Move code from d8 into stand-alone execution
- Add test case to ensure it's up-to-date

Review-Url: https://codereview.chromium.org/2809653003
Cr-Commit-Position: refs/heads/master@{#44687}

This adds a new "ignition_asm" configuration for the correctness fuzzer.
It is intended to compare execution behavior of asm.js modules (either
valid or invalid) that are translated to WASM, against baseline Ignition
execution. There should be no observable difference between these two
configurations.

R=machenbach@chromium.org
BUG=v8:6127
NOTRY=true

Change-Id: Id3bf8ef8251bf60391876d560f35ddd89818898f
Reviewed-on: https://chromium-review.googlesource.com/479653Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44686}

We can use TUPLE2 or TUPLE3 for structs that do not need special
handling by deoptimizer and compiler.

This frees up a few instance types, so that adding the next few
new structs will not cause ABI compatibility to break.

R=mstarzinger@chromium.org

Review-Url: https://codereview.chromium.org/2811183005
Cr-Commit-Position: refs/heads/master@{#44685}

BUG=v8:5828

Change-Id: I1a75c06ba80a39b28b74870c3e3be4d5e2ec3712
Reviewed-on: https://chromium-review.googlesource.com/480299Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44684}

This changes the message from

"method_name is not generic"

to

"method_name requires that 'this' be a primitive_name object"

BUG=v8:6206

Review-Url: https://codereview.chromium.org/2814043006
Cr-Commit-Position: refs/heads/master@{#44683}

Moved recording data about functions to PreParser, since it knows the
num_inner_funcs. Recording used to be done in AnalyzePartially and then it was
too late, since at that point we only have the Scope and have lost all other
info about the function.

BUG=v8:5516
R=vogelheim@chromium.org

Change-Id: Icb379149882629f2181a1400781d31d653e300ba
Reviewed-on: https://chromium-review.googlesource.com/475833
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44682}

Use Type::Array to constant-fold Array.isArray builtin based on the
value input type. Also use it to improve type based alias analysis,
where we know that stores to an object of type Array don't affect stores
to an object of type OtherObject, and vice versa.

R=jarin@chromium.org
BUG=v8:6262

Review-Url: https://codereview.chromium.org/2819583002
Cr-Commit-Position: refs/heads/master@{#44681}

The CheckBounds operator identifies zeros, but we ignore these bits in
the representation selector, which generates unnecessary -0 checks for
array accesses.

R=jarin@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2823203002
Cr-Commit-Position: refs/heads/master@{#44680}

No usage sites are getting the length for uncompiled functions, so we can
postpone setting the correct length until after compilation. This way we don't
need to produce and store it for skipped inner functions.

In the current implementation, getting the function length compiles it (and
users rely on it - so the feature is probably not going to go away).

BUG=v8:5516

Change-Id: Id8c9a05d2391505a6cde613841094170c9a1b808
Reviewed-on: https://chromium-review.googlesource.com/468927
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44679}

Revert of [inspector] avoid cloning of async call chains (patchset #7 id:120001 of https://codereview.chromium.org/2816043006/ )

Reason for revert:
Speculative revert. Seems to block the roll:
https://codereview.chromium.org/2822983004/

Might require changing a browser test first?

Original issue's description:
> [inspector] avoid cloning of async call chains
>
> - separated V8StackTraceImpl and AsyncStackTrace,
> - V8Debugger owns all AsyncStackTrace and cleanup half of them when limit is reached (first created - first cleaned),
> - V8StackTraceImpl, AsyncStackTrace and async-task-related tables in V8Debugger have weak reference to other async stack traces.
> - async tasks are cleared with related async stacks.
>
> BUG=v8:6189
> R=dgozman@chromium.org
>
> Review-Url: https://codereview.chromium.org/2816043006
> Cr-Commit-Position: refs/heads/master@{#44670}
> Committed: https://chromium.googlesource.com/v8/v8/+/1bca73bc832c645138bd3e0306fcaa8bb44dad04

TBR=dgozman@chromium.org,kozyatinskiy@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:6189

Review-Url: https://codereview.chromium.org/2825713002
Cr-Commit-Position: refs/heads/master@{#44678}

BUG=v8:4743
TBR=jgruber@chromium.org

Review-Url: https://codereview.chromium.org/2827613002
Cr-Commit-Position: refs/heads/master@{#44677}

Fix  751e8935 commit
Fix typo in implementation
BUG=

Review-Url: https://codereview.chromium.org/2816733004
Cr-Commit-Position: refs/heads/master@{#44676}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/94c06fe..1501368

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/buildtools/+log/d307444..88811f4

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/9a55aba..49eb11f

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/49df471..88db8e4

Rolling v8/tools/gyp: https://chromium.googlesource.com/external/gyp/+log/e7079f0..eb296f6

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: Ib7d224ff72a750be91d2bec859180d67cad4e1e4
Reviewed-on: https://chromium-review.googlesource.com/479156Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44675}

BUG=none
R=yangguo@chromium.org

Change-Id: I683c10eae10f60fb7239f3714df0a12a9d19a43b
Reviewed-on: https://chromium-review.googlesource.com/480071Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Jochen Eisinger <jochen@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44674}

Bug: v8:5193
TBR=yangguo@chromium.org
NOTRY=true

Change-Id: I2f6b8e9e9468195fca4e74b83c642a8595c4a51b
Reviewed-on: https://chromium-review.googlesource.com/480091Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44673}

This rolls:
https://chromium.googlesource.com/chromium/deps/icu/+log/450be73..b34251f

Bug: v8:6252
Change-Id: I496f35bad1717105c8e450ce045f3e9929574e0f
Reviewed-on: https://chromium-review.googlesource.com/475652Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44672}

Currently when the module has memory specified in the compiled bytes, but with no initial memory
exported memory assigns a bogus buffer to the instance. When grow_memory is called on this buffer, it tries to patch an incorrect address.
 - Fix exported memory to handle no initial memory
 - Fix grow_memory to handle uninitialized buffers

BUG=chromium:710844
R=bradnelson@chromium.org

Review-Url: https://codereview.chromium.org/2820223002
Cr-Commit-Position: refs/heads/master@{#44671}

- separated V8StackTraceImpl and AsyncStackTrace,
- V8Debugger owns all AsyncStackTrace and cleanup half of them when limit is reached (first created - first cleaned),
- V8StackTraceImpl, AsyncStackTrace and async-task-related tables in V8Debugger have weak reference to other async stack traces.
- async tasks are cleared with related async stacks.

BUG=v8:6189
R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2816043006
Cr-Commit-Position: refs/heads/master@{#44670}

Today, the semantics of:

WebAssembly.instantiate

and

WebAssembly.compile().then(new WebAssemblyInstance)

are subtly different, to the point where attempting the proposed
change uncovered bugs.

In the future, it's possible that .instantiate actually have different
semantics - if we pre-specialized to the provided ffi, for example.
Right now that's not the case.

This CL:
- gets our implementation closer to what developers may write using
the compile -> new Instance alternative, in particular wrt promise
creation. By reusing code paths, we uncover more bugs, and keep
maintenance cost lower.

- it gives us the response-based WebAssembly.instantiate implicitly.
Otherwise, we'd need that same implementation on the blink side. The
negative is maintenance: imagine if the bugs I mentioned could only be
found when running in Blink.

BUG=chromium:697028

Review-Url: https://codereview.chromium.org/2806073002
Cr-Original-Commit-Position: refs/heads/master@{#44592}
Committed: https://chromium.googlesource.com/v8/v8/+/7829af3275ff4644a2d0a1270abe1a1e4415e9fb
Review-Url: https://codereview.chromium.org/2806073002
Cr-Commit-Position: refs/heads/master@{#44669}

Bug=chromium:707066
R=littledan@chromium.org, adamk@chromium.org, caitp@igalia.com
CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_trusty_blink_rel

Change-Id: I24ce0a08816940ef4646d0f2de188d4832c823a0
Reviewed-on: https://chromium-review.googlesource.com/474990Reviewed-by: Daniel Ehrenberg <littledan@chromium.org>
Commit-Queue: Josh Wolfe <jwolfe@igalia.com>
Cr-Commit-Position: refs/heads/master@{#44668}

This flag was shipped with V8 5.7 (Chrome 57).

Bug: v8:5244
Change-Id: I044edb8d7e74ea3c84bf46ec5cf81b8ff1b7a3de
Reviewed-on: https://chromium-review.googlesource.com/477975Reviewed-by: Daniel Ehrenberg <littledan@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44667}