This brings VerifyPointersVisitor into line with Object::VerifyPointer.

R=hpayer@chromium.org
BUG=v8:5854

Review-Url: https://codereview.chromium.org/2640623002
Cr-Commit-Position: refs/heads/master@{#42471}

Revert of [Ignition/turbo] Add a CallWithSpread bytecode. (patchset #10 id:170001 of https://codereview.chromium.org/2629363002/ )

Reason for revert:
Causes a few bugs caught by clusterfuzz.

Original issue's description:
> [Ignition/turbo] Add a CallWithSpread bytecode.
>
> Also, emit a NewWithSpread bytecode for CallNew AST nodes where possible, rather than desugaring in the parser.
>
> BUG=v8:5511
>
> Review-Url: https://codereview.chromium.org/2629363002
> Cr-Commit-Position: refs/heads/master@{#42455}
> Committed: https://chromium.googlesource.com/v8/v8/+/4bae43471d5685e34d8bd74458889b83e60235a0

TBR=bmeurer@chromium.org,rmcilroy@chromium.org,verwaest@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5511

Review-Url: https://codereview.chromium.org/2642843002
Cr-Commit-Position: refs/heads/master@{#42470}

V8InspectorSession::schedulePauseOnNextStatement and V8InspectorSession::cancelPauseOnNextStatement are now exposed in inspector tests. These methods are required at least for better blackboxing tests.

BUG=v8:5842
R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2636613002
Cr-Commit-Position: refs/heads/master@{#42469}

R=joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2639853002
Cr-Commit-Position: refs/heads/master@{#42468}

The results are too noisy ATM. This switches off validate-asm for
default comparisons. We can add back dedicated jobs later that switch
it on.

BUG=chromium:663714
NOTRY=true
TBR=bradnelson@chromium.org,titzer@chromium.org

Review-Url: https://codereview.chromium.org/2640743004
Cr-Commit-Position: refs/heads/master@{#42467}

First step in splitting apart https://codereview.chromium.org/2622833002/ to
land piece by piece.

Porting src/js/async-await.js to TF builtins using this boilerplate is
now very straightforward.

BUG=v8:4483, v8:5855
R=jgruber@chromium.org, gsathya@chromium.org

Review-Url: https://codereview.chromium.org/2635353002
Cr-Commit-Position: refs/heads/master@{#42466}

R=titzer@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2643783002
Cr-Commit-Position: refs/heads/master@{#42465}

The new ignition config will be used as baseline comparison in new
jobs, e.g. against ignition_turbo. We'll keep --validate-asm off
in ignition_turbo for now as it is very chatty.

BUG=chromium:673246
NOTRY=true

Review-Url: https://codereview.chromium.org/2640043002
Cr-Commit-Position: refs/heads/master@{#42464}

- Refactors many FP, integer, and signed integer instructions where
possible.

LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2639443002
Cr-Commit-Position: refs/heads/master@{#42463}

BUG=chromium:681806
NOTRY=true
TBR=bradnelson@chromium.org

Review-Url: https://codereview.chromium.org/2644573002
Cr-Commit-Position: refs/heads/master@{#42462}

CodeAssemblerLabel's destructor was not calling RawMachineLabel's destructor, because label_ is zone-allocated. RawMachineLabel's destructor contains a DCHECK that would make debugging easier. If the DCHECK is not triggered, things will go awry in the register allocation phase, making it harder to debug the issue.

BUG=

Review-Url: https://codereview.chromium.org/2641863002
Cr-Commit-Position: refs/heads/master@{#42461}

R=titzer@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2640823002
Cr-Commit-Position: refs/heads/master@{#42460}

A future linear version of the hash table will only need the element count and
deleted element count. Hence moving them to the beginning of the underlying
fixed array makes the transition easier.

BUG=v8:5717

Review-Url: https://codereview.chromium.org/2630373002
Cr-Commit-Position: refs/heads/master@{#42459}

Power9 support was originally added in CL
https://codereview.chromium.org/2625013002

R=jochen@chromium.org
BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2637213002
Cr-Commit-Position: refs/heads/master@{#42458}

R=machenbach@chromium.org,eholk@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2641873002
Cr-Commit-Position: refs/heads/master@{#42457}

Due to outstanding performance issues, it's safer to revert these
changes.

Revert "PPC/s390: [TypeFeedbackVector] DeclareGlobals needs a literals array"
Revert "[TypeFeedbackVector] DeclareGlobals needs a literals array"
Revert "PPC/s390: [builtins] CompileLazy bailed out to the runtime entirely too often."
Revert "[builtins] CompileLazy bailed out to the runtime entirely too often."

Another CL is to follow that removes the main part of this work
(after that revert, performance regressions should disappear.

TBR=mstarzinger@chromium.org, leszeks@chromium.org, bmeurer@chromium.org
BUG=680637

Review-Url: https://codereview.chromium.org/2645543002
Cr-Commit-Position: refs/heads/master@{#42456}

Also, emit a NewWithSpread bytecode for CallNew AST nodes where possible, rather than desugaring in the parser.

BUG=v8:5511

Review-Url: https://codereview.chromium.org/2629363002
Cr-Commit-Position: refs/heads/master@{#42455}

This CL fixes the check for empty elements in keys.cc. Previously we would
accidentally bail out of the fast path because the check would always fail.
As a consequence for-in loops that would initialize the enum-cache of an object
with own-only fast properties would never be optimized properly.

Review-Url: https://codereview.chromium.org/2638323002
Cr-Commit-Position: refs/heads/master@{#42454}

Lower JSLoadMessage and JSStoreMessage in JSTypedLowering to allow for
optimizations across try-catch, try-finally, for-of, destructuring,
etc.

BUG=v8:5448
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2641843002
Cr-Commit-Position: refs/heads/master@{#42453}

Makes us pass the spec's memory.wast test.

R=titzer@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2640453003
Cr-Commit-Position: refs/heads/master@{#42452}

Breakpoints are always re-set by the embedder after compilation, so we
don't want to store the corresponding breakpoint objects.
Also don't serialize WASM_INTERPRETER_ENTRY stubs as they are replaced
by ordinary WASM_FUNCTION code at instantiation anyway, and skip
WASM_TO_JS wrappers which are recompiled on each instantiation.
Instead, we serialize the Illegal builtin, and also use that one
instead of the placeholder when compiling the wasm code initially.

R=titzer@chromium.org, yangguo@chromium.org
BUG=v8:5822

Review-Url: https://codereview.chromium.org/2629853004
Cr-Commit-Position: refs/heads/master@{#42451}

As no one will ever try to allocate a Thread directly, we can just make
Thread a proxy of ThreadImpl by reinterpret_casting between both types.
This allows to not mention ThreadImpl in the header at all, and to
define it in an anonymous namespace in the implementation, allowing for
more optimizations.
It also saves runtime, as no memory load is needed to forward from
Thread to ThreadImpl, and we do not need to allocate ThreadImpl objects
on the heap.

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2643443002
Cr-Commit-Position: refs/heads/master@{#42450}

When inlining allocations for Array and String iterators, make sure the
allocations have proper types on it (rather than just Type::Any). This
allows us to escape analyze the iterators in a couple of more cases,
i.e. in this very simple case:

  function f(a) {
    const it = a[Symbol.iterator]();
    return it.next().value;
  }

R=jarin@chromium.org
BUG=v8:4586,v8:5448

Review-Url: https://codereview.chromium.org/2640743003
Cr-Commit-Position: refs/heads/master@{#42449}

TBR=titzer@chromium.org
NOTRY=true

Review-Url: https://codereview.chromium.org/2639903003
Cr-Commit-Position: refs/heads/master@{#42448}

This also introduces exhaustive switch-cases for instance types.

BUG=chromium:681383

Review-Url: https://codereview.chromium.org/2646433002
Cr-Commit-Position: refs/heads/master@{#42447}

BUG=chromium:681241
NOTRY=true
TBR=bradnelson@chromium.org,titzer@chromium.org

Review-Url: https://codereview.chromium.org/2644503002
Cr-Commit-Position: refs/heads/master@{#42446}

This fast path check compared a tagged smi and an untagged one, meaning that the slow path was always taken.

Review-Url: https://codereview.chromium.org/2641823002
Cr-Commit-Position: refs/heads/master@{#42445}

BUG=v8:5659

Review-Url: https://codereview.chromium.org/2571563004
Cr-Commit-Position: refs/heads/master@{#42444}

Store breakpoint positions in the WasmSharedModuleData in order to set
them on new instantiations. Also redirect them to all live instances at
the time the breakpoint is set.

Inside the WasmDebugInfo, we store the BreakPointInfo objects to find
hit breakpoints.

R=titzer@chromium.org, yangguo@chromium.org
BUG=v8:5822

Review-Url: https://codereview.chromium.org/2626253002
Cr-Commit-Position: refs/heads/master@{#42443}

We used dynamic dispatch before, which has considerable runtime
overhead. Pimpl (a.k.a. opaque pointer) has the same memory overhead
of one additional pointer, but less runtime overhead.

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2639013002
Cr-Commit-Position: refs/heads/master@{#42442}

BUG=chromium:681088
NOTRY=true
TBR=bradnelson@chromium.org

Review-Url: https://codereview.chromium.org/2637423002
Cr-Commit-Position: refs/heads/master@{#42441}

BUG=674089
R=marja@chromium.org

Review-Url: https://codereview.chromium.org/2614563002
Cr-Commit-Position: refs/heads/master@{#42440}

BUG=

Review-Url: https://codereview.chromium.org/2635243002
Cr-Commit-Position: refs/heads/master@{#42439}

R=adamk@chromium.org
BUG=
NOTRY=true
NOTREECHECKS=true

Review-Url: https://codereview.chromium.org/2634313002
Cr-Commit-Position: refs/heads/master@{#42438}

This is done out of courtesy for Node.js and will be
removed as soon as we branch for version 5.8.

R=jgruber@chromium.org

Review-Url: https://codereview.chromium.org/2636423002
Cr-Commit-Position: refs/heads/master@{#42437}

Non-capturing groups so far did not have any effect, so we elided
them in the regexp parser. However, they do affect how lookarounds
are parsed: in unicode mode, lookarounds are not quantifiable. They
are however if wrapped in a group.

BUG=v8:5845

Review-Url: https://codereview.chromium.org/2636883002
Cr-Commit-Position: refs/heads/master@{#42436}

Collect Receiver feedback for abstract/strict equality in Ignition and
use it in TurboFan to optimize JSEqual and JSStrictEqual operations to
pointer equality instead of having to call Equal/StrictEqual builtins.

R=jarin@chromium.org
BUG=v8:5267,v8:5400

Review-Url: https://codereview.chromium.org/2639883002
Cr-Commit-Position: refs/heads/master@{#42435}

Use the representation selector to insert appropriate Smi checks for
CheckString and CheckInternalizedString when necessary.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2637363002
Cr-Commit-Position: refs/heads/master@{#42434}

BUG=681707
R=aseemgarg@chromium.org,titzer@chromium.org

Review-Url: https://codereview.chromium.org/2641513003
Cr-Commit-Position: refs/heads/master@{#42433}

 - Currently WebAssembly.Memory.grow() assumes that it always has an instance associated with it,
 fix to grow and reflect new size when no instance is associated with memory object.
 - Correctness fixes for the js api, throw range errors instead of generic errors

BUG=chromium:680938

R=bradnelson@chromium.org, titzer@chromium.org

Review-Url: https://codereview.chromium.org/2638243002
Cr-Commit-Position: refs/heads/master@{#42432}