Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/ec59932..5d0c607

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: I7bcebf5758a5993e3612c779a80f515030e54971
Reviewed-on: https://chromium-review.googlesource.com/877564Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50738}

1. Fix infinite loop caused by time based fuzzing
2. Shallow copy of the result to avoid dropping output
by different processor.

Bug: v8:6917
Change-Id: Icf823e853be9d3cc8dfd46ed2fb954979bf02d2f
Reviewed-on: https://chromium-review.googlesource.com/877761
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50737}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/972ab23..ec59932

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/b4706e7..c4b36e2

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: Idb247907b6f3c1d9f67e8021344a66df57cec969
Reviewed-on: https://chromium-review.googlesource.com/877560
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50736}

A map’s `constructor_or_backpointer` can be any kind of value,
because `fn.prototype = foo` sets that field to `foo` if the
latter is not a `JSReceiver`; so the `DCHECK` that is being
removed here was invalid.

Refs: https://github.com/nodejs/node/issues/18223
Bug: node:18223
Change-Id: Ia6449c07bb724e515d73b162369ab36ab1d89c6b
Reviewed-on: https://chromium-review.googlesource.com/874472
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50735}

Bug: v8:6917
Change-Id: I7576a3b8a7fb95244b241532f50759e1c88f6a5a
Reviewed-on: https://chromium-review.googlesource.com/876427
Commit-Queue: Michał Majewski <majeski@google.com>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50734}

Avoids detecting local cores and guessing remote jobs.

No-try: true
Change-Id: I4a825b8dd922802c5f539419313888fd3b21b870
Reviewed-on: https://chromium-review.googlesource.com/876009
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50733}

Samples taken during deoptimization require care in the stack walk
used to gather frames. The top N stack frames may not have JSFunction
objects in place, because those frames represent inlined functions
which may not have closures yet.

Bug: v8:7314
Change-Id: Ib6488aee46a47d5341cab1b1c9c3851592ba6509
Reviewed-on: https://chromium-review.googlesource.com/870036
Commit-Queue: Ali Ijaz Sheikh <ofrobots@google.com>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Ali Ijaz Sheikh <ofrobots@google.com>
Cr-Commit-Position: refs/heads/master@{#50732}

Update flags before recalculating outcomes.

Bug: v8:6917
Change-Id: I5f54f7d14fd60f7e35a976e5200d3f7f0e74a5b7
Cq-Include-Trybots: luci.v8.try:v8_linux64_fyi_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/876364Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michał Majewski <majeski@google.com>
Cr-Commit-Position: refs/heads/master@{#50731}

TBR=sergiyb@chromium.org
NOTRY=true

Bug: v8:6972
Change-Id: I011302ff740dc65ab6a50545ad6e51a2ee32c1bc
Reviewed-on: https://chromium-review.googlesource.com/876094Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50730}

If an entry may have side effects (non-fast JS Array), restart and add all entries in slow path.

- Move allocating and setting table into AddConstructorEntries.
- Move handling non-object map entries into LoadKeyValue.
- AddConstructorEntry and LoadKeyValue go to a label when adding a map entry may have side effects.

Bug: chromium:798026, chromium:799364
Change-Id: I3c28594fc4a8379a106413e19e6df9e83eeb5278
Reviewed-on: https://chromium-review.googlesource.com/874786Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Peter Wong <peter.wm.wong@gmail.com>
Cr-Commit-Position: refs/heads/master@{#50729}

Bug: v8:6917
Change-Id: I2a7ecc6897c8ccd6ed862cf2b0b484673ee359f6
Reviewed-on: https://chromium-review.googlesource.com/871310
Commit-Queue: Michał Majewski <majeski@google.com>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50728}

The tests currently time out due to too many deopt points and hence too many
tests generated.

TBR=sergiyb@chromium.org

Bug: v8:6900
Change-Id: I0998097024a4ed9c087728bb5ef288ab17d3371e
Reviewed-on: https://chromium-review.googlesource.com/876322Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50727}

When the array created would exceed the maximum size for a regular heap
object, instead create it using Runtime::kNewArray directly rather than
via AllocateJSArray.

Bug: chromium:803750
Change-Id: I78cd82edf5a813a2ed69272361e0ca07f864c5ba
Reviewed-on: https://chromium-review.googlesource.com/876011
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50726}

This avoids the call to the StringCharCodeAt builtin from
within TurboFan optimized code and instead emits a loop
that does the character load. This (together with previously
reverted CL to the JSCallReducer) almost completely recovers
the performance regression caused when we shipped TurboFan.

Without untrusted code mitigations the benchmark goes from
580ms to roughly 490ms, and with the patch to the JSCallReducer
the time goes down to 280ms, which is very close to what we
had with Crankshaft.

This also renames the LoadFromString helper method in the
EffectControlLinearizer to LoadFromSeqString to make it
clear what it does.

Bug: v8:7326
Change-Id: I6c77209ae01a3eacbd1e8fd40e4ad842eaf1999a
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/876102
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50725}

No-try: true
Tbr: cbruni@chromium.org
Bug: v8:7266
Change-Id: I65ad82a8ae7b2b499ba3f2bf9fbec178edf7616a
Reviewed-on: https://chromium-review.googlesource.com/876202Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50724}

This is a reland of a7c91c77.

Original change's description:
> [typedarray] Port ConstructByTypedArray to CSA.
> 
> This is needed to easily port the constructor dispatcher to CSA.
> 
> Bug: v8:7102
> Change-Id: I9672416495940ca12088a2980a9ecc61364aef9d
> Reviewed-on: https://chromium-review.googlesource.com/785630
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Commit-Queue: Peter Marshall <petermarshall@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#50671}

Bug: v8:7102
Change-Id: I9d839343d9b95f288f806953455c2c26ca8cab06
Reviewed-on: https://chromium-review.googlesource.com/875031Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50723}

Change-Id: If1a3d08c1fca73234d94db6b527f5d11d10aa6cc
Reviewed-on: https://chromium-review.googlesource.com/867032
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50722}

TBR=sergiyb@chromium.org
NOTRY=true

Bug: v8:6972
Change-Id: Iada267047a023cf32e49866dbf46f62311a3445c
Reviewed-on: https://chromium-review.googlesource.com/876123
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50721}

This adds the benchmarks suite to the deopt fuzzer and removes the
obsolete deopt configs, which since a while are part of the num-fuzz
configs.

TBR=sergiyb@chromium.org

Bug: v8:6900
Change-Id: I9202e2a66a132eca5940b4444fda97816b034e54
Reviewed-on: https://chromium-review.googlesource.com/876085
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50720}

This is the implementation of crrev.com/c/866721 for mips and mips64.

Drive-by change: I made the slot index calculation on mips the same as
on mips64.

Original description:

At the moment the slot index is encoded in the opcode. This, however,
sets an upper limit the slot index which is lower than what we want to
have (i.e. < 512). With this change we pass the slot index as an
immediate operand, which does not impose limits on the value it
contains.

R=v8-mips-ports@googlegroups.com

Change-Id: I46219b07962eadd174f418cba1ea38b07f9b5e96
Reviewed-on: https://chromium-review.googlesource.com/866723
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#50719}

Bug: v8:5828
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I5aabd10a76cd50fefe0ab50ccf239f562cad1522
Reviewed-on: https://chromium-review.googlesource.com/844038Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50718}

Until now, String.prototype.{trimLeft,trimRight} were non-standard
language extensions, required for Web compatibility.

The proposal at https://github.com/tc39/proposal-string-left-right-trim
standardizes this functionality as String.prototype.{trimStart,trimEnd},
and defines String.prototype.{trimLeft,trimRight} as aliases for
backwards compatibility.

This patch implements that proposal behind the --harmony-string-trimming
flag.

Bug: v8:6530
Change-Id: Id21e624c12a79e6b782efb049a48901b9da7db71
Reviewed-on: https://chromium-review.googlesource.com/867044
Commit-Queue: Mathias Bynens <mathias@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50717}

This is the first step towards getting rid of GYP configs.

R=machenbach@chromium.org

Bug: v8:7335
Change-Id: I688a9ff7a09c7cac67cfef8d74a893f2a6d00a8c
Reviewed-on: https://chromium-review.googlesource.com/876122Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50716}

TBR=sergiyb@chromium.org
NOTRY=true

Bug: v8:6917
Change-Id: Ic4f9d151be887fa5795ebe62dcdd3b849cc176ab
Reviewed-on: https://chromium-review.googlesource.com/875965Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50715}

- Base recording just on the concept of virtual instance types.
- Re-add dropped types incrementally.

Bug: v8:7266
Change-Id: Ic8209ce8c6067e24536a0c62404e1160f86377db
Reviewed-on: https://chromium-review.googlesource.com/873646Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50714}

TBR=sergiyb@chromium.org
NOTRY=true

Bug: v8:6972
Change-Id: Id1bdaa1fe4cd0a02f1b59eb7b7f4cecda36ded9a
Reviewed-on: https://chromium-review.googlesource.com/876004Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50713}

Along with double holey support.

Bug: v8:1956
Change-Id: Ic7fb233c57cbc3d43a5a6190f5d166686ae86df7
Reviewed-on: https://chromium-review.googlesource.com/874476Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50712}

TBR=easterbunny

Change-Id: I9f466f6eb0072e6576512d0bb0cead5924a12513
Reviewed-on: https://chromium-review.googlesource.com/875983Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50711}

TBR=sergiyb@chromium.org

Bug: v8:6972
Change-Id: Ia4225f0a2a102ad6b59d2436d7f32aaee90458e7
Reviewed-on: https://chromium-review.googlesource.com/875962
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50710}

This reverts commit 93d67d20.

Reason for revert: several layout test failures:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/21062

Original change's description:
> [turbofan] Inline StringCharCodeAt like Crankshaft did.
> 
> This avoids the call to the StringCharCodeAt builtin from
> within TurboFan optimized code and instead emits a loop
> that does the character load. This (together with previously
> reverted CL to the JSCallReducer) almost completely recovers
> the performance regression caused when we shipped TurboFan.
> 
> Without untrusted code mitigations the benchmark goes from
> 580ms to roughly 490ms, and with the patch to the JSCallReducer
> the time goes down to 280ms, which is very close to what we
> had with Crankshaft.
> 
> This also renames the LoadFromString helper method in the
> EffectControlLinearizer to LoadFromSeqString to make it
> clear what it does.
> 
> Bug: v8:7326
> Change-Id: Ibe0ec1847911a234f244bd8dcec6be18b241fda0
> Reviewed-on: https://chromium-review.googlesource.com/873376
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#50702}

TBR=yangguo@chromium.org,bmeurer@chromium.org

Change-Id: I6e909adba82adc46e269ab14426ee24caaca6ff9
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7326
Reviewed-on: https://chromium-review.googlesource.com/875963Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50709}

This adds gc stress and scavenge stress to legacy gc fuzzer. Each
flag can be used in separation or combined.

TBR=sergiyb@chromium.org
NOTRY=true

Bug: v8:6972
Change-Id: Id03ef96bd42b77415dd201e7f78b3b42786dd3bc
Reviewed-on: https://chromium-review.googlesource.com/874452
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50708}

This is a reland of 183bc643.

Original change's description:
> [wasm] Fix page size constant + test limits on max pages.
> 
> BUG=chromium:801604
> R=bbudge@chromium.org,titzer@chromium.org
> 
> Change-Id: I5fa57d5f8ea288d7aef7d466cbf11df46c4dcd1d
> Reviewed-on: https://chromium-review.googlesource.com/869468
> Reviewed-by: Ben Titzer <titzer@chromium.org>
> Reviewed-by: Bill Budge <bbudge@chromium.org>
> Commit-Queue: Brad Nelson <bradnelson@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#50665}

Bug: chromium:801604
Change-Id: I89943644f5921f8635e62af82bb472c7bfd5e145
Reviewed-on: https://chromium-review.googlesource.com/874696Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50707}

- Changes OS::Allocate to first try an exact size aligned
  allocation, then padded allocations. All padded allocations should
  be trimmed.

Bug: chromium:800511
Change-Id: Iccab2eddbf2a3b08d2b83b95f96c766c9fad7a82
Reviewed-on: https://chromium-review.googlesource.com/875242Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50706}

R=machenbach@chromium.org

Bug: v8:6105
Change-Id: Ieb0de4d0ee031d61d7af1a89607bfbcb64151bcb
Reviewed-on: https://chromium-review.googlesource.com/874353Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50705}

Change-Id: Ia0d50a989e02e916ff6a65a5d0d6a6fc980c2c80
Reviewed-on: https://chromium-review.googlesource.com/869933Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50704}

Bug: v8:5267
Change-Id: I7a580b77650452a7cf2151d4faa8c629e18e42d8
Reviewed-on: https://chromium-review.googlesource.com/873915
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50703}

This avoids the call to the StringCharCodeAt builtin from
within TurboFan optimized code and instead emits a loop
that does the character load. This (together with previously
reverted CL to the JSCallReducer) almost completely recovers
the performance regression caused when we shipped TurboFan.

Without untrusted code mitigations the benchmark goes from
580ms to roughly 490ms, and with the patch to the JSCallReducer
the time goes down to 280ms, which is very close to what we
had with Crankshaft.

This also renames the LoadFromString helper method in the
EffectControlLinearizer to LoadFromSeqString to make it
clear what it does.

Bug: v8:7326
Change-Id: Ibe0ec1847911a234f244bd8dcec6be18b241fda0
Reviewed-on: https://chromium-review.googlesource.com/873376Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50702}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/b3a78cd..972ab23

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/buildtools/+log/6fe4a32..437a616

Rolling v8/third_party/android_tools: https://chromium.googlesource.com/android_tools/+log/c78b258..c9f9bbf

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/b4826a5..b4706e7

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/2708887..e80cb0b

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: Ic95248a169651c4730974b310e9a51f590733830
Reviewed-on: https://chromium-review.googlesource.com/874573
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50701}

Bug: v8:6889
Change-Id: Id79989b5ea65fa4a622205769e961a6e200641b7
Reviewed-on: https://chromium-review.googlesource.com/874996
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50700}

This is the v8 side of changes; blink changes are at https://chromium-review.googlesource.com/c/chromium/src/+/809228

BUG=chromium:716320

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Ia77764aed09dd609bf2304fe3c392a0e8ee16334
Reviewed-on: https://chromium-review.googlesource.com/847337Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Cr-Original-Commit-Position: refs/heads/6.5.123@{#1}
Cr-Original-Branched-From: 2a8e1e4a-refs/heads/master@{#50331}
Reviewed-on: https://chromium-review.googlesource.com/854395
Commit-Queue: Malcolm White <malcolmwhite@google.com>
Reviewed-by: Ben Smith <binji@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50699}