Node::InputCount() and ::InputAt() have to check for inline/out-of-line
inputs every time they are called. The compiler doesn't seem to be very
good at caching the result of this check, meaning that it (and all its
jumps) would happen for every node access.

Previously we would get around this sometimes, by using Node::inputs(),
which returned a Node::Inputs iterable over node inputs. However,
sometimes node access is more convenient using an index, or we also
want to access the count. This patch adds an index accessor and 'count'
method to Node::Inputs, and replaces several uses of InputCount and
InputAt with this accessor.

Review-Url: https://codereview.chromium.org/2617123002
Cr-Commit-Position: refs/heads/master@{#42179}

... which were done after the promise has been resolved.

Goal of this CL - change promise instrumentation to support better callbacks, chained after promise resolution and prepare instrumentation for adding new asyncTaskCreated instrumentation.

Instrumentation changes:
- asyncTaskScheduled(recurring) when promise is fulfilled or rejected,
- asyncTaskCancelled when promise is collected (since [1] we can be sure that promise will survive scheduled microtasks).

Minor changes:
- async task type in inspector <-> debugger API transferred by enum instead of string,
- Debug manages async task ids based on promise objects.

More details: https://docs.google.com/document/d/1u19N45f1gSF7M39mGsycJEK3IPyJgIXCBnWyiPeuJFE

[1] https://codereview.chromium.org/2581503003/

BUG=chromium:632829,v8:5738
R=dgozman@chromium.org,yangguo@chromium.org,gsathya@chromium.org

Review-Url: https://codereview.chromium.org/2578923002
Cr-Commit-Position: refs/heads/master@{#42178}

... including property reconfiguring, elements kind change and migration
of a map to an up-to-date non-deprecated version.

BUG=v8:5495

Review-Url: https://codereview.chromium.org/2601643002
Cr-Commit-Position: refs/heads/master@{#42177}

- Disassembler, simulator support too.
LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2600153002
Cr-Commit-Position: refs/heads/master@{#42176}

Sometimes, the embedder might want to merge a fix to an abandoned branch
or to a supported branch but the fix is not relevant to Chromium.
This adds a new version string that the embedder can set on compile time
and that will be appended to the official V8 version.
The separator must be provided in the string. For instance, to have a
full version string like "5.5.372.37.custom.1", the embedder must set
V8_EMBEDDER_STRING to ".custom.1".

Related Node.js issue: https://github.com/nodejs/node/pull/9754

BUG=v8:5740
R=machenbach@chromium.org,hablich@chromium.com,ofrobots@google.com

Review-Url: https://codereview.chromium.org/2619213002
Cr-Commit-Position: refs/heads/master@{#42175}

Now we have declarations too, so it doesn't matter whether preparser
produces the same unresolved variables as the parser.

BUG=v8:5501, v8:5516
R=verwaest@chromium.org

Review-Url: https://codereview.chromium.org/2623583004
Cr-Commit-Position: refs/heads/master@{#42174}

BUG=chromium:679345
R=verwaest@chromium.org

Review-Url: https://codereview.chromium.org/2622873002
Cr-Commit-Position: refs/heads/master@{#42173}

BUG=v8:5620
R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2620973002
Cr-Commit-Position: refs/heads/master@{#42172}

BUG=v8:5269

Review-Url: https://codereview.chromium.org/2623483002
Cr-Commit-Position: refs/heads/master@{#42171}

Revert of Internalize strings in-place (patchset #16 id:300001 of https://codereview.chromium.org/2549773002/ )

Reason for revert:
gc stress failures:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20gc%20stress/builds/8024

Original issue's description:
> Internalize strings in-place
>
> using newly introduced ThinStrings, which store a pointer to the actual,
> internalized string they represent.
>
> BUG=v8:4520
>
> Review-Url: https://codereview.chromium.org/2549773002
> Cr-Commit-Position: refs/heads/master@{#42168}
> Committed: https://chromium.googlesource.com/v8/v8/+/af51befe694fe039db3554d4b9165f7d6baceb77

TBR=ishell@chromium.org,hpayer@chromium.org,bmeurer@chromium.org,jkummerow@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4520

Review-Url: https://codereview.chromium.org/2621913002
Cr-Commit-Position: refs/heads/master@{#42170}

This adds tracking the following:
- Let / var declarations in for loops

BUG=v8:5501, v8:5516

Review-Url: https://codereview.chromium.org/2616393002
Cr-Commit-Position: refs/heads/master@{#42169}

using newly introduced ThinStrings, which store a pointer to the actual,
internalized string they represent.

BUG=v8:4520

Review-Url: https://codereview.chromium.org/2549773002
Cr-Commit-Position: refs/heads/master@{#42168}

Related to:
https://chromium-review.googlesource.com/c/426618

BUG=chromium:673246
NOTRY=true
NOTREECHECKS=true
TBR=tandrii@chromium.org,jochen@chromium.org

Review-Url: https://codereview.chromium.org/2628483003
Cr-Commit-Position: refs/heads/master@{#42167}

This adds the correctness fuzzer harness files to the output
directory guarded by a gn arg.

The switch will be turned on on the builder uploading builds to
clusterfuzz.

BUG=chromium:673246
NOTRY=true
TBR=tandrii@chromium.org,jochen@chromium.org

Review-Url: https://codereview.chromium.org/2623843002
Cr-Commit-Position: refs/heads/master@{#42166}

BUG=v8:5402

Review-Url: https://codereview.chromium.org/2628473003
Cr-Commit-Position: refs/heads/master@{#42165}

BUG=v8:5766
R=ahaas@chromium.org
NOTRY=true

Review-Url: https://codereview.chromium.org/2622863002
Cr-Commit-Position: refs/heads/master@{#42164}

R=clemensh@chromium.org
BUG=chromium:663994

Review-Url: https://codereview.chromium.org/2622563002
Cr-Commit-Position: refs/heads/master@{#42163}

Revert of [WASM] Fix failing Wasm SIMD F32x4 tests. (patchset #7 id:130001 of https://codereview.chromium.org/2594043002/ )

Reason for revert:
F32x4Add / Sub are still failing. I'll have to investigate on ARM hardware when I get back.

Original issue's description:
> [WASM] Fix failing Wasm SIMD F32x4 tests.
> - Perform lane checks using FP compare instead of reinterpret casts. 0 and -0
> will be different under I32 compare.
> - Some arithmetic operations can generate NaN results, such as adding -Inf
> and +Inf. Skip these tests until we have a way to do more sophisticated
> FP comparisons in the SIMD tests.
> - Eliminate a redundant F32x4 parameter for FP SIMD vector checking. We will only have this one FP type.
>
> LOG=N
> BUG=v8:4124
>
> Review-Url: https://codereview.chromium.org/2594043002
> Cr-Commit-Position: refs/heads/master@{#42154}
> Committed: https://chromium.googlesource.com/v8/v8/+/5560bbb498252334595a39bb5f313ac8eb82cfe1

TBR=titzer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2624713002
Cr-Commit-Position: refs/heads/master@{#42162}

Inline calls to Math.ceil(x) as -Math.floor(-x) via the existing fast
path in Crankshaft.

R=ishell@chromium.org
BUG=v8:5782

Review-Url: https://codereview.chromium.org/2621903002
Cr-Commit-Position: refs/heads/master@{#42161}

Instead of exporting/importing PromiseCreate and RejectPromise and going
through them, just call the runtime function / the TF builtin on the
context directly.

BUG=v8:5639

Review-Url: https://codereview.chromium.org/2599003002
Cr-Commit-Position: refs/heads/master@{#42160}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/87eca92..da5025b

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/487c2d0..886ff59

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/d150023..b644731

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2619903003
Cr-Commit-Position: refs/heads/master@{#42159}

Deferred function call validation is required to support out of order
asm.js function declaration. Unfortunately, since we've started interleaving
validation and asm-wasm building, we don't check names are resolved until
the end.
Fortunately, undefined names can be detected from their CallType.
Check this at asm-typer time.

BUG=676797
R=aseemgarg@chromium.org,titzer@chromium.org

Review-Url: https://codereview.chromium.org/2615443003
Cr-Commit-Position: refs/heads/master@{#42158}

  port 38602f1f (r42146)

  original commit message:
  This changes the NewClosure interface descriptor, but ignores
  the additional vector/slot arguments for now. The feedback vector
  gets larger, as it holds a space for each literal array. A follow-on
  CL will constructively use this space.

BUG=

Review-Url: https://codereview.chromium.org/2616403007
Cr-Commit-Position: refs/heads/master@{#42157}

R=adamk@chromium.org

Review-Url: https://codereview.chromium.org/2626493002
Cr-Commit-Position: refs/heads/master@{#42156}

The original TF port didn't maintain the same semantics as the CS/runtime implementation, and in fact introduced a bug that grew capacity too slowly on
32-bit platforms.

R=ishell@chromium.org
LOG=N

Review-Url: https://codereview.chromium.org/2617393002
Cr-Commit-Position: refs/heads/master@{#42155}

- Perform lane checks using FP compare instead of reinterpret casts. 0 and -0
will be different under I32 compare.
- Some arithmetic operations can generate NaN results, such as adding -Inf
and +Inf. Skip these tests until we have a way to do more sophisticated
FP comparisons in the SIMD tests.
- Eliminate a redundant F32x4 parameter for FP SIMD vector checking. We will only have this one FP type.

LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2594043002
Cr-Commit-Position: refs/heads/master@{#42154}

Adds overloads for float, int32, int16, uint16, int8 and uint8 arrays.

LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2619223002
Cr-Commit-Position: refs/heads/master@{#42153}

Previously, the Intl implementation tracked types two ways:
 - In the intl_initialized_marker_symbol
 - In various named properties of the intl_impl_object_symbol value

As far as I can tell, these will never disagree with each other,
modulo bugs in Intl itself. This patch removes the second type
checking system.

This reland includes a fixed type check for
Intl.DateTimeFormat.prototype.formatToParts , which is the only Intl
method which is not bound. All future methods will follow this
pattern.

The second reland ensures that a newly inserted test is only run
if Intl is present.

BUG=v8:5751,chromium:677055, v8:4962
CQ_INCLUDE_TRYBOTS=master.tryserver.v8:v8_linux_noi18n_rel_ng

TBR=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2623683002
Cr-Commit-Position: refs/heads/master@{#42152}

Avoid allocating local objects in the outer zone, instead create a new inner zone
in ValidatePendingAssessment.

BUG=v8:5796

Review-Url: https://codereview.chromium.org/2617413002
Cr-Commit-Position: refs/heads/master@{#42151}

This makes sure the metadata is found during minimization. Also renames
the test files to fit the naming pattern.

BUG=chromium:673246
NOTRY=true
TBR=tandrii@chromium.org,mbarbella@chromium.org

Review-Url: https://codereview.chromium.org/2622653002
Cr-Commit-Position: refs/heads/master@{#42150}

I can't actually figure out how to trigger a change in behavior here,
but it looks like we should be passing the same attributes both to
the accessor and the descriptor.

R=verwaest@chromium.org

Review-Url: https://codereview.chromium.org/2616843005
Cr-Commit-Position: refs/heads/master@{#42149}

BUG=v8:5798
R=epertoso@chromium.org
LOG=N

Review-Url: https://codereview.chromium.org/2619263002
Cr-Commit-Position: refs/heads/master@{#42148}

String16 had a pseudo move constructor that took a const String16&&. The
problem with this is that the point of moving objects is the ability to
clobber the underlying data. If we look at this particular case, the
move ctor tried to then std::move the underlying std::basic_string<>;
this results in passing a const std::basic_string<>&& to the
basic_string ctor. This resolves to the const std::basic_string<>&
*copy* ctor. So in the end, we haven't moved anything.

Fix this by taking a mutable rvalue reference that allows the moving to
work as expected.

BUG=None

Review-Url: https://codereview.chromium.org/2616973002
Cr-Commit-Position: refs/heads/master@{#42147}

This changes the NewClosure interface descriptor, but ignores
the additional vector/slot arguments for now. The feedback vector
gets larger, as it holds a space for each literal array. A follow-on
CL will constructively use this space.

BUG=v8:5456

Review-Url: https://codereview.chromium.org/2614373002
Cr-Commit-Position: refs/heads/master@{#42146}

GCC4.8.5 on s390 emits warning "array subscript is above array bounds"
for line "code[pos + 1] = kLocalVoid;". The warning seems to be
correct because code[sizeof(code)] should be out of bounds.
I'm suggesting to run the loop till "sizeof(code) - 1" which GCC(4.8.5)
agrees with. Although this means the last byte is missed, but it should
be safe to do since the last few bytes are "0xb" (kExprEnd) and the
offending statement is only run when byte=kExprBlock.

R=titzer@chromium.org, mstarzinger@chromium.org, bradnelson@chromium.org
BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2619063002
Cr-Commit-Position: refs/heads/master@{#42145}

Review-Url: https://codereview.chromium.org/2622453003
Cr-Commit-Position: refs/heads/master@{#42144}

BUG=

Review-Url: https://codereview.chromium.org/2579243003
Cr-Commit-Position: refs/heads/master@{#42143}

If you try to store an object in new space to the Code header, it will
be added to the store buffer, and a DCHECK will fail later, since Code
objects should never occur in the store buffer.

This CL adds DCHECKs to catch such assignments early. Once we handle
this case better, they can be removed again.

R=mstarzinger@chromium.org, ulan@chromium.org
BUG=chromium:674535

Review-Url: https://codereview.chromium.org/2587073002
Cr-Commit-Position: refs/heads/master@{#42142}

R=clemensh@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2595733003
Cr-Commit-Position: refs/heads/master@{#42141}

Downside: this adds all kinds of weird includes in the .cc files.

(See design doc linked in the bug.)

BUG=v8:5402

Review-Url: https://codereview.chromium.org/2622503002
Cr-Commit-Position: refs/heads/master@{#42140}