Properly recognize and optimize typeof in a strict/abstract equality
comparison with the string literal "object" to a check for Null or a
check of the map for Receiver instance type and non-callable.

Drive-by-fix: Also optimize typeof o === "function" somewhat, now that
we have the new types for Callable and NonCallable.

R=jarin@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2646763003
Cr-Commit-Position: refs/heads/master@{#42501}

Instead of doing the dance via JSStrictEqual for comparisons with null,
undefined or the hole, we can just go to ReferenceEqual directly. Also
avoid the Select(x, false, true) dance for negation and use BooleanNot
directly.

R=mstarzinger@chromium.org

Review-Url: https://codereview.chromium.org/2646763004
Cr-Commit-Position: refs/heads/master@{#42500}

R=rossberg@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2640953002
Cr-Commit-Position: refs/heads/master@{#42499}

BUG=

Review-Url: https://codereview.chromium.org/2644843002
Cr-Commit-Position: refs/heads/master@{#42498}

Currently PropertyConstness is still in sync with PropertyLocation.

BUG=v8:5495

Review-Url: https://codereview.chromium.org/2591233002
Cr-Commit-Position: refs/heads/master@{#42497}

Revert of Revert [TypeFeedbackVector] Root literal arrays in function literal slots (patchset #2 id:20001 of https://codereview.chromium.org/2642743002/ )

Reason for revert:
Breaks nosnap:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap/builds/13802

Original issue's description:
> Revert [TypeFeedbackVector] Root literal arrays in function literal slots
>
> GC performance issues need to be addressed first.
>
> TBR=bmeurer@chromium.org, mstarzinger@chromium.org, yangguo@chromium.org
> BUG=v8:5456
>
> Review-Url: https://codereview.chromium.org/2642743002
> Cr-Commit-Position: refs/heads/master@{#42495}
> Committed: https://chromium.googlesource.com/v8/v8/+/7803aa1ffb2f835c5f317ed2a097390d53e52567

TBR=mvstanton@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5456

Review-Url: https://codereview.chromium.org/2642933003
Cr-Commit-Position: refs/heads/master@{#42496}

GC performance issues need to be addressed first.

TBR=bmeurer@chromium.org, mstarzinger@chromium.org, yangguo@chromium.org
BUG=v8:5456

Review-Url: https://codereview.chromium.org/2642743002
Cr-Commit-Position: refs/heads/master@{#42495}

Especially support constant-folding typeof for detectable and
undetectable receivers.

BUG=v8:5267,v8:5270
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2646743002
Cr-Commit-Position: refs/heads/master@{#42494}

This makes sure 32-bit constants that are used as {MachineType::Uint32}
by the deoptimization translation are also interpreted as such when the
literals are collected.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-681983
BUG=chromium:681983

Review-Url: https://codereview.chromium.org/2646463002
Cr-Commit-Position: refs/heads/master@{#42493}

Just desugar directly into the runtime call instead.

BUG=v8:5639

Review-Url: https://codereview.chromium.org/2633353002
Cr-Commit-Position: refs/heads/master@{#42492}

Revert of [test] Speculatively remove local-tests from archive (patchset #2 id:20001 of https://codereview.chromium.org/2643983002/ )

Reason for revert:
Breaks all windows bots:
https://build.chromium.org/p/client.v8/builders/V8%20Win32%20-%20debug/builds/6811

Original issue's description:
> [test] Remove local-tests from test262 archive and add to .isolate
>
> This might help fix the bots, which are broken in e.g.,
> https://build.chromium.org/p/tryserver.v8/builders/v8_mac_rel_ng_triggered/builds/14011
>
> The archive was added in order to transmit test262 tests more rapidly.
> It doesn't serve much of a purpose for local-tests. I naively added
> local-tests there out of symmetry. However, the BUILD.gn file does not
> regenerate an archive when files are only deleted and not added or
> changed. Since the performance concern is not present for the small
> volume of local-tests, this patch reverts to the more normal mechanism
> for sending over dependencies, with test262.isolate.
>
> R=adamk
>
> Review-Url: https://codereview.chromium.org/2643983002
> Cr-Commit-Position: refs/heads/master@{#42485}
> Committed: https://chromium.googlesource.com/v8/v8/+/9f545ea96f18b7036ac6ec43e359d63f41c3686a

TBR=adamk@chromium.org,littledan@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2640223003
Cr-Commit-Position: refs/heads/master@{#42491}

Since the script origin is part of the key used in the compilation
cache, this ensures that the cache never confuses a module with a
non-module script.

BUG=v8:1569,v8:5685

Review-Url: https://codereview.chromium.org/2611643002
Cr-Commit-Position: refs/heads/master@{#42490}

When StringAdd builtin is used to concatenate two primitive values,
we know that the operation might throw, but cannot trigger any other
observable side effect, so it shouldn't flush the LoadElimination state.

R=jarin@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2645523002
Cr-Commit-Position: refs/heads/master@{#42489}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/c94e6d2..70270c1

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/3a41cc3..7a4c8c9

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2644793002
Cr-Commit-Position: refs/heads/master@{#42488}

Intl constructors are specified to prohibit structurally invalid
subtags. BCP 47 defines itself to be case-insensitive. Firefox does
throw on case-insensitive duplicates, following the specifications.
This patch makes V8 do the same. There is some small compatibility
risk, but the case is fairly niche, so I hope it does not cause
much breakage.

BUG=v8:4215

Review-Url: https://codereview.chromium.org/2639333003
Cr-Commit-Position: refs/heads/master@{#42487}

The IA32AddPair and IA32SubPair instructions were using an input register as a
temporary value, which led to registers sometimes being clobbered when they
shouldn't have been. This led to problems, for example, in calling printf to
format doubles:

printf("%f", 1.2345) => 0.61725 (on x86)

BUG= https://bugs.chromium.org/p/v8/issues/detail?id=5800

Review-Url: https://codereview.chromium.org/2637583002
Cr-Commit-Position: refs/heads/master@{#42486}

This might help fix the bots, which are broken in e.g.,
https://build.chromium.org/p/tryserver.v8/builders/v8_mac_rel_ng_triggered/builds/14011

The archive was added in order to transmit test262 tests more rapidly.
It doesn't serve much of a purpose for local-tests. I naively added
local-tests there out of symmetry. However, the BUILD.gn file does not
regenerate an archive when files are only deleted and not added or
changed. Since the performance concern is not present for the small
volume of local-tests, this patch reverts to the more normal mechanism
for sending over dependencies, with test262.isolate.

R=adamk

Review-Url: https://codereview.chromium.org/2643983002
Cr-Commit-Position: refs/heads/master@{#42485}

This reverts the following commits to fix a Node.js regression:
* 5529430d "[compiler] Consistently use Ignition+TurboFan for lexical variables."
* 78691367 "[compiler] Improve let+const decision in AstNumbering."

R=adamk@chromium.org, bmeurer@chromium.org, hablich@chromium.org
BUG=
NOTRY=true

Review-Url: https://codereview.chromium.org/2647523002
Cr-Commit-Position: refs/heads/master@{#42484}

Inspector is moved to per-event-type callbacks instead of general v8::debug::SetDebugEventListener. It allows to:
- remove any usage of v8::Debug::EventDetails in debug-interface,
- avoid redundant JS call on each event to get properties of event objects,
- introduce better pure C++ API for these events later.

BUG=v8:5510
R=yangguo@chromium.org,jgruber@chromium.org,dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2622253004
Cr-Commit-Position: refs/heads/master@{#42483}

Port 0b8200c7

R=petermarshall@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:5659
LOG=N

Review-Url: https://codereview.chromium.org/2645683002
Cr-Commit-Position: refs/heads/master@{#42482}

This CL implements ldrex, ldrexb, ldrexh, strex, strexb, and strexh in the
Simulator. These instructions provide "exclusive" access, which provides mutual
exclusion for concurrent threads of execution.

The ARM specification gives some leeway to implementors, but essentially
describes each processor as having Local Monitor and Global Monitor. The Local
Monitor is used to check the exclusivity state without having to synchronize
with other processors. The Global Monitor is shared between processors. We
model both to make it easier to match behavior with the spec.

When running with multiple OS threads, each thread has its own isolate, and
each isolate has its own Simulator. The Local Monitor is stored directly on the
Simulator, and the Global Monitor is stored as a lazy singleton. The Global
Monitor maintains a linked-list of all Simulators.

All loads/stores (even non-exclusive) are guarded by the Global Monitor's mutex.

BUG=v8:4614

Review-Url: https://codereview.chromium.org/2006183004
Cr-Commit-Position: refs/heads/master@{#42481}

Currently V8 context just crashes on OOM, with this CL backend will send paused notification with OOM reason before OOM and will increase heap limits to allow further debugging on pause.

BUG=chromium:675911

Review-Url: https://codereview.chromium.org/2624543004
Cr-Commit-Position: refs/heads/master@{#42480}

BUG=v8:4203
R=hablich@chromium.org

Review-Url: https://codereview.chromium.org/2641983002
Cr-Commit-Position: refs/heads/master@{#42479}

So far we only recognized

  typeof x == 'type'
  typeof x != 'type'
  typeof x === 'type'
  typeof x !== 'type'

but some people seem to prefer it the other way around, i.e.

  'type' == typeof x
  'type' != typeof x
  'type' === typeof x
  'type' !== typeof x

as spotted in some Ember.js code, so we should obviously handle that as
well and reduce it to a quick check on x instead of calling the TypeOf
builtin and comparing the resulting string.

R=ishell@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2642743003
Cr-Commit-Position: refs/heads/master@{#42478}

Listener is called instead of event listener for v8::AfterCompile and v8::CompileError events if installed.
- removed v8::debug::Script::Wrap.

BUG=v8:5510
R=yangguo@chromium.org,jgruber@chromium.org,dgozman@chromium.org,clemensh@chromium.org, alph@chromium.org,

Review-Url: https://codereview.chromium.org/2626283002
Cr-Commit-Position: refs/heads/master@{#42477}

This reverts commits
* 45c11887 "[fullcodegen] Remove dead hole check logic"
* 2aaf217b "[crankshaft] Remove dead Variable hole-checking code"
* f40a3817 "[crankshaft] Fix mips/mips64 build: remove unused variable"

BUG=
R=adamk@chromium.org,bmeurer@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2640793004
Cr-Commit-Position: refs/heads/master@{#42476}

FFI Compiler outline based on code stub assembler. We are looking to land this frame to allow specific type translation implementations to proceed in parallel.

BUG=v8:4456

Review-Url: https://codereview.chromium.org/2607993003
Cr-Commit-Position: refs/heads/master@{#42475}

When attempting to allocate a blocked register, in the absence of
aliasing, it was possible to assume that a register that was
blocked - by either belonging to an active fixed register, or to
an active unspillable range - could not have possibly be allocated
to another active range (because there'd be an interference otherwise).

With aliasing, that changes. The range we're trying to allocate
may be a double, while the 2 or more active ranges in the paragraph
above may be singles aliasing to the same double slot.

Opportunistically refactored for readability an optimization, and
added some comments.

BUG=681529

Review-Url: https://codereview.chromium.org/2632373004
Cr-Commit-Position: refs/heads/master@{#42474}

R=rossberg@chromium.org,clemensh@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2640013003
Cr-Commit-Position: refs/heads/master@{#42473}

R=adamk@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2645503002
Cr-Commit-Position: refs/heads/master@{#42472}

This brings VerifyPointersVisitor into line with Object::VerifyPointer.

R=hpayer@chromium.org
BUG=v8:5854

Review-Url: https://codereview.chromium.org/2640623002
Cr-Commit-Position: refs/heads/master@{#42471}

Revert of [Ignition/turbo] Add a CallWithSpread bytecode. (patchset #10 id:170001 of https://codereview.chromium.org/2629363002/ )

Reason for revert:
Causes a few bugs caught by clusterfuzz.

Original issue's description:
> [Ignition/turbo] Add a CallWithSpread bytecode.
>
> Also, emit a NewWithSpread bytecode for CallNew AST nodes where possible, rather than desugaring in the parser.
>
> BUG=v8:5511
>
> Review-Url: https://codereview.chromium.org/2629363002
> Cr-Commit-Position: refs/heads/master@{#42455}
> Committed: https://chromium.googlesource.com/v8/v8/+/4bae43471d5685e34d8bd74458889b83e60235a0

TBR=bmeurer@chromium.org,rmcilroy@chromium.org,verwaest@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5511

Review-Url: https://codereview.chromium.org/2642843002
Cr-Commit-Position: refs/heads/master@{#42470}

V8InspectorSession::schedulePauseOnNextStatement and V8InspectorSession::cancelPauseOnNextStatement are now exposed in inspector tests. These methods are required at least for better blackboxing tests.

BUG=v8:5842
R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2636613002
Cr-Commit-Position: refs/heads/master@{#42469}

R=joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2639853002
Cr-Commit-Position: refs/heads/master@{#42468}

The results are too noisy ATM. This switches off validate-asm for
default comparisons. We can add back dedicated jobs later that switch
it on.

BUG=chromium:663714
NOTRY=true
TBR=bradnelson@chromium.org,titzer@chromium.org

Review-Url: https://codereview.chromium.org/2640743004
Cr-Commit-Position: refs/heads/master@{#42467}

First step in splitting apart https://codereview.chromium.org/2622833002/ to
land piece by piece.

Porting src/js/async-await.js to TF builtins using this boilerplate is
now very straightforward.

BUG=v8:4483, v8:5855
R=jgruber@chromium.org, gsathya@chromium.org

Review-Url: https://codereview.chromium.org/2635353002
Cr-Commit-Position: refs/heads/master@{#42466}

R=titzer@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2643783002
Cr-Commit-Position: refs/heads/master@{#42465}

The new ignition config will be used as baseline comparison in new
jobs, e.g. against ignition_turbo. We'll keep --validate-asm off
in ignition_turbo for now as it is very chatty.

BUG=chromium:673246
NOTRY=true

Review-Url: https://codereview.chromium.org/2640043002
Cr-Commit-Position: refs/heads/master@{#42464}

- Refactors many FP, integer, and signed integer instructions where
possible.

LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2639443002
Cr-Commit-Position: refs/heads/master@{#42463}

BUG=chromium:681806
NOTRY=true
TBR=bradnelson@chromium.org

Review-Url: https://codereview.chromium.org/2644573002
Cr-Commit-Position: refs/heads/master@{#42462}