This is how it would look like.

(gdb) bta
[1 ] V8_Fatal                                         ../../src/base/logging.cc:67
[2 ] v8::internal::Heap::AllocateRaw                  ../../src/heap/heap-inl.h:298
[3 ] v8::internal::Heap::AllocateHeapNumber           ../../src/heap/heap.cc:2432
[4 ] v8::internal::Factory::NewHeapNumber             ../../src/factory.cc:1253
[5 ] v8::internal::Factory::NewNumber                 ../../src/factory.cc:1228
[6 ] v8::internal::__RT_impl_Runtime_ConstructDouble  ../../src/runtime/runtime-test.cc:32
 -> Allow HEAP_ALLOCATION (yes_gc)
 -> Disallow HEAP_ALLOCATION (no_gc)
[7 ] v8::internal::Runtime_ConstructDouble            ../../src/runtime/runtime-test.cc:24

R=jochen@chromium.org

Review-Url: https://codereview.chromium.org/2466263007
Cr-Commit-Position: refs/heads/master@{#40748}

R=machenbach@chromium.org
BUG=v8:5457
NOTRY=true
NOTREECHECKS=true

Review-Url: https://codereview.chromium.org/2471113004
Cr-Commit-Position: refs/heads/master@{#40747}

Use a NumberConstant op rather than an Int32Constant to make assertions in
v8::internal::compiler::EscapeAnalysis::ProcessAllocation() happy.

BUG=v8:5598
R=bmeurer@chromium.org, franzih@chromium.org

Review-Url: https://codereview.chromium.org/2478643002
Cr-Commit-Position: refs/heads/master@{#40746}

This patch is a follow-up patch to enable runtime statistics to use
TracingCategoryObserver.

BUG=v8:5590

Review-Url: https://codereview.chromium.org/2460973003
Cr-Commit-Position: refs/heads/master@{#40745}

BUG=none
R=dgozman@chromium.org
CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_precise_blink_rel

Review-Url: https://codereview.chromium.org/2467853003
Cr-Commit-Position: refs/heads/master@{#40744}

Revert of [Tracing] Use TracingCategoryObserver in runtime statistics (patchset #6 id:140001 of https://codereview.chromium.org/2460973003/ )

Reason for revert:
Static-Initializers failed on Ubuntu-12.04

Original issue's description:
> [Tracing] Use TracingCategoryObserver in runtime statistics
>
> This patch is a follow-up patch to enable runtime statistics to use
> TracingCategoryObserver.
>
> BUG=v8:5590

TBR=cbruni@chromium.org,fmeawad@chromium.org,alph@chromium.org,bmeurer@chromium.org,mlippautz@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5590

Review-Url: https://codereview.chromium.org/2469403005
Cr-Commit-Position: refs/heads/master@{#40743}

This patch is a follow-up patch to enable runtime statistics to use
TracingCategoryObserver.

BUG=v8:5590

Review-Url: https://codereview.chromium.org/2460973003
Cr-Commit-Position: refs/heads/master@{#40742}

Use HeapConstant for string_iterator_map rather than loading it
manually. This avoids unnecessary map checks.

BUG= v8:3822,v8:5267

Review-Url: https://codereview.chromium.org/2479563003
Cr-Commit-Position: refs/heads/master@{#40741}

During instruction selection, match the pattern

  Float64LessThan(#0.0, Float64Abs(x))

which TurboFan generates for NumberToBoolean in the general case,
and which evaluates to false if x is 0, -0 or NaN, and compile this
to a simple (v)ucomisd using not_equal flags condition, which avoids
the costly Float64Abs.

Also consistently generate this pattern in TurboFan and the code
stubs/interpreter for ToBoolean.

R=mstarzinger@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2473923003
Cr-Commit-Position: refs/heads/master@{#40740}

This patch removes TracingCategoryObserver API and moves the creation of
observer inside platform initialization, by assuming that either
Platform::AddTraceStateObserver is implemented correctly to add observer to
tracing controller that implemented by embedders, or default tracing controller
has already been set up and attached to platform before
v8::V8::InitializePlatform is called.

BUG=v8:5590

Review-Url: https://codereview.chromium.org/2471583004
Cr-Commit-Position: refs/heads/master@{#40739}

Since all possible data-encoded prototype chain checks are supported by LoadIC
we can remove this extra iteration.

LoadGlobalIC does not support data handlers yet.

BUG=v8:5561

Review-Url: https://codereview.chromium.org/2479523002
Cr-Commit-Position: refs/heads/master@{#40738}

Revert of [heap] Add a guard for restarting the memory reducer after mark-compact. (patchset #1 id:1 of https://chromiumcodereview.appspot.com/2433933005/ )

Reason for revert:
Speculative revert to see impact on crbug.com/659531

Original issue's description:
> [heap] Add a guard for restarting the memory reducer after mark-compact.
>
> Currently it is possible to get into a cycle of
> mark-compact -> memory reducer -> mark-compact -> memory reducer ...
> where the memory reducer does not free memory.
>
> This patch ensures that the memory reducer restarts only if the
> committed memory increased by sufficient amount after the last run.
>
> BUG=

TBR=hpayer@chromium.org,davidroutier17@gmail.com
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=

Review-Url: https://codereview.chromium.org/2472053003
Cr-Commit-Position: refs/heads/master@{#40737}

Exchanged the ZoneList for a ZoneChunkList to avoid
unnecessary growing.

Review-Url: https://codereview.chromium.org/2468183004
Cr-Commit-Position: refs/heads/master@{#40736}

BUG=v8:5561

Review-Url: https://codereview.chromium.org/2471613006
Cr-Commit-Position: refs/heads/master@{#40735}

Changes the ValueNumberingReducer to grow when at 80% capacity, rather
than at 50% capacity. This matches the behaviour of base/hashmap.

Review-Url: https://codereview.chromium.org/2474873003
Cr-Commit-Position: refs/heads/master@{#40734}

This makes sure the test in question does not rely on specific lifetime
characteristics for local variables within a function. Note that these
lifetimes are not specified by JavaScript and are not observable within
JavaScript proper. The natives syntax however makes it observable.

BUG=v8:5345
TEST=mjsunit/wasm/compiled-module-management
R=mtrofin@chromium.org

Review-Url: https://codereview.chromium.org/2474053002
Cr-Commit-Position: refs/heads/master@{#40733}

BUG=

Review-Url: https://codereview.chromium.org/2472703002
Cr-Commit-Position: refs/heads/master@{#40732}

Port 4447405b

R=danno@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2474023002
Cr-Commit-Position: refs/heads/master@{#40731}

Load the correct 32-bit word to determine if the buffer is shared by
using kBitFieldOffset instead of kBitFieldSlot.

R=ishell@chromium.org,mstarzinger@chromium.org,jkummerow@chromium.org
BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2470023003
Cr-Commit-Position: refs/heads/master@{#40730}

If a WebAssembly function is exported, its js-to-wasm wrapper has a
field which contains a reference to the WebAssembly function.
Originally this reference was an index into the export table, which
then contains an index into the function table, which then contains
the metadata of the WebAssembly function.

With this CL we use the index into the function table directly as
the reference to the WebAssembly function.

TEST=mjsunit/wasm/test-import-export-wrapper
R=rossberg@chromium.org, mtrofin@chromium.org
CC=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2472103002
Cr-Commit-Position: refs/heads/master@{#40729}

BUG=

Review-Url: https://codereview.chromium.org/2477733002
Cr-Commit-Position: refs/heads/master@{#40728}

Cr-Commit-Position: refs/heads/master@{#40727}

With an instance of CodeStubArguments, builtin stub generators can generate code
that accesses the receiver passed to the builtin, as well as access and iterate
over the variable number of arguments that are passed in.

Review-Url: https://codereview.chromium.org/2469273003
Cr-Commit-Position: refs/heads/master@{#40726}

For lowering CheckHeapObject, always report TaggedPointer representation
and let the RepresentationChanger come up with a reasonable conversion from
whatever input representation to TaggedPointer. This way we no longer insert
the useless ChangeSomethingToTagged and then check the result for HeapObject,
i.e. mostly reduces the amount of useless code being generated.

Note there are now two operators ChangeFloat64ToTaggedPointer and the old
ChangeFloat64ToTagged, because their semantics different wrt. the strength
reduction in the SimplifiedOperatorReducer.

Also set the output MachineRepresentation::kTaggedPointer properly in
SimplifiedLowering whenever we know that we produce a HeapObject.

R=jarin@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2476593002
Cr-Commit-Position: refs/heads/master@{#40725}

BUG=v8:4680

Review-Url: https://codereview.chromium.org/2467223005
Cr-Commit-Position: refs/heads/master@{#40724}

Also properly deal with constant indices for String element access in
the JSNativeContextSpecialization.

BUG=chromium:661949
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2474013002
Cr-Commit-Position: refs/heads/master@{#40723}

Removed a wrong condition test in  TwoByteExternalBufferedStream. This changed fixes errors that may occur under some conditions.

Review-Url: https://codereview.chromium.org/2469723002
Cr-Commit-Position: refs/heads/master@{#40722}

Review-Url: https://codereview.chromium.org/2475433005
Cr-Commit-Position: refs/heads/master@{#40721}

This ensures that incremental marking step does not change the top and limit
pointers of the old space, which is needed for allocation folding.

For more info see:
https://bugs.chromium.org/p/chromium/issues/detail?id=659165#c13

BUG=chromium:659165

Review-Url: https://codereview.chromium.org/2469273002
Cr-Commit-Position: refs/heads/master@{#40720}

Allow swapping the tracer if not in a GC.

BUG=chromium:468240
TBR=ulan@chromium.org
NOTRY=true

Review-Url: https://codereview.chromium.org/2475503004
Cr-Commit-Position: refs/heads/master@{#40719}

BUG=v8:4680

Review-Url: https://codereview.chromium.org/2467223004
Cr-Commit-Position: refs/heads/master@{#40718}

Reason: We're planning to drop support for Linux Precise for layout tests.

BUG=chromium:660580
NOTRY=true

Review-Url: https://codereview.chromium.org/2475563002
Cr-Commit-Position: refs/heads/master@{#40717}

This disables the usage of the {maybe_assigned} flag that the variable
resolution computes for each variable on non-asm.js code. Note that the
analysis is fundamentally broken for destructuring and top-level lexical
variables. Also note that this still uses the analysis for asm.js code
even though it is not validated. One can still trigger the bug by using
invalid constructs within a function marked with "use asm". The fix is
intentionally minimal so that it can be merged to release branches.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-659915
BUG=chromium:659915

Review-Url: https://codereview.chromium.org/2471523005
Cr-Commit-Position: refs/heads/master@{#40716}

This removes the first stack check in inlined functions in the bytecode
graph builder, to match the behaviour of the AST graph builder.

I measure a ~1% statistically significant (p < 0.01) improvement on
Mandreel with --ignition-staging --turbo (on my x64 machine, YMMV).

Review-Url: https://codereview.chromium.org/2392333002
Cr-Commit-Position: refs/heads/master@{#40715}

This turns the ZoneList with minimum 6 words overhead into a linked list through variables, using 2 words for the empty list. Additionally the average number of pointers per entry goes down to the optimal 1 per variable that's in a list.

This does introduce 1 pointer unnecessary overhead for dynamic variables. If that becomes a problem we could distinguish between variables in lists and variables not in lists. We can distinguish them at construction-time.

BUG=v8:5209

Review-Url: https://codereview.chromium.org/2475433002
Cr-Commit-Position: refs/heads/master@{#40714}

Revert of [heap] Invoke incremental marking step before allocation. (patchset #1 id:1 of https://codereview.chromium.org/2464393002/ )

Reason for revert:
Performance regression on Octane and V8 runtime stats.

Original issue's description:
> [heap] Invoke incremental marking step before allocation.
>
> This ensures that the newly allocated object immediatly precedes the
> linear allocation area, which is needed for allocation folding.
>
> For more info see:
> https://bugs.chromium.org/p/chromium/issues/detail?id=659165#c13
>
> BUG=chromium:659165

TBR=hpayer@chromium.org,mlippautz@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:659165

Review-Url: https://codereview.chromium.org/2472043002
Cr-Commit-Position: refs/heads/master@{#40713}

Review-Url: https://codereview.chromium.org/2467513002
Cr-Commit-Position: refs/heads/master@{#40712}

'a' and 'w' are mutually exclusive and just 'a' is what we actually
want. Linux doesn't care (it just takes the first one) but Windows
throws a ValueError.

R=machenbach@chromium.org
BUG=None

Review-Url: https://codereview.chromium.org/2467363002
Cr-Commit-Position: refs/heads/master@{#40711}

Revert of [tools] Support custom script injection for callstats.py (patchset #1 id:1 of https://codereview.chromium.org/2455623002/ )

Reason for revert:
speculative revert to address regressions on cnn.com benchmark.

Original issue's description:
> [tools] Support custom script injection for callstats.py
>
> This is a poor-man's solution to trigger page interactions.
>
> BUG=

TBR=jochen@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=

Review-Url: https://codereview.chromium.org/2464053005
Cr-Commit-Position: refs/heads/master@{#40710}

Make RuntimeCallTimer::parent_ and RuntimeCallStats::current_timer_
fields atomic as they are accessed from the signal handler.

BUG=chromium:660428

Review-Url: https://codereview.chromium.org/2464973002
Cr-Commit-Position: refs/heads/master@{#40709}