Functions with builtin ids can be compiled with Ignition, so it is no longer
an option to overlap the bytecode_array field with the builtin id on
the SharedFunctionInfo object. Instead overlap it with the
inferred_name, which is only used for debug and so shouldn't be required
for functions with builtin ids. This result in the inferred_name field
being renamed to function_identifier, and adding typed accessors for
inferred_name and builtin_function_id.

This is required to build the snapshot with --no-lazy.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1801023002

Cr-Commit-Position: refs/heads/master@{#34867}

This new intrinsic is used by the desugared ES6 instanceof implementation for
the cases when the F[@@hasInstance] property is null or undefined.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1809993002

Cr-Commit-Position: refs/heads/master@{#34866}

    Port 33c08596

    Original commit message:
        Int64Sub is lowered to a new turbofan operator, Int32SubPair. The new
        operator takes 4 inputs an generates 2 outputs. The inputs are the low
        word of the left input, high word of the left input, the low word of the
        right input, and high word of the right input. The ouputs are the low
        and high word of the result of the subtraction.

        The implementation is very similar to the implementation of Int64Add.

R=ahaas@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1807243002

Cr-Commit-Position: refs/heads/master@{#34865}

R=mstarzinger@chromium.org
TBR=rossberg
BUG=

Review URL: https://codereview.chromium.org/1806293002

Cr-Commit-Position: refs/heads/master@{#34864}

Repair this to match what the runtime correctly does, by first checking if the
function is a constructor before we access the prototype.

R=verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1810953002

Cr-Commit-Position: refs/heads/master@{#34863}

Currently, if the size of two cmp or test operands is a byte or a word, we sign-extend or zero-extend each of them into a 32-bit register before doing the comparison, even when the conditions for the use of a memory operand are met.

This CL makes it possible to load only one of them into a register and address the other as a memory operand.

Meanwhile, comparisons between Uint8 values in the string relational comparison stubs are done with Uint32LessThan (previously we were always zero-extending the byte to a 32-bit value, so signed comparison was alright).

Found that Assembler::arithmetic_op_8(byte, Register, const Operand&) wasn't taking the Operand's rex_ field into account, so I fixed that too.

BUG=

Review URL: https://codereview.chromium.org/1780193003

Cr-Commit-Position: refs/heads/master@{#34862}

BUG=chromium:524425
LOG=N

Review URL: https://codereview.chromium.org/1807923004

Cr-Commit-Position: refs/heads/master@{#34861}

Port 879d254d

Original commit message:
Landing this again, excluding arm as it fail and arm64
out of caution that other wasm arm64 tests are also disabled.

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=mjsunit/asm-wasm
LOG=N

Review URL: https://codereview.chromium.org/1778673004

Cr-Commit-Position: refs/heads/master@{#34860}

Immortal immovable roots must be allocated on the first page of the space.
If serializing the root list exceeds the first page, immortal immovable root
objects might end up outside of the first page. That could cause missing
write barriers.

We now iterate the root list twice. The first time we only serialize immortal
immovable root objects. The second time we serialize the rest.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1811913002

Cr-Commit-Position: refs/heads/master@{#34859}

The new location allows to add an external reference without requiring
an lgtm from a snapshot/ owner.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1812853002

Cr-Commit-Position: refs/heads/master@{#34858}

GCC on S390 31-bit treats size_t as 'long unsigned int', which
is incompatible with %d format specifier that expects an 'int'.
Introduce a new V8 SIZET PREFIX to use %zd instead.

R=danno@chromium.org,jkummerow@chromium.org,jochen@chromium.org,jyan@ca.ibm.com,michael_dawson@ca.ibm.com,mbrandy@us.ibm.com,yangguo@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1813453002

Cr-Commit-Position: refs/heads/master@{#34857}

HandleScopes in for-loops are rather expensive and pose a significant overhead
to some builtin/runtime-functions. The FOR_WITH_HANDLE_SCOPE macro is used to
only create a new HandleScope every 1024th iteration.

BUG=

Review URL: https://codereview.chromium.org/1785403002

Cr-Commit-Position: refs/heads/master@{#34856}

The way desugared instanceof called OrdinaryHasInstance if the lookup of
@@hasInstance failed was incorrect.

BUG=v8:4774
LOG=N

Review URL: https://codereview.chromium.org/1812793002

Cr-Commit-Position: refs/heads/master@{#34855}

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1808153002

Cr-Commit-Position: refs/heads/master@{#34854}

Before this CL, free memory (FreeSpace) has been managed through a global free
list that contains single-linked lists of FreeSpace nodes for each size class.

We move away from this approach to a global two-level doubly-linked list that
refers to singly-linked lists of FreeSpace nodes on the corresponding pages.
This way we can refill on a page-level granularity. Furthermore, it also enables
constant-time eviction of pages from the free list.

BUG=chromium:524425
LOG=N

Review URL: https://codereview.chromium.org/1772733002

Cr-Commit-Position: refs/heads/master@{#34853}

(The goal is to have CodeStubAssembler be the sole assembler-like user of
the TF compiler pipeline; with RMA being a private implementation detail
and FAA being a client.)

BUG=chromium:508898
LOG=Y

Review URL: https://codereview.chromium.org/1674633002

Cr-Commit-Position: refs/heads/master@{#34852}

* New and old space pages have the same allocatable memory size
* Enforce declaration order in NewSpacePage

BUG=chromium:581412
LOG=N

Review URL: https://codereview.chromium.org/1809863003

Cr-Commit-Position: refs/heads/master@{#34851}

NOTRY=true
NOTREECHECKS=true
TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1806273002

Cr-Commit-Position: refs/heads/master@{#34850}

A startup snapshot is considered cold when it does not contain any
function code. We can now create a warm startup snapshot from a cold one
by running a warm-up script. Functions exercised by the warm-up script
are compiled and its code included in the warm startup snapshot. Side
effects caused by the warm-up script does not persist.

R=vogelheim@chromium.org
BUG=v8:4836
LOG=Y

Review URL: https://codereview.chromium.org/1805903002

Cr-Commit-Position: refs/heads/master@{#34849}

BUG=v8:4839
LOG=n

Review URL: https://codereview.chromium.org/1811693002

Cr-Commit-Position: refs/heads/master@{#34848}

BUG=

Review URL: https://codereview.chromium.org/1809983002

Cr-Commit-Position: refs/heads/master@{#34847}

If the variable is unallocated, say so.

This CL also fixes the return value of FormatSlotNode.

R=mvstanton@chromium.org
TBR=rossberg@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1806883003

Cr-Commit-Position: refs/heads/master@{#34846}

  port e1a7c1e7 (r34836)

  original commit message:
   - New RelocInfo mode WASM_MEMORY_REFERENCE as a marker for wasm code objects that need to be relocated on a heap change
   - RelocInfo mode recorded for immediates that use the memory buffer as base
   - Tests to verify address patching works

BUG=

Review URL: https://codereview.chromium.org/1809973002

Cr-Commit-Position: refs/heads/master@{#34845}

  port 33c08596 (r34808)

  original commit message:
  Int64Sub is lowered to a new turbofan operator, Int32SubPair. The new
  operator takes 4 inputs an generates 2 outputs. The inputs are the low
  word of the left input, high word of the left input, the low word of the
  right input, and high word of the right input. The ouputs are the low
  and high word of the result of the subtraction.

  The implementation is very similar to the implementation of Int64Add.

  @v8-arm-ports: please take a careful look at the implementation of sbc
  in the simulator

BUG=

Review URL: https://codereview.chromium.org/1812753003

Cr-Commit-Position: refs/heads/master@{#34844}

R=ahaas@chromium.org,mtrofin@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1802353002

Cr-Commit-Position: refs/heads/master@{#34843}

Since Crankshaft specializes to the native context anyways, we don't
need the indirection of loading from the native context and calling the
JS runtime function indirectly, but we can just specialize to the JS
runtime function from the native context and emit a direct (constant)
function call.

BUG=chromium:592692,chromium:595265
R=ishell@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1807003002

Cr-Commit-Position: refs/heads/master@{#34842}

Skips mjsunit/ignition/debug-scope-on-return on ignition and msan

TBR=rmcilroy@chromium.org,machenbach@chromium.org
BUG=v8:4280
LOG=N
NOTRY=true

Review URL: https://codereview.chromium.org/1808873002

Cr-Commit-Position: refs/heads/master@{#34841}

Original commit message:
    Int64Add is lowered to a new turbofan operator, Int32AddPair. The new
    operator takes 4 inputs an generates 2 outputs. The inputs are the low
    word of the left input, high word of the left input, the low word of the
    right input, and high word of the right input. The ouputs are the low
    and high word of the result of the addition.

R=ahaas@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1807013002

Cr-Commit-Position: refs/heads/master@{#34840}

Report correct error message when a scanner error occurs while parsing a tagged
template within an expression context.

BUG=v8:4829, v8:3230
LOG=N
R=adamk@chromium.org, littledan@chromium.org

Review URL: https://codereview.chromium.org/1806063002

Cr-Commit-Position: refs/heads/master@{#34839}

BUG=chromium:578883
LOG=NO

Review URL: https://codereview.chromium.org/1811653002

Cr-Commit-Position: refs/heads/master@{#34838}

R=joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1809643004

Cr-Commit-Position: refs/heads/master@{#34837}

 - New RelocInfo mode WASM_MEMORY_REFERENCE as a marker for wasm code objects that need to be relocated on a heap change
 - RelocInfo mode recorded for immediates that use the memory buffer as base
 - Tests to verify address patching works

BUG=

Committed: https://crrev.com/cc815b69c17da368107ed77306a5bb161170c834
Cr-Commit-Position: refs/heads/master@{#34831}

Review URL: https://codereview.chromium.org/1759873002

Cr-Commit-Position: refs/heads/master@{#34836}

Revert of [crankshaft] Fixing ES6 tail call elimination. (patchset #7 id:200001 of https://codereview.chromium.org/1780043004/ )

Reason for revert:
[Sheriff] Leads to mac gc stress crashes:
https://build.chromium.org/p/client.v8/builders/V8%20Mac%20GC%20Stress/builds/4975

Original issue's description:
> [crankshaft] Fixing ES6 tail call elimination.
>
> In case when F inlined normal call to G which tail calls H we should not write translation for G for the tail call site.
> Otherwise we will see G in a stack trace inside H.
>
> This CL also enables all existing tests related to ES6 tail call elimination.
>
> TBR=bmeurer@chromium.org
> BUG=v8:4698
> LOG=N
>
> Committed: https://crrev.com/689980f7d4dfd4c29492f616d7b616b86ec9af91
> Cr-Commit-Position: refs/heads/master@{#34830}

TBR=mstarzinger@chromium.org,ishell@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4698

Review URL: https://codereview.chromium.org/1814433002

Cr-Commit-Position: refs/heads/master@{#34835}

This will allow to only load json data for the files under
review instead of the whole data set.

This will be called on the infra-side after all coverage
data has been merged.

Also fix a bunch of log lines.

BUG=chromium:568949
LOG=n
NOTRY=true

Review URL: https://codereview.chromium.org/1808663002

Cr-Commit-Position: refs/heads/master@{#34834}

This makes the aforementioned visitation function independent of the
target architecture by leveraging existing abstractions.

R=ishell@chromium.org

Review URL: https://codereview.chromium.org/1807943002

Cr-Commit-Position: refs/heads/master@{#34833}

Revert of Assembler changes for enabling GrowHeap in Wasm (patchset #13 id:260001 of https://codereview.chromium.org/1759873002/ )

Reason for revert:
Breaks compile:
https://build.chromium.org/p/client.v8/builders/V8%20Mac64/builds/7740

Probably had outdated tryjobs

Original issue's description:
> Assembler changes for enabling GrowHeap in Wasm
>  - New RelocInfo mode WASM_MEMORY_REFERENCE as a marker for wasm code objects that need to be relocated on a heap change
>  - RelocInfo mode recorded for immediates that use the memory buffer as base
>  - Tests to verify address patching works
>
> BUG=
>
> Committed: https://crrev.com/cc815b69c17da368107ed77306a5bb161170c834
> Cr-Commit-Position: refs/heads/master@{#34831}

TBR=titzer@chromium.org,yangguo@chromium.org,bradnelson@chromium.org,bradnelson@google.com,marija.antic@imgtec.com,gdeepti@google.com
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1808823002

Cr-Commit-Position: refs/heads/master@{#34832}

 - New RelocInfo mode WASM_MEMORY_REFERENCE as a marker for wasm code objects that need to be relocated on a heap change
 - RelocInfo mode recorded for immediates that use the memory buffer as base
 - Tests to verify address patching works

BUG=

Review URL: https://codereview.chromium.org/1759873002

Cr-Commit-Position: refs/heads/master@{#34831}

In case when F inlined normal call to G which tail calls H we should not write translation for G for the tail call site.
Otherwise we will see G in a stack trace inside H.

This CL also enables all existing tests related to ES6 tail call elimination.

TBR=bmeurer@chromium.org
BUG=v8:4698
LOG=N

Review URL: https://codereview.chromium.org/1780043004

Cr-Commit-Position: refs/heads/master@{#34830}

Various failures for MIPS were introduced by the refactoring of
the way frames are marked https://codereview.chromium.org/1696043002.

Problems were caused during context loading in CheckAccessGlobalProxy
* The value of the register at was unintentionally modified.
* Use of branch instruction instead of branch macro resulted in
  a branch instruction in forbidden slot.

BUG=

Review URL: https://codereview.chromium.org/1812463002

Cr-Commit-Position: refs/heads/master@{#34829}

Function declarations were previously permitted by V8 in many locations
which no ECMAScript specification allowed; the ECMAScript 2015 spec
enumerates a few locations (in blocks, as well as after labels and in
conditionals when in sloppy mode). This patch ships the flag to restrict
the usage of function declarations to those contexts.

R=adamk
LOG=Y
BUG=v8:4824
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1799233003

Cr-Commit-Position: refs/heads/master@{#34828}