Bug: 
Change-Id: I77915d33e427f00f42fb61ed0ba903e43d737180
Reviewed-on: https://chromium-review.googlesource.com/565417Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46524}

Pass --gerrit explicitly to be resiliant to possible rollbacks of the Gerrit
switch.

This'll also enforce using Gerrit on older release branches when using
the release tools for cherry-picking.

NOTRY=true
TBR=hablich@chromium.org

Bug: chromium:685318
Change-Id: If60784b4c804f38ca36649ac4b2e62209d7cf729
Reviewed-on: https://chromium-review.googlesource.com/565415Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46523}

This reverts commit bb881c88.

Reason for revert: nosnap debug:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap%20-%20debug/builds/13930

Original change's description:
> Document RootIndexMap's requirement for immovable roots.
> 
> R=​mstarzinger@chromium.org
> 
> Change-Id: I27cf279c77204becc449221e1bcebeacbc275792
> Reviewed-on: https://chromium-review.googlesource.com/565281
> Commit-Queue: Yang Guo <yangguo@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46517}

TBR=yangguo@chromium.org,mstarzinger@chromium.org

Change-Id: Ifac3ec6192207bf2be8932408c37bea66bb435e8
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/565598Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46522}

The CL introducing optimizations in memory load/store helper,
https://chromium-review.googlesource.com/c/552119/, caused several
failures on r6 builders. The problem was in Sdc1 macro instruction where
address in at register was overwritten before being used. Also in debug
mode a DCHECK was failing because an incorrect type was used.

BUG=

Change-Id: If38f9dfbbe2e72dfce05c24f7b6019060ef28334
Reviewed-on: https://chromium-review.googlesource.com/565297Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@imgtec.com>
Commit-Queue: Miran Karić <Miran.Karic@imgtec.com>
Cr-Commit-Position: refs/heads/master@{#46521}

Change-Id: Ib95ab0c5669fe344ff199cc6cad811e175bc8bb3
Reviewed-on: https://chromium-review.googlesource.com/565410Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Albert Mingkun Yang <albertnetymk@google.com>
Cr-Commit-Position: refs/heads/master@{#46520}

Bug: chromium:738865
Change-Id: I93721f535ecf8518bf0355e62d5848147460abc8
Reviewed-on: https://chromium-review.googlesource.com/565198Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46519}

BUG=chromium:740325
R=ahaas@chromium.org,mlippautz@chromium.org

Review-Url: https://codereview.chromium.org/2972353002
Cr-Commit-Position: refs/heads/master@{#46518}

R=mstarzinger@chromium.org

Change-Id: I27cf279c77204becc449221e1bcebeacbc275792
Reviewed-on: https://chromium-review.googlesource.com/565281
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46517}

This adds a convenience method for the common Smi to int conversion
pattern.

Bug: 
Change-Id: I7d7b171c36cfec5f6d10c60f1d9c3e06e3aed0fa
Reviewed-on: https://chromium-review.googlesource.com/563205
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Andreas Rossberg <rossberg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46516}

BUG=

Review-Url: https://codereview.chromium.org/2970443003
Cr-Commit-Position: refs/heads/master@{#46515}

Port https://chromium-review.googlesource.com/c/519267/.

R=bmeurer@chromium.org

Bug: v8:6048
Change-Id: Ic94a12b30967fd26ebfa0c6752475d0c013f81e4
Reviewed-on: https://chromium-review.googlesource.com/565400Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46514}

BUG=v8:1956
LOG=N
R=bmeurer@chromium.org

Change-Id: I190002227d3321df0f68e77f3b7b0a468446c493
Reviewed-on: https://chromium-review.googlesource.com/561011
Commit-Queue: Daniel Clifford <danno@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46513}

NOTRY=true

Bug: v8:6408
Change-Id: I9e70131158d837b735d398436a1da4b2e85daa67
Reviewed-on: https://chromium-review.googlesource.com/565398Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46512}

Rename builtins-proxy.cc to builtins-proxy-gen.cc.

Bug: v8:6557, v8:6567
Change-Id: I0e52a0c0c6c9b307c33bb18ec36079bdfd4a89ef
Reviewed-on: https://chromium-review.googlesource.com/565278
Commit-Queue: Maya Lekova <mslekova@google.com>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46511}

This introduces a new builtin (MapLookupHashIndex) and uses it
in Turbofan to compute Map.p.get and Map.p.has.

I have also refactored the existing CSA builtins for Map.p.get and 
Map.p.has to use the new builtin under the hood.

The code for the lookup has been also improved.
- Specialized lookups for smis, strings, heap numbers and everything else.
  - the advantage is that we can use fast equalities for the lookup.
  - strings can likely be optimized further if we care about the 
    internalized string fast case.
- Instead of a call to runtime to get the hash code, we now call C directly.

In the Turbofan implementation itself, there are no special optimizations yet.
The next step is to teach load elimination to reuse the indexes from
previous calls of MapLookupHashIndex. 

BUG=v8:6410

Change-Id: I0b1a70493eb031d444e51002f6b2cc1f30ea2b68
Reviewed-on: https://chromium-review.googlesource.com/560169Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46510}

RootCanBeTreatedAsConstant checks that the object is not in new space.
This check is not thread-safe and, moreover, makes no sense in Turbofan.

R=bmeurer@chromium.org

Bug: v8:6048
Change-Id: I6df682ceef1508c33d5f32bd0d5bf25828e8c88f
Reviewed-on: https://chromium-review.googlesource.com/565259
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46509}

R=clemensh@chromium.org
BUG=chromium:740199

Review-Url: https://codereview.chromium.org/2977543002
Cr-Commit-Position: refs/heads/master@{#46508}

Bug: v8:6211
Change-Id: Iab0e787e7d9abfb9f24cd77276e1c00cc2e165a7
Reviewed-on: https://chromium-review.googlesource.com/561456
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46507}

Change-Id: I7fd794342a13718059b47ea25c26d850ed2da509
Reviewed-on: https://chromium-review.googlesource.com/564189Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46506}

BUG=chromium:694255

Change-Id: Ib0403a2d406428d2cd7896521abb6e95c3841c1c
Reviewed-on: https://chromium-review.googlesource.com/563364
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46505}

An invalid I32V value as index could be used to get a valid
WasmFunction.

R=clemensh@chromium.org

Bug: chromium:735887
Change-Id: I5fbfa01fc3300d86a4a2ba9bcbb86fc02f231ef9
Reviewed-on: https://chromium-review.googlesource.com/561536Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46504}

There are other things to export beside functions. Thus, also print the
export kind when printing an error for duplicate export names.

R=titzer@chromium.org

Change-Id: I7477040dda274a16cfd776d7ac8db6e50a197b97
Reviewed-on: https://chromium-review.googlesource.com/564940Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46503}

This reverts commit 66b54ab1.

Reason for revert: TSAN unhappy.

Original change's description:
> [compiler] Move the main pipeline's code assembly pass into the background.
> 
> R=​bmeurer@chromium.org
> 
> Bug: v8:6048
> Change-Id: I60bc35c02b5460416c3b0e2872fc72ebf9b808a5
> Reviewed-on: https://chromium-review.googlesource.com/563386
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Commit-Queue: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46499}

TBR=neis@chromium.org,bmeurer@chromium.org

Change-Id: I84ac8ad92c98ebe541e04529cda2b7e1eb07eafc
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6048
Reviewed-on: https://chromium-review.googlesource.com/564421Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46502}

Extend the deoptimization jump-table in optimized code objects
to also contain entries for lazy deoptimization exits, and
introduce a trampoline pc in the DeoptimizationInputData,
which maps back from the return-site to the jump-table offset.

Bug: v8:6562, v8:6561
Change-Id: Id085d5467e3ceff251c2ec2768329a9e22c0aff6
Reviewed-on: https://chromium-review.googlesource.com/563403
Commit-Queue: Juliana Patricia Vicente Franco <jupvfranco@google.com>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46501}

... so that we can get rid of explicit AllowHandleDereference at the
call sites.

Bug: v8:6048
Change-Id: I1c31998fc8e0a63348f52ad60dd8c49244d45b40
Reviewed-on: https://chromium-review.googlesource.com/563658Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46500}

R=bmeurer@chromium.org

Bug: v8:6048
Change-Id: I60bc35c02b5460416c3b0e2872fc72ebf9b808a5
Reviewed-on: https://chromium-review.googlesource.com/563386Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46499}

... according to the spec ES#sec-%throwtypeerror%

Bug: v8:4034
Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng
Change-Id: Ia4f2d228397edf55447fe3e71402c8fc4589369a
Reviewed-on: https://chromium-review.googlesource.com/563214
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Daniel Ehrenberg <littledan@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46498}

This is the next step towards faster Map and Set iteration. It
introduces the appropriate instance types for Map and Set
iterators (following the pattern for Array iterators) and migrates
the following builtins to the CodeStubAssembler:

  - Set.prototype.entries
  - Set.prototype.values
  - Map.prototype.entries
  - Map.prototype.keys
  - Map.prototype.values
  - %SetIteratorPrototype%.next
  - %MapIteratorPrototype%.next

This already provides a significant performance boost for regular
for-of iteration of Sets and Maps, by a factor of 5-10 depending
on the input. The final step will be to inline some fast-paths
into TurboFan.

Drive-by-fix: Remove obsolete %IsJSSetIterator and %IsJSMapIterator
intrinsics and runtime functions.

TBR=jgruber@chromium.org

Bug: v8:6344, v8:6571, chromium:740122
Change-Id: I3ab0ee49e2afe8d4295707a5ecbd51adda621918
Reviewed-on: https://chromium-review.googlesource.com/563626
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46497}

The CL adds optimizations to MipsCtz and MipsPopcnt for mips32 and to
Mips64Ctz, Mips64Dctz, Mips64Popcnt and Mips64Dpopcnt for mips64 in
code generator.

BUG=

Change-Id: I080d4eca6b8521c3d01d727b883f3efa9876b7a1
Reviewed-on: https://chromium-review.googlesource.com/563197Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@imgtec.com>
Commit-Queue: Miran Karić <Miran.Karic@imgtec.com>
Cr-Commit-Position: refs/heads/master@{#46496}

This reverts commit 3f22832b.

Reason for revert: Layout tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/16849

Original change's description:
> [builtins] Port Map and Set iterators to CodeStubAssembler.
> 
> This is the next step towards faster Map and Set iteration. It
> introduces the appropriate instance types for Map and Set
> iterators (following the pattern for Array iterators) and migrates
> the following builtins to the CodeStubAssembler:
> 
>   - Set.prototype.entries
>   - Set.prototype.values
>   - Map.prototype.entries
>   - Map.prototype.keys
>   - Map.prototype.values
>   - %SetIteratorPrototype%.next
>   - %MapIteratorPrototype%.next
> 
> This already provides a significant performance boost for regular
> for-of iteration of Sets and Maps, by a factor of 5-10 depending
> on the input. The final step will be to inline some fast-paths
> into TurboFan.
> 
> Drive-by-fix: Remove obsolete %IsJSSetIterator and %IsJSMapIterator
> intrinsics and runtime functions.
> 
> Bug: v8:6571, chromium:740122
> Change-Id: Iad7a7dec643d8f8b5799327f89a351108ae856bf
> Reviewed-on: https://chromium-review.googlesource.com/563399
> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46492}

TBR=jgruber@chromium.org,bmeurer@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:6571, chromium:740122
Change-Id: Iadb48d72e3b85ec8ad880e50ab7912c5502caf07
Reviewed-on: https://chromium-review.googlesource.com/564419Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46495}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/e934a19..4dba73a

TBR=machenbach@chromium.org,hablich@chromium.org

Change-Id: Ia5565c87706a87cf470539128f5a4a5d0663aee8
Reviewed-on: https://chromium-review.googlesource.com/563886Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46494}

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/256098d..00b0c16

TBR=machenbach@chromium.org,hablich@chromium.org

Change-Id: I4fda81b9cb1c3c55261abeccc65161593ddd2ea9
Reviewed-on: https://chromium-review.googlesource.com/563785Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46493}

This is the next step towards faster Map and Set iteration. It
introduces the appropriate instance types for Map and Set
iterators (following the pattern for Array iterators) and migrates
the following builtins to the CodeStubAssembler:

  - Set.prototype.entries
  - Set.prototype.values
  - Map.prototype.entries
  - Map.prototype.keys
  - Map.prototype.values
  - %SetIteratorPrototype%.next
  - %MapIteratorPrototype%.next

This already provides a significant performance boost for regular
for-of iteration of Sets and Maps, by a factor of 5-10 depending
on the input. The final step will be to inline some fast-paths
into TurboFan.

Drive-by-fix: Remove obsolete %IsJSSetIterator and %IsJSMapIterator
intrinsics and runtime functions.

Bug: v8:6571, chromium:740122
Change-Id: Iad7a7dec643d8f8b5799327f89a351108ae856bf
Reviewed-on: https://chromium-review.googlesource.com/563399
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46492}

This reverts commit 5b44ba0e.

Reason for revert: Layout tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/16841

Original change's description:
> (Reland) [parser] moved load property position after dot
> 
> Currently LdaNamedProperty bytecode for expressions like a.b has position before dot. This CL moves this location after dot.
> It's important for later removing of Nop bytecodes in expressions like a.b() where a is local variable, property call and property load should have the same position.
> 
> R=​jgruber@chromium.org
> TBR=marja@chromium.org
> 
> Bug: v8:6425
> Change-Id: I05c21ca5e018da9c432c6bc963c7a96799336d1c
> Reviewed-on: https://chromium-review.googlesource.com/562879
> Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46484}

TBR=kozyatinskiy@chromium.org,jgruber@chromium.org

Change-Id: If9d5fa5f46ed10a407559e9cf10d2a6a54dbe163
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6425
Reviewed-on: https://chromium-review.googlesource.com/564418Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46491}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/47732a6..e934a19

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/6539cc7..256098d

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/a89cc89..4dc63de

TBR=machenbach@chromium.org,hablich@chromium.org

Change-Id: If2fcdde3e3d2c1f25f3a1ea276e2c236dd4b1535
Reviewed-on: https://chromium-review.googlesource.com/563982Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46490}

- Implements the Promise.race algorithm using CodeStubAssembler.
- Delete src/js/promise.js, which is no longer needed.
- Migrate Promise constructor from slow to fast object in bootstrapper
  (per v8:5902)

Increases size of snapshot_blob.bin on an x64.release build by 1.27kb.

BUG=v8:5343
R=gsathya@chromium.org, cbruni@chromium.org

Change-Id: I751e7389bd6ba410109640fcd7960b6021540f2f
Reviewed-on: https://chromium-review.googlesource.com/535041
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46489}

BUG=v8:6231

Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng
Change-Id: I326ace8ee27e5347d26bae11b8061f4fe524db53
Reviewed-on: https://chromium-review.googlesource.com/562744Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Ben Smith <binji@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46488}

... but use proper map for functions with readonly prototype from the start.

Bug: v8:6459
Change-Id: I432d4969822e7cc4c2ba83e103f550d1c4f2e234
Reviewed-on: https://chromium-review.googlesource.com/563199Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46487}

Bug: v8:5785
Change-Id: Id4ffd1d48f1afa1dc6b7c4c00d493d8681057a25
Reviewed-on: https://chromium-review.googlesource.com/563018Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46486}

R=danno@chromium.org

Change-Id: Ib4f672b5e773772278553126912b596e6b28b476
Reviewed-on: https://chromium-review.googlesource.com/554756Reviewed-by: Daniel Clifford <danno@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46485}