BUG=v8:6077

Review-Url: https://codereview.chromium.org/2765323002
Cr-Commit-Position: refs/heads/master@{#44035}

Indisputable profit:
- correct break location in next task (see tests),
- stepOver with async await never lands in random code (see related test and issue),
- inspector doesn't store current stepping state in debugger agent and completely trust V8 - step to new inspector-V8 design (I will finish design doc soon).
- willExecuteScript and didExecuteScript instrumentation could be removed from code base - reduce probability of future errors.
- finally - less code,
- stepping implementation in V8 makes another step to follow our stepping strategy (stepOut should do stepInto and break when exit current frame) (another one one page design doc based on @aandrey comment is coming),
- knowledge about existing of context groups is still inspector-only.

Disputable part is related to super rare scenario when in single isolate we have more then one context group id with enabled debugger agent:
- if one agent request break in own context (stepping, pause, e.t.c.) then we ignore all breaks in another agent. From one hand it looks like good: user clicks stepInto and they don't expect that execution could be paused by another instance of DevTools in unobservable from current DevTools way (second DevTools will get paused notification and run nested message loop). From another hand we shouldn't ignore breakpoints or debugger statement never. In general, I think that proposed behavior is rathe feature then issue.
- and disadvantage, on attempt to break in non-target context group id we just call StepOut until reach target context group id, step out call could deoptimize code in non related to current debugger agent context. But break could happens only in case of debugger stmt or breakpoint - sound like minor issue. Ignoring break on exception sounds like real issue but by module of rareness of this case I think we can ignore this.

Implementation details:
- when debugger agent request break for any reason it passes target context group id to V8Debugger - last agent requesting break is preferred.
- when V8Debugger gets BreakProgramRequested notification from V8, it checks current context group id against target context group id, if they match then just process break as usual otherwise makes StepOut action,
- debug.cc at the end of microtask if last_scheduled_action is StepOut, schedules StepIn and will break on first instruction in next task.

BUG=chromium:654022
R=dgozman@chromium.org,yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2748503002
Cr-Commit-Position: refs/heads/master@{#44034}

This adds optimization and deoptimization counts to the Web UI. Also, the function timeline
now shows optimization and deoptimization marks.

Review-Url: https://codereview.chromium.org/2753543006
Cr-Commit-Position: refs/heads/master@{#44033}

It would be better to generate ctags file for specified architecture so
this CL adds a script gen-tags.py to generate architecture specific
ctags.

  Usage:
      $ tools/dev/gen-tags.py [<arch>...]

  The example usage for 'x64' is as follows:
      $ tools/dev/gen-tags.py x64

  If no <arch> is given, it generates tags file for all arches:
      $ tools/dev/gen-tags.py

R=yangguo@chromium.org,jochen@chromium.org,jkummerow@chromium.org,clemensh@chromium.org

NOTRY=true

Review-Url: https://codereview.chromium.org/2762903002
Cr-Commit-Position: refs/heads/master@{#44032}

BUG=

Review-Url: https://codereview.chromium.org/2762973004
Cr-Commit-Position: refs/heads/master@{#44031}

BUG=chromium:651354

Change-Id: Ic4cc354160b84267a4d930734120b68c2b7ba092
Reviewed-on: https://chromium-review.googlesource.com/458351Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44030}

... and introduce BinaryOpAssembler.

BUG=v8:6116

Change-Id: I86b0afedbe6ac11fda286b877fe55cda746f5347
Reviewed-on: https://chromium-review.googlesource.com/458278
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44029}

Proposed behaviour:
- StepNext at return position go into next function call (no changes with current behavior, but implemented in v8::Debug instead of hack on inspector side);
- StepOut at return position go into next non-current function call.

We need this to have better stepping in cases with native functions, blackboxed functions and/or different embedder calls (e.g. event listeners).

New behavior could be illustrated with two examples (for more see stepping-with-natives-and-frameworks test):
- let's assume that we've blackboxed callAll function, this function just takes its arguments and call one after another:
var foo = () => 1;
callAll(foo, foo, () => 2);
If we break inside of first call of function foo. Then on..
..StepNext - we're able to reach second call of function foo,
..StepOut - we're able to reach () => 2 call.

- let's consider case with native function:
[1,2,3].map(x => x * 2)
If we break inside of first callback call, then with StepNext we can iterate through all calls of callback, with StepOut we go to next statement after .map call.

Implementation details:
- when we request break we schedule step-in function call for any step action at return position and for step-in at any position,
- when we request StepOut at return position - we mark current function as needed-to-be-ignored inside of PrepareStepIn(function) call,
- when we request StepOut at not return position - we set break at return position and ask debugger to just repeat last step action on next stepping-related break.

Design doc: https://docs.google.com/document/d/1ihXHOIhP_q-fJCA0e2EiXz_Zr3B08KMjaPifcaqZ60Q/edit

BUG=v8:6118,chromium:583193
R=dgozman@chromium.org,yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2758483002
Cr-Commit-Position: refs/heads/master@{#44028}

Add a check to appendToTable to catch illegal input, and fix a test
case triggering this check.
Also removing unused variables and fix indentation.

R=ahaas@chromium.org

Change-Id: I0eaa48ab95ef710530a3cfbe94ed4dd419618cda
Reviewed-on: https://chromium-review.googlesource.com/458436
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44027}

Before, we carefully turned on fast array builtins only if flag
--enable-fast-array-builtins was true (though it was implied true
if --turbo was on). Now, the set of Array.prototype.{some, forEach,
every, reduce} is good enough to always turn them on. This means
we can remove the JavaScript implementations.

The flag is renamed to --experimental-fast-array-builtins, which is
off. In the next days we'll add more non-javascript implementations
here for testing.

BUG=
R=danno@chromium.org

Review-Url: https://codereview.chromium.org/2761783002
Cr-Commit-Position: refs/heads/master@{#44026}

BUG=v8:6116

Change-Id: I9659871441f90832bc4032444fc11af86b145488
Reviewed-on: https://chromium-review.googlesource.com/458397Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44025}

Use MarkingState to abstract over the different sets of markbits.

BUG=chromium:651354

Change-Id: I1635eb0d441be2aeed19f0ed91999f0f0f1bbffc
Reviewed-on: https://chromium-review.googlesource.com/458398Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44024}

filter creates an output array with the Array species constructor for
storing values from the input array that pass the user-supplied
predicate function. Our new array builtins are implemented such that
if we fall out of the fast path, we'll pick up where we left off
in a continuation function. It's important to pass the index of
where we left off appending to the output array, because otherwise
we will read it at the start of the continuation function.

That would be observable, and a spec violation.

BUG=

Review-Url: https://codereview.chromium.org/2771483002
Cr-Commit-Position: refs/heads/master@{#44023}

... which is a TF_BUILTIN-like wrapper for defining code stubs.

BUG=v8:6116

Change-Id: Iad599dfc71a50c5082d9e3fba2a7b553b9912207
Reviewed-on: https://chromium-review.googlesource.com/458476Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44022}

This is a step towards the world where only leaf CSA classes have access
to parameters (via respective interface descriptor specified in builtin
definition macro).

BUG=v8:6116

Change-Id: I35dcd9a1c9d38ea394895ab339a07988a26070a0
Reviewed-on: https://chromium-review.googlesource.com/458198Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44021}

Some of the StrictEquality comparisons do not require feedback (for ex: in
try-finally, generators). This cl introduces StrictEqualityNoFeedback bytecode
to be used in such cases. With this change, we no longer have to check if the 
type feedback slot is valid in compare bytecode handlers.

This is the first step in reworking the compare bytecode handler to avoid
duplicate checks when collecting feedback and when performing the operation.

BUG=v8:4280

Change-Id: Ia650fd43c0466b8625d3ce98c39ed1073ba42a6b
Reviewed-on: https://chromium-review.googlesource.com/455778
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44020}

Port for https://codereview.chromium.org/2737493002

TEST=cctest/test-run-machops/Regression6046b
BUG=

Review-Url: https://codereview.chromium.org/2762993002
Cr-Commit-Position: refs/heads/master@{#44019}

Deletes unused crankshaft implementation and C++ implementation,
which have been replaced by a CSA implementation.

BUG=v8:5977

Change-Id: I3614561e45db48583ee886461f98abb14cd9cc4f
Reviewed-on: https://chromium-review.googlesource.com/458418
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44018}

Review-Url: https://codereview.chromium.org/2760313002
Cr-Commit-Position: refs/heads/master@{#44017}

... when we run without code flushing.

BUG=

Change-Id: I956c53732598d805581388453010238c029fc3ba
Reviewed-on: https://chromium-review.googlesource.com/458199Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44016}

R=leszeks@chromium.org
BUG=chromium:633159

Review-Url: https://codereview.chromium.org/2767903002
Cr-Commit-Position: refs/heads/master@{#44015}

Handle fall-off returns and returns inside try blocks.

Store the type-profile feedback slot on the FunctionLiteral
rather than on every return statement.

Next steps:
* Store entries in nexus that can be identified as 'return' (rather than parameter or assignment)
* Collect types for parameters and assignments
* Distinguish multiple parameters and assignments correctly

R=mstarzinger@chromium.org
BUG=v8:5935

Review-Url: https://codereview.chromium.org/2764113002
Cr-Commit-Position: refs/heads/master@{#44014}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/4ae7d8e..a53333d

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/84775f4..8cbbd7f

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: Ie5c7d77f1d80e775637d7a590b1fb6dceabe435e
Reviewed-on: https://chromium-review.googlesource.com/458077Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44013}

The old method always returned a Handle<Object>, requiring an explicit
cast in the caller. This CL makes it return Handle<T> if called with a
T* as parameter.

Also, remove now redundant casts from callers.

R=bmeurer@chromium.org

Change-Id: I13cfb2f2e812e8582a9a1d9d6c8a5a24f40d0e79
Reviewed-on: https://chromium-review.googlesource.com/458376Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44012}

Third bulk of changes.

BUG=v8:6116

Change-Id: I26f5c03a44e55a998e71160a42f6e2c1509f41c7
Reviewed-on: https://chromium-review.googlesource.com/458197Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44011}

Currently there are a number of comment in src/v8.h which look like
this: TODO(dcarney): mark V8_WARN_UNUSED_RESULT.

This commit attempts to remove these comments and add the
V8_WARN_UNUSED_RESULT macro to the methods in question.

BUG=

Review-Url: https://codereview.chromium.org/2135973002
Cr-Commit-Position: refs/heads/master@{#44010}

Add a test case as reminder for future work.

There is no return statement, therefore 'undefined' should be the type.

R=mstarzinger@chromium.org
BUG=v8:5935

Review-Url: https://codereview.chromium.org/2768503002
Cr-Commit-Position: refs/heads/master@{#44009}

This fixes a corner case where the "instance prototype" diverges from
the "non-instance prototype" that we store on the initial map of a
constructor function.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-703610
BUG=chromium:703610

Change-Id: I30a19ae621e10b512215ffb191ce00d030941440
Reviewed-on: https://chromium-review.googlesource.com/458396Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44008}

The regex was slightly off, meaning the results would not
display properly.

Change-Id: Ie3b2bf54a50bffde9b64663d7b8b8c0ad39a1212
Reviewed-on: https://chromium-review.googlesource.com/458416Reviewed-by: Franziska Hinkelmann <franzih@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44007}

Add a test case as reminder for future work.

The return statement is in a try
finally and is never used when returning. The type should
not be collected.

R=mstarzinger@chromium.org
BUG=v8:5935

Review-Url: https://codereview.chromium.org/2765863002
Cr-Commit-Position: refs/heads/master@{#44006}

BUG=v8:5561

Change-Id: Ibc64f2a42089b40a605313a5f24b1da85722fde8
Reviewed-on: https://chromium-review.googlesource.com/457370
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44005}

For instance, /\b\b\b\B\B\B/ is folded into the equivalent /\b\B/.

BUG=v8:6126

Review-Url: https://codereview.chromium.org/2768443003
Cr-Commit-Position: refs/heads/master@{#44004}

TBR=machenbach@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review-Url: https://codereview.chromium.org/2770623002
Cr-Commit-Position: refs/heads/master@{#44003}

BUG=

Review-Url: https://codereview.chromium.org/2758503002
Cr-Original-Commit-Position: refs/heads/master@{#43861}
Committed: https://chromium.googlesource.com/v8/v8/+/b880309bc7f2c4be67f12bac04249f09b0fdd66d
Review-Url: https://codereview.chromium.org/2758503002
Cr-Commit-Position: refs/heads/master@{#44002}

BUG=v8:5193,v8:6113,v8:6132,v8:6133
TBR=hablich@chromium.org
NOTRY=true

Change-Id: I2293a6978006e3b00cfd6a438ba81be23df2620d
Reviewed-on: https://chromium-review.googlesource.com/457997Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44001}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/9e7f0b1..4ae7d8e

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/d233eb2..84775f4

Rolling v8/third_party/instrumented_libraries: https://chromium.googlesource.com/chromium/src/third_party/instrumented_libraries/+log/6227538..48dcb2c

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: I3e089e5c54ca79e8f1ee53b359588caf7b659299
Reviewed-on: https://chromium-review.googlesource.com/457877Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44000}

ip gets modified when FrameAndConstantPoolScope scope ends.
Using another register to store the start of the returned
instr.

R=joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2765713003
Cr-Commit-Position: refs/heads/master@{#43999}

R=joransiu@ca.ibm.com, bjaideep@ca.ibm.com, michael_dawson@ca.ibm.com

Review-Url: https://codereview.chromium.org/2761953002
Cr-Commit-Position: refs/heads/master@{#43998}

BUG=None
Test=None

Review-Url: https://codereview.chromium.org/2744703002
Cr-Commit-Position: refs/heads/master@{#43997}

This saves 72 KiB (approximately 0.1%) of the Chrome APK size of for ARM/Android.

In Counters, each similar group of counters generates a compact data structure,
which a loop then iterates over, rather than having the full loop unrolled
(though the compiler will automatically unroll small ones).

In RuntimeCallStats, the compiler was not being clever enough to avoid
initializing count_ and time_ to zero individually, even after the initialization
of names was moved into a loop. As a result, RuntimeCallCounter was modified
to have a non-initializing constructor for exclusive use by RuntimeCallStats,
which explicitly initializes the counters in a loop. Since v8::base::TimeDelta
does not support an uninitialized state, time_ was changed to be stored as
int64_t microseconds internally, which generates the same code (it's the same
representation as TimeDelta).

BUG=v8:6119

Review-Url: https://codereview.chromium.org/2759033002
Cr-Commit-Position: refs/heads/master@{#43996}