Actually all it does is throw a TypeError.

R=jkummerow@chromium.org

Bug: v8:6791
Change-Id: I884da4eaa937519c07c3516a1713829f52e28ad8
Reviewed-on: https://chromium-review.googlesource.com/753730Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49171}

Due to lazy deserialization, we need to ensure the snapshot blob is
not freed until the Isolate is destroyed.

Re-enable a few tests that can handle lazy deserialization just fine.

Unfortunately we can't do this for all tests as UNINITIALIZED_TEST does
not sufficiently set up the isolate for lazy deserialization (there's no
Isolate::snapshot_blob_).

Bug: v8:6624
Change-Id: Icf0d217da3a4c5ff1506facc7869d2dd1ac3a983
Reviewed-on: https://chromium-review.googlesource.com/756694Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49170}

Lazy TFJ builtins rely on a mechanism that uses the SharedFunctionInfo
to determine the builtin to deserialize. That obviously doesn't work if
we call the lazy builtin directly, so make sure this does not happen (at
least not through (Tail)CallBuiltin).

Bug: v8:6624
Change-Id: Iea95d83379a5a0e47324e1fef83c005350f2f02a
Reviewed-on: https://chromium-review.googlesource.com/754684Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49169}

This commit updates the jobs for generating postmortem
metadata. I96a8a7cdded6f7c37b6f1da659d63df9e3a5de2b moved
the Code class to a new file without updating the postmortem
jobs. This resulted in some constants used by Node.js to
disappear, leading to build failures on SmartOS.

See: https://github.com/nodejs/node-v8/issues/21
Bug: 
Change-Id: Icf5f59fe464d933c4f5a3f622b08c01bc43c6a80
Reviewed-on: https://chromium-review.googlesource.com/741919
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49168}

This change
- adds new maps for elements, global, and named dictionaries.
- adds support to embed these dictionaries in the startup snapshot.
- adds support to embed these dictionaries in the code cache.
- refactors the rehashing logic.

TBR=mstarzinger@chromium.org, ishell@chromium.org, jgruber@chromium.org

Bug: v8:6593
Change-Id: I2455fe2a9cc6e93247940de99de5f124c2ada137
Reviewed-on: https://chromium-review.googlesource.com/756693Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49167}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/be72997..b5d1311

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/11a6764..af046c5

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: I0fb9023e899edb09572c3c103a6f37dd8bb8aa5c
Reviewed-on: https://chromium-review.googlesource.com/756574Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49166}

This reverts commit 32f30f63.

Reason for revert: broken Fuchsia build, https://logs.chromium.org/v/?s=chromium%2Fbb%2Fclient.v8%2FV8_Fuchsia%2F460%2F%2B%2Frecipes%2Fsteps%2Fcompile%2F0%2Fstdout

Original change's description:
> [platform] check return values from memory operations
> 
> This change adds DCHECKs for calls such as mprotect, as well as marking some of
> the memory allocation and deallocation routines as V8_MUST_USE_RESULT. This
> additional checking gives us more useful information for failure in the presence
> of, for example, address space exhaustion.
> 
> Bug: 
> Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
> Change-Id: I5bc76c1da6160262d3d556fea49d284ddd4e02c5
> Reviewed-on: https://chromium-review.googlesource.com/721267
> Commit-Queue: Eric Holk <eholk@chromium.org>
> Reviewed-by: Hannes Payer <hpayer@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#49164}

TBR=hpayer@chromium.org,mlippautz@google.com,eholk@chromium.org

Change-Id: Ie4b57b45c801dcce7884645f50ff74f833de6dc4
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/756137Reviewed-by: Eric Holk <eholk@chromium.org>
Commit-Queue: Eric Holk <eholk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49165}

This change adds DCHECKs for calls such as mprotect, as well as marking some of
the memory allocation and deallocation routines as V8_MUST_USE_RESULT. This
additional checking gives us more useful information for failure in the presence
of, for example, address space exhaustion.

Bug: 
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I5bc76c1da6160262d3d556fea49d284ddd4e02c5
Reviewed-on: https://chromium-review.googlesource.com/721267
Commit-Queue: Eric Holk <eholk@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49164}

Port ef6c175c

R=ulan@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Change-Id: I045c22ac71d6ac18e10429e7ba1a7a5ef107529e
Reviewed-on: https://chromium-review.googlesource.com/755894Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#49163}

Resetting phantom handles while keeping finalizers alive leads to the
problem of eagerly resetting a handle although another finalizer keeps
it (transitively) alive.

This becomes a problem with internal pointers to Blink as without
global handle a Blink GC is free to collect wrappables.

This CL untangles finalizers handling from phantom handle resets by
introducing a separate path for resetting.

CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel;master.tryserver.chromium.android:android_optional_gpu_tests_rel

Bug: chromium:781728
Change-Id: Ica138b72942698fd996c6e9fe0bdc19cc432c010
Reviewed-on: https://chromium-review.googlesource.com/753724
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49162}

This test uses a lot of memory and is causing OOM crashes on bots.

Bug: v8:7042
Change-Id: I63ff4d44ca8e26b65875df53ebd235976183c558
Reviewed-on: https://chromium-review.googlesource.com/755593
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49161}

The sampling heap profiles can now be retrieved without stopping
the profiler.

BUG=v8:6887

Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel
Change-Id: I491206d0bafd7d4e198622117c12aab0057e6bc6
Reviewed-on: https://chromium-review.googlesource.com/749700Reviewed-by: Pavel Feldman <pfeldman@chromium.org>
Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Commit-Queue: Alexei Filippov <alph@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49160}

Previously StaNamedProperty and StaKeyedProperty were in a weird state where
they claimed to not touch the accumulator, but actually did in case they were
deopted in the middle. A frame was added in the middle to overwrite the 
accumulator again with the right value before returning from the setter, using
a lot of complexity in the deoptimizer.

This changes those instructions to be marked as writing to the accumulator
(e.g., the result of the setter), and uses to manually store and reload into
the accumulator the value being stored.

If we want to avoid the additional bytecodes, we could make sure that bytecodes
that claim to leave the accumulator alone don't deopt back to Advance/Dispatch
but LoadAccumulatorWithValue/Advance/Dispatch. That's in a way similar to what
happened before this CL, but I believe could be implemented much simpler.


Bug: 
Change-Id: I4850a690ef5a30976701d0e050951faa46fd1c18
Reviewed-on: https://chromium-review.googlesource.com/753487Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49159}

Bug: chromium:769203
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Iffb7e92fb9c08c42f03ad28c8defb516454a2d3d
Reviewed-on: https://chromium-review.googlesource.com/753740Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49158}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/53fa255..be72997

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/7208715..11a6764

Rolling v8/third_party/icu: https://chromium.googlesource.com/chromium/deps/icu/+log/21d33b1..4b5a724

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/9f0284f..723b259

Rolling v8/tools/swarming_client: https://chromium.googlesource.com/infra/luci/client-py/+log/5da404c..6fd3c7b

This also ports a fix for gyp from:
https://chromium-review.googlesource.com/c/chromium/src/+/752143

TBR=sergiyb@chromium.org

Change-Id: I2f6d183094b1d4dd398cc38ca2dfe1df83b38f4b
Reviewed-on: https://chromium-review.googlesource.com/753587Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49157}

This reverts commit 3877bf6f.

Reason for revert: failed compilation on Win64/clang:

https://build.chromium.org/p/client.v8/builders/V8%20Win64%20-%20clang/builds/9015

Original change's description:
> Snapshot: support rehashing property and element dictionaries.
> 
> This change
> - adds new maps for elements, global, and named dictionaries.
> - adds support to embed these dictionaries in the startup snapshot.
> - adds support to embed these dictionaries in the code cache.
> - refactors the rehashing logic.
> 
> R=​ishell@chromium.org, jgruber@chromium.org, mstarzinger@chromium.org
> 
> Bug: v8:6593
> Change-Id: I8d9a7ba7145f1af4e6e15301a4d5611f07c77f33
> Reviewed-on: https://chromium-review.googlesource.com/753323
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Commit-Queue: Yang Guo <yangguo@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#49155}

TBR=yangguo@chromium.org,mstarzinger@chromium.org,jgruber@chromium.org,ishell@chromium.org

Change-Id: I0b45d2d07da97b9a7953abf4ad24eec4ea944306
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6593
Reviewed-on: https://chromium-review.googlesource.com/755493Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49156}

This change
- adds new maps for elements, global, and named dictionaries.
- adds support to embed these dictionaries in the startup snapshot.
- adds support to embed these dictionaries in the code cache.
- refactors the rehashing logic.

R=ishell@chromium.org, jgruber@chromium.org, mstarzinger@chromium.org

Bug: v8:6593
Change-Id: I8d9a7ba7145f1af4e6e15301a4d5611f07c77f33
Reviewed-on: https://chromium-review.googlesource.com/753323Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49155}

Each valid memory module generated by one of the wasm fuzzers will now
also be executed in Liftoff, and the result of the execution will be
compared against the interpreted result.

R=ahaas@chromium.org

Bug: v8:6600
Change-Id: I6a437faae4230ce4dfc7924dd1418da20ea92356
Reviewed-on: https://chromium-review.googlesource.com/753328Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49154}

Initialize the home object when we create the initializer function
keeping this in line with other functions that initialize home object.

Bug: v8:5367
Change-Id: I1c5e32ae0cb496740341e6c99c9359f6c5e00875
Reviewed-on: https://chromium-review.googlesource.com/754163Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49153}

In current implementation Object.getOwnPropertyDescriptor calls native
getter. It can produce side effects. We can avoid calling it.
DevTools frontend will show clickable dots and on click returns value.
This CL does not affect Blink and only affect several Node.js
properties, e.g. process.title.

R=yangguo@chromium.org

Bug: v8:6945
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I5764c779ceed4d50832edf68b2b4c6ee2c2dd65c
Reviewed-on: https://chromium-review.googlesource.com/754223
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49152}

Bug: v8:5561
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I47b7df39e80a66449a1ebe98e30052ced2ef2bd3
Reviewed-on: https://chromium-review.googlesource.com/753326Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49151}

When initializing the cache state for a merge, we should never use
registers multiple times. Other code paths leading to the same merge
point might provide different values for the different slots there.

R=ahaas@chromium.org

Bug: v8:7035, v8:6600
Change-Id: I8e409b494af0fdc1a5045ec04571611b97fcaf86
Reviewed-on: https://chromium-review.googlesource.com/754816
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49150}

Bug: chromium:749486
Change-Id: I2fd8b8efe5bea15e48b31945736659495a009c9f
Reviewed-on: https://chromium-review.googlesource.com/739322
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49149}

This is a reland of 2769a7c4.
The failing test is fixed now.

Original change's description:
> [wasm] Test binary operations for more inputs
> 
> Instead of hard-coding one or two inputs per binary operation, use all
> inputs provided by FOR_INT32_INPUTS.
> 
> R=ahaas@chromium.org
> 
> Change-Id: I534227f93068f52d69ea0ff0fcf686a9af034bad
> Reviewed-on: https://chromium-review.googlesource.com/753484
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#49136}

Change-Id: Ied9d4e5977b13b3d0f644e6586b1b14bd412de26
Reviewed-on: https://chromium-review.googlesource.com/753389Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49148}

This adds code-space modification scopes to all sites that still rely on
mutation of {Code} objects after allocation. Currently some scopes also
potentially are in performance-critical places that might regress if the
protection would be enabled in its current form.

R=clemensh@chromium.org
BUG=v8:6792

Change-Id: I8d511e0e452324dae027e50a9da8e6f77224b86f
Reviewed-on: https://chromium-review.googlesource.com/751521
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49147}

Instead of calling a number of member functions which return lambdas
which are then wrapped in std::functions, just use the member functions
directly. This allows to make the arrays with the alternatives constexpr
instead of dynamically filling it on each call.

R=eholk@chromium.org, ahaas@chromium.org

Change-Id: Id1256f442f411eb291941911b25de24a985a9b34
Reviewed-on: https://chromium-review.googlesource.com/753722
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Eric Holk <eholk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49146}

Bug: 
Change-Id: I957e96129d9194eaae406383454f7cd09f53c97f
Reviewed-on: https://chromium-review.googlesource.com/753514Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49145}

This CL adds support for memory operations to the AST-based Wasm compile
fuzzer. We've had several bugs in this area, so additional fuzz coverage should
help detect these sooner.

Change-Id: I28b5b95f1fc28939db764efe78de6d56bc61263c
Reviewed-on: https://chromium-review.googlesource.com/742383
Commit-Queue: Eric Holk <eholk@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49144}

Bug: chromium:774108,v8:6792
Change-Id: Ibdb00bee4dc563663ef2151b489600a2b100f146
Reviewed-on: https://chromium-review.googlesource.com/739601
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49143}

The maximum length of the chars in bytes was hardcoded and was not
updated with the increase in string length on 64-bit platforms.
The other platforms don't do this debug check so they don't need
updating.

Bug: chromium:779407
Change-Id: I94fd946f9e67b39075c1f7eed14a20e9db126a72
Reviewed-on: https://chromium-review.googlesource.com/753584Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49142}

The function receives imports and memory, but always calls
SyncInstantiate with null handles. This CL fixes this by passing on the
received values.

R=ahaas@chromium.org

Change-Id: I1ddb617b3d4847db341d97737043cc667f879734
Reviewed-on: https://chromium-review.googlesource.com/753727Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49141}

This ports:
https://chromium-review.googlesource.com/c/chromium/src/+/732997

NOTRY=true

Bug: chromium:781724
Change-Id: Ib57e94bfa66f7898c10b14ce0c07a12b0c3d25b8
Reviewed-on: https://chromium-review.googlesource.com/753725
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49140}

This reverts commit 2769a7c4.

Reason for revert:
https://build.chromium.org/p/client.v8.ports/builders/V8%20Arm/builds/5195

Original change's description:
> [wasm] Test binary operations for more inputs
> 
> Instead of hard-coding one or two inputs per binary operation, use all
> inputs provided by FOR_INT32_INPUTS.
> 
> R=​ahaas@chromium.org
> 
> Change-Id: I534227f93068f52d69ea0ff0fcf686a9af034bad
> Reviewed-on: https://chromium-review.googlesource.com/753484
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#49136}

TBR=ahaas@chromium.org,clemensh@chromium.org

Change-Id: I40a6822679956d872b21d5c01e548d5c49a4250f
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/753731Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49139}

This is a reland of 7d231e57, fixed to
avoid instantiating CountLeadingZeros for bits==0.

Original change's description:
> [bits] Consolidate Count{Leading,Trailing}Zeros
> 
> Instead of having one method for 32 bit integers and one for 64 bit,
> plus a templatized version to choose from those two, just implement one
> version which handles unsigned integers of any size. Also, make them
> constexpr.
> The Count{Leading,Trailing}Zeros{32,64} methods are kept for now in
> order to keep the amount of code changes small. Also, sometimes it
> improves readability by stating exactly the size of the argument,
> especially for leading zeros (where zero-extending would add more
> leading zeros).
> 
> CountLeadingZeros now uses a binary search inspired implementation
> as proposed in Hacker's Delight. It's more than 20% faster on x64 if
> the builtins are disabled.
> CountTrailingZeros falls back to CountPopulation instead of counting in
> a naive loop. This is ~50% faster.
> 
> R=mstarzinger@chromium.org
> 
> Change-Id: I1d8bf1d7295b930724163248150444bd17fbb34e
> Reviewed-on: https://chromium-review.googlesource.com/741231
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#49106}

Change-Id: Icdff2510ec66d1c96a1912cef29d77d8550994ee
Reviewed-on: https://chromium-review.googlesource.com/753903Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49138}

If the destination register of a binop is the same register as the
right hand side, we would first move the left hand side into that
register (overwriting the value of the rhs), and then use the rhs.
This CL fixes this issue and adds a regression test.

R=ahaas@chromium.org

Bug: v8:6600, v8:7033
Change-Id: Ief90b5bcffc65823037bc57fb00741b2448e6375
Reviewed-on: https://chromium-review.googlesource.com/753462
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49137}

Instead of hard-coding one or two inputs per binary operation, use all
inputs provided by FOR_INT32_INPUTS.

R=ahaas@chromium.org

Change-Id: I534227f93068f52d69ea0ff0fcf686a9af034bad
Reviewed-on: https://chromium-review.googlesource.com/753484
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49136}

Bug: 
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I9df5beca6444a42aa35c624760265a3cc02182b6
Reviewed-on: https://chromium-review.googlesource.com/753450Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Franziska Hinkelmann <franzih@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49135}

Fix a stack overflow in the wasm_compile_fuzzer by limiting the
recursion depth to 64. At this depth, we always just generate a
constant expression.

R=eholk@chromium.org, ahaas@chromium.org

Bug: chromium:747348
Change-Id: I236c1e07b8cb2b6c9181c549e850eca34fac6ec6
Reviewed-on: https://chromium-review.googlesource.com/753329Reviewed-by: Eric Holk <eholk@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49134}

This CL ensures that elements kind transitions don't cause silent
mutable-to-constant field migrations when the following options
are enabled: --track_constant_fields --modify_map_inplace.

Bug: v8:5495, v8:6980
Change-Id: Ie28daab84f91d424110e71504b025a2e465bfe16
Reviewed-on: https://chromium-review.googlesource.com/753087
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49133}

R=jkummerow@chromium.org

Bug: v8:6791
Change-Id: I765790d8b163aff6725900f19e95a914c75a0fe9
Reviewed-on: https://chromium-review.googlesource.com/752521
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49132}