Bug:

Change-Id: I532e8894df288c81a71b08ca85742f2847f57191
Reviewed-on: https://chromium-review.googlesource.com/484339
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44781}

Ensure source map is not stable if elements kind transitions are expected.

BUG=chromium:700733

Change-Id: Ie937e7064127250b1100109986c3e9b411fae1d6
Reviewed-on: https://chromium-review.googlesource.com/483442Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44780}

If we avoid throwing a stack overflow exception from Irregexp code during
direct calls, there is no need to construct exit frames before the Irregexp
call anymore. As that was the last remaining blocker, we can now implement the
entire stub in CSA.

BUG=v8:5339

Review-Url: https://codereview.chromium.org/2752143003
Cr-Original-Original-Commit-Position: refs/heads/master@{#44770}
Committed: https://chromium.googlesource.com/v8/v8/+/74f2497eae068f85da26904d8c451376c77957bf
Review-Url: https://codereview.chromium.org/2752143003
Cr-Original-Commit-Position: refs/heads/master@{#44775}
Committed: https://chromium.googlesource.com/v8/v8/+/9c0832eb1aceba625a2443a31d51bcaf550c575a
Review-Url: https://codereview.chromium.org/2752143003
Cr-Commit-Position: refs/heads/master@{#44779}

R=franzih@chromium.org

Review-Url: https://codereview.chromium.org/2834053002
Cr-Commit-Position: refs/heads/master@{#44778}

NOTRY=true

Review-Url: https://codereview.chromium.org/2834853002
Cr-Commit-Position: refs/heads/master@{#44777}

Revert of [regexp] Remove remainder of native RegExpExecStub (patchset #10 id:180001 of https://codereview.chromium.org/2752143003/ )

Reason for revert:
More failures on ports:

https://build.chromium.org/p/client.v8.ports/builders/V8%20Android%20Arm64%20-%20builder/builds/9123/steps/compile/logs/stdio

https://build.chromium.org/p/client.v8.ports/builders/V8%20Mips%20-%20builder/builds/8966/steps/compile/logs/stdio

Original issue's description:
> [regexp] Remove remainder of native RegExpExecStub
>
> If we avoid throwing a stack overflow exception from Irregexp code during
> direct calls, there is no need to construct exit frames before the Irregexp
> call anymore. As that was the last remaining blocker, we can now implement the
> entire stub in CSA.
>
> BUG=v8:5339
>
> Review-Url: https://codereview.chromium.org/2752143003
> Cr-Original-Commit-Position: refs/heads/master@{#44770}
> Committed: https://chromium.googlesource.com/v8/v8/+/74f2497eae068f85da26904d8c451376c77957bf
> Review-Url: https://codereview.chromium.org/2752143003
> Cr-Commit-Position: refs/heads/master@{#44775}
> Committed: https://chromium.googlesource.com/v8/v8/+/9c0832eb1aceba625a2443a31d51bcaf550c575a

TBR=ishell@chromium.org,mstarzinger@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5339

Review-Url: https://codereview.chromium.org/2832193002
Cr-Commit-Position: refs/heads/master@{#44776}

If we avoid throwing a stack overflow exception from Irregexp code during
direct calls, there is no need to construct exit frames before the Irregexp
call anymore. As that was the last remaining blocker, we can now implement the
entire stub in CSA.

BUG=v8:5339

Review-Url: https://codereview.chromium.org/2752143003
Cr-Original-Commit-Position: refs/heads/master@{#44770}
Committed: https://chromium.googlesource.com/v8/v8/+/74f2497eae068f85da26904d8c451376c77957bf
Review-Url: https://codereview.chromium.org/2752143003
Cr-Commit-Position: refs/heads/master@{#44775}

Review-Url: https://codereview.chromium.org/2831083003
Cr-Commit-Position: refs/heads/master@{#44774}

Revert "Revert of [regexp] Remove remainder of native RegExpExecStub (patchset #8 id:140001 of https://codereview.chromium.org/2752143003/ )"

This reverts commit da118ddf.

Erroneous double revert.

TBR=jgruber@chromium.org
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true

Change-Id: Iecabbb9b046e9c66cb86f9e9c5c6e0de6eab1c58
Reviewed-on: https://chromium-review.googlesource.com/484382Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44773}

Revert of [regexp] Remove remainder of native RegExpExecStub (patchset #8 id:140001 of https://codereview.chromium.org/2752143003/ )

Reason for revert:
https://build.chromium.org/p/client.v8.ports/builders/V8%20Android%20Arm64%20-%20builder/builds/9118

Original issue's description:
> [regexp] Remove remainder of native RegExpExecStub
>
> If we avoid throwing a stack overflow exception from Irregexp code during
> direct calls, there is no need to construct exit frames before the Irregexp
> call anymore. As that was the last remaining blocker, we can now implement the
> entire stub in CSA.
>
> BUG=v8:5339
>
> Review-Url: https://codereview.chromium.org/2752143003
> Cr-Commit-Position: refs/heads/master@{#44770}
> Committed: https://chromium.googlesource.com/v8/v8/+/74f2497eae068f85da26904d8c451376c77957bf

TBR=ishell@chromium.org,mstarzinger@chromium.org,jgruber@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5339

Review-Url: https://codereview.chromium.org/2827243005
Cr-Commit-Position: refs/heads/master@{#44772}

Revert of [regexp] Remove remainder of native RegExpExecStub (patchset #8 id:140001 of https://codereview.chromium.org/2752143003/ )

Reason for revert:
https://build.chromium.org/p/client.v8.ports/builders/V8%20Android%20Arm64%20-%20builder/builds/9118

Original issue's description:
> [regexp] Remove remainder of native RegExpExecStub
>
> If we avoid throwing a stack overflow exception from Irregexp code during
> direct calls, there is no need to construct exit frames before the Irregexp
> call anymore. As that was the last remaining blocker, we can now implement the
> entire stub in CSA.
>
> BUG=v8:5339
>
> Review-Url: https://codereview.chromium.org/2752143003
> Cr-Commit-Position: refs/heads/master@{#44770}
> Committed: https://chromium.googlesource.com/v8/v8/+/74f2497eae068f85da26904d8c451376c77957bf

TBR=ishell@chromium.org,mstarzinger@chromium.org,jgruber@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5339

Review-Url: https://codereview.chromium.org/2833083002
Cr-Commit-Position: refs/heads/master@{#44771}

If we avoid throwing a stack overflow exception from Irregexp code during
direct calls, there is no need to construct exit frames before the Irregexp
call anymore. As that was the last remaining blocker, we can now implement the
entire stub in CSA.

BUG=v8:5339

Review-Url: https://codereview.chromium.org/2752143003
Cr-Commit-Position: refs/heads/master@{#44770}

Now that we are counting deopts instead of optimizations for the
"too many deoptimizations" bailout, we can remove the OSR deopt
increment hack.

Bug: chromium:700016
Change-Id: I3edd55db986cc47add632bb5af969dcee4e7a2b5
Reviewed-on: https://chromium-review.googlesource.com/484340Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44769}

This simplifies the double-indirection used for the signature cache in
function imports and also reduces the memory its memory footprint. Also
switch to use the local zone as an underlying storage.

R=rossberg@chromium.org
BUG=v8:6127

Change-Id: I8bc6cf13f2ce9ffa02485e76b7e36f389c9e02e5
Reviewed-on: https://chromium-review.googlesource.com/483443Reviewed-by: Andreas Rossberg <rossberg@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44768}

Adds general support for concurrent modifications to live byte counters.

BUG=chromium:651354

Review-Url: https://codereview.chromium.org/2836583002
Cr-Commit-Position: refs/heads/master@{#44767}

Bug: v8:6284

Change-Id: I3a52819f4e67a143a0b3b63358fc4dd0df384553
Reviewed-on: https://chromium-review.googlesource.com/483482
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44766}

BUG=v8:6102

Review-Url: https://codereview.chromium.org/2833463002
Cr-Commit-Position: refs/heads/master@{#44765}

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/a9a3094..5d201de

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: I27cd525fb18d47ff9fcf1c60c45d251d4f36ef80
Reviewed-on: https://chromium-review.googlesource.com/484100Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44764}

This also removes a broken optimization regarding immutable (i.e. const)
global variables. For now mutable and immutable global variables are
treated the same and hence copied during module initialization.

R=rossberg@chromium.org
TEST=mjsunit/asm/global-imports
BUG=v8:6279

Change-Id: I020fc12036dc534f5a62fb43f5c6fdb252314e62
Reviewed-on: https://chromium-review.googlesource.com/483360Reviewed-by: Andreas Rossberg <rossberg@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44763}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/98f2769..ff3857b

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/6939b1d..34ee837

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/a38e11d..a9a3094

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: I0f3817c86616ae1c7020ee8834070a68900657d8
Reviewed-on: https://chromium-review.googlesource.com/484003Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44762}

This reverts commit 64c12860.

Reason for revert: the number of buckets can be changed later, so we can't cache the value

Original change's description:
> [OrderedHashSet] Remove extra entry lookup
> 
> Bug: v8:5717
> Change-Id: I999ea81f745a25a1f3a539e50594e597e64f5287
> Reviewed-on: https://chromium-review.googlesource.com/481044
> Reviewed-by: Adam Klein <adamk@chromium.org>
> Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#44705}

TBR=adamk@chromium.org,cbruni@chromium.org,gsathya@chromium.org,v8-reviews@googlegroups.com
# Not skipping CQ checks because original CL landed > 1 day ago.

Change-Id: Iade35c0041e943f6dedb24844b07034f56ff1150
Reviewed-on: https://chromium-review.googlesource.com/483904
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44761}

This reverts commit 88376a78.

Reason for revert: the number of buckets could change, so we can't cache the value

Original change's description:
> [OrderedHashSet] Remove redundant hash to bucket
> 
> Bug: v8:5717
> Change-Id: I88e1e3089844b0955f0f7a6a792c2e10949a5b18
> Reviewed-on: https://chromium-review.googlesource.com/480927
> Reviewed-by: Adam Klein <adamk@chromium.org>
> Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#44707}

TBR=adamk@chromium.org,cbruni@chromium.org,gsathya@chromium.org,v8-reviews@googlegroups.com
# Not skipping CQ checks because original CL landed > 1 day ago.

Change-Id: I4d42021a1d1f5bc069b3787efc828761098038e0
Reviewed-on: https://chromium-review.googlesource.com/483903Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44760}

BUG=
R=jyan@ca.ibm.com, bjaideep@ca.ibm.com, joransiu@ca.ibm.com

Review-Url: https://codereview.chromium.org/2829713003
Cr-Commit-Position: refs/heads/master@{#44759}

The included test case illustrates the problem. It subtracts (16 << 27)
from another number. The Machine Operator Reducer would replace the
shift computation with 0x0000000080000000, and then change the subtract
to an add of -(0x0000000080000000), which is 0xffffffff80000000.
The instruction selector would determine that this value could be an
immediate, because it fits in 32 bits, so it would select the lea
instruction. Finally, the code generator would detect that the
immediate was less than 0, flip the sign and replace the add with a
subtract of 0x80000000. Because the x64 subtract instruction's
immediate field is 32 bits, the processor would interpret this as
0xffffffff80000000 instead of an unsigned value.

This change fixes the issue by making the CanBeImmediate check
explicitly compare against INT_MIN and INT_MAX. We disallow INT_MIN
as an immediate precisely because we cannot tell 0x0000000080000000
from 0xffffffff80000000 when truncated to 32 bits.

Bug: chromium:711203
Change-Id: Ie371b8ea290684a6bb723bae9c693a866f961850
Reviewed-on: https://chromium-review.googlesource.com/482448
Commit-Queue: Eric Holk <eholk@chromium.org>
Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44758}

It was a straight pass-through to JSFunction::SetPrototype, with the
added wrinkle that it appeared to sometimes throw (although it never did).

Also improves typing of JSFunction::SetInstancePrototype signature to
require being passed a JSReceiver.

Change-Id: Ie85b9a74955f72bf988cd902c5eec34e32b51a24
Reviewed-on: https://chromium-review.googlesource.com/482421Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44757}

Now you can do: "gm.py x64.release mkgrokdump"

NOTRY=true

Review-Url: https://codereview.chromium.org/2827383003
Cr-Commit-Position: refs/heads/master@{#44756}

BUG=v8:6189
R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2826183002
Cr-Commit-Position: refs/heads/master@{#44755}

v8::Extension should be replaced with ObjectTemplates. So let's not use it for utils.

BUG=none
R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2828143002
Cr-Commit-Position: refs/heads/master@{#44754}

Since we already have cache on V8 side we can introduce caching on inspector side. It will decrease memory consumption and reduce time which we spend for collecting stacks. See [1] for details.

[1] https://docs.google.com/a/google.com/document/d/13H1Pn6dekcwqlaYP26CfyyYGuL-U9LtUPWmt3TIpOag/edit?usp=sharing

BUG=v8:6189
R=dgozman@chromium.org,yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2825903002
Cr-Commit-Position: refs/heads/master@{#44753}

A lot of web sites around the world has hack which replaces native console.assert by function with fast return.
Current console.assert is slow because we need to run CPP builtin but we should enter this builtin iff condition is false or omitted.

BUG=v8:6175
R=ishell@chromium.org,dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2828933002
Cr-Commit-Position: refs/heads/master@{#44752}

Change-Id: I436e8390073fce6488cb9a26b9bde60f92935638
Reviewed-on: https://chromium-review.googlesource.com/482578Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44751}

With recent CLs we always store maximum N async stack traces and when we reach limit we drop half of them.
Current promise collected event requires creating weak handle:
- it takes time,
- it consumes memory.
Since async task id distribution for promises is uniform (each new promise has last_async_task_id + 1 as an id) our hash map is good enough to handle any amount of async task ids, following time of executing 1 000 000 000 of lookups:
- for empty hash map: 1.45 seconds,
- for hash map with one entry: 14.95 seconds
- 1024 entries: 15.03 seconds
- 1024 * 1024 entries: 14.82 seconds
- 1024 * 1024 * 1024: 17.9 seconds

BUG=v8:6189
R=dgozman@chromium.org,yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2819423005
Cr-Commit-Position: refs/heads/master@{#44750}

Fix 6ee0b6ce

Fix wrong register usage for MIPS ports

TEST=mjsunit/regress/regress-5638b
BUG=

Review-Url: https://codereview.chromium.org/2831733004
Cr-Commit-Position: refs/heads/master@{#44749}

R=jarin@chromium.org
BUG=chromium:713584

Review-Url: https://codereview.chromium.org/2833783002
Cr-Commit-Position: refs/heads/master@{#44748}

Revert of [serializer/debugger] hide scripts in the snapshot from the debugger. (patchset #5 id:80001 of https://codereview.chromium.org/2826073004/ )

Reason for revert:
failure in the custom snapshot build: http://builders/V8%20Linux64%20-%20custom%20snapshot%20-%20debug/builds/14178

Original issue's description:
> [serializer/debugger] hide scripts in the snapshot from the debugger.
>
> R=jgruber@chromium.org
> BUG=v8:6274
>
> Review-Url: https://codereview.chromium.org/2826073004
> Cr-Commit-Position: refs/heads/master@{#44745}
> Committed: https://chromium.googlesource.com/v8/v8/+/215e668256a205aba7bacf2da8b68ddfc573d3dd

TBR=jgruber@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:6274

Review-Url: https://codereview.chromium.org/2831893002
Cr-Commit-Position: refs/heads/master@{#44747}

For MIPS64, many load/store operations from/to memory emit more then
one instruction. This is the reason for moving them from assembler to
macro-assembler.

TEST=
BUG=

Review-Url: https://codereview.chromium.org/2829073002
Cr-Commit-Position: refs/heads/master@{#44746}

R=jgruber@chromium.org
BUG=v8:6274

Review-Url: https://codereview.chromium.org/2826073004
Cr-Commit-Position: refs/heads/master@{#44745}

Without this fix, we create a new state-values node for parameters per environment. This is especially bad for heavily branching functions. With the fix, we should only create one node per function.

Drive-by: removes some unused fields for state values in the environment.

BUG=v8:5267

Review-Url: https://codereview.chromium.org/2826223004
Cr-Commit-Position: refs/heads/master@{#44744}

This reverts commit 64bb6e6c.

Reason for revert: Breaks layout tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/15092

See:
https://github.com/v8/v8/wiki/Blink-layout-tests

Original change's description:
> [runtime] Pass global proxy as receiver to native accessors in case of contextual access
> 
> Bug:
> 
> Change-Id: I288c0d7a34b65eda6c6e46168c436b87a350f6d4
> Reviewed-on: https://chromium-review.googlesource.com/483199
> Commit-Queue: Toon Verwaest <verwaest@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#44739}

TBR=yangguo@chromium.org,verwaest@chromium.org,v8-reviews@googlegroups.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Change-Id: Ifc204ce5a2e6d774b993210fcc6782fc6f27dd7b
Reviewed-on: https://chromium-review.googlesource.com/483480Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44743}

Preparser does not keep track of function names. If we want to
parse top-level function and top-level code was only preparsed
we need to parse the function name again. Even if we parsed the
function name, passing it is non-trivial so it makes sense to just
reparse.

BUG=v8:6093

Change-Id: Iafbcd677981f1db52b485eee0f0d769e4fd26543
Reviewed-on: https://chromium-review.googlesource.com/483359
Commit-Queue: Wiktor Garbacz <wiktorg@google.com>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44742}