This patch is a follow-up patch to enable gc statistics to use
TracingCategoryObserver.

Previously we need to pass --track_gc_object_stats to v8 if we want to enable
gc statistics in tracing. In this patch, we introducce an integer flag
FLAG_gc_stats, and FLAG_track_gc_object_stats and FLAG_trace_gc_object_stats
will set it to 0x01, tracing will set it to 0x10 when we start tracing and
reset the bit when we stop tracing.

BUG=v8:5590

Review-Url: https://codereview.chromium.org/2459903003
Cr-Commit-Position: refs/heads/master@{#40817}

  port 4447405b (r40712)

  original commit message:

BUG=

Review-Url: https://codereview.chromium.org/2486433004
Cr-Commit-Position: refs/heads/master@{#40816}

Using Read/WriteLittleEndianValue method to access native
memory. This will perform byte reversal depending on the
endianness of the patform.

Testcase was added in CL: https://codereview.chromium.org/2405293002

R=ahaas@chromium.org, titzer@chromium.org
BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2479043003
Cr-Commit-Position: refs/heads/master@{#40815}

Review-Url: https://codereview.chromium.org/2448993002
Cr-Commit-Position: refs/heads/master@{#40814}

Note: This CL might regress code that relies on such arguments access.
In that case, we could still optimize the access if it accesses at
constant index (and the argument at that index is not context-allocated).

If any code relies on a general access to context-allocated arguments,
we would need to analyze the function for assignment to the arguments - this
might be quite tricky.

BUG=chromium:662845

Review-Url: https://codereview.chromium.org/2484723002
Cr-Commit-Position: refs/heads/master@{#40813}

In the lightweight mode it only maintains pseudo stack and does not
collect timing information. It can be used in the sampling mode.

BUG=chromium:660428

Review-Url: https://codereview.chromium.org/2472193002
Cr-Commit-Position: refs/heads/master@{#40812}

Revert of [wasm] Indirect calls without function table cause validation errors. (patchset #3 id:40001 of https://codereview.chromium.org/2484623002/ )

Reason for revert:
Speculative revert for blocking roll:
https://codereview.chromium.org/2479233002/

Original issue's description:
> [wasm] Indirect calls without function table cause validation errors.
>
> The spec defines that indirect calls in WebAssembly code should cause a
> validation error if no function table exists.
>
> The CL contains the following changes:
> 1) Throw a validation error for indirect calls if the function table
>    not exist.
> 2) Do not create TF nodes to throw a runtime error for indirect calls
>    if the function table does not exist.
> 3) Fix existing unit tests by creating a dummy function table.
> 4) Add new a new test which tests that indirect calls without function
>    table cause a validation error.
>
> R=rossberg@chromium.org
> CC=titzer@chromium.org
>
> TEST=unittests/AstDecoderTest.IndirectCallsWithoutTableCrash

TBR=rossberg@chromium.org,titzer@chromium.org,ahaas@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2479283002
Cr-Commit-Position: refs/heads/master@{#40811}

The existing Load/StoreContextElement operations take the index as an int.  This
CL adds versions that take the index as a Node.  These already existed in the
interpreter-assembler, from which they are now removed.

R=mstarzinger@chromium.org, rmcilroy@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2473003004
Cr-Commit-Position: refs/heads/master@{#40810}

Otherwise we could in theory abort preparsing to the preparser and preparse again before aborting again... We shouldn't have this mess; so only set up mode_ in the parser in the first place.

BUG=

Review-Url: https://codereview.chromium.org/2479213002
Cr-Commit-Position: refs/heads/master@{#40809}

This makes use of the newly introduced cell indices to speed up variable
accesses. Imports and local exports are now directly stored in (separate)
arrays. In the future, we may merge the two arrays into a single one, or
even into the module context.

This CL also replaces the LoadImport and LoadExport runtime functions with
a single LoadVariable taking a variable index as argument (rather than a
name).

BUG=v8:1569

Review-Url: https://codereview.chromium.org/2465283004
Cr-Commit-Position: refs/heads/master@{#40808}

BUG=

Review-Url: https://codereview.chromium.org/2481743003
Cr-Commit-Position: refs/heads/master@{#40807}

The revert somehow lost the contents of regress-2825.js.

NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
BUG=chromium:662928

Review URL: https://codereview.chromium.org/2483863002 .

Cr-Commit-Position: refs/heads/master@{#40806}

Revert of [debugger] Migrate more debugger tests to inspector (patchset #2 id:20001 of https://codereview.chromium.org/2480223002/ )

Reason for revert:
http://build.chromium.org/p/client.v8/builders/V8%20Linux%20gcc%204.8/builds/9724

Original issue's description:
> [debugger] Migrate more debugger tests to inspector
>
> This moves all tests currently working with the inspector debugger wrapper to
> test/debugger.
>
> BUG=v8:5530

TBR=yangguo@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5530

Review-Url: https://codereview.chromium.org/2480283002
Cr-Commit-Position: refs/heads/master@{#40805}

This moves all tests currently working with the inspector debugger wrapper to
test/debugger.

BUG=v8:5530

Review-Url: https://codereview.chromium.org/2480223002
Cr-Commit-Position: refs/heads/master@{#40804}

This
- removes the ParserRecorder base class,
- devirtualizes the LogFunction and LogMessage functions,
- reuses the SingletonLogger for all preparser calls

In a subsequent step the preparser should probably log directly to the CompleteParserRecorder rather than indirectly through the singleton logger...

BUG=

Review-Url: https://codereview.chromium.org/2474393003
Cr-Commit-Position: refs/heads/master@{#40803}

The spec defines that indirect calls in WebAssembly code should cause a
validation error if no function table exists.

The CL contains the following changes:
1) Throw a validation error for indirect calls if the function table
   not exist.
2) Do not create TF nodes to throw a runtime error for indirect calls
   if the function table does not exist.
3) Fix existing unit tests by creating a dummy function table.
4) Add new a new test which tests that indirect calls without function
   table cause a validation error.

R=rossberg@chromium.org
CC=titzer@chromium.org

TEST=unittests/AstDecoderTest.IndirectCallsWithoutTableCrash

Review-Url: https://codereview.chromium.org/2484623002
Cr-Commit-Position: refs/heads/master@{#40802}

The maximum memory size is a user-defined upper limit for the size of
the memory of a WebAssembly instance. The actual limit is the minimum of
the user-defined limit and the V8 limit. With this CL we allow the
user-defined limit to be greater than the V8 limit, which is required by
the spec.

R=titzer@chromium.org
CC=gdeepti@chromium.org

TEST=unittests/WasmModuleVerifyTest.MaxMaximumMemorySize

Review-Url: https://codereview.chromium.org/2484643002
Cr-Commit-Position: refs/heads/master@{#40801}

This CL adds further support to the test wrapper. We are now able to
run almost all mjsunit/debug-step-* tests using the inspector backend.

debug-stepframe-* tests are not yet supported since inspector does not
know a 'frame' step type.

The interface has also been improved to be able to move these tests to
inspector mostly without modification.

BUG=v8:5330

Review-Url: https://codereview.chromium.org/2466273005
Cr-Commit-Position: refs/heads/master@{#40800}

When we hit an unspported field store, only flush the state of
potentially aliasing objects, but don't flush the full state table.

R=jarin@chromium.org
BUG=v8:5608

Review-Url: https://codereview.chromium.org/2476213002
Cr-Commit-Position: refs/heads/master@{#40799}

LiveObjectIterator sometimes runs concurrently to the main thread. In this
scenarios we are not allowed to access memory of live objects in non-atomic
ways. Use synchronized reads where needed.

Correctness (already ok in current state):
- Reading a larger size is fine per definition.
- Reading a smaller size is fine since are guaranteed that one word fillers will
  follow.

BUG=v8:5583
R=ulan@chromium.org,hpayer@chromium.org

Review-Url: https://codereview.chromium.org/2477823003
Cr-Commit-Position: refs/heads/master@{#40798}

Drive-by-fix 1: be more precise in machine representations for
AllocateNameDictionary to make --turbo_verify_machine_graph happy.

Drive-by-fix 2: Improve graph verifier output by printing input
representation.

BUG=

Review-Url: https://codereview.chromium.org/2475913002
Cr-Commit-Position: refs/heads/master@{#40797}

R=jkummerow@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2461993002
Cr-Commit-Position: refs/heads/master@{#40796}

R=adamk@chromium.org
BUG=v8:1569

Review-Url: https://codereview.chromium.org/2473993002
Cr-Commit-Position: refs/heads/master@{#40795}

The test case did not test anything in its original form. Fix it and add
documentation.

BUG=v8:5339

Review-Url: https://codereview.chromium.org/2481733002
Cr-Commit-Position: refs/heads/master@{#40794}

BUG=v8:5581

R=jgruber@chromium.org

Review-Url: https://codereview.chromium.org/2469043003
Cr-Commit-Position: refs/heads/master@{#40793}

We need to rename the receiver on CheckHeapObject, because we
don't canonicalize numbers in SignedSmall range, and thus we
the representation selection can hand out TaggedSigned values
for receiver uses, even though we checked for TaggedPointerness
first.

Note that this is rather hacky and just intended to fix the bug
ASAP. We need to think about how to deal with representations in
earlier compilation stages.

BUG=chromium:662410
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2485563002
Cr-Commit-Position: refs/heads/master@{#40792}

TBR=mtrofin@chromium.org
NOTRY=true

Review-Url: https://codereview.chromium.org/2481133002
Cr-Commit-Position: refs/heads/master@{#40791}

TBR=machenbach@chromium.org
NOTRY=true

Review-Url: https://codereview.chromium.org/2477303002
Cr-Commit-Position: refs/heads/master@{#40790}

Using _exit on windows may cause race conditions in threads.

BUG=chromium:603131

Review-Url: https://codereview.chromium.org/2478473003
Cr-Commit-Position: refs/heads/master@{#40789}

This adds support to track Float64 fields on 64-bit platforms, which is
necessary to properly deal with unboxed double fields there.

Drive-by-fix: Crash if we see Simd128 representation here.

R=jarin@chromium.org
BUG=v8:5608

Review-Url: https://codereview.chromium.org/2485543002
Cr-Commit-Position: refs/heads/master@{#40788}

In Crankshaft we unconditionally assume that accesses to arguments[i] will
be in-bounds and don't take into account IC feedback that would eventually
teach us about out-of-bounds accesses that have happened in the past, so
there's no real guard to protect the bounds check in optimized code.

TEST=mjsunit/compiler/deopt-arguments-oob
R=jarin@chromium.org
BUG=v8:5606

Review-Url: https://codereview.chromium.org/2481053002
Cr-Commit-Position: refs/heads/master@{#40787}

fix schedule viewing for text like
1756: HeapConstant[0x3ff62d29 <FixedArray[31]>] : HeapConstant(0x3ff62d29 <FixedArray[31]>)

BUG=

Review-Url: https://codereview.chromium.org/2471573007
Cr-Commit-Position: refs/heads/master@{#40786}

Revert of [Tracing] Use TracingCategoryObserver in gc statistics (patchset #5 id:100001 of https://codereview.chromium.org/2459903003/ )

Reason for revert:
Speculative revert for blocking roll:
https://codereview.chromium.org/2473003006/

E.g.:
https://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_rel_ng/builds/331898

Original issue's description:
> [Tracing] Use TracingCategoryObserver in gc statistics
>
> This patch is a follow-up patch to enable gc statistics to use
> TracingCategoryObserver.
>
> Previously we need to pass --track_gc_object_stats to v8 if we want to enable
> gc statistics in tracing. In this patch, we introducce an integer flag
> FLAG_gc_stats, and FLAG_track_gc_object_stats and FLAG_trace_gc_object_stats
> will set it to 0x01, tracing will set it to 0x10 when we start tracing and
> reset the bit when we stop tracing.
>
> BUG=v8:5590

TBR=fmeawad@chromium.org,mlippautz@chromium.org,lpy@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5590

Review-Url: https://codereview.chromium.org/2477143002
Cr-Commit-Position: refs/heads/master@{#40785}

This roll includes:
  - [inspector_protocol] remove old style domains support
  - Add missing virtual destructor to backend callbacks. [2]

[1] https://codereview.chromium.org/2479693002/
[2] https://codereview.chromium.org/2473393002/

BUG=none
R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2478853002
Cr-Commit-Position: refs/heads/master@{#40784}

This method iterates through all shared function info which are related to passed script, compiles debug code for SFI in range if needed and returns possible break locations.

BUG=chromium:566801
CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_precise_blink_rel

Review-Url: https://codereview.chromium.org/2465553003
Cr-Commit-Position: refs/heads/master@{#40783}

BUG=none
R=dgozman@chromium.org
CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_precise_blink_rel

Review-Url: https://codereview.chromium.org/2471583003
Cr-Commit-Position: refs/heads/master@{#40782}

BUG=chromium:662388

Review-Url: https://codereview.chromium.org/2468423008
Cr-Commit-Position: refs/heads/master@{#40781}

The flag has been on since at least Chrome 53.

R=littledan@chromium.org

Review-Url: https://codereview.chromium.org/2478883002
Cr-Commit-Position: refs/heads/master@{#40780}

R=adamk@chromium.org
BUG=v8:4806

Review-Url: https://codereview.chromium.org/2475383003
Cr-Commit-Position: refs/heads/master@{#40779}

This patch fixes two bugs in V8 to allow the global object to have a frozen proto:
- The immutable prototype map check is done on the map of the "real receiver",
  the one that's found after the hidden prototype traversal, rather than
  the object that SetPrototype is called on.
- The immutable prototype bit from the ObjectTemplate used to instantiate
  the global object, as passed to Context::New, is respected when instantiating
  the global object.

R=adamk
BUG=v8:5149

Review-Url: https://codereview.chromium.org/2474843003
Cr-Commit-Position: refs/heads/master@{#40778}