BUG= https://bugs.chromium.org/p/v8/issues/detail?id=4203
BUG= https://bugs.chromium.org/p/v8/issues/detail?id=5406
LOG=N
R=mstarzinger@chromium.org,machenbach@chromium.org

Review-Url: https://codereview.chromium.org/2309833003
Cr-Commit-Position: refs/heads/master@{#39521}

Reland of Fix async/await memory leak (patchset #1 id:1 of https://codereview.chromium.org/2348403003/ )

This patch closes a memory leak in async/await where the desugaring
was creating a situation analagous to that described in v8:5002.
Intermediate Promises were being kept alive, so a long-running loop
would cause linear memory usage on the heap. This patch returns
undefined to the 'then' callback passed into PerformPromiseThen
in order to avoid this hazard. Test expectations are fixed to remove
expecting extraneous events which occurred on Promises that are
now not given unnecessarily complex resolution paths before being
thrown away.

This patch is a reland; originally, tests which exercised the memory
exhaustion were checked in. Although it's possible to find good parameters
for running such tests locally, it is difficult to automate the tests
between the rock of timeouts and the hard place of too-small heaps
causing memory exhaustion in some modes even when there is no leak.

BUG=v8:5390

Review-Url: https://codereview.chromium.org/2352933002
Cr-Commit-Position: refs/heads/master@{#39520}

We must keep track of the exact order in which modules are requested.
To do so, maintain a map from module specifiers to position while
parsing (in ModuleDescriptor). Descriptor entries now refer to that
position rather than the string.  When generating the ModuleInfo, turn
this map into an array of specifiers. We don't need the map anymore
later on, so we do not reconstruct it when deserializing again.

BUG=v8:1569

Review-Url: https://codereview.chromium.org/2353633002
Cr-Commit-Position: refs/heads/master@{#39519}

Revert of [crankshaft] Protect against deopt loops from string length overflows. (patchset #1 id:1 of https://codereview.chromium.org/2348293002/ )

Reason for revert:
Mean https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/builds/10910

Original issue's description:
> [crankshaft] Protect against deopt loops from string length overflows.
>
> Crankshaft just unconditionally deoptimizes the code when the length of
> a string addition result would overflow. In order to protect against
> deopt loops we insert a global protector cell.
>
> We will use the same mechanism for inlining certain string additions
> into TurboFan as well, and protecting against overflow (we will also
> extend this to deal with String.prototype.concat and friends once we
> get there).
>
> BUG=v8:5404
> R=jarin@chromium.org,hpayer@chromium.org
>
> Committed: https://crrev.com/cb19257a926a55209a6d6858ce26d51a0447ba71
> Cr-Commit-Position: refs/heads/master@{#39511}

TBR=hpayer@chromium.org,jarin@chromium.org,bmeurer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5404

Review-Url: https://codereview.chromium.org/2357433002
Cr-Commit-Position: refs/heads/master@{#39518}

Port: 2ab3fcf4

Original commit message:

	To make better inlining decisions, it's good to have call
counts for poly/mega-morphic cases. This CL makes it work for calls,
and another will follow to better unify the code between constructor
calls and normal calls (and thence, to record megamorphic call counts
there as well).

R=mvstanton@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com
BUG=

Review-Url: https://codereview.chromium.org/2356483002
Cr-Commit-Position: refs/heads/master@{#39517}

Revert of [cq] Temporarily make failing chromium trybot experimental (patchset #1 id:1 of https://codereview.chromium.org/2352573002/ )

Reason for revert:
Real fix landed by now.

Original issue's description:
> [cq] Temporarily make failing chromium trybot experimental
>
> BUG=chromium:648153
> NOTRY=true
> NOPRESUBMIT=true
> TBR=emso@chromium.org
>
> Committed: https://crrev.com/bb6fa481b6e8e643cb86d66cfa5b8bb35d1dd320
> Cr-Commit-Position: refs/heads/master@{#39494}

TBR=emso@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:648153

Review-Url: https://codereview.chromium.org/2353713002
Cr-Commit-Position: refs/heads/master@{#39516}

Handle the case of asm.js modules that return a single function
instead of a collection of them.

R=mtrofin@chromium.org
TEST=mjsunit/asm/asm-wasm
BUG=v8:4203
BUG=v8:5356

Review-Url: https://codereview.chromium.org/2348383003
Cr-Commit-Position: refs/heads/master@{#39515}

BUG=v8:5209

Review-Url: https://codereview.chromium.org/2349193002
Cr-Commit-Position: refs/heads/master@{#39514}

Introduce TraceStateObserver interface along with add/remove
methods to the platform.

BUG=chromium:406277

Review-Url: https://codereview.chromium.org/2344893005
Cr-Commit-Position: refs/heads/master@{#39513}

Revert of Fix async/await memory leak (patchset #5 id:160001 of https://codereview.chromium.org/2348403002/ )

Reason for revert:
Still causes issues on bot (sometimes!)

Original issue's description:
> Reland of Fix async/await memory leak (patchset #1 id:1 of https://codereview.chromium.org/2354473002/ )
>
> Reason for revert:
> Relanding with faster-running test
>
> Original issue's description:
> > Revert of Fix async/await memory leak (patchset #5 id:80001 of https://codereview.chromium.org/2334323006/ )
> >
> > Reason for revert:
> > newly introduced test async-await-loop times out: https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/builds/10894/steps/Ignition%20-%20turbofan%20%28flakes%29/logs/async-await-loop
> >
> > Original issue's description:
> > > Fix async/await memory leak
> > >
> > > This patch closes a memory leak in async/await where the desugaring
> > > was creating a situation analagous to that described in v8:5002.
> > > Intermediate Promises were being kept alive, so a long-running loop
> > > would cause linear memory usage on the heap. This patch returns
> > > undefined to the 'then' callback passed into PerformPromiseThen
> > > in order to avoid this hazard. Test expectations are fixed to remove
> > > expecting extraneous events which occurred on Promises that are
> > > now not given unnecessarily complex resolution paths before being
> > > thrown away.
> > >
> > > BUG=v8:5390
> > >
> > > Committed: https://crrev.com/a0ba18e9634c5e2d439033ab61a77cff54f9af35
> > > Cr-Commit-Position: refs/heads/master@{#39479}
> >
> > TBR=adamk@chromium.org,caitp@igalia.com,littledan@chromium.org
> > NOTRY=true
> > BUG=v8:5390
> >
> > Committed: https://crrev.com/196db1999da130019bbf8e3bd65977f840e8afaf
> > Cr-Commit-Position: refs/heads/master@{#39493}
>
> TBR=adamk@chromium.org,caitp@igalia.com,hablich@chromium.org
> # Skipping CQ checks because original CL landed less than 1 days ago.
> BUG=v8:5390
>
> Committed: https://crrev.com/e51482f01f26e0013e6377e85c4d2c41900e403c
> Cr-Commit-Position: refs/heads/master@{#39508}

TBR=adamk@chromium.org,caitp@igalia.com,hablich@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5390

Review-Url: https://codereview.chromium.org/2348403003
Cr-Commit-Position: refs/heads/master@{#39512}

Crankshaft just unconditionally deoptimizes the code when the length of
a string addition result would overflow. In order to protect against
deopt loops we insert a global protector cell.

We will use the same mechanism for inlining certain string additions
into TurboFan as well, and protecting against overflow (we will also
extend this to deal with String.prototype.concat and friends once we
get there).

BUG=v8:5404
R=jarin@chromium.org,hpayer@chromium.org

Review-Url: https://codereview.chromium.org/2348293002
Cr-Commit-Position: refs/heads/master@{#39511}

Previously we didn't implement TRACE_STR_COPY when we write trace events to
file, which causes us to allocate a growing independent memory chunk for dumped
runtime call stats table. Since we now have a fully functional TRACE_STR_COPY,
this memory allocation can be avoided, this patch removes it.

BUG=v8:5089

Committed: https://crrev.com/e1997bb7d780d12e3a89078e8dd652dcf1d90039
Review-Url: https://codereview.chromium.org/2342643004
Cr-Original-Commit-Position: refs/heads/master@{#39462}
Cr-Commit-Position: refs/heads/master@{#39510}

This CL avoids relying on signed/unsigned implicit conversions
when re-computing wasm mem sizes.

BUG=

Review-Url: https://codereview.chromium.org/2349053002
Cr-Commit-Position: refs/heads/master@{#39509}

Reland of Fix async/await memory leak (patchset #1 id:1 of https://codereview.chromium.org/2354473002/ )

Reason for revert:
Relanding with faster-running test

Original issue's description:
> Revert of Fix async/await memory leak (patchset #5 id:80001 of https://codereview.chromium.org/2334323006/ )
>
> Reason for revert:
> newly introduced test async-await-loop times out: https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/builds/10894/steps/Ignition%20-%20turbofan%20%28flakes%29/logs/async-await-loop
>
> Original issue's description:
> > Fix async/await memory leak
> >
> > This patch closes a memory leak in async/await where the desugaring
> > was creating a situation analagous to that described in v8:5002.
> > Intermediate Promises were being kept alive, so a long-running loop
> > would cause linear memory usage on the heap. This patch returns
> > undefined to the 'then' callback passed into PerformPromiseThen
> > in order to avoid this hazard. Test expectations are fixed to remove
> > expecting extraneous events which occurred on Promises that are
> > now not given unnecessarily complex resolution paths before being
> > thrown away.
> >
> > BUG=v8:5390
> >
> > Committed: https://crrev.com/a0ba18e9634c5e2d439033ab61a77cff54f9af35
> > Cr-Commit-Position: refs/heads/master@{#39479}
>
> TBR=adamk@chromium.org,caitp@igalia.com,littledan@chromium.org
> NOTRY=true
> BUG=v8:5390
>
> Committed: https://crrev.com/196db1999da130019bbf8e3bd65977f840e8afaf
> Cr-Commit-Position: refs/heads/master@{#39493}

TBR=adamk@chromium.org,caitp@igalia.com,hablich@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
BUG=v8:5390

Review-Url: https://codereview.chromium.org/2348403002
Cr-Commit-Position: refs/heads/master@{#39508}

This is in preparation for upcmoming scanner + bookmarking cleanups.

Also, drive-by fix for setting a bookmark close to the end of the stream,
when the look-ahead character (c0_) is kEndOfInput, which the bookmarking
logic also used as kNoBookmark.

R=marja@chomium.org
BUG=v8:4947

Review-Url: https://codereview.chromium.org/2345053003
Cr-Commit-Position: refs/heads/master@{#39507}

BUG=chromium:635948
R=dgozman@chromium.org,alph@chromium.org

Review-Url: https://codereview.chromium.org/2332243002
Cr-Commit-Position: refs/heads/master@{#39506}

The test does not compile with https://codereview.chromium.org/2253973003.
I will comment it out, land the mentioned patch, fix the compile error
(a simple one-liner), and enable the test again.

BUG=647986

Review-Url: https://codereview.chromium.org/2348063002
Cr-Commit-Position: refs/heads/master@{#39505}

BUG=v8:5209

Review-Url: https://codereview.chromium.org/2351673002
Cr-Commit-Position: refs/heads/master@{#39504}

This commit ensures that the d8 shared library build uses the same logic as
the standard static build by exporting relevant functions and classes.

BUG=chromium:646337

Review-Url: https://codereview.chromium.org/2342563002
Cr-Commit-Position: refs/heads/master@{#39503}

BUG=

Review-Url: https://codereview.chromium.org/2266493002
Cr-Commit-Position: refs/heads/master@{#39502}

PreParser is already capable of handling natives, because
ParseV8Intrinsic was moved to ParserBase. There's no reason to force
eager parsing when natives are allowed.

R=nikolaos@chromium.org, mstarzinger@chromium.org
BUG=v8:5398

Review-Url: https://codereview.chromium.org/2342133003
Cr-Commit-Position: refs/heads/master@{#39501}

Forgot to include that in the previous CL

TBR=machenbach@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2354513002
Cr-Commit-Position: refs/heads/master@{#39500}

Remove files that were removed from the build files but never deleted.

R=machenbach@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2346103002
Cr-Commit-Position: refs/heads/master@{#39499}

BUG=v8:5364

Review-Url: https://codereview.chromium.org/2339123002
Cr-Commit-Position: refs/heads/master@{#39498}

According to the ES6 specification, in "for in/of" loops like:

   for (var v of [1,2,3]) return f(...);

the call to f() should not be considered a tail call.  This was
not working properly, i.e., the case without declarations:

   var v;
   for (v of [1,2,3]) return f(...);

R=adamk@chromium.org, ishell@chromium.org
BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2343823002
Cr-Commit-Position: refs/heads/master@{#39497}

- Remove redundant "impl()->".
- Remove NewBlock method from "impl()", exists in "factory()".
- Resolve TODO comments.

R=adamk@chromium.org, marja@chromium.org
BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2345103003
Cr-Commit-Position: refs/heads/master@{#39496}

If the scope was lazily parsed, the ScopeInfo won't be correct (and we
won't store it in the SharedFunctionInfo).

BUG=chromium:644106
R=marja@chromium.org

Review-Url: https://codereview.chromium.org/2345243002
Cr-Commit-Position: refs/heads/master@{#39495}

BUG=chromium:648153
NOTRY=true
NOPRESUBMIT=true
TBR=emso@chromium.org

Review-Url: https://codereview.chromium.org/2352573002
Cr-Commit-Position: refs/heads/master@{#39494}

Revert of Fix async/await memory leak (patchset #5 id:80001 of https://codereview.chromium.org/2334323006/ )

Reason for revert:
newly introduced test async-await-loop times out: https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/builds/10894/steps/Ignition%20-%20turbofan%20%28flakes%29/logs/async-await-loop

Original issue's description:
> Fix async/await memory leak
>
> This patch closes a memory leak in async/await where the desugaring
> was creating a situation analagous to that described in v8:5002.
> Intermediate Promises were being kept alive, so a long-running loop
> would cause linear memory usage on the heap. This patch returns
> undefined to the 'then' callback passed into PerformPromiseThen
> in order to avoid this hazard. Test expectations are fixed to remove
> expecting extraneous events which occurred on Promises that are
> now not given unnecessarily complex resolution paths before being
> thrown away.
>
> BUG=v8:5390
>
> Committed: https://crrev.com/a0ba18e9634c5e2d439033ab61a77cff54f9af35
> Cr-Commit-Position: refs/heads/master@{#39479}

TBR=adamk@chromium.org,caitp@igalia.com,littledan@chromium.org
NOTRY=true
BUG=v8:5390

Review-Url: https://codereview.chromium.org/2354473002
Cr-Commit-Position: refs/heads/master@{#39493}

Review-Url: https://codereview.chromium.org/2349983002
Cr-Commit-Position: refs/heads/master@{#39492}

  port 7f3d15aa(r39470)

  original commit message:
  In ignition, arguments to function calls and function constructors are
  pushed onto the stack before calling the function. It is required to check
  that stack does not overflow when pushing the arguments.

BUG=

Review-Url: https://codereview.chromium.org/2351543002
Cr-Commit-Position: refs/heads/master@{#39491}

  port c7d7ca36(r39410)

  original commit message:
  Add a notion of "invocation count" to the baseline compilers, which
  increment a special slot in the TypeFeedbackVector for each invocation
  of a given function (the optimized code doesn't currently collect this
  information).

  Use this invocation count to relativize the call counts on the call
  sites within the function, so that the inlining heuristic has a view
  of relative importance of a call site rather than some absolute numbers
  with unclear meaning for the current function. Also apply the call site
  frequency as a factor to all frequencies in the inlinee by passing this
  to the graph builders so that the importance of a call site in an
  inlinee is relative to the topmost optimized function.

  Note that all functions that neither have literals nor need type
  feedback slots will share a single invocation count cell in the
  canonical empty type feedback vector, so their invocation count is
  meaningless, but that doesn't matter since we only use the invocation
  count to relativize call counts within the function, which we only have
  if we have at least one type feedback vector (the CallIC slot).

  See the design document for additional details on this change:
  https://docs.google.com/document/d/1VoYBhpDhJC4VlqMXCKvae-8IGuheBGxy32EOgC2LnT8

BUG=

Review-Url: https://codereview.chromium.org/2352493002
Cr-Commit-Position: refs/heads/master@{#39490}

  port 3ccedd5d(r39398)

  original commit message:

BUG=

Review-Url: https://codereview.chromium.org/2352483002
Cr-Commit-Position: refs/heads/master@{#39489}

Rolling v8/build to cce8ee87cfdbbac3b05240132f74fe1f398e83d1

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2346163002
Cr-Commit-Position: refs/heads/master@{#39488}

  port 2ab3fcf4(r39377)

  original commit message:
  To make better inlining decisions, it's good to have call counts for poly/mega-morphic cases. This CL makes it work for calls, and another will follow to better unify the code between constructor
  calls and normal calls (and thence, to record megamorphic call counts there as well).

BUG=

Review-Url: https://codereview.chromium.org/2351523002
Cr-Commit-Position: refs/heads/master@{#39487}

In practice this is a dense array, because there is currently no provision
in the format for assigning IDs other than sequentially to every object.
Thus a FixedArray is more efficient than a general dictionary.

BUG=chromium:148757

Review-Url: https://codereview.chromium.org/2342293003
Cr-Commit-Position: refs/heads/master@{#39486}

Rolling v8/build to f7f13b559d1d51c4e932659e11b28be595595041

Rolling v8/buildtools to 6115afa0ea5ea33e1f284d9ef2175a03db1370ca

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2351503002
Cr-Commit-Position: refs/heads/master@{#39485}

test-run-wasm-module cctests broken in debug since recent refactoring changes for moving Compilation/Instantiation off the module object (https://codereview.chromium.org/2320723005). The problem here is that SetupIsolateForWasm tries to add the same property to a module_object multiple times and hits a DCHECK when this property is found on a lookup.
 - Fixed to use the setup method only once when CcTest::InitIsolateOnce is used.
 - Move setup method to test as this is only used for cctests/fuzzers. The install method should take care of this in the regular JS pipeline.

 R=mtrofin@chromium.org, ahaas@chromium.org

Review-Url: https://codereview.chromium.org/2342263002
Cr-Commit-Position: refs/heads/master@{#39484}

We'd like wasm regressions to live under a subfolder of the mjsunit
regression folder.

BUG=

Review-Url: https://codereview.chromium.org/2344373002
Cr-Commit-Position: refs/heads/master@{#39483}

Normally the parser just uses AstConsStrings to concatenate, but some
types require an AstRawString. This patch adds an AstValueFactory
method which produces one from two AstRawStrings.

Review-Url: https://codereview.chromium.org/2348783002
Cr-Commit-Position: refs/heads/master@{#39482}