Rolling v8/build to 464a8fa0e414f18a55f20f2a6981778f105060da

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2313833002
Cr-Commit-Position: refs/heads/master@{#39189}

This restores the contract that all API methods that return Maybe<T> or
MaybeLocal<T> always throw an exception when they return nothing.

Since v8::ValueDeserializer::ReadHeader can now throw exceptions, it
needs a Local<Context> parameter so that it can set up execution state
(entering the context, etc.). The old method has been marked for
deprecation, but since this API is experimental I intend to remove it
as soon as I've removed the use from Blink.

value-serializer-unittest has been updated to expect an exception in
all decode failure cases.

BUG=chromium:148757,chromium:641964

Review-Url: https://codereview.chromium.org/2308053002
Cr-Commit-Position: refs/heads/master@{#39188}

This handles the case where preparation of bytecode might fail inside
Compiler::EnsureBytecode due to the underlying function being a fully
validated asm.js module. We simply bailout of bytecode preparation.

R=bradnelson@chromium.org
TEST=mjsunit/regress/regress-crbug-644111
BUG=chromium:644111

Review-Url: https://codereview.chromium.org/2309853002
Cr-Commit-Position: refs/heads/master@{#39187}

Disable the propagation of truncations through Phi, Select or TypeGuard
if the output representation is tagged, because when the truncations are
taken we don't necessarily reflect this in the types and therefore we
might end up in a situation where we produce a word32 value, the type
says Number, and now we need to change that to tagged, which is not
possible since we don't know how to interpret the bits, i.e. whether the
value is Signed32 or Unsigned32.

BUG=chromium:644048

Review-Url: https://codereview.chromium.org/2311903002
Cr-Commit-Position: refs/heads/master@{#39186}

R=ulan@chromium.org

Review-Url: https://codereview.chromium.org/2311003002
Cr-Commit-Position: refs/heads/master@{#39185}

Move either in heap-inl.h or heap.cc, depending on the performance requirements.

R=ulan@chromium.org

Review-Url: https://codereview.chromium.org/2312643003
Cr-Commit-Position: refs/heads/master@{#39184}

Generate a flag-setting instruction for a binary operation when
the result is tested for equality/inequality to zero.

BUG=

Review-Url: https://codereview.chromium.org/2315453002
Cr-Commit-Position: refs/heads/master@{#39183}

There are no CONST function declarations. Also make check independent of variable location.

R=adamk@chromium.org, rmcilroy@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2301863002
Cr-Commit-Position: refs/heads/master@{#39182}

BUG=

Review-Url: https://codereview.chromium.org/2309823002
Cr-Commit-Position: refs/heads/master@{#39181}

After we landed the tracing runtime call stats, which gave
us a lot of V8 insight in tracing, we noticed that there is
some arising issues and discrepancies.

Issues include:
Missing trace events, that happened due to
transforming those trace events into runtime calls

Discrepancies include:
Missing categories in Runtime call stats like GC,
because we are not handling the Scoped runtime calls
properly in the tracing version.

To reduce/eliminate those issue, we are taking a small
step back. We are unifying the RuntimeStats code and
using the original one. That would allow us to use all
the original probes but emit trace events from them.
We are also putting back the trace-events in their place.

The output from both system should be intact (Except of
the addition of the missing trace-events).

Also as a byproduct, we are reducing the number of context
scopes by half since we are using the same scope as
runtime call stats.

As a follow up to this CL, we will address the non-scoped
Runtime Call Stats (mainly in GC).
BUG=642373

Review-Url: https://codereview.chromium.org/2296243002
Cr-Commit-Position: refs/heads/master@{#39180}

And not the Representation dimension of Type*.

BUG=

Review-Url: https://codereview.chromium.org/2312703002
Cr-Commit-Position: refs/heads/master@{#39179}

Review-Url: https://codereview.chromium.org/2316453002
Cr-Commit-Position: refs/heads/master@{#39178}

Revert of [regexp] Port RegExpConstructor (patchset #2 id:20001 of https://codereview.chromium.org/2302773002/ )

Reason for revert:
Performance regressions: crbug.com/644087
Clusterfuzz: crbug.com/644074

We'll reland all regexp changes at once when the port is complete and at least performance-neutral, since the partial port requires slow workarounds.

Original issue's description:
> [regexp] Port RegExpConstructor
>
> BUG=v8:5339
>
> Committed: https://crrev.com/0aa80be16b8d876999066545c2922e1291e09610
> Cr-Commit-Position: refs/heads/master@{#39074}

TBR=bmeurer@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=v8:5339

Review-Url: https://codereview.chromium.org/2312743002
Cr-Commit-Position: refs/heads/master@{#39177}

Revert of [regexp] Port RegExp getters and setters (patchset #5 id:80001 of https://codereview.chromium.org/2305573002/ )

Reason for revert:
Performance regressions: crbug.com/644087
Clusterfuzz: crbug.com/644074

We'll reland all regexp changes at once when the port is complete and at least performance-neutral, since the partial port requires slow workarounds.

Original issue's description:
> [regexp] Port RegExp getters and setters
>
> BUG=v8:5339
>
> Committed: https://crrev.com/ac0eb5e05af40e16ae9402bb8a62600b32cc2ec9
> Committed: https://crrev.com/7711b1a16f864ed6ea56fa40274ff3f6287bbe34
> Cr-Original-Commit-Position: refs/heads/master@{#39076}
> Cr-Commit-Position: refs/heads/master@{#39088}

TBR=bmeurer@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=v8:5339

Review-Url: https://codereview.chromium.org/2313713002
Cr-Commit-Position: refs/heads/master@{#39176}

This patch moves the following parsing methods to ParserBase:

- ParseStatementList
- ParseStatementListItem
- ParseStatement
- ParseSubStatement (subsumed in ParseStatement)
- ParseStatementAsUnlabeled

It also refactors the Target and TargetScope objects, used by the
parser.

R=adamk@chromium.org, marja@chromium.org
BUG=
LOG=N

Committed: https://crrev.com/df29f3fda25660075a273cc27ad9f7787f321072
Review-Url: https://codereview.chromium.org/2307073002
Cr-Original-Commit-Position: refs/heads/master@{#39167}
Cr-Commit-Position: refs/heads/master@{#39175}

Review-Url: https://codereview.chromium.org/2309773002
Cr-Commit-Position: refs/heads/master@{#39174}

R=mvstanton@chromium.org

Review-Url: https://codereview.chromium.org/2312723002
Cr-Commit-Position: refs/heads/master@{#39173}

And also handle dictionary elements loads in the dispatcher.

This is a reland with fix for negative indices into DICTIONARY_ELEMENTS.
Original review: https://codereview.chromium.org/2245683002/

Review-Url: https://codereview.chromium.org/2313683002
Cr-Commit-Position: refs/heads/master@{#39172}

Also disable four cpu-profiler tests under asan that fail
with the GN setup.

BUG=chromium:474921,v8:5243

Review-Url: https://codereview.chromium.org/2309263002
Cr-Commit-Position: refs/heads/master@{#39171}

Revert of [regexp] Port RegExpCompile and RegExpToString (patchset #3 id:40001 of https://codereview.chromium.org/2295273003/ )

Reason for revert:
Performance regressions: crbug.com/644087
Clusterfuzz: crbug.com/644074

We'll reland all regexp changes at once when the port is complete and at least performance-neutral, since the partial port requires slow workarounds.

Original issue's description:
> [regexp] Port RegExpCompile and RegExpToString
>
> BUG=v8:5339
>
> Committed: https://crrev.com/836299aa9c484eb96b6b4aa48270ab2c30b85801
> Cr-Commit-Position: refs/heads/master@{#39119}

TBR=bmeurer@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=v8:5339

Review-Url: https://codereview.chromium.org/2311883002
Cr-Commit-Position: refs/heads/master@{#39170}

Revert of [parser] Refactor of Parse*Statement*, part 1 (patchset #2 id:20001 of https://codereview.chromium.org/2307073002/ )

Reason for revert:
https://build.chromium.org/p/client.v8.ports/builders/V8%20Mips%20-%20builder

Original issue's description:
> [parser] Refactor of Parse*Statement*, part 1
>
> This patch moves the following parsing methods to ParserBase:
>
> - ParseStatementList
> - ParseStatementListItem
> - ParseStatement
> - ParseSubStatement (subsumed in ParseStatement)
> - ParseStatementAsUnlabeled
>
> It also refactors the Target and TargetScope objects, used by the
> parser.
>
> R=adamk@chromium.org, marja@chromium.org
> BUG=
> LOG=N
>
> Committed: https://crrev.com/df29f3fda25660075a273cc27ad9f7787f321072
> Cr-Commit-Position: refs/heads/master@{#39167}

TBR=adamk@chromium.org,marja@chromium.org,nikolaos@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review-Url: https://codereview.chromium.org/2313703002
Cr-Commit-Position: refs/heads/master@{#39169}

We used to have Array types for typed arrays in asm.js at some point,
but had to change that quite some time ago already. And Function types
were mostly used for the CallInterfaceDescriptor (and the code-stub.js
experiment), but are also unusedn nowadays.

R=mvstanton@chromium.org
BUG=v8:5267,v8:5270

Review-Url: https://codereview.chromium.org/2310923002
Cr-Commit-Position: refs/heads/master@{#39168}

This patch moves the following parsing methods to ParserBase:

- ParseStatementList
- ParseStatementListItem
- ParseStatement
- ParseSubStatement (subsumed in ParseStatement)
- ParseStatementAsUnlabeled

It also refactors the Target and TargetScope objects, used by the
parser.

R=adamk@chromium.org, marja@chromium.org
BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2307073002
Cr-Commit-Position: refs/heads/master@{#39167}

Those have been effectively unused for quite a while now, and we
don't see any use in having them around. Actually it'd be way more
consistent and simpler to just use OtherInternal as type for contexts
instead.

R=mvstanton@chromium.org
BUG=v8:5267,v8:5270

Review-Url: https://codereview.chromium.org/2305383002
Cr-Commit-Position: refs/heads/master@{#39166}

Revert of [regexp] Remove dead code (patchset #1 id:1 of https://codereview.chromium.org/2301803003/ )

Reason for revert:
Performance regressions: crbug.com/644087
Clusterfuzz: crbug.com/644074

We'll reland all regexp changes at once when the port is complete and at least performance-neutral, since the partial port requires slow workarounds.

Original issue's description:
> [regexp] Remove dead code
>
> Remove dead code, and drop the legacy RegExp.prototype.exec implementation (the
> only differences are TO_BOOLEAN on global and sticky).
>
> BUG=v8:5339
>
> Committed: https://crrev.com/1cb2a70cb5baa7545fdf9cc4e035a6d45cb189fd
> Cr-Commit-Position: refs/heads/master@{#39121}

TBR=bmeurer@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=v8:5339

Review-Url: https://codereview.chromium.org/2310903002
Cr-Commit-Position: refs/heads/master@{#39165}

Since the extension field is already used for the catch name, store a
ContextExtension there instead.

In the future, this will allow for chaining ScopeInfos together, so we
no longer need a context chain for lazy parsing / compilation.

BUG=v8:5215
R=bmeurer@chromium.org,neis@chromium.org,marja@chromium.org

Review-Url: https://codereview.chromium.org/2302013002
Cr-Commit-Position: refs/heads/master@{#39164}

R=rmcilroy@chromium.org
BUG=v8:4680

Review-Url: https://codereview.chromium.org/2282733002
Cr-Commit-Position: refs/heads/master@{#39163}

R=mvstanton@chromium.org
BUG=v8:5267,v8:5270

Review-Url: https://codereview.chromium.org/2312693002
Cr-Commit-Position: refs/heads/master@{#39162}

Rebuilding (after touching certain files) is crazy slow because
includes are out of control.

BUG=v8:5294

Review-Url: https://codereview.chromium.org/2312683002
Cr-Commit-Position: refs/heads/master@{#39161}

Revert of [regexp] Port RegExpExec (patchset #2 id:20001 of https://codereview.chromium.org/2307853002/ )

Reason for revert:
Performance regressions: crbug.com/644087
Clusterfuzz: crbug.com/644074

We'll reland all regexp changes at once when the port is complete and at least performance-neutral, since the partial port requires slow workarounds.

Original issue's description:
> [regexp] Port RegExpExec
>
> BUG=v8:5339
>
> Committed: https://crrev.com/c79e163ba82f2e2dcf9b60639127d187fdbf54b9
> Cr-Commit-Position: refs/heads/master@{#39150}

TBR=bmeurer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5339

Review-Url: https://codereview.chromium.org/2315473002
Cr-Commit-Position: refs/heads/master@{#39160}

Revert of includes: Make ast.h not need isolate.h any more. (patchset #3 id:60001 of https://codereview.chromium.org/2301423002/ )

Reason for revert:
Breaks gc stress:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20gc%20stress/builds/5642

Original issue's description:
> includes: Make ast.h not need isolate.h any more.
>
> Also remove other unnecessary includes from ast.h and dependencies.
>
> BUG=v8:5294
>
> Committed: https://crrev.com/9c888dffda4bff420ec3ef21e623aa4e5054d1c3
> Cr-Commit-Position: refs/heads/master@{#39155}

TBR=adamk@chromium.org,mstarzinger@chromium.org,bmeurer@chromium.org,marja@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5294

Review-Url: https://codereview.chromium.org/2305373002
Cr-Commit-Position: refs/heads/master@{#39159}

Revert of [gn] Switch win clang bot to gn (patchset #1 id:1 of https://codereview.chromium.org/2310863002/ )

Reason for revert:
Fails compilation:
https://build.chromium.org/p/client.v8/builders/V8%20Win64%20-%20clang

Original issue's description:
> [gn] Switch win clang bot to gn
>
> BUG=chromium:474921
> NOTRY=true
>
> Committed: https://crrev.com/1740587772bbd1ffb7b79a90deb16519e8d47588
> Cr-Commit-Position: refs/heads/master@{#39156}

TBR=jochen@chromium.org,vogelheim@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:474921

Review-Url: https://codereview.chromium.org/2311853002
Cr-Commit-Position: refs/heads/master@{#39158}

BUG=chromium:605349
LOG=NO

Review-Url: https://codereview.chromium.org/2304203002
Cr-Commit-Position: refs/heads/master@{#39157}

BUG=chromium:474921
NOTRY=true

Review-Url: https://codereview.chromium.org/2310863002
Cr-Commit-Position: refs/heads/master@{#39156}

Also remove other unnecessary includes from ast.h and dependencies.

BUG=v8:5294

Review-Url: https://codereview.chromium.org/2301423002
Cr-Commit-Position: refs/heads/master@{#39155}

Revert of [wasm] reuse the first compiled module (patchset #12 id:220001 of https://codereview.chromium.org/2305903002/ )

Reason for revert:
mac gc stress failures:
https://build.chromium.org/p/client.v8/builders/V8%20Mac%20GC%20Stress/builds/8341

Original issue's description:
> [wasm] reuse the first compiled module.
>
> This change avoids needing to keep around an unused compiled
> module. Instead, the result of compiling the wasm bytes is
> given to the first instance. The module object and that instance object
> point to the same compiled module. Instances are, then, cloned from
> the compiled module the module object points to. When an instance is
> collected, we make sure that the module object still has a clone
> available, and, if the last instance is GC-ed, we also reset the compiled
> module so that it does not reference its heap, so that it (==heap) may
> be collected.
>
> This is achieved by linking the clones in a double-linked list and
> registering a finalizer for each. When we create an instance, we tie it
> in the front of the list, making the module object point to it (O(1)). When
> the finalizer is called, we relink the list over the dying object (O(1)). The
> costliest operation is finalizing the last instance, since we need to visit
> all wasm functions and reset heap references.
>
> BUG=v8:5316
>
> Committed: https://crrev.com/01f5af515728aebe6c5246f4f7dd6c573e8748af
> Cr-Commit-Position: refs/heads/master@{#39153}

TBR=bradnelson@chromium.org,verwaest@chromium.org,vogelheim@chromium.org,yangguo@chromium.org,mtrofin@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5316

Review-Url: https://codereview.chromium.org/2306403002
Cr-Commit-Position: refs/heads/master@{#39154}

This change avoids needing to keep around an unused compiled
module. Instead, the result of compiling the wasm bytes is
given to the first instance. The module object and that instance object
point to the same compiled module. Instances are, then, cloned from
the compiled module the module object points to. When an instance is
collected, we make sure that the module object still has a clone
available, and, if the last instance is GC-ed, we also reset the compiled
module so that it does not reference its heap, so that it (==heap) may
be collected.

This is achieved by linking the clones in a double-linked list and
registering a finalizer for each. When we create an instance, we tie it
in the front of the list, making the module object point to it (O(1)). When
the finalizer is called, we relink the list over the dying object (O(1)). The
costliest operation is finalizing the last instance, since we need to visit
all wasm functions and reset heap references.

BUG=v8:5316

Review-Url: https://codereview.chromium.org/2305903002
Cr-Commit-Position: refs/heads/master@{#39153}

There are no users of class types left inside TurboFan, so we can nuke
them and thereby simplify the type system quite a bit.

R=mvstanton@chromium.org
BUG=v8:5267,v8:5270

Review-Url: https://codereview.chromium.org/2309753002
Cr-Commit-Position: refs/heads/master@{#39152}

Avoid the useless strict equality comparisons with true/false being
generated for the JumpIfTrue, JumpIfFalse, JumpIfToBooleanTrue and
JumpIfToBooleanFalse bytecodes. Instead feed the accumulator (or the
outcome of ToBoolean) directly to the Branch node and do the negation
as part of the control flow.

The previous subraphs would render the loop variable analysis useless,
and would cause a lot of unnecessary bit materialization, because many
of our optimizations don't kick in.

Note: This is only part of the problem, there are more subtle differences
in the bytecode pipeline that prevent several important optimizations to
kick in.

R=mstarzinger@chromium.org
BUG=v8:5267,v8:5348

Review-Url: https://codereview.chromium.org/2309733002
Cr-Commit-Position: refs/heads/master@{#39151}

BUG=v8:5339

Review-Url: https://codereview.chromium.org/2307853002
Cr-Commit-Position: refs/heads/master@{#39150}