Change-Id: I05bd981c8050a6f59446be660d449320979ceaea
Reviewed-on: https://chromium-review.googlesource.com/1053957Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#53168}

Port 5dfe23a4

Original Commit Message:

    When encountering a LoadStackPointer input to a comparison, generate a register
    LocationOperand that points to the stack pointer. This can avoid unnecessary
    spilling of the stack pointer.

R=georgia.kouveli@arm.com, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: Ie3fecf70f78c234fefad86fec74820a61f3d227b
Reviewed-on: https://chromium-review.googlesource.com/1057965Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#53167}

Bug: v8:6443, v8:7569
Change-Id: I61677e75f23c604ba7ad0ea110aa57578dcadb89
Reviewed-on: https://chromium-review.googlesource.com/1047957
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53166}

Implement atomic compare exchange and atomic bin OPs for
PPC and s390

Change-Id: I8f89a0ebb912082c4c1e6b9a3daf64f28c114010
Reviewed-on: https://chromium-review.googlesource.com/1013861Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#53165}

Bug: chromium:842101

R=neis@chromium.org

Change-Id: I4a142b28682ba73cbf3398e74c15614fa491ad40
Reviewed-on: https://chromium-review.googlesource.com/1057627
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53164}

This makes the fact that {WasmSharedModuleData} is shared across
instances explicit by hanging this {shared} reference off the module
object instead of the instance-specific {WasmCompiledModule} object.

R=titzer@chromium.org

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I99bf3d855d6283bdc48373f0f8e2df1990905d3f
Reviewed-on: https://chromium-review.googlesource.com/1051909
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53163}

Bug: chromium:831822
Change-Id: I4d6fba6dd37a1a3f1d9b3ebcf2a88e2753d8dcf1
Reviewed-on: https://chromium-review.googlesource.com/1057269
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53162}

When encountering a LoadStackPointer input to a comparison, generate a register
LocationOperand that points to the stack pointer. This can avoid unnecessary
spilling of the stack pointer.

Change-Id: Ifd1a5aaf22c9c594e653cf4689ba46587811c4d0
Reviewed-on: https://chromium-review.googlesource.com/1055568Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53161}

Change-Id: I971fe8a5aaadd6360f589451433848ed67e49813
Reviewed-on: https://chromium-review.googlesource.com/1054232Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Théotime Grohens <theotime@google.com>
Cr-Commit-Position: refs/heads/master@{#53160}

This CL disables a DCHECK in RemoveArrayHoles that was triggered for
JSArrays that have read-only elements in the prototype chain.

The DCHECK is not removed because it will be re-enabled later when
the copying from the prototype chain (during sorting) will be done
for JSArrays as well.

R=cbruni@chromium.org

Bug: chromium:840855
Change-Id: Ia278bd2f060df094f477b4efbc3f5bdafd7ea7a8
Reviewed-on: https://chromium-review.googlesource.com/1057588Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Simon Zünd <szuend@google.com>
Cr-Commit-Position: refs/heads/master@{#53159}

Liftoff currently does not support all asm.js code, and tier-up does
not work with lazy compilation. Hence, disable Liftoff for asm.js in
general. We will look at this later, when we have better tier-up.

R=titzer@chromium.org

Bug: v8:6600
Change-Id: I00d9e27d861067b22c0738ade7070538ee8c919c
Reviewed-on: https://chromium-review.googlesource.com/1047245Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53158}

Instead of unconditionally copying the script name into a
heap-allocated char vector, use existing storage if possible. Also, try
to avoid materializing the script name for computing its length.

R=titzer@chromium.org

Change-Id: If0e8ac95ecbbb4e7463d9e4a4cdb5579270bcdaf
Reviewed-on: https://chromium-review.googlesource.com/1051230Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53157}

Minor performance optimization: A {WasmDecoder} instantiated with
{validate == false} does not need to check {decoder->ok()}.

R=titzer@chromium.org

Change-Id: Ieac8b18432453e1cfe9ee66a15a5e2145570436e
Reviewed-on: https://chromium-review.googlesource.com/1057567Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53156}

Now that {WasmCode} objects are no longer specific to an instance, it is
no longer needed to patch code when the last instance is finalized. The
code specialization in {WasmCompiledModule::Reset} is no longer needed.

R=clemensh@chromium.org

Change-Id: I430e7f7258d309916de1188d47677c7feb8123b0
Reviewed-on: https://chromium-review.googlesource.com/1057488Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53155}

A std::unique_ptr of array type uses the "delete[]" operator to delete
the memory, hence we should use "new[]" to allocate it.
I sometimes get this reported locally, even though I have
"alloc_dealloc_mismatch=0" in ASAN_OPTIONS. So why not just fix it.

R=marja@chromium.org

Bug: v8:7754
Change-Id: I026287a0e0ee4b9560c4fc7333267e738392b13f
Reviewed-on: https://chromium-review.googlesource.com/1057230Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53154}

The --trace-turbo flag would cause a crash when compiling a WASM_FUNCTION. It
was caused by assuming the OptimizedCompilationInfo had a SharedFunctionInfo
attached if the code isn't a stub and wasm functions are not considered as such.

In order to test this, we've added a new flag to specify were to dump JSON
files: --trace-turbo-path. This is used to make sure we do not leave lots of
files behind in the top-level directory. It should be useful as standalone
feature too.


Change-Id: Ia9442638d28100bea45a8683fb233803cc5393f2
Reviewed-on: https://chromium-review.googlesource.com/1030555
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53153}

The flag hash is used by code caching to recognize incompatible V8
configurations. When the flag hash differs, the cache is thrown out.

Code produced by embed/noembed builds is incompatible, and thus needs
to change the flag hash as well.

Bug: v8:6666, v8:7739
Change-Id: Icae8c6dc39b2eab491d28b2155f67103acf68181
Reviewed-on: https://chromium-review.googlesource.com/1057331Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53152}

This gets rid of the weakness hacks which were needed for remembering that maps
as handlers are weak, and other handles are strong.

BUG=v8:7308

Change-Id: I7fd3252ba67350803e2207dc12bbdf6abbae7e23
Reviewed-on: https://chromium-review.googlesource.com/1055449Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53151}

Module and script SharedFunctionInfos can't be used interchangeably
(e.g.: it should not be possible to bind a Module's SFI to a Context).

The dedicated type disambiguates the two.

This also adds an overload for CreateCodeCache which takes an unbound
module script instead of an unbound script. Both are just a SFI
underneath, so their behavior is identical.

Bug: v8:7685
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: Iab519d0d50b6b41c95abdb6397f5622e292da4d8
Reviewed-on: https://chromium-review.googlesource.com/1047107
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53150}

R=marja@chromium.org
BUG=v8:7490

Change-Id: Ib95662764db5659bd312327021cf5f44493c1cb3
Reviewed-on: https://chromium-review.googlesource.com/1057147Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53149}

Change-Id: I1815de5bc5fc955014cba8099e8c704a23a2e9be
Reviewed-on: https://chromium-review.googlesource.com/1044187Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53148}

The clusterfuzz issue crashes because VisitBinops expected only but 4
input operands but in the generated graph 5 input operands get created
The issue is fixed by increasing the size of the input operand buffer.

R=jarin@chromium.org

Bug: chromium:842501
Change-Id: I4bbb09a968e165e6f5a0a02d06eee97333f7aa38
Reviewed-on: https://chromium-review.googlesource.com/1056989Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53147}

Makes all but one data member private instead of protected and replaces
all Space::heap_ accesses with Space::heap().

Also moves Executability down from Space into PagedSpace and remove all
references in SemiSpace since it's always initialized with
NOT_EXECUTABLE.

Bug: v8:7754
Change-Id: Ic03ce35a5f970b3c1e25b32da53e4c9717b2ee1e
Reviewed-on: https://chromium-review.googlesource.com/1055510Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53146}

Shares the feedback slot when loading / storing named properties
when the name of the property and the variable corresponding
to the object are the same. This reduces the memory usage on most
real world benchmarks. There is a slight (~1%) increase in the overall
time spent in V8 on a couple of these pages.

There is also no overall performance regression on peak-performance
benchmarks like Octane, ARES. More detailed results are in this doc[1]

[1]: https://docs.google.com/document/d/1rPNjXU-WOlyNQovuQS28Zf2PHCENR97Bi76gV9mHHOc/edit?usp=sharing

BUG: v8:7530
Change-Id: I7dd98c2d26f4e6c94690ca7d9a8a4a8281b3142d
Reviewed-on: https://chromium-review.googlesource.com/966302
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53145}

We must not accept something of kBit representation as of
kWord32 representation (unless it's truncated accordingly).
Deopt instead.

Bug: v8:7740
Change-Id: Ib4f73600d66f8762a6e22f7ea1ce79e8ef451b34
Reviewed-on: https://chromium-review.googlesource.com/1054670
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53144}

Change-Id: I5e50e49a5ffe03f86e0da3d60083cafa83f5c6c6
Reviewed-on: https://chromium-review.googlesource.com/1055494Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Georgia Kouveli <georgia.kouveli@arm.com>
Cr-Commit-Position: refs/heads/master@{#53143}

We accidentally always enabled retpolines for indirect calls in
https://crrev.com/c/1047385. This regresses performance and code size
unnecessarily if the --no-untrusted-code-mitigations flag is used.

R=titzer@chromium.org

Bug: chromium:840376, chromium:798964
Change-Id: I6bab130e33d0dafa1f547ebf7e7930a23c4eba20
Reviewed-on: https://chromium-review.googlesource.com/1057128Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53142}

LSan is not implemented on windows, and trying to use the
{__lsan_ignore_object} function gives link error.
Since LSan is never enabled on windows, we also don't need the
annotations, so just disable them on windows.

R=bmeurer@chromium.org

Bug: chromium:842166,v8:7738
Change-Id: Ibaed77b4b884c09c7a08e081d953c56c53f907ff
Reviewed-on: https://chromium-review.googlesource.com/1056990Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53141}

This reverts commit 989285b7.

Reason for revert: broke internal bots

Original change's description:
> [tools] Add benchmark owners to the config
> 
> R=​machenbach@chromium.org
> 
> No-Try: true
> Bug: chromium:826280
> Change-Id: Ic34d13170dfecdd9e791974a34c33ba0248c7a38
> Reviewed-on: https://chromium-review.googlesource.com/1053809
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#53138}

TBR=machenbach@chromium.org,sergiyb@chromium.org

Change-Id: Iec3f8fa8eda77b1bcfb00274b28a12e4d233d6c4
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:826280
Reviewed-on: https://chromium-review.googlesource.com/1057091Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53140}

Revert "[async-await] Eliminate throwaway promise in async functions."

This reverts commit a840f1f8.

Revert "[async-generators] Also avoid throwaway promise here."

This reverts commit feb545ce.

Revert "[async-await] Turn await closures into intrinsics."

This reverts commit d97bb317.

Revert "[async-generators] Add fast-path for primitives in AsyncGeneratorYield."

This reverts commit e57b500e.

Revert "[async-generators] Add fast-path to skip "then" lookup in AsyncGeneratorResolve."

This reverts commit c15802e1.

Revert "[promises] Correctly run before/after hooks for await."

This reverts commit ca763923.

Bug: v8:7253, v8:7745
Change-Id: I25ad0d2df3cfbc84dbb431aa25b268bce8a39e89
Reviewed-on: https://chromium-review.googlesource.com/1049975
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53139}

R=machenbach@chromium.org

No-Try: true
Bug: chromium:826280
Change-Id: Ic34d13170dfecdd9e791974a34c33ba0248c7a38
Reviewed-on: https://chromium-review.googlesource.com/1053809Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53138}

This reverts commit 42334363.

Reason for revert: Seems to lead to floating point exceptions, i.e. with this code:

```js
__v_0 = 'x'.repeat();
var __f_1 = (function __f_0() {
  "use asm";
  function __f_1(__v_5, __v_0) {
    __v_5 = __v_5 | 0;
    __v_0 = __v_0 | 0;
    return ((__v_5 >>> 4) % (__v_0 >>> 1073741824)) | -1073741825;
  }
  return { __f_1: __f_1 };
})().__f_1;
  for (var __v_5 = 0; __v_5 < 4294967296; __v_5 += 3999773) {__v_5 % __v_0 | 0, __f_1();
  }
```

Running with UBSan via `d8-ubsan-vptr-linux-release-v8-component-53134/d8 --random-seed=54105979 --disable-in-process-stack-traces --stress-marking=100 fuzz-02382.js`

Original change's description:
> [turbofan][x64] Reduce compare-zero followed by flags-setting binop
> 
> On IA architecture, arithmetic and shifting operations set the flags
> according to the computation result.
> 
>     subl rsi,0x1
>     REX.W movq rbx,[rbx+0x17]
>     cmpl rsi, 0                       <-- TO BE REDUCED
>     jnz 0x3f54d2dcef0
> ==>
>     REX.W movq rbx,[rbx+0x17]
>     subl rsi,0x1
>     jnz 0x3f54d2dcef0
> &
>     orl rdx,rbx
>     cmpl rdx,0x0                      <-- TO BE REDUCED
>     jnz 0x3f54d22b0f5
> ==>
>     orl rdx,rbx
>     jnz 0x3f54d22b0f5
> 
> Change-Id: If69c023712212ad7b9fa8b29f4b98274f7885e35
> Reviewed-on: https://chromium-review.googlesource.com/1051445
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Commit-Queue: Kanghua Yu <kanghua.yu@intel.com>
> Cr-Commit-Position: refs/heads/master@{#53118}

TBR=bmeurer@chromium.org,kanghua.yu@intel.com

# Not skipping CQ checks because original CL landed > 1 day ago.

Change-Id: I8a177b9268a2fefcd6877d8f33134e7e0c980926
Reviewed-on: https://chromium-review.googlesource.com/1057067Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53137}

Change-Id: I37ed9115c099f3d17f23a26348a1bbf5f773ee32
Reviewed-on: https://chromium-review.googlesource.com/1056668Reviewed-by: Daniel Clifford <danno@chromium.org>
Commit-Queue: Peter Wong <peter.wm.wong@gmail.com>
Cr-Commit-Position: refs/heads/master@{#53136}

In the process, add a few simple tests for "constexpr" expressions, which
identified a few bugs that are also fixed in this CL.

Change-Id: I97486c781572642d2b574b92133b1f9cda3db592
Reviewed-on: https://chromium-review.googlesource.com/1055493
Commit-Queue: Daniel Clifford <danno@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53135}

Bug: chromium:842083
Change-Id: Ic28d47df055277878cb8e066cd2276cedf06d3cf
Reviewed-on: https://chromium-review.googlesource.com/1054074
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53134}

Change-Id: I8b9308d7628d7efc2a2212ef3a3aa52ccddbfb36
Reviewed-on: https://chromium-review.googlesource.com/1048036
Commit-Queue: Alexei Filippov <alph@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53133}

Node.js still support older versions of clang, and some of those
versions require us to explicitly declare default constructors for
classes. While updating V8 to 6.7 on Node.js we hit a build failure on
Mac OS X and FreeBSD because there was one constructor not complying
with that rule. This commit fixes it.

R=bmeurer@google.com, franzih@google.com, ofrobots@google.com, yangguo@google.com

Bug: v8:7743
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel
Change-Id: I1f57f0c88c27e4755c9e05f6fedd9def55d8cb77
Reviewed-on: https://chromium-review.googlesource.com/1050666Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Commit-Queue: Ali Ijaz Sheikh <ofrobots@google.com>
Cr-Commit-Position: refs/heads/master@{#53132}

This makes the fact that export wrapper code is shared across instances
explicit by hanging the {export_wrappers} array off the module object
instead of the instance-specific {WasmCompiledModule} object.

R=titzer@chromium.org

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: Ic5c73bcc17f759e520c105317361e5654628b99e
Reviewed-on: https://chromium-review.googlesource.com/1051987
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53131}

In case of {kLoadI32}, use same sequence of instructions as in case
of {kI64LoadI32S}. This fixes irregular behavior on target.

TEST=cctest/test-run-wasm/RunWasmLiftoff_I32ShrSOnDifferentRegisters

Change-Id: I7ae6915c8b9bacb682e01db2c00f0c280dbb8254
Reviewed-on: https://chromium-review.googlesource.com/1054878Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#53130}

This reverts commit be2f237d.

Original change's description:
> [heap] Unprotect code pages on demand in MinorMC
>
> This reduces average pause of MinorMC in Richards benchmark from 0.32ms
> to 0.25ms:
>
> baseline pause
>   len: 22
>   min: 0.3
>   max: 0.6
>   avg: 0.322727272727
>   [0,5[: 22
>
> pause
>   len: 22
>   min: 0.2
>   max: 0.7
>   avg: 0.254545454545
>   [0,5[: 22
>
> Bug: chromium:651354

Change-Id: I9d70037dda612528368fb1ba330dc6f6510a14a6
Reviewed-on: https://chromium-review.googlesource.com/1055450Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53129}