This introduces a new heap object ModuleInfo, which is to ModuleDescriptor
what ScopeInfo is to Scope.  When deserializing a scope info that contains
a module info, we deserialize the module info into a module descriptor and
put it into the synthesized module scope.

Currently, module infos only store exports.

R=adamk@chromium.org
BUG=v8:1569

Review-Url: https://codereview.chromium.org/2277253003
Cr-Commit-Position: refs/heads/master@{#39049}

Just always predeclare it

R=marja@chromium.org,verwaest@chromium.org
BUG=v8:5215

Review-Url: https://codereview.chromium.org/2298743002
Cr-Commit-Position: refs/heads/master@{#39048}

Both x64.optdebug and x64.debug map to the x64.debug config, so
just printing arch/mode is still confusing.

R=machenbach@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2299623002
Cr-Commit-Position: refs/heads/master@{#39047}

The fuzzer found out that "start" is not always a good control input
for a diamond.

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2295173002
Cr-Commit-Position: refs/heads/master@{#39046}

Ignition OSR to turbofan seems to cause instruction selector crashes
(where instructions selector gets simplified operators, probably
because we break the effect chain somehow).

BUG=chromium:641893

Review-Url: https://codereview.chromium.org/2298613003
Cr-Commit-Position: refs/heads/master@{#39045}

TBR=ulan@chromium.org
BUG=chromium:468240
NOTRY=true

Review-Url: https://codereview.chromium.org/2293903004
Cr-Commit-Position: refs/heads/master@{#39044}

TBR=rmcilroy@chromium.org
BUG=NONE

Review-Url: https://codereview.chromium.org/2298703002
Cr-Commit-Position: refs/heads/master@{#39043}

The goal is to not have to look at the outer scope chain during parsing.

BUG=v8:5215
R=verwaest@chromium.org,marja@chromium.org

Review-Url: https://codereview.chromium.org/2298673002
Cr-Commit-Position: refs/heads/master@{#39042}

- Respect a deadline when processing wrappers during incremental marking, i.e.,
  don't force completetion on each individual step
- Only finalize when both, the internal marking deque and wrappers, are
  processed

Some results (twitter using --enable-blink-features=TraceWrappables)

=== BEFORE ===
incremental_wrapper_tracing_longest_step
  len: 13
  min: 0.0
  ---> max: 6.6
  ---> avg: 3.83846153846
  [0,5[: 7
  [5,10[: 6
mark.wrapper_tracing
  len: 13
  min: 0.0
  max: 2.0 (non-incremental MC)
  avg: 0.153846153846
  [0,5[: 13

=== AFTER ===
incremental_wrapper_tracing_longest_step
  len: 8
  min: 0.0
  ---> max: 1.1
  ---> avg: 0.8875
  [0,5[: 8
mark.wrapper_tracing (not excluding non-incremental MC)
  len: 8
  min: 0.0
  max: 2.5 (non-incremental MC)
  avg: 0.3125
  [0,5[: 8

BUG=chromium:468240
R=ulan@chromium.org

Review-Url: https://codereview.chromium.org/2287343002
Cr-Commit-Position: refs/heads/master@{#39041}

When we try to further fold previously folded allocations in Crankshaft
GVN we don't properly transform the allocations involved, which causes
the mechanism to leave holes in the new/old space (and thereby violate
the iterability property of the new/old space).

BUG=chromium:621868
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2297983003
Cr-Commit-Position: refs/heads/master@{#39040}

The last user was propagating asm_module_ to inner function scopes as asm_function_. asm_function_ is already set upon scope creation when the outer scope IsAsmModule(). With default parameter it's possible that inner scopes are created before set_asm_module() is called. To keep current behavior we'll eagerly mark inner scopes as asm_function_ upon set_asm_module().

There's only one special case that used to be marked asm_function_ which is now no longer marked as such: asm functions in block scopes that are 'Finalized'. PropagateScopeInfo used to mark them as asm_function_ as well, whereas the new version would not mark them upon construction of the inner scope.

I presume both above cornercases aren't actually intended valid asm.js use-cases anyway. The second we can now easily identify in the verifier and mark as invalid asm, since we'll have an asm module with non-asm-function inner functions. If we want to disallow the first, we can also not mark them as asm_functions_ (by removing the loop I added in set_asm_module), which will reveal this structure to the validator.

BUG=v8:5209

Review-Url: https://codereview.chromium.org/2270743003
Cr-Commit-Position: refs/heads/master@{#39039}

This way, many files which only need CompilationInfo but not compiler.h
and its dependencies can include just compilation-info.h.

BUG=

Review-Url: https://codereview.chromium.org/2284313003
Cr-Commit-Position: refs/heads/master@{#39038}

R=marja@chromium.org
TBR=verwaest@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2294193003
Cr-Commit-Position: refs/heads/master@{#39037}

This is the first step towards unifying ParseVariableDeclarations.

BUG=

Review-Url: https://codereview.chromium.org/2297643002
Cr-Commit-Position: refs/heads/master@{#39036}

Rolling v8/build to 679c9fd3fa7390897bcf6891f0dc57a5e5dced0d

Rolling v8/tools/mb to d939c7d364f0565ac2ddcae09aafe01c9bf8007d

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2293333002
Cr-Commit-Position: refs/heads/master@{#39035}

Ports https://codereview.chromium.org/2293853002 to unblock
deps roller.

BUG=474921
TBR=jochen@chromium.org, kjellander@chromium.org, vogelheim@chromium.org
NOTRY=true

Review-Url: https://codereview.chromium.org/2290233005
Cr-Commit-Position: refs/heads/master@{#39034}

The way we use FinishRegion for transitioning stores makes them eligible
for elimination by TypedOptimization, which is unintended and removes
the atomicity of the transitioning stores. This is a quickfix to ensure
that we don't remove the FinishRegion nodes during TypedOptimization;
the real fix is probably to have separate region operators for value
(producing) regions (i.e. allocations) and for effect-only regions (i.e.
transitioning stores).

R=jarin@chromium.org
BUG=v8:5303

Review-Url: https://codereview.chromium.org/2293023003
Cr-Commit-Position: refs/heads/master@{#39033}

If the type of a tracked field or element value is less precise than the
advertised type of the field or element load, then we replace the load
operation with a TypeGuard that guards the advertised type.

R=jarin@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2295643002
Cr-Commit-Position: refs/heads/master@{#39032}

We (mis)used Type::Class to track stable field maps in the past. But
that always more or less unsupport and wrong for various reasons, mostly
because the class types do not really present static information and
thus it is possible to violate fundamental assumptions of the type
system (i.e. intersecting class types and other types produces
"interesting" results).

Now it is possible to finally nuke the class types completely and thus
simplify (and ideally correctify) the type system further.

Note to performance sheriff: We do expect to see some performance
regressions from this change. This is because we do not yet have a sane
replacement mechanism to track known field maps and utilize them during
LoadElimination. This will be accomplished in a follow up CL.

BUG=v8:5270,v8:5267
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2293343002
Cr-Commit-Position: refs/heads/master@{#39031}

This removes two bits of duplication:
  - Parsing of each AssignmentExpression, which previously was called
    first outside the loop and then inside the loop.
  - Parsing of arrow rest parameters, which previously was handled
    separately for the one-arg and N-arg cases.

The only change in behavior is in a few error messages.

Review-Url: https://codereview.chromium.org/2279363002
Cr-Commit-Position: refs/heads/master@{#39030}

Revert of Refactor object/class literal property name parsing (patchset #7 id:120001 of https://codereview.chromium.org/2278153004/ )

Reason for revert:
Fails to reject "{*foo: 1}" as an object literal, found
by the fuzzer:

https://build.chromium.org/p/client.v8/builders/V8%20Fuzzer/builds/12315/steps/Fuzz%20on%20Ubuntu-12.04/logs/stdio

Original issue's description:
> Refactor object/class literal property name parsing
>
> This patch arranges that property names are parsed in a single pass,
> reporting the name as well as the type of the property, instead of
> parsing qualifiers like 'static' or 'get' initially as names and then
> re-parsing. This change is easier to reason about, very slightly (4%)
> faster in some cases (although slower in other, less common ones, though
> this slowdown will be fixed in an upcoming patch), and is a prerequisite
> for separating the parsing of object and class literal properties, which
> will become increasingly important as ECMAScript adds more class features.
>
> Committed: https://crrev.com/6dd26c729584024e17a05a2a76b319d4aecdc138
> Cr-Commit-Position: refs/heads/master@{#39027}

TBR=littledan@chromium.org,marja@chromium.org,bakkot@google.com
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2295743003
Cr-Commit-Position: refs/heads/master@{#39029}

Test ensuring globals are isolated between instances. Also
added support for globals section to mjsunit's
WebModuleBuilder as a prerequisite.

BUG=

Review-Url: https://codereview.chromium.org/2296993002
Cr-Commit-Position: refs/heads/master@{#39028}

This patch arranges that property names are parsed in a single pass,
reporting the name as well as the type of the property, instead of
parsing qualifiers like 'static' or 'get' initially as names and then
re-parsing. This change is easier to reason about, very slightly (4%)
faster in some cases (although slower in other, less common ones, though
this slowdown will be fixed in an upcoming patch), and is a prerequisite
for separating the parsing of object and class literal properties, which
will become increasingly important as ECMAScript adds more class features.

Review-Url: https://codereview.chromium.org/2278153004
Cr-Commit-Position: refs/heads/master@{#39027}

Increasingly, we avoid using the representation dimension of Type,
  and set it explicitly ourselves.

BUG=

Review-Url: https://codereview.chromium.org/2290233002
Cr-Commit-Position: refs/heads/master@{#39026}

When changing from Tagged to Float64 representation, it's not unlikely
to see a HeapNumber (or if feedback says so, an Oddball), so we
shouldn't penalize the code that deals with this case by marking it as
deferred.

R=mvstanton@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2295933003
Cr-Commit-Position: refs/heads/master@{#39025}

BUG=chromium:616434
LOG=NO

Review-Url: https://codereview.chromium.org/2294783002
Cr-Commit-Position: refs/heads/master@{#39024}

When FieldType::None() returns a cast Smi::FromInt(0), which translates
as nullptr, the FieldType::IsNone() check becomes equivalent to
`this == nullptr` which is not allowed by the standard and
therefore optimized away as a false constant by GCC 6.

This has lead to crashes when invoking methods on FieldType::None().

Using a different Smi constant for FieldType::None() makes the compiler
always include a comparison against that value. The choice of these
constants has no effect as they are effectively arbitrary.

BUG=https://github.com/nodejs/node/issues/8310

Review-Url: https://codereview.chromium.org/2292953002
Cr-Commit-Position: refs/heads/master@{#39023}

If the input of grow-memory was not representable as a SMI, then the
input was not passed correctly to the runtime, which caused a crash.
With this CL the input of grow-memory is checked before the runtime is
called.

R=titzer@chromium.org, gdeepti@chromium.org
TEST=mjsunit/wasm/grow-memory.js:testGrowMemoryTrapsWithNonSmiInput()

Review-Url: https://codereview.chromium.org/2288773002
Cr-Commit-Position: refs/heads/master@{#39022}

Hi Brad,

am I right that the two files that I added to .gitignore are generated
by your fuzzer CL (https://codereview.chromium.org/2273303002/)?

Cheers, Andreas

R=bradnelson@chromium.org

Review-Url: https://codereview.chromium.org/2289163002
Cr-Commit-Position: refs/heads/master@{#39021}

BUG=

Review-Url: https://codereview.chromium.org/2291103002
Cr-Commit-Position: refs/heads/master@{#39020}

[turbofan] Treat the INT32 state of a truncating binary op IC as number or oddball on 32-bit machines.

This was causing a few unexpected deopt loops.

BUG=v8:5320

Review-Url: https://codereview.chromium.org/2292873002
Cr-Commit-Position: refs/heads/master@{#39019}

Original issue's description:
> Release streamed script resources after it was compiled
>
> Otherwise, we'd hold on to the resources until the embedder frees them
> which might take a long time
>
> R=marja@chromium.org,verwaest@chromium.org
> BUG=
>
> Committed: https://crrev.com/877dac34465c018bb534b7781fbe242ae4e33c32
> Cr-Commit-Position: refs/heads/master@{#38999}

TBR=marja@chromium.org,verwaest@chromium.org
BUG=chromium:642347

Review-Url: https://codereview.chromium.org/2296733002
Cr-Commit-Position: refs/heads/master@{#39018}

BUG=chromium:148757

Review-Url: https://codereview.chromium.org/2290753002
Cr-Commit-Position: refs/heads/master@{#39017}

Now incremental marking tracing outputs isolate and timestamp:

[41894:0x21efec0]    17253 ms: [IncrementalMarking] Start (old space step)

This patch also adds walltime duration of incremental marking to GC trace output.

BUG=

Review-Url: https://codereview.chromium.org/2293883002
Cr-Commit-Position: refs/heads/master@{#39016}

This commit introduces several new types:

* JSStackFrame and WasmStackFrame are wrapper classes around a single frame
  in a FrameArray.
* They both inherit from StackFrameBase, which uses virtual dispatch to call
  the correct implementation.
* FrameArrayIterator contains a static instance of JSStackFrame and
  WasmStackFrame and returns a pointer to the corresponding type for each
  frame.
* The JS callsite object now contains the frame array and frame index
  as internal fields.

Internal stack formatting now relies completely on FrameArrayIterator and the
{JS,Wasm}StackFrame types. JS callsite instances are allocated only for custom
user formatting through Error.prepareStackTrace.

BUG=

Review-Url: https://codereview.chromium.org/2275233002
Cr-Commit-Position: refs/heads/master@{#39015}

With this CL we use isolate->native_context() to provide a context for
the CEntryStub of the runtime call. The native_context() is sufficient
here because Runtime::kWasmThrowTypeError does not use the context.

R=titzer@chromium.org
TEST=mjsunit/wasm/ffi-error.js
BUG=chromium:639492

Review-Url: https://codereview.chromium.org/2291043002
Cr-Commit-Position: refs/heads/master@{#39014}

R=ulan@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2292073002
Cr-Commit-Position: refs/heads/master@{#39013}

Revert of Release streamed script resources after it was compiled (patchset #1 id:1 of https://codereview.chromium.org/2297523002/ )

Reason for revert:
Seems to break webkit unit tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/9360
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064%20%28dbg%29/builds/5503

Original issue's description:
> Release streamed script resources after it was compiled
>
> Otherwise, we'd hold on to the resources until the embedder frees them
> which might take a long time
>
> R=marja@chromium.org,verwaest@chromium.org
> BUG=
>
> Committed: https://crrev.com/877dac34465c018bb534b7781fbe242ae4e33c32
> Cr-Commit-Position: refs/heads/master@{#38999}

TBR=marja@chromium.org,verwaest@chromium.org,jochen@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review-Url: https://codereview.chromium.org/2290173003
Cr-Commit-Position: refs/heads/master@{#39012}

R=machenbach@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2295703002
Cr-Commit-Position: refs/heads/master@{#39011}

Rolling v8/build to 52f474cdb9e67007b938fd4a47220cb3c012e5e8

Rolling v8/third_party/WebKit/Source/platform/inspector_protocol to 84d90b2cc3f01a39bf73a8119a5cec0337d00c9f

Rolling v8/tools/clang to 3e1948978834c16073c1b076410df1a80adda1f5

Rolling v8/tools/mb to ac239cc82ef08858d6f2b75216dd13afcdbc6ac3

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Committed: https://crrev.com/3b8a2e5129fec64674bb0191cba5aa4592d08d5f
Review-Url: https://codereview.chromium.org/2289063002
Cr-Original-Commit-Position: refs/heads/master@{#38995}
Cr-Commit-Position: refs/heads/master@{#39010}