We used to intercept function definitions, but not declarations.
GenericNamedPropertySetterCallback now also intercepts function declarations.

For definitions, we call DeclareGlobal and then InitializeVarGlobal. For
declarations, we never call InitializeVarGlobal, thus we must check for
interceptors in DeclareGlobal.

If the semantics of a redeclaration are wrong, e.g., redeclaring a read-only
property, an exception is thrown independent of whether an interceptor is
installed. Usually, i.e., not during a declaration, we only throw if
the call is not successfully intercepted.

BUG=v8:5375

Review-Url: https://codereview.chromium.org/2334733002
Cr-Commit-Position: refs/heads/master@{#39450}

This CL implements the throw wasm opcode. This is a pre-requisite for
implementing try-catches in wasm.

BUG=

Review-Url: https://codereview.chromium.org/2339053003
Cr-Commit-Position: refs/heads/master@{#39449}

This handles the case where generating bytecode for inlining purposes
causes a stack overflow. We just abort inlining but also need to clear
pending exceptions.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-647217
BUG=chromium:647217

Review-Url: https://codereview.chromium.org/2339383002
Cr-Commit-Position: refs/heads/master@{#39448}

R=machenbach@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2342663004
Cr-Commit-Position: refs/heads/master@{#39447}

Port c7d7ca36

Original commit message:

    Add a notion of "invocation count" to the baseline compilers, which
    increment a special slot in the TypeFeedbackVector for each invocation
    of a given function (the optimized code doesn't currently collect this
    information).

    Use this invocation count to relativize the call counts on the call
    sites within the function, so that the inlining heuristic has a view
    of relative importance of a call site rather than some absolute numbers
    with unclear meaning for the current function. Also apply the call site
    frequency as a factor to all frequencies in the inlinee by passing this
    to the graph builders so that the importance of a call site in an
    inlinee is relative to the topmost optimized function.

    Note that all functions that neither have literals nor need type
    feedback slots will share a single invocation count cell in the
    canonical empty type feedback vector, so their invocation count is
    meaningless, but that doesn't matter since we only use the invocation
    count to relativize call counts within the function, which we only have
    if we have at least one type feedback vector (the CallIC slot).

    See the design document for additional details on this change:
    https://docs.google.com/document/d/1VoYBhpDhJC4VlqMXCKvae-8IGuheBGxy32EOgC2LnT8

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=v8:5267,v8:5372
LOG=N

Review-Url: https://codereview.chromium.org/2338413002
Cr-Commit-Position: refs/heads/master@{#39446}

Review-Url: https://codereview.chromium.org/2343813002
Cr-Commit-Position: refs/heads/master@{#39445}

The semantics of the {BailoutId} representing an OSR entry point is
different between the interpreter and the full code generator. These
semantics are hard-coded in various graph builders. We need to ensure
that the correct graph builder is chosen for OSR compilations.

R=rmcilroy@chromium.org
TEST=mjsunit/regress/regress-5380
BUG=v8:5380

Review-Url: https://codereview.chromium.org/2341663002
Cr-Commit-Position: refs/heads/master@{#39444}

Ignition requires that objects which will be inserted into the
constant pool are canonicalized (to enable off-thread bytecode
generation). We created a CanonicalizeHandleScope across parse/compile
however this impacts performance (~5-8% on CodeLoad).

Now we localize the CanonicalHandleScope to only the parse /
internalization and renumbering phases where objects are created which
could end up in the constant array pool. This seems to address
the performance regression.

BUG=v8:5203,chromium:634953

Review-Url: https://codereview.chromium.org/2318653002
Cr-Commit-Position: refs/heads/master@{#39443}

Revert of [heap] Decouple old generation allocation limit from external memory. (patchset #1 id:1 of https://codereview.chromium.org/2329993002/ )

Reason for revert:
Regressions in telemetry benchmarks:
crbug.com/646819.

Original issue's description:
> [heap] Decouple old generation allocation limit from external memory.
>
> We check for external memory limit in Heap::ReportExternalMemoryPressure.
>
> BUG=chromium:616434
>
> Committed: https://crrev.com/672d079ccba686019fa1457c83b42c2e692ef88b
> Cr-Commit-Position: refs/heads/master@{#39374}

TBR=hpayer@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=chromium:616434

Review-Url: https://codereview.chromium.org/2339033005
Cr-Commit-Position: refs/heads/master@{#39442}

When zeroing a floating point stack slot, store the zero register directly,
rather than storing zero moved to an FP register.

BUG=

Review-Url: https://codereview.chromium.org/2339943002
Cr-Commit-Position: refs/heads/master@{#39441}

R=titzer@chromium.org

BUG=chromium:647027

Review-Url: https://codereview.chromium.org/2344853002
Cr-Commit-Position: refs/heads/master@{#39440}

This is a first implementation of inlining into graphs that have been
created using the {BytecodeGraphBuilder}. Note that inlining sticks to
graphs of the same kind, we only ever inline AstGraph into AstGraph or
BytecodeGraph into BytecodeGraph, no mixed inlining.

R=bmeurer@chromium.org,rmcilroy@chromium.org
TEST=cctest/test-run-inlining
BUG=v8:5251

Review-Url: https://codereview.chromium.org/2262033003
Cr-Commit-Position: refs/heads/master@{#39439}

Migrate the platform DatePrototype_GetField (and all wrappers) to
TurboFan.

BUG=v8:5049

Review-Url: https://codereview.chromium.org/2263533002
Cr-Commit-Position: refs/heads/master@{#39438}

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2338263004
Cr-Commit-Position: refs/heads/master@{#39437}

Rolling v8/build to a34a5233778556481dfa869bff735fad2157f196

Rolling v8/third_party/WebKit/Source/platform/inspector_protocol to e240fdcdb5880deb48156dbb9ccee0c28664cf88

Rolling v8/third_party/instrumented_libraries to 45f5814b1543e41ea0be54c771e3840ea52cca4a

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2347533002
Cr-Commit-Position: refs/heads/master@{#39436}

This flag has been flipped off since 52, so it is due for removal.

R=adamk@chromium.org,caitp@igalia.com
BUG=v8:3785
CQ_INCLUDE_TRYBOTS=master.tryserver.v8:v8_linux_noi18n_rel_ng

Review-Url: https://codereview.chromium.org/2268633002
Cr-Commit-Position: refs/heads/master@{#39435}

    In case of duplicate exports, always report the error for the very last
    one.

(Fixed a bug.)

BUG=v8:5358,v8:1569

Review-Url: https://codereview.chromium.org/2340953002
Cr-Commit-Position: refs/heads/master@{#39434}

Handle the "synchronous case" by marking try/catch blocks introduced for
async functions as ASYNC_AWAIT and traversing up the stack, finding successive
Promises and returning caught if any of them are predicted to be caught.

BUG=v8:5167

Review-Url: https://codereview.chromium.org/2325813002
Cr-Commit-Position: refs/heads/master@{#39433}

Revert of [inspector] fixed all shorten-64-to-32 warnings (patchset #4 id:80001 of https://codereview.chromium.org/2332163002/ )

Reason for revert:
Blocking V8 roll: https://codereview.chromium.org/2347463002/

See https://build.chromium.org/p/tryserver.chromium.win/builders/win_chromium_rel_ng/builds/293368 for compile error.

Original issue's description:
> [inspector] fixed all shorten-64-to-32 warnings
>
> BUG=chromium:635948
> R=dgozman@chromium.org,alph@chromium.org
>
> Committed: https://crrev.com/3d10918d2e1c57d72531c55a956262f5a72fceaa
> Cr-Commit-Position: refs/heads/master@{#39426}

TBR=jochen@chromium.org,alph@chromium.org,dgozman@chromium.org,kozyatinskiy@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:635948

Review-Url: https://codereview.chromium.org/2339173004
Cr-Commit-Position: refs/heads/master@{#39432}

Revert of [inspector] removed ArrayLengthHelperFunction specialization for empty array (patchset #2 id:20001 of https://codereview.chromium.org/2340623002/ )

Reason for revert:
needed to revert https://codereview.chromium.org/2339173004/

Original issue's description:
> [inspector] removed ArrayLengthHelperFunction specialization for empty array
>
> There is no zero length array usage in inspector codebase. We can safely remove template specialization.
>
> BUG=chromium:635948
> R=dgozman@chromium.org,alph@chromium.org
>
> Committed: https://crrev.com/b249ffc1915d8c35ff66eae3d51d3878d588dfbf
> Cr-Commit-Position: refs/heads/master@{#39428}

TBR=jochen@chromium.org,alph@chromium.org,dgozman@chromium.org,kozyatinskiy@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:635948

Review-Url: https://codereview.chromium.org/2334163006
Cr-Commit-Position: refs/heads/master@{#39431}

Revert of [modules] Make duplicate export error deterministic. (patchset #2 id:20001 of https://codereview.chromium.org/2331003002/ )

Reason for revert:
Seems to break one of our arm64 bots: https://chromegw.corp.google.com/i/client.v8.ports/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20nosnap%20-%20debug/builds/2303

Original issue's description:
> [modules] Make duplicate export error deterministic.
>
> In case of duplicate exports, always report the error for the very last
> one.
>
> R=adamk@chromium.org
> BUG=v8:5358,v8:1569
>
> Committed: https://crrev.com/da1f911c4269048d24a3442791b18523455f3b24
> Cr-Commit-Position: refs/heads/master@{#39424}

TBR=adamk@chromium.org,neis@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5358,v8:1569

Review-Url: https://codereview.chromium.org/2340903002
Cr-Commit-Position: refs/heads/master@{#39430}

Similar to json-parser.

BUG=chromium:148757

Review-Url: https://codereview.chromium.org/2334353002
Cr-Commit-Position: refs/heads/master@{#39429}

There is no zero length array usage in inspector codebase. We can safely remove template specialization.

BUG=chromium:635948
R=dgozman@chromium.org,alph@chromium.org

Review-Url: https://codereview.chromium.org/2340623002
Cr-Commit-Position: refs/heads/master@{#39428}

BUG=chromium:646794
R=machenbach@chromium.org

Review-Url: https://codereview.chromium.org/2339933002
Cr-Commit-Position: refs/heads/master@{#39427}

BUG=chromium:635948
R=dgozman@chromium.org,alph@chromium.org

Review-Url: https://codereview.chromium.org/2332163002
Cr-Commit-Position: refs/heads/master@{#39426}

Port 3ccedd5d

R=mvstanton@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2330353005
Cr-Commit-Position: refs/heads/master@{#39425}

In case of duplicate exports, always report the error for the very last
one.

R=adamk@chromium.org
BUG=v8:5358,v8:1569

Review-Url: https://codereview.chromium.org/2331003002
Cr-Commit-Position: refs/heads/master@{#39424}

Review-Url: https://codereview.chromium.org/2337283002
Cr-Commit-Position: refs/heads/master@{#39423}

This exposes an interface for the embedder to provide a delegate which can
serialize or deserialize embedder-specific objects, like Blink's DOM wrappers.

BUG=chromium:148757

Review-Url: https://codereview.chromium.org/2327653002
Cr-Commit-Position: refs/heads/master@{#39422}

TEST=unittest WasmModuleVerifyTest.Global_invalid_type2
BUG=chromium:645443
R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2342593002
Cr-Commit-Position: refs/heads/master@{#39421}

Add a dedicated simplified operator to inline the general case for the
ToBoolean conversion. In a follow up CL we will also use the ToBoolean
hints gathered by the baseline compiler.

CQ_INCLUDE_TRYBOTS=master.tryserver.v8:v8_linux_arm64_gc_stress_dbg
R=jarin@chromium.org
BUG=v8:5267

Committed: https://crrev.com/8c50b51ab3d21efcd2f6900d83962159f21e1590
Review-Url: https://codereview.chromium.org/2167593002
Cr-Original-Commit-Position: refs/heads/master@{#37882}
Cr-Commit-Position: refs/heads/master@{#39420}

R=titzer@chromium.org
BUG=chromium:646258

Review-Url: https://codereview.chromium.org/2341673002
Cr-Commit-Position: refs/heads/master@{#39419}

BUG=

Review-Url: https://codereview.chromium.org/2342533002
Cr-Commit-Position: refs/heads/master@{#39418}

RegExpSubclassExecJS and RegExpExecJS only differed in the additional
TO_BOOLEAN on global and sticky flags and the useless (i < 0) check.

R=littledan@chromium.org
BUG=v8:5339

Review-Url: https://codereview.chromium.org/2337923002
Cr-Commit-Position: refs/heads/master@{#39417}

BUG=chromium:474921
NOTRY=true

Review-Url: https://codereview.chromium.org/2334003005
Cr-Commit-Position: refs/heads/master@{#39416}

Implementation MADD.S. MSUB.fmt, MADDF.fmt, MSUBF.fmt and corresponding
tests for assembler and disassembler.

TEST=cctest/test-assembler-mips[64], cctest/test-disasm-mips[64]
BUG=

Review-Url: https://codereview.chromium.org/2313623002
Cr-Commit-Position: refs/heads/master@{#39415}

This restores the original gyp behavior. Blocks:
https://codereview.chromium.org/2334003005

BUG=chromium:474921
NOTRY=true

Review-Url: https://codereview.chromium.org/2344493002
Cr-Commit-Position: refs/heads/master@{#39414}

This CL adds fuzzers for the wasm module sections 'types', 'names',
'globals', 'imports', 'function signatures', 'memory', and 'data', one
fuzzer per section. No fuzzers are added for the other sections because
either there already exists a fuzzer (e.g. wasm-code), or there exist
inter-section dependencies.

To avoid introducing a bunch executables which would make compilation
with make slow, I introduce a single executable
'v8_simple_wasm_section_fuzzer' which calls the fuzzers mentioned above.
This executable is run by the trybots and ensures that the fuzzers
actually compile. For debugging I introduce commandline parameters which
allow to execute the specific fuzzers from 'v8_simple_wasm_section_fuzzer'.

R=titzer@chromium.org, jochen@chromium.org, mstarzinger@chromium.org

Review-Url: https://codereview.chromium.org/2336603002
Cr-Commit-Position: refs/heads/master@{#39413}

This is required to be able to deserialize the scope chain from the
scope info alone.

BUG=v8:5215
R=marja@chromium.org,jgruber@chromium.org

Review-Url: https://codereview.chromium.org/2331323006
Cr-Commit-Position: refs/heads/master@{#39412}

The wasm-module-runner is used both in cctests and in fuzzers. As
discussed offline, it is weird to include cctest header files in
fuzzers, so I introduce a new test/common directory which contains the
common files.

R=titzer@chromium.org, jochen@chromium.org

Review-Url: https://codereview.chromium.org/2335193002
Cr-Commit-Position: refs/heads/master@{#39411}