The inlined version of Array.prototype.push returned the value that was
pushed instead of the new "length" property value.

R=jarin@chromium.org
BUG=chromium:656037

Review-Url: https://codereview.chromium.org/2425903002
Cr-Commit-Position: refs/heads/master@{#40384}

BUG=v8:5501

Review-Url: https://codereview.chromium.org/2424013002
Cr-Commit-Position: refs/heads/master@{#40383}

Switch off maybe-uninitialized warning as it gives often
false positives with optimizations in gcc.

NOTRY=true
TBR=bmeurer@chromium.org, zhengxing.li@intel.com, caitp@igalia.com, ahaas@chromium.org

Review-Url: https://codereview.chromium.org/2425913002
Cr-Commit-Position: refs/heads/master@{#40382}

This CL adds two new fast-paths for RegExp.prototype.replace in the case
that the regexp itself is an unmodified JSRegExp instance and the
replace argument is callable. Such cases call directly into runtime.

This could be improved even further by turning the relevant runtime
functions into inline TurboFan.

BUG=v8:5339

Review-Url: https://codereview.chromium.org/2415663007
Cr-Commit-Position: refs/heads/master@{#40381}

BUG=chromium:635948

Review-Url: https://codereview.chromium.org/2395763002
Cr-Commit-Position: refs/heads/master@{#40380}

In the process:
- Add ToString to the CodeStubAssembler and use it where appropriate
- Add constant-folding versions of IntPtrAdd/IntPtrSub to simplify code
  in element offset computation, especially for strings.

BUG=chromium:608675
LOG=N

Review-Url: https://codereview.chromium.org/2407813002
Cr-Commit-Position: refs/heads/master@{#40379}

EffectPhis can cause a cycle in a TurboFan graph. We delay the
processing of EffectPhis in the Int64Lowering to break these cycles. We
do the same already for Phis.

R=titzer@chromium.org
BUG=v8:5518
TEST=unittests/Int64LoweringTest.EffectPhiLoop

Review-Url: https://codereview.chromium.org/2428583002
Cr-Commit-Position: refs/heads/master@{#40378}

This slot is completely unused and always undefined anyways, so there's
no need to maintain the slot during object construction.

R=yangguo@chromium.org
BUG=v8:5049

Review-Url: https://codereview.chromium.org/2423323002
Cr-Commit-Position: refs/heads/master@{#40377}

BUG=

Review-Url: https://codereview.chromium.org/2420373002
Cr-Commit-Position: refs/heads/master@{#40376}

  movzxbl/movsxbl/movzxwl/movsxwl operations implicitly zero-extend to 64-bit on x64, So It's not necessary to generate a "movl" instruction to zero-extend.

  For example, movzxbl/movl instruction sequence occurs frequently in v8 interpreter bytecode handler.
  such as:
  kind = BYTECODE_HANDLER
  name = LdaSmi
  compiler = turbofan
  Instructions (size = 76)
  0x184870a3ce40 0 430fbe442601 movsxbl rax,[r14+r12*1+0x1]
  0x184870a3ce46 6 48c1e020 REX.W shlq rax, 32
  0x184870a3ce4a 10 498d5c2402 REX.W leaq rbx,[r12+0x2]
  0x184870a3ce4f 15 420fb61433 movzxbl rdx,[rbx+r14*1]
  0x184870a3ce54 20 8bd2 movl rdx,rdx          <---------------------- here is a redundant "movl"
  0x184870a3ce56 22 4883fa1e REX.W cmpq rdx,0x1e
  0x184870a3ce5a 26 0f8518000000 jnz 56 (0x184870a3ce78)

  This CL also referenced to CL #36038 (https://codereview.chromium.org/1950013003 ) for adding test cases.

BUG=

Review-Url: https://codereview.chromium.org/2427483002
Cr-Commit-Position: refs/heads/master@{#40375}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/5e4af51..eb8eb7a

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapul/+log/6087117..9a96d45

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clan/+log/6ba3d23..75350a8

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2424693004
Cr-Commit-Position: refs/heads/master@{#40374}

Implements the variations of CreateArrayIterator() in TFJ builtins
(ArrayPrototypeValues, ArrayPrototypeEntries and ArrayPrototypeKeys), and
provides two new Object types with numerous maps which identify certain
behaviours, which will be useful for inlining.

Removes src/js/array-iterator.js entirely

Also adds support for printing Symbol literals inserted by the Parser during
desugaring when FLAG_print_builtin_ast is set to true.

BUG=v8:5388
R=bmeurer@chromium.org, cbruni@chromium.org
TBR=ulan@chromium.org

Review-Url: https://codereview.chromium.org/2405253006
Cr-Commit-Position: refs/heads/master@{#40373}

R=cbruni@chromium.org
BUG=v8:705

Review-Url: https://codereview.chromium.org/2405003002
Cr-Commit-Position: refs/heads/master@{#40372}

fragmentation_limit_kb has type of size_t, using PRIuS instead of V8PRIdPTR.

R=mlippautz@chromium.org, ulan@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2425013002
Cr-Commit-Position: refs/heads/master@{#40371}

Prepared by:
https://codereview.chromium.org/2423083002/

BUG=chromium:656573
NOTRY=true
TBR=tandrii@chromium.org

Review-Url: https://codereview.chromium.org/2427603002
Cr-Commit-Position: refs/heads/master@{#40370}

BUG=v8:5343

Review-Url: https://codereview.chromium.org/2415023002
Cr-Commit-Position: refs/heads/master@{#40369}

BUG=v8:5526

Review-Url: https://codereview.chromium.org/2422173003
Cr-Commit-Position: refs/heads/master@{#40368}

BUG=

Review-Url: https://codereview.chromium.org/2425723002
Cr-Commit-Position: refs/heads/master@{#40367}

BUG=v8:5209

Review-Url: https://codereview.chromium.org/2428533002
Cr-Commit-Position: refs/heads/master@{#40366}

Using a global proxy (e.g. 'window.f', 'w.f' or 'this.f') is considerably slower than evaluating just 'f'. This CL aims to perform the necessary checks at compile time and inline the accesses.

This is a follow-on CL to crrev.com/2369933005:
- The initial upload is crrev.com/2369933005 + a rebase.
- The remaining issues are the fixes requested by the reviewers on that CL.

BUG=chromium:634276, chromium:654716

Committed: https://crrev.com/8f43d748272536117008aa6a1b53ea52126261c1
Review-Url: https://codereview.chromium.org/2403003002
Cr-Original-Commit-Position: refs/heads/master@{#40153}
Cr-Commit-Position: refs/heads/master@{#40365}

This makes the character escaping in the graph visualizer less generic
but correct against the JSON spec. The spec has the following definition
for valid characters within a double quoted string:

char ::
  any-Unicode-character-except-"-or-\-or-control-character
  \"
  \\
  \/
  \b
  \f
  \n
  \r
  \t
  \u four-hex-digits

R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2421313002
Cr-Commit-Position: refs/heads/master@{#40364}

We don't have an Isolate, so we cannot use it for retrieving data or
calling the embedder's OOM handler. So just crash.

BUG=5525

Review-Url: https://codereview.chromium.org/2427623002
Cr-Commit-Position: refs/heads/master@{#40363}

Revert of [debug] Consistently use script from FrameMirror (patchset #3 id:40001 of https://codereview.chromium.org/2415073003/ )

Reason for revert:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/10706

https://github.com/v8/v8/wiki/Blink-layout-tests

Original issue's description:
> [debug] Consistently use script from FrameMirror
>
> ... instead of getting it from the FunctionMirror. For WASM frames
> (including asm.js -> WASM), the function is either unresolved or does
> not contain the script.
>
> The added test case failed before this CL.
>
> R=kozyatinskiy@chromium.org, yangguo@chromium.org, titzer@chromium.org
> BUG=v8:4203
>
> Committed: https://crrev.com/ce32e2ffd835062d764f3c0ee6a32543417cb615
> Cr-Commit-Position: refs/heads/master@{#40348}

TBR=kozyatinskiy@chromium.org,yangguo@chromium.org,titzer@chromium.org,clemensh@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4203

Review-Url: https://codereview.chromium.org/2427633002
Cr-Commit-Position: refs/heads/master@{#40362}

This adds more useful information to the v8-heap-stats tool.

BUG=v8:5489

Review-Url: https://codereview.chromium.org/2394213003
Cr-Commit-Position: refs/heads/master@{#40361}

R=mstarzinger@chromium.org

Review-Url: https://codereview.chromium.org/2427583002
Cr-Commit-Position: refs/heads/master@{#40360}

Adds a boolean flag to the liveness analysis which makes it also analyze
the accumulator. This can help prevent the accumulator escaping loops,
as well as decreasing the number of distinct state values nodes in the
graph.

The flag is a kind of ugly way to hack this in, however it is probably
the simplest to add, and (more importantly) to remove once the AST graph
builder is gone.

I measure a 2.6% improvement on Mandreel on my x64 machine, and a ~2%
improvement on Navier-Stokes. Other improvements are expected.

Review-Url: https://codereview.chromium.org/2428503002
Cr-Commit-Position: refs/heads/master@{#40359}

BUG=

Review-Url: https://codereview.chromium.org/2428473002
Cr-Commit-Position: refs/heads/master@{#40358}

R=ahaas@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2414053002
Cr-Commit-Position: refs/heads/master@{#40357}

BUG=v8:5209

Review-Url: https://codereview.chromium.org/2424693003
Cr-Commit-Position: refs/heads/master@{#40356}

BUG=chromium:645378

Review-Url: https://codereview.chromium.org/2422143002
Cr-Commit-Position: refs/heads/master@{#40355}

RIP, handwritten KeyedLoadICStub, handwritten KeyedLoadIC_Megamorphic,
and hydrogenized KeyedLoadGeneric!

Review-Url: https://codereview.chromium.org/2424433002
Cr-Commit-Position: refs/heads/master@{#40354}

This removes the {ParseInfo} constructor consuming a closure, replacing
all uses to pass only the shared function info. The goal is to make the
fact that parsing is independent of a concrete closure explicit.

R=jochen@chromium.org
BUG=v8:2206

Committed: https://crrev.com/3de42b3f224217ec88e4c609d3cf23fe06806dca
Review-Url: https://codereview.chromium.org/2396963003
Cr-Original-Commit-Position: refs/heads/master@{#40083}
Cr-Commit-Position: refs/heads/master@{#40353}

Apply the same strength reduction to the ChangeTaggedSignedToInt32
operator that we already have for ChangeTaggedToInt32.

R=epertoso@chromium.org

Review-Url: https://codereview.chromium.org/2428493002
Cr-Commit-Position: refs/heads/master@{#40352}

Once the escape analysis ran, it'll be harder to eliminate a bunch of
checks (for example map checks, which would currently block escape
analysis, but that's about to be fixed). Also the escape analysis will
have a lot less stress after the load elimination, which takes care of
redundant loads and checks already.

R=mstarzinger@chromium.org
BUG=v8:5448

Review-Url: https://codereview.chromium.org/2427533002
Cr-Commit-Position: refs/heads/master@{#40351}

R=machenbach@chromium.org,titzer@chromium.org,bmeurer@chromium.org,jgruber@chromium.org
BUG=
CQ_INCLUDE_TRYBOTS=master.tryserver.v8:v8_win_dbg,v8_mac_dbg;master.tryserver.chromium.android:android_arm64_dbg_recipe

Review-Url: https://codereview.chromium.org/2416243002
Cr-Commit-Position: refs/heads/master@{#40350}

BUG=

Review-Url: https://codereview.chromium.org/2425633002
Cr-Commit-Position: refs/heads/master@{#40349}

... instead of getting it from the FunctionMirror. For WASM frames
(including asm.js -> WASM), the function is either unresolved or does
not contain the script.

The added test case failed before this CL.

R=kozyatinskiy@chromium.org, yangguo@chromium.org, titzer@chromium.org
BUG=v8:4203

Review-Url: https://codereview.chromium.org/2415073003
Cr-Commit-Position: refs/heads/master@{#40348}

1) assertInstanceOf(o, Foo, Bar) used to produce this error message:

Failure: expected <o> is not an instance of <Foo> but of < Bar>> found <undefined>

Fixed:

Failure: <o> is not an instance of <Foo> but of <Bar>

2) assertDoesNotThrow("throw 1") used to produce this error message:

Failure: expected <threw an exception: > found <1>

Fixed:

Failure: threw an exception: 1

3) assertDoesNotThrow("...", SomeError) was not doing what you'd
think it does, so removed the last parameter.

BUG=

Review-Url: https://codereview.chromium.org/2424743003
Cr-Commit-Position: refs/heads/master@{#40347}

[wasm] Add a Managed<T> wrapper class for allocating C++ classes that are deleted when the wrapper is garbage collected.

Use sparingly!

This doesn't add any really new functionality, other than making it more
convenient to do this.

This will primarily be used to wrap a WasmModule to be referenced from a
JSObject that represents an instance. There is one WasmModule C++ object
per parsed WasmModule, so this should not be more than a handful or a few
dozen in well-behaved programs.

R=rossberg@chromium.org,mlippautz@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2409173005
Cr-Commit-Position: refs/heads/master@{#40346}

This is a fix for a regression that started ~6 months ago when
https://codereview.chromium.org/1757013002 landed. This patch will remove the
unnecessary Change/CallWithDescriptor/Change opcodes causing the regression.

BUG=v8:5373
R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2423923002
Cr-Commit-Position: refs/heads/master@{#40345}