Previously the Boyer-Moore-Horspool optimization gave up in the presence of a
submatch.  A submatch is where we record the current position so that we can go
back to it, which is an essential part of the semantics of lookarounds
(lookaheads and lookbehinds).  This has been the case since
Boyer-Moore-Horspool was implemented, but it was overly cautious.

* For positive lookahead it is OK to use the patterns inside the lookahead to
  guide the BMS optimization.
* For positive lookbehind we harmlessly fail to optimize when the patterns
  inside the lookbehind go backwards because TextNode::EatsAtLeast returns 0.
* For negative lookarounds, the NegativeLookaroundChoiceNode::FillInBMInfo method
  (in jsregexp.h) knows to only look at the following pattern.

This is in response to disappointing lookbehind performance in Atom.
See https://github.com/atom/find-and-replace/issues/571

R=yangguo@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2777583003
Cr-Commit-Position: refs/heads/master@{#44139}

Bug: v8:1569, v8:5401
Change-Id: I6a223d20eb9e7e299712955a36c7b95762780604
Reviewed-on: https://chromium-review.googlesource.com/459601Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44138}

In code generator, DEXTM instruction will be emitted for intervals
position=[0,31] and size=[33,64]. In simulator, mask for DEXTM will be
calculated on correct way for size = 64. Disassembler has now possibility
to disassemble instructions DEXTM and DEXTU.

TEST=cctest/test-run-machops/Regression6122
BUG=

Review-Url: https://codereview.chromium.org/2769403002
Cr-Commit-Position: refs/heads/master@{#44137}

The goal of this commit is to add the equivalent to gdbinit but
for lldb. I've tried to replicate the commands as close as possible
but I'm unsure about the jss command and hoping to get some feedback
on it in addition to the bta command which I'm not sure how/when this
could be used. This is probably just inexperience on my part.

The lldbinit file can be placed into a directory prefixed with dot
(.lldbinit) and the python script is currently expected to be in the
same directory. The path to the script can be changed manually if needed
as well.

NOTRY=true

Review-Url: https://codereview.chromium.org/2758373002
Cr-Commit-Position: refs/heads/master@{#44136}

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/2a8813f..5c4f541

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: I15666959387a117f3ece2881cee7b1328a827368
Reviewed-on: https://chromium-review.googlesource.com/458784Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44135}

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/bb15ced..0cfeabf

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: I37e9585d0d500d027f3c0112baa1a1f1798dc8be
Reviewed-on: https://chromium-review.googlesource.com/459144Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44134}

BUG=v8:6142

Change-Id: Ia9dff3814fa9d802d94f1769d0f4b5db709a96df
Reviewed-on: https://chromium-review.googlesource.com/459436
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44133}

- Implement %TypedArray%prototype.reverse in builtins and
  ElementsAccessor to use std::reverse
- Remove TypedArrayReverse in src/js/typedarray.js
- Fix typo in comments

BUG=v8:5929

Review-Url: https://codereview.chromium.org/2761453002
Cr-Commit-Position: refs/heads/master@{#44132}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/96aa45c..ad3a39a

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/5c300b0..bb15ced

Rolling v8/third_party/instrumented_libraries: https://chromium.googlesource.com/chromium/src/third_party/instrumented_libraries/+log/48dcb2c..61065eb

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: Icd74808073a5a1d5ba1b533e369d8968b104b2e9
Reviewed-on: https://chromium-review.googlesource.com/459178Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44131}

Besides adding accessors get_origin() and set_origin(), it creates easier test
accessors is_wasm() and is_asm_js().

This allows the possibility of caching boolean flags for is_wasm() and
is_asm_js() without having to change any code except for the files containing
the class definition for WasmModule.

BUG= v8:6152
R=bbudge@chromium.org,mtrofin@chromium.org

Review-Url: https://codereview.chromium.org/2771803005
Cr-Commit-Position: refs/heads/master@{#44130}

ToNumber for Oddball/String has no side-effect, no need to go
through %Typearray%.prototype.fill slow path.

BUG=v8:5929,chromium:702902

Review-Url: https://codereview.chromium.org/2769673002
Cr-Commit-Position: refs/heads/master@{#44129}

Methods on Object can be overriden by user, we should be prepared.

BUG=chromium:595206
R=dgozman@chromium.org,luoe@chromium.org,yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2772093002
Cr-Commit-Position: refs/heads/master@{#44128}

TBR=yangguo@chromium.org

Change-Id: Iaed993ed1a61003e35bb40d1f9e0d78864979b2c
Reviewed-on: https://chromium-review.googlesource.com/459443Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44127}

Currently, v8 uses the same flag to collect time for compiling wasm modules from js asm and wasm. This separates the v8 counter into two separate counters, and then uses the appropriate counter when compiling a module.

Note: This CL doesn't separate the corresponding Chromium counter. Rather that is intenionally being delayed until v8 code has separated all appropriate counters for js asm and wasm. That way, the installation into chrome can be done at once.

BUG=chromium:704922
R=bradnelson@chromium.org,bbudge@chromium.org

Review-Url: https://codereview.chromium.org/2778493002
Cr-Commit-Position: refs/heads/master@{#44126}

CQ_INCLUDE_TRYBOTS=master.tryserver.v8:v8_linux_noi18n_rel_ng

Change-Id: Iff5ff2e73d598ecae1be30a61856c1292f2fd6da
Reviewed-on: https://chromium-review.googlesource.com/456646
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44125}

Port 798ffc9d

R=jarin@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:6077
LOG=N

Review-Url: https://codereview.chromium.org/2774883003
Cr-Commit-Position: refs/heads/master@{#44124}

Require the use of MarkingState when going through ObjectMarking
and friends.

BUG=chromium:651354

Review-Url: https://codereview.chromium.org/2770253002
Cr-Commit-Position: refs/heads/master@{#44123}

Currently, v8 uses the same flag to collect time for instantiating wasm modules
from js asm and wasm. This separates the v8 counter into two separate counters,
and then uses the appropriate counter when instantiating a module.

BUG=chromium:704922
R=aseemgarg@chromium.org,bradnelson@chromium.org,bbudge@chromium.org

Review-Url: https://codereview.chromium.org/2772773004
Cr-Commit-Position: refs/heads/master@{#44122}

+ bonus: new version of get-properties.js test - good illustration of out progress in tests.

BUG=none
R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2774493002
Cr-Commit-Position: refs/heads/master@{#44121}

Only include function ranges for with non-0 counts or if the immediate outer function has non-0 count.

R=caseq@chromium.org, jgruber@chromium.org
BUG=v8:5808

Review-Url: https://codereview.chromium.org/2764073004
Cr-Original-Commit-Position: refs/heads/master@{#44079}
Committed: https://chromium.googlesource.com/v8/v8/+/a7577ede0b74967727895eba5e06dbe1d01fb56d
Review-Url: https://codereview.chromium.org/2764073004
Cr-Commit-Position: refs/heads/master@{#44120}

V8 side mechanism for overriding the wasm js APIs.

We will use these to:
- implement the Chrome-side constraints on module size, and throw with more
actionable error messages, while preserving layering.
The old mechansms will be deleted once we update the Chrome side with
this new mechanism.

- implement Chrome-side .compile and .instantiate overrides accepting
Response objects.

We may want to evolve this mechanism into something more general, not
requiring V8 preparation, by replacing the v8-definition with embedder
provided definitions. We're currently exploring if we can expand
"Extras", for instance.

BUG=

Review-Url: https://codereview.chromium.org/2773063002
Cr-Commit-Position: refs/heads/master@{#44119}

Bug: chromium:645890
TBR=yangguo@chromium.org

Change-Id: Idd884f71278643ce40352a63f436c9072c84c6fd
Reviewed-on: https://chromium-review.googlesource.com/459556Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44118}

- Renames kArmSimd128Load, kArmSimd128Store to kArmVld1S128,
  kArmVst1S128
- Handles the unaligned load/store cases.
LOG=N
BUG=v8:6020

Review-Url: https://codereview.chromium.org/2769083003
Cr-Commit-Position: refs/heads/master@{#44117}

This helper is used directly when constructing from an object with
a length, as well as by ConstructByIterable and ByTypedArray.

BUG=v8:5977

Change-Id: I18a4829c2a22a6099cf3b0824ea1f698bfbf1917
Reviewed-on: https://chromium-review.googlesource.com/456707Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Franziska Hinkelmann <franzih@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44116}

BUG=

Review-Url: https://codereview.chromium.org/2769973005
Cr-Commit-Position: refs/heads/master@{#44115}

The temp_instance is not used but had an enormous performance impact.
The instantiation time of the zengarden WebAssembly module improved now
from 12 seconds to less than a second.

R=clemensh@chromium.org
BUG=v8:6146

Change-Id: Ibac7809b3b6092032abd77ed94f639c09f62d816
Reviewed-on: https://chromium-review.googlesource.com/458918
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44114}

We should never check existing of the property by typeof obj.name check.

BUG=chromium:693338
R=dgozman@chromium.org,luoe@chromium.org

Review-Url: https://codereview.chromium.org/2767323002
Cr-Commit-Position: refs/heads/master@{#44113}

BUG=v8:5402
R=mstarzinger@chromium.org

Change-Id: I4220cd1d7907f9c353265aeab38ee53dcf6f56b6
Reviewed-on: https://chromium-review.googlesource.com/459541Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44112}

Currently BodyDescriptorBase::IterateBodyImpl does a run-time check
for obj->map()->HasFastPointerLayout(), which is redundant for all
non-JSObject heap objects.

BUG=chromium:694255

Review-Url: https://codereview.chromium.org/2774553003
Cr-Commit-Position: refs/heads/master@{#44111}

BUG=chromium:703226

Change-Id: Ic71ae018c0090b2142f1d732bcf9c94c65e81f83
Reviewed-on: https://chromium-review.googlesource.com/458917Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44110}

R=machenbach@chromium.org
BUG=v8:6127

Change-Id: I8681102a2eec42a55db8d98d2422faa69d4c193c
Reviewed-on: https://chromium-review.googlesource.com/459478Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44109}

[runtime] Immediately set the array-index hash in Uint32ToString and convert to string in ForInPrepare

This speeds up for/in over arrays. E.g.,:

function f(a) {
  for (let i in a) {
    if (a[i] != a[i]) print(false);
  }
}
var a = new Array(10000000);
a.fill(1);
f(a);

runs 3x faster after the change.

BUG=chromium:703226

Change-Id: Iabc5e931d985a03f89440cd702b2feb3eb9f5c18
Reviewed-on: https://chromium-review.googlesource.com/459538Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44108}

BUG=v8:6139

Review-Url: https://codereview.chromium.org/2771073003
Cr-Commit-Position: refs/heads/master@{#44107}

This reverts commit f20261bf.

Reason for revert: We need the GetMapConstructor instruction for CallApiCallbackStub

Original change's description:
> Remove ClassOf intrinsic from FCG and CS
> 
> I plan to change the constructor field of maps, and instead of patching
> the intrinsics all over the place, just fall back to the runtime.
> 
> R=​bmeurer@chromium.org
> BUG=v8:6084
> 
> Change-Id: Ie294b74ab615fd794d7fc47488e2e30e2b49b4db
> Reviewed-on: https://chromium-review.googlesource.com/454616
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Commit-Queue: Jochen Eisinger <jochen@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#43765}

TBR=jochen@chromium.org,bmeurer@chromium.org,adamk@chromium.org,hablich@chromium.org,v8-reviews@googlegroups.com,v8-mips-ports@googlegroups.com,v8-ppc-ports@googlegroups.com,v8-x87-ports@googlegroups.com
# Not skipping CQ checks because original CL landed > 1 day ago.
BUG=v8:6084

Change-Id: I06f60d409eccb4ad3abad14f5c9782bfe9122aea
Reviewed-on: https://chromium-review.googlesource.com/458379Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Commit-Queue: Jochen Eisinger <jochen@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44106}

BUG=v8:1956

Review-Url: https://codereview.chromium.org/2776433003
Cr-Commit-Position: refs/heads/master@{#44105}

Removes the AstString super-class and makes the two sub-classes stand-alone.
That also removes the slightly awkward implementation of a super-class with
dynamically dispatched behaviour, except it was manually implemented because
virtual function calls were considered expensive.

BUG=v8:6902

Change-Id: I079a2372557aa17ee839efcaddb9b7fe86e38b4d
Reviewed-on: https://chromium-review.googlesource.com/458428
Commit-Queue: Daniel Vogelheim <vogelheim@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44104}

This reverts commit 15898daf.

Reason for revert: Bunch of custom snapshot check failures:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/builds/11887
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20custom%20snapshot%20-%20debug/builds/13603

Original change's description:
> [asm.js] Switch test coverage to --fast-validate-asm.
> 
> R=​machenbach@chromium.org
> BUG=v8:6127
> 
> Change-Id: I65a6905e57ff47195503b37118c279d22f0baba0
> Reviewed-on: https://chromium-review.googlesource.com/459536
> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#44099}

TBR=bradnelson@chromium.org,machenbach@chromium.org,mstarzinger@chromium.org,v8-reviews@googlegroups.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:6127

Change-Id: Iecbd29d8ee31b49e553048c6f59670167cd22d9d
Reviewed-on: https://chromium-review.googlesource.com/459497Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44103}

BUG=v8:5402
R=mstarzinger@chromium.org

Change-Id: I4b22be4ec2b55a2aeb003b23b2528cef6df29138
Reviewed-on: https://chromium-review.googlesource.com/459616Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44102}

BUG=v8:5830

Review-Url: https://codereview.chromium.org/2761293002
Cr-Commit-Position: refs/heads/master@{#44101}

This reverts commit 00d3098d.

BUG=chromium:694255,v8:6138

Review-Url: https://codereview.chromium.org/2773093002
Cr-Commit-Position: refs/heads/master@{#44100}