BUG=chromium:673246
NOTRY=true
TBR=tandrii@chromium.org

Review-Url: https://codereview.chromium.org/2598323002
Cr-Commit-Position: refs/heads/master@{#41954}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/d14a3a7..bdc04ca

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2604693002
Cr-Commit-Position: refs/heads/master@{#41953}

Cr-Commit-Position: refs/heads/master@{#41952}

Revert of [heap] Report wrappers after processing the marking deque incrementally (patchset #5 id:80001 of https://codereview.chromium.org/2604583002/ )

Reason for revert:
Speculative revert. Might block the roll:
https://codereview.chromium.org/2606503002/

The gpu bots crash with this stack top:v88internal18IncrementalMarking25AdvanceIncrementalMarkingEdNS1_16CompletionActionENS1_21ForceCompletionActionENS0_10StepOrigin

Original issue's description:
> [heap] Report wrappers after processing the marking deque incrementally
>
> BUG=chromium:676700, chromium:468240
>
> Review-Url: https://codereview.chromium.org/2604583002
> Cr-Commit-Position: refs/heads/master@{#41946}
> Committed: https://chromium.googlesource.com/v8/v8/+/1344e3a9caba4206758623630e3c3dd6872879e7

TBR=hpayer@chromium.org,mlippautz@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:676700, chromium:468240

Review-Url: https://codereview.chromium.org/2604673002
Cr-Commit-Position: refs/heads/master@{#41951}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/69a30f6..d14a3a7

Rolling v8/test/test262/harness: https://chromium.googlesource.com/external/github.com/test262-utils/test262-harness-py/+log/cbd968f..0f2acdd

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/810f05a..1e8a2ca

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/68d808f..7018464

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2599293004
Cr-Commit-Position: refs/heads/master@{#41950}

TBR=adamk@chromium.org

Review-Url: https://codereview.chromium.org/2604483005
Cr-Commit-Position: refs/heads/master@{#41949}

Revert of Disable the CompilerDispatcher if we don't have idle time (patchset #1 id:1 of https://codereview.chromium.org/2600743002/ )

Reason for revert:
[Sheriff] Speculative revert since we got persistent timeouts on win32 debug:
https://build.chromium.org/p/client.v8/builders/V8%20Win32%20-%20debug/builds/6417

Please reland if it doesn't help.

Original issue's description:
> Disable the CompilerDispatcher if we don't have idle time
>
> Since we can't do all steps on background threads, we need idle time to
> work
>
> BUG=v8:5215
> R=danno@chromium.org
>
> Review-Url: https://codereview.chromium.org/2600743002
> Cr-Commit-Position: refs/heads/master@{#41944}
> Committed: https://chromium.googlesource.com/v8/v8/+/a0d9eb346bba90aa0b32a2d3184cbbfd6adb243e

TBR=danno@chromium.org,jochen@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5215

Review-Url: https://codereview.chromium.org/2600773002
Cr-Commit-Position: refs/heads/master@{#41948}

BUG=v8:5343

Review-Url: https://codereview.chromium.org/2604483002
Cr-Commit-Position: refs/heads/master@{#41947}

BUG=chromium:676700, chromium:468240

Review-Url: https://codereview.chromium.org/2604583002
Cr-Commit-Position: refs/heads/master@{#41946}

Fix issue created by patch https://codereview.chromium.org/2582993002/

CQ_INCLUDE_TRYBOTS=master.tryserver.v8:v8_linux_noi18n_rel_ng
TBR=yangguo@chromium.org
BUG=v8:4360

Review-Url: https://codereview.chromium.org/2599973002
Cr-Commit-Position: refs/heads/master@{#41945}

Since we can't do all steps on background threads, we need idle time to
work

BUG=v8:5215
R=danno@chromium.org

Review-Url: https://codereview.chromium.org/2600743002
Cr-Commit-Position: refs/heads/master@{#41944}

ECMA 402 v2 made Intl constructors more strict in terms of how they would
initialize objects, refusing to initialize objects which have already
been constructed. However, when Chrome tried to ship these semantics,
we ran into web compatibility issues.

This patch tries to square the circle and implement the simpler v2 object
semantics while including a compatibility workaround to allow objects to
sort of be initialized later, storing the real underlying Intl object
in a symbol-named property.

The new semantics are described in this PR against the ECMA 402 spec:
https://github.com/tc39/ecma402/pull/84

BUG=v8:4360, v8:4870
LOG=Y

Review-Url: https://codereview.chromium.org/2582993002
Cr-Commit-Position: refs/heads/master@{#41943}

BUG=v8:5756

Review-Url: https://codereview.chromium.org/2596843002
Cr-Commit-Position: refs/heads/master@{#41942}

Previously, the Intl implementation tracked types two ways:
 - In the intl_initialized_marker_symbol
 - In various named properties of the intl_impl_object_symbol value

As far as I can tell, these will never disagree with each other,
modulo bugs in Intl itself. This patch removes the second type
checking system.

BUG=v8:5751

Review-Url: https://codereview.chromium.org/2591203002
Cr-Commit-Position: refs/heads/master@{#41941}

1) Alternate between processing v8 and wrappers
2) Once v8 is empty, try 3 rounds of finding the fixpoint between v8 and wrappers
3) After that, finalize once v8 marking deque is empty again

Reland fixed: Toggle needs to be IncrementalMarking global as we need to properly
alternate tracing v8 and wrappers.

BUG=chromium:468240, chromium:668164

Review-Url: https://codereview.chromium.org/2599283002
Cr-Commit-Position: refs/heads/master@{#41940}

LoadFieldStub is the last Crankshaft/Hydrogen stub that stands in the way
of being able to run --ignition-staging --turbo without any Crankshaft support,
even for ICs/stubs.

Review-Url: https://codereview.chromium.org/2595343002
Cr-Commit-Position: refs/heads/master@{#41939}

Reland 0cf56232

The original patch got reverted because testing RegisterConfiguration was
overwritten by turbofan RegisterConfiguration. This caused some test cases not being
properly tested. The new patch uses correct RegisterConfiguration.

Original commit message:
Test InstructionSequenceTest has been initialized with a testing RegisterConfiguration
instance defined in instruction-sequence-unittest.h, whereas class ExplicitOperand which
is being tested used RegisterConfiguration from instruction.cc. In case these two
instances are different, the tests would fail. The issue is fixed by using the same
instance of RegisterConfiguration both for test code and code under test.

Additionally, the tests in register-allocator-unittest.cc use hardcoded values
for register and begin failing is the hardcoded register is not available for
allocation. Fix by forcing the use of allocatable registers only.

TEST=unittests.MoveOptimizerTest.RemovesRedundantExplicit,unittests.RegisterAllocatorTest.SpillPhi
BUG=

Review-Url: https://codereview.chromium.org/2595293002
Cr-Commit-Position: refs/heads/master@{#41938}

Now we run nested message loop with debugger context as current one.

BUG=chromium:676749
R=yangguo@chromium.org,dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2604553002
Cr-Commit-Position: refs/heads/master@{#41937}

Revert of Reland "[heap] Ensure progress when incrementally marking wrappers" (patchset #8 id:140001 of https://codereview.chromium.org/2591383004/ )

Reason for revert:
Breaks webkit-unit-tests. Investigating..

Original issue's description:
> Reland "[heap] Ensure progress when incrementally marking wrappers"
>
> 1) Alternate between processing v8 and wrappers
> 2) Once v8 is empty, try 3 rounds of finding the fixpoint between v8 and wrappers
> 3) After that, finalize once v8 marking deque is empty again
>
> BUG=
>
> Review-Url: https://codereview.chromium.org/2591383004
> Cr-Commit-Position: refs/heads/master@{#41932}
> Committed: https://chromium.googlesource.com/v8/v8/+/61a55548c50e01d84ed4aefa396324cbb4039b51

TBR=hpayer@chromium.org,ulan@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review-Url: https://codereview.chromium.org/2592393003
Cr-Commit-Position: refs/heads/master@{#41936}

Revert of [debugger] deprecate v8::Debug:GetDebugContext. (patchset #2 id:20001 of https://codereview.chromium.org/2589203002/ )

Reason for revert:
crbug/676749

Original issue's description:
> [debugger] deprecate v8::Debug:GetDebugContext.
>
> R=jgruber@chromium.org
> BUG=v8:5530
>
> Review-Url: https://codereview.chromium.org/2589203002
> Cr-Commit-Position: refs/heads/master@{#41911}
> Committed: https://chromium.googlesource.com/v8/v8/+/381082168d37d4f2794360ae31dc078f2a350113

TBR=jgruber@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=v8:5530, chromium:676749

Review-Url: https://codereview.chromium.org/2595413003
Cr-Commit-Position: refs/heads/master@{#41935}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/5c10e06..69a30f6

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/489a5bc..810f05a

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/f6f94f4..68d808f

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2594203005
Cr-Commit-Position: refs/heads/master@{#41934}

Improve the S390 allocate sequence by:
- Keeping allocation limit in memory, and leverage compare RX-instr.
- Prefetching subsequent cache lines from allocation top.
- Optimizing object tagging with LA
- Optimizing increment for Fast-Allocate with ASI/AGSI

R=jyan@ca.ibm.com, michael_dawson@ca.ibm.com, bjaideep@ca.ibm.com
BUG=

Review-Url: https://codereview.chromium.org/2601563002
Cr-Commit-Position: refs/heads/master@{#41933}

1) Alternate between processing v8 and wrappers
2) Once v8 is empty, try 3 rounds of finding the fixpoint between v8 and wrappers
3) After that, finalize once v8 marking deque is empty again

BUG=

Review-Url: https://codereview.chromium.org/2591383004
Cr-Commit-Position: refs/heads/master@{#41932}

Ignoring this linker warning will enable Chromium builds to start
treating all linker warnings as errors in Windows builds.

BUG=676417, 659007

Review-Url: https://codereview.chromium.org/2594013004
Cr-Commit-Position: refs/heads/master@{#41931}

BUG=v8:5343

Review-Url: https://codereview.chromium.org/2595423002
Cr-Commit-Position: refs/heads/master@{#41930}

These methods now return undefined upon finding a data property in the
prototype chain which shadows an accessor property, and when hitting
a Proxy, call the appropriate proxy traps.

R=cbruni@chromium.org, littledan@chromium.org
BUG=v8:5130

Review-Url: https://codereview.chromium.org/2592013003
Cr-Commit-Position: refs/heads/master@{#41929}

Revert of Turn on icu_case_mapping by default (patchset #4 id:60001 of https://codereview.chromium.org/2588963002/ )

Reason for revert:
Causes crashes on Canary: crbug.com/676643

Original issue's description:
> Turn on icu_case_mapping by default
>
> Update string-capitalize expected result because now it
> passes all the tests in the file.
> Mark fast/js/string-capitalization as failing with no_i18n.
>
> Relanding after revert because the failure was taken care of
> by Adam's CL at https://codereview.chromium.org/2597543002 .
>
>
> BUG=v8:4477, v8:4476
> TEST=test262/{built-ins,intl402}/Strings/*, webkit/fast/js/*,
>      mjsunit/string-case, intl/general/case*
>
> Cr-Original-Commit-Position: refs/heads/master@{#41834}
> Committed: https://chromium.googlesource.com/v8/v8/+/7c79e23c34ea971947eedc6e42d8a882617c0e47
> Review-Url: https://codereview.chromium.org/2588963002
> Cr-Commit-Position: refs/heads/master@{#41883}
> Committed: https://chromium.googlesource.com/v8/v8/+/a42c8c67dece5328896b13d37c5c846a2a0f5b0b

TBR=littledan@chromium.org,yangguo@chromium.org,jshin@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=v8:4477, v8:4476, chromium:676643

Review-Url: https://codereview.chromium.org/2601553002
Cr-Commit-Position: refs/heads/master@{#41928}

Similar to Crankshaft use the CallIC to continue gathering feedback for
uninitialized call sites instead of inserting a soft deopt.

R=mvstanton@chromium.org

Review-Url: https://codereview.chromium.org/2597173002
Cr-Commit-Position: refs/heads/master@{#41927}

BUG=

Review-Url: https://codereview.chromium.org/2600513002
Cr-Commit-Position: refs/heads/master@{#41926}

LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2589283002
Cr-Commit-Position: refs/heads/master@{#41925}

Revert of [heap] Ensure progress when incrementally marking wrappers (patchset #3 id:60001 of https://codereview.chromium.org/2592403002/ )

Reason for revert:
This won't work because the finalization still checks whether both marking deques are empty, also calling into blink. So we never proceed there.

Original issue's description:
> [heap] Ensure progress when incrementally marking wrappers
>
> The problem here is estimating the marking step size for wrapper tracing. If the
> steps are too small, we cannot keep up with the mutator creating new wrappers.
> The result is an endless stream of incremental marking steps, alternating v8 and
> wrappers tracing, without ever finalizing in a GC.
>
> The mitigation here is to abort finding the fix point after 10 incremental
> iterations.
>
> A proper solution would track newly created wrappers on the blink side during
> wrapper tracing. Will give this more thought after the holidays.
>
> BUG=chromium:668164, chromium:468240
>
> Review-Url: https://codereview.chromium.org/2592403002
> Cr-Commit-Position: refs/heads/master@{#41923}
> Committed: https://chromium.googlesource.com/v8/v8/+/a47417b89373c615f9256800cfc803d84ba58378

TBR=ulan@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:668164, chromium:468240

Review-Url: https://codereview.chromium.org/2602433002
Cr-Commit-Position: refs/heads/master@{#41924}

The problem here is estimating the marking step size for wrapper tracing. If the
steps are too small, we cannot keep up with the mutator creating new wrappers.
The result is an endless stream of incremental marking steps, alternating v8 and
wrappers tracing, without ever finalizing in a GC.

The mitigation here is to abort finding the fix point after 10 incremental
iterations.

A proper solution would track newly created wrappers on the blink side during
wrapper tracing. Will give this more thought after the holidays.

BUG=chromium:668164, chromium:468240

Review-Url: https://codereview.chromium.org/2592403002
Cr-Commit-Position: refs/heads/master@{#41923}

This divergence bug is very similar to the one fixed in https://codereview.chromium.org/2522253002/, this time it is an oscillation between a cleared field and a new phi node. The page http://www.sears.com/clothing-shoes-jewelry-clothing-men-s-clothing-men-s-jeans/b-1325287370?Brand=LEE&filterList=Brand&sortOption=UNITS_HIGH_TO_LOW allows for a reliable reproduction.

This fix makes sure that once a field that generated a phi gets cleared, it always stays cleared.

BUG=chromium:670202

R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2599793002
Cr-Commit-Position: refs/heads/master@{#41922}

In certain corner-cases we would grow a FAST_ELEMENTS packed backing store of a
JS_ARGUMENTS_TYPE object without converting to holey elements kinds. As a side
effect you could then read out the_hole.

BUG=v8:5772

Review-Url: https://codereview.chromium.org/2597013004
Cr-Commit-Position: refs/heads/master@{#41921}

This CL changes the displayed names of "Callbacks" and "Runtime" to "Blink C++"
and "V8 C++" respectively.

NOTRY=true

Review-Url: https://codereview.chromium.org/2598993002
Cr-Commit-Position: refs/heads/master@{#41920}

The last remaining JS user of this in promise.js has recently been moved
to TF. The underlying FastObjectStub is still in use.

BUG=

Review-Url: https://codereview.chromium.org/2598973002
Cr-Commit-Position: refs/heads/master@{#41919}

Revert of [turbofan] reenable escape analysis to further investigate crashes (patchset #1 id:1 of https://codereview.chromium.org/2589163002/ )

Reason for revert:
still crashing with the known issues

Original issue's description:
> [turbofan] reenable escape analysis to further investigate crashes
>
> R=jarin@chromium.org
>
> BUG=chromium:669242
>
> Review-Url: https://codereview.chromium.org/2589163002
> Cr-Commit-Position: refs/heads/master@{#41857}
> Committed: https://chromium.googlesource.com/v8/v8/+/fd4812323f8c90662be1d0961fbeaabe52565478

TBR=jarin@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=chromium:669242

Review-Url: https://codereview.chromium.org/2601463002
Cr-Commit-Position: refs/heads/master@{#41918}

Revert of [TypeFeedbackVector] Root literal arrays in function literals slots (patchset #11 id:370001 of https://codereview.chromium.org/2504153002/ )

Reason for revert:
Speculative revert because of blocked roll: https://codereview.chromium.org/2596013002/

Original issue's description:
> [TypeFeedbackVector] Root literal arrays in function literals slots
>
> Literal arrays and feedback vectors for a function can be garbage
> collected if we don't have a rooted closure for the function, which
> happens often. It's expensive to come back from this (recreating
> boilerplates and gathering feedback again), and the cost is
> disproportionate if the function was inlined into optimized code.
>
> To guard against losing these arrays when we need them, we'll now
> create literal arrays when creating the feedback vector for the outer
> closure, and root them strongly in that vector.
>
> BUG=v8:5456
>
> Review-Url: https://codereview.chromium.org/2504153002
> Cr-Commit-Position: refs/heads/master@{#41893}
> Committed: https://chromium.googlesource.com/v8/v8/+/93df094081f04c629c3df2e40318de90ce5e0fb9

TBR=bmeurer@chromium.org,mlippautz@chromium.org,mvstanton@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5456

Review-Url: https://codereview.chromium.org/2597163002
Cr-Commit-Position: refs/heads/master@{#41917}

Odd numbered floating-point register shouldn't be used as compare register
on mips32r6 architecture. In case cpu switches to FRE mode, writes to odd
numbered single-precision fp register will update upper part of even
double-precision register, which will corrupt the even register.

BUG=

Review-Url: https://codereview.chromium.org/2591063003
Cr-Commit-Position: refs/heads/master@{#41916}

Revert of [regexp] Remove IsRegExp intrinsic (patchset #1 id:1 of https://codereview.chromium.org/2591923003/ )

Reason for revert:
speculative revert: https://codereview.chromium.org/2596013002/

Original issue's description:
> [regexp] Remove IsRegExp intrinsic
>
> The two remaining uses of this intrinsic in debug.js and mirrors.js now
> simply rely on the runtime function.
>
> BUG=v8:5339
>
> Review-Url: https://codereview.chromium.org/2591923003
> Cr-Commit-Position: refs/heads/master@{#41892}
> Committed: https://chromium.googlesource.com/v8/v8/+/c9cb94a06fa7a863d24dd6760b66cecd55748abf

TBR=bmeurer@chromium.org,jgruber@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5339

Review-Url: https://codereview.chromium.org/2592383002
Cr-Commit-Position: refs/heads/master@{#41915}