Replaces the anchor page circular doubly linked list
with a doubly linked list pointing to nullptr on its ends.

Fixes a memory leak when rewinding pages.

The large pages list will move to the new list implementation
in a follow-up CL.

Change-Id: I2933a5e222d4ca768f4b555c47ed0d7a7027aa73
Reviewed-on: https://chromium-review.googlesource.com/1060973
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53288}

If it points to a new space object which doesn't get scavenged, we need to drop
the reference.

BUG=v8:7308, v8:7768

Change-Id: I4485a7abcac3a26781811cc9bf134fd80e5f35b5
Reviewed-on: https://chromium-review.googlesource.com/1069127
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53287}

R=machenbach@chromium.org

Bug: v8:7766
Change-Id: If96c5b278ef25f2b8729a4abc81defb598b444ee
Reviewed-on: https://chromium-review.googlesource.com/1066558Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53286}

Change-Id: I488b47a51ef79c97545576fcc7d58e9147deb664
Reviewed-on: https://chromium-review.googlesource.com/1067677Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53285}

This CL adds grammar support for function pointers to generic builtins.
It also instantiates generic specializations when they are only used
in an assignment to a function pointer.

Example:

builtin GenericBuiltinTest<T: type>(c: Context, param: T): Object {
  return Null;
}

let fnptr: builtin(Context, Smi) => Object = GenericBuiltinTest<Smi>;

Change-Id: Ib7e5f47ffc05f14eb5d0b789936587263dfb961d
Reviewed-on: https://chromium-review.googlesource.com/1068731
Commit-Queue: Simon Zünd <szuend@google.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53284}

This CL adds a benchmark where the array to sort undergoes
multiple element kind transitions before it is sorted.

R=jgruber@chromium.org

Bug: v8:7382
Change-Id: I5196a33139a5f3b833719c2a111dc9a521bdb37c
Reviewed-on: https://chromium-review.googlesource.com/1066012
Commit-Queue: Simon Zünd <szuend@google.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53283}

We already had to introduce TypeAlias to allow types to be const.
With TypeAlias, there is no need for types to be declarable themselves.

Change-Id: Ia718482f6c121b5316aca819368e6d048283e5e8
Reviewed-on: https://chromium-review.googlesource.com/1068734
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53282}

Bug: v8:7779
Change-Id: Iabe5b74900885d489309fdfe25674a29e8690965
Reviewed-on: https://chromium-review.googlesource.com/1068745
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53281}

The wrappers for imports are not accessible through the code() accessor,
so avoid tracing them for now.

BUG=chromium:844745
R=ahaas@chromium.org

Change-Id: I63fe447091ba3c202e3ffcfddfa645049a0b83cf
Reviewed-on: https://chromium-review.googlesource.com/1068739
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53280}

Bug: v8:7327
Change-Id: Ic1c4a10a251a8243fc337dc149eb057a29cace2b
Reviewed-on: https://chromium-review.googlesource.com/1065670
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53279}

This map is often quite small and holds small items (ints) so wastes
quite a bit of overhead in the backing tree representation.

This CL changes the std::map to a sorted vector of pairs. This reduces
the size significantly (2.13 MiB -> 598 KiB on the node server example).

Bug: v8:7719
Change-Id: Ic829693f007732ae145fae02850a1ed913cd941e
Reviewed-on: https://chromium-review.googlesource.com/1064233
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Alexei Filippov <alph@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53278}

R=titzer@chromium.org

Change-Id: Ifffa4ddb671ab337d75952515b6f5e55033bbd7d
Reviewed-on: https://chromium-review.googlesource.com/1068040Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53277}

This CL re-uses pipeline naming for --trace-turbo phase naming.

Bug: v8:7327
Change-Id: I87efb01170ed5d3add7a79c9f38542e9cba6c493
Reviewed-on: https://chromium-review.googlesource.com/1064237
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53276}

This migrates test configs for all remaining trybots.

All migrated builders are not on CQ, hence, they don't run regularly.
Therefore, some shard configs are too low by now and are also upgraded
in this CL to match their CI counterparts.

This also sets the --gc-stress flag for all tests on gc stress builders
explicitly, since the infra-side configuration (which sets it per
builder) will be deleted soon.

NOTRY=true

Bug: chromium:830557
Change-Id: Id8a9505fcd2c848ec659c7401cbbe9224feaf5d2
Reviewed-on: https://chromium-review.googlesource.com/1065674Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53275}

This is to allow testing object stats collection.

No-try: true
Bug: v8:7760
Change-Id: I1e5318f18bfb3799b90c0ee0aec6df87a794b32c
Reviewed-on: https://chromium-review.googlesource.com/1065478
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53274}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/d28bd70..b5df251

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/1d08c64..49edbd3

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/679372d..c893c7e

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: I37f185f145ee138d152758376da38fd12d322673
Reviewed-on: https://chromium-review.googlesource.com/1067992
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53273}

ToDirectStringAssembler::PointerToData returns a raw pointer, which
is invalidated when GC moves the original string and hence must not
be accessed after any allocations. This fixes the bug introduced in
b4ebbc57 / r53260.

Bug: chromium:845060
Tbr: jgruber@chromium.org
Change-Id: I248d0dd2a275bf9308269b3f65d00c4c4c3d4292
Reviewed-on: https://chromium-review.googlesource.com/1068213
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53272}

The ECMAScript ⊃ JSON proposal shipped in V8 v6.6 and Chrome 66.

Bug: v8:7418
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: Id8979d0cec6d61ef4a7e9982142a3f3dcf7c326b
Reviewed-on: https://chromium-review.googlesource.com/1067857Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Mathias Bynens <mathias@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53271}

The ECMAScript ⊃ JSON proposal doesn’t affect LineContinuation
grammar. These tests verify that the behavior remains the same when
the --harmony-subsume-json feature flag is enabled.

Bug: v8:7418
Change-Id: Iec5cb1bc112f278481ba1202f0c2b8693917843a
Reviewed-on: https://chromium-review.googlesource.com/1067463Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Mathias Bynens <mathias@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53270}

It seems that the output on snapshot failure has changed, so failed
snapshots were no longer being automatically re-run in gdb.

Change-Id: I321a6055b5683db31d215b9c30827f4badca3df7
Reviewed-on: https://chromium-review.googlesource.com/1066058Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53269}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/a071784..d28bd70

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/669dcb1..1d08c64

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: I270b86ba6f048eeaa8e77658c0b1a14b7fd1621a
Reviewed-on: https://chromium-review.googlesource.com/1067123Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53268}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/0676f76..a071784

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/78fd930..669dcb1

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/3f0591d..083eb25

Rolling v8/third_party/icu: https://chromium.googlesource.com/chromium/deps/icu/+log/b0e0b84..f61e46d

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/a67a084..679372d

Rolling v8/tools/swarming_client: https://chromium.googlesource.com/infra/luci/client-py/+log/8822987..833f5eb

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: I46b469b09b81ad3106ae4526d2996d2babec080a
Reviewed-on: https://chromium-review.googlesource.com/1066895Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53267}

R=gdeepti@chromium.org,bbudge@chromium.org,clemensh@chromium.org,titzer@chromium.org
BUG=v8:6020

Change-Id: I25676d4f8a7ea7b1e02a54abe009faec0eb2c6db
Reviewed-on: https://chromium-review.googlesource.com/1018840
Commit-Queue: Aseem Garg <aseemgarg@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53266}

Bug: v8:6600
Change-Id: I64ab212badf1b54d3e50466b74b30eb2866fbc9e
Reviewed-on: https://chromium-review.googlesource.com/1060345Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Vincent Belliard <vincent.belliard@arm.com>
Cr-Commit-Position: refs/heads/master@{#53265}

This is not web compatible, so let's delete the code.

Bug: v8:5536
Change-Id: I50506d37dcdff1f7f95577c47adcec653cc1f06e
Reviewed-on: https://chromium-review.googlesource.com/1064740
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53264}

For AArch64, clean correctly the pools when the compilation is aborted

Bug: v8:6600
Change-Id: I4bacdbeae49290ece0ce1bf47319bf7076fec37c
Reviewed-on: https://chromium-review.googlesource.com/1066151
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53263}

This requires changing the way stubs and builtins are encoded in tags, as for
arm64 we only have 26 bits to encode a PC-relative offset. With the previous
encoding scheme the builtin ids were shifted by 16 bits and ended up exceeding
this range.

Change-Id: I0f396390a622ea67b890d2dd47ca12e00092e204
Reviewed-on: https://chromium-review.googlesource.com/1059209
Commit-Queue: Georgia Kouveli <georgia.kouveli@arm.com>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53262}

Command-line flags can be parsed in two modes. In the mode used by
Chrome, an unrecognized flag causes the remaining arguments to be
ignored. This is different from how d8 parses flags.

Example:

1) d8 --enable-slow-asserts --trace-ic
2) content_shell --js-flags='--enable-slow-asserts --trace-ic'

Assuming we compiled without ENABLE_SLOW_DCHECKS, in (1) we get a
warning that --enable-slow-asserts is unknown. Nevertheless,
--trace-ic will be enabled. In (2), we get an error that
--enable-slow-asserts is unknown but --trace-ic will NOT be enabled
(and neither does content_shell abort).

This inconsistency is obviously very confusing. With this CL, we
will at least print any flags that got ignored.

Change-Id: I22bdb06d2b0accc234b3f5d596458809de364bce
Reviewed-on: https://chromium-review.googlesource.com/1066010
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53261}

Optimize String.p.split for the case when the separator is empty and
the subject is a direct one-byte string.

Bug: v8:7103
Change-Id: Ica277d2c426679a1f77a1ef8ecb523bd596f65fb
Reviewed-on: https://chromium-review.googlesource.com/1045950
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53260}

Shortcuts e and c select (and make visible) the next effect/control
node downwards in the chain; ALT+e/c moves upward.

Additionally, the graph bounding box is redetermined every time the
graph is redrawn (instead of only when relayouted).

Bug: v8:7327
Change-Id: If01b16fc25273703e25e429bdc36753a2fa87f7c
Reviewed-on: https://chromium-review.googlesource.com/1064210
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53259}

This also includes the precise reducer name. Currently the information
is available in the node tooltip in turbolizer. The new shortcut 's' in
the graph view selects the nodes the currently selected nodes were created
from.

Bug: v8:7327
Change-Id: I7ca7327d0cfa112972e3567df6e4a223c8eff3c0
Reviewed-on: https://chromium-review.googlesource.com/1064059
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53258}

R=sigurds@chromium.org

Change-Id: Ieb73e6b573f2721e62b1c2bc216c26f8b9d38837
Reviewed-on: https://chromium-review.googlesource.com/1065970Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53257}

When processing imports of an instance, we were storing pointers to
exported (and re-imported) wasm functions in the code table of the
importing module. This is dangerous since imports are instance specific.
Avoid ever storing call targets for imports in the NativeModule.
Instead, read the call targets from the imports table of the instance.

R=mstarzinger@chromium.org

Bug: chromium:843563

Change-Id: Id9f43a6c127025a5feaa81b2be75c001bc0bea81
Reviewed-on: https://chromium-review.googlesource.com/1065774
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53256}

Change-Id: Ie52c6793736f38d1ab1f323b856f36587c46e7f9
Reviewed-on: https://chromium-review.googlesource.com/1059773Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#53255}

The js-to-wasm wrappers are shared across instances, so we cannot
directly call the instance-specific wasm-to-js wrappers. Instead, we
need to call via the import table.

R=titzer@chromium.org

Bug: chromium:843563
Change-Id: Ia882604f6769472fe2eb69176cbed728215ced29
Reviewed-on: https://chromium-review.googlesource.com/1064610Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53254}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/03f39fd..0676f76

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/buildtools/+log/e754647..94288c2

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/d8600cc..78fd930

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/8de3800..ed1bb34

Rolling v8/third_party/googletest/src: https://chromium.googlesource.com/external/github.com/google/googletest/+log/045e7f9..08d5b1f

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: I2d370b3e6c8601d104e7a34d6a68d489092fa2db
Reviewed-on: https://chromium-review.googlesource.com/1062816Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53253}

Fixes known issue that specialization doesn't rigorously checked to
verify that specialization signature precisely matches generic
declaration.

Change-Id: I884f7f16a467ab716d2b0c553485f4b1c55ed806
Reviewed-on: https://chromium-review.googlesource.com/1063613Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Daniel Clifford <danno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53252}

ICU 61.1 was released in late March with CLDR 33.
Arabic number format change in CLDR 33 requires
a small adjustment in the test result.

See https://chromium-review.googlesource.com/c/chromium/deps/icu/+/1041578
for details on ICU 61.1.

NOTREECHECKS=true


Bug: chromium:838383, chromium:843073
Test: test262/intl402/*, intl/*
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: I3778423b7dc67891767c95ea503e003013ae5b69
Reviewed-on: https://chromium-review.googlesource.com/1038230
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53251}

Drive-by: Fix some accessor definitions.

R=mstarzinger@chromium.org

Change-Id: I2457ac76c376d1e6ffcc19255e669cc7a9732883
Reviewed-on: https://chromium-review.googlesource.com/1063972Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53250}

Bug: v8:6949, v8:7754, chromium:844200
Change-Id: I0d0d0d7931ac2d560c219ab22ff3df93007f6dad
Reviewed-on: https://chromium-review.googlesource.com/1065876Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53249}