This adds support to specify the maximum memory size when building a
WebAssembly module. Default is not maximum, one can be explicitly set.
It is mainly used by the WebAssembly fuzzers to prevent OOMs.

R=ahaas@chromium.org
BUG=chromium:759973

Change-Id: Ibf5fa63a7e36e5f3b65ced528c73a65355d5632f
Reviewed-on: https://chromium-review.googlesource.com/640386Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47676}

Bug: v8:5267
Change-Id: Ib93b4e5110061a0dcae0a6879f5d0e878cf1bf3f
Reviewed-on: https://chromium-review.googlesource.com/640704
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47675}

This CL introduces 4 test that verify that the effects of a grow_memory
instruction executed in a function invoked inside a loop are visible
also when the loop is over. This is needed because the
AnalyzeLoopAssignment method in function-body-decoder.cc is creating Phi
nodes only for variables assigned inside the loop. The test cases
introduced by this CL verify that the mem_size and mem_start variables
are always correct.

The tests verify the output of the current_memory instruction and the
result of loading a variable stored in the grown memory inside the
loop in the following cases:

 * the memory is grown in a directly called function inside a loop;

 * the memory is grown in an indirectly called function inside a loop.

R=ahaas@chromium.org,clemensh@chromium.org,gdeepti@chromium.org

Change-Id: I2992bf4086b5eac9580c87e2e0ca06364b99714c
Reviewed-on: https://chromium-review.googlesource.com/637911Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Enrico Bacis <enricobacis@google.com>
Cr-Commit-Position: refs/heads/master@{#47674}

We reset profiler ticks when the feedback changes so that we could tier
up functions with more stable feedback. We missed resetting these ticks
for call / construct bytecodes. This cl fixes it.

Bug: 
Change-Id: Ia912dfee0495c776d9fc517a887a2fdd999773ab
Reviewed-on: https://chromium-review.googlesource.com/635846Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47673}

This reverts commit 6b4dc039.

Reason for revert: Mips build failure: https://build.chromium.org/p/client.v8.ports/builders/V8%20Mips%20-%20builder/builds/11749

Original change's description:
> [wasm] Refactor function body decoder
> 
> This refactoring separates graph building from wasm decoding. The
> WasmGraphBuilder is just a consumer of the decoded information.
> Decoding without any consumer (i.e. just validation) gets 16% faster by
> this refactoring, because no TFNode* have to be stored in the value
> stack, and all dynamic tests to determine whether the graph should be
> build are gone (measured on AngryBots; before: 110.2 +- 3.3ms, after:
> 92.2 +- 3.1 ms).
> 
> This new design will allow us to also attach other consumers, e.g. a
> new baseline compiler.
> 
> R=​titzer@chromium.org
> 
> Bug: v8:6600
> Change-Id: I4b60f2409d871a16c3c52a37e515bcfb9dbb8f54
> Reviewed-on: https://chromium-review.googlesource.com/571010
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Reviewed-by: Ben Titzer <titzer@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#47671}

TBR=titzer@chromium.org,clemensh@chromium.org

Change-Id: I76a50e355f0390cc53a2da4ceedd8830ca20a9c6
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6600
Reviewed-on: https://chromium-review.googlesource.com/640870Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47672}

This refactoring separates graph building from wasm decoding. The
WasmGraphBuilder is just a consumer of the decoded information.
Decoding without any consumer (i.e. just validation) gets 16% faster by
this refactoring, because no TFNode* have to be stored in the value
stack, and all dynamic tests to determine whether the graph should be
build are gone (measured on AngryBots; before: 110.2 +- 3.3ms, after:
92.2 +- 3.1 ms).

This new design will allow us to also attach other consumers, e.g. a
new baseline compiler.

R=titzer@chromium.org

Bug: v8:6600
Change-Id: I4b60f2409d871a16c3c52a37e515bcfb9dbb8f54
Reviewed-on: https://chromium-review.googlesource.com/571010
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47671}

Bug: v8:5267
Change-Id: Ib103fbc3cabaac191dde817724308b19361c443b
Reviewed-on: https://chromium-review.googlesource.com/640385Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47670}

Bug: chromium:758983
Change-Id: Iea65c6c6330b4eed0969eee1f8b261e1446771f5
Reviewed-on: https://chromium-review.googlesource.com/640382
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47669}

This removes overflow check in addition when we have Smi or
Int32 feedback for the addition, and the result is truncated
to word32. Here is an example, assuming that we passed only
integers to this function so far.

function f(a) { return a + 1 | 0; }

If the result of the addition is word32-truncated, there is no need
for an overflow check.

Until now, we would only eliminate the overflow check
if we knew that the static types of the inputs guaranteed that
the result is in safe integer range. With this CL, we use the
checked type from the feedback, too (but we do not propagate the
truncation!).

Bug: v8:5267,v8:6764
Change-Id: Ia2f929600758f58e6e7db52fef638a0e56c936a9
Reviewed-on: https://chromium-review.googlesource.com/635083
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47668}

R=titzer@chromium.org

Change-Id: I637cbafc99caf1ada1d92d41f7796cf5551bc532
Reviewed-on: https://chromium-review.googlesource.com/588895
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47667}

Make sure there is a matching Leave for each Enter. Otherwise it ends up
with a dead stack-allocated object in the timer chain.

The patch incorporates the following fixes:
- RuntimeCallTimerScope::RuntimeCallTimerScope(HeapObject* ...) did create a
  local object instead of calling an overloaded constructor.
- InterpreterCompilationJob::ExecuteJobImpl made an implicit call to a default
  copy constructor of TimerScope which led to a single Enter was made per two
  Leaves.
- InterpreterCompilationJob::FinalizeJobImpl was calling RuntimeCallTimerScope
  from a background thread, which caused timer scopes become unbalanced.
- RuntimeCallTimerScope constructors were put into counters-inl.h which is not
  included into most usages of RCS. That led to a suboptimal performance.
- Added thread check into Enter and Leave

BUG=chromium:669329

Change-Id: Ib5cff0e02e0b6c8b56a03ca3a5ebc37d93fcde55
Reviewed-on: https://chromium-review.googlesource.com/637307Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Alexei Filippov <alph@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47666}

When we use a WasmCompiledModule for a second instance (i.e. the first
instance has been collected already by the GC), we reset all instance
specialization data the WasmCompiledModule contains, and then patch in
the new instance specialization data. However, we guarded the reset of
memory references, and in the referenced issue the memory references
were not reset and therefore later patched incorrectly during
instantiation. With this CL we change the condition and reset now every
time the current version of a WasmCompiledModule contains non-default
values.

R=mtrofin@chromium.org
CC=​mstarzinger@chromium.org
TEST=mjsunit/regress/regress-crbug-759327

Bug: chromium:759327
Change-Id: I9a147afd6ad4000b782850dae0b90685759c9dc7
Reviewed-on: https://chromium-review.googlesource.com/638571
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47665}

This won't affect the real release but will give more clusterfuzz + test
coverage on V8 side.

BUG=v8:5516

Change-Id: I6ed29b1a1b23b5bf1ce9a9a9dfe741c53312ee54
Reviewed-on: https://chromium-review.googlesource.com/640373Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47664}

Bug: v8:6333
Change-Id: I6292bc6b31c696dddd3e3361a519e7275404b144
Reviewed-on: https://chromium-review.googlesource.com/631879Reviewed-by: Ben Titzer <titzer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47663}

Change-Id: I6e61dd1e4173432d38cc546a102f6843021866c2
Reviewed-on: https://chromium-review.googlesource.com/640374Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47662}

This reverts commit de839c56.

Reason for revert: Breaks chromium compilation, e.g.:
https://build.chromium.org/p/client.v8.fyi/builders/Linux%20Debug%20Builder/builds/6010


Original change's description:
> Inspector: Runtime.callFunctionOn to accept executionContextId
> 
> This patch:
> - teaches Runtime.callFunctionOn to accept executionContextId instead of
>   objectId.
> - adds the optional objectGroup parameter to the Runtime.callFunctionOn.
> 
> R=​kozy
> 
> Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel
> Change-Id: Ia29ee37f37a1e8cbe2d9f15ae75e841534ecf727
> Reviewed-on: https://chromium-review.googlesource.com/639751
> Reviewed-by: Pavel Feldman <pfeldman@chromium.org>
> Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
> Commit-Queue: Andrey Lushnikov <lushnikov@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#47659}

TBR=lushnikov@chromium.org,pfeldman@chromium.org,kozyatinskiy@chromium.org

Change-Id: I2586a6accde6c1f79d628b8999d90222b5714dc1
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel
Reviewed-on: https://chromium-review.googlesource.com/640590Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47661}

Bug: v8:5267
Change-Id: I0a94b1c2df3d5d0871e36c0f688a5d7d88179a09
Reviewed-on: https://chromium-review.googlesource.com/640370
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47660}

This patch:
- teaches Runtime.callFunctionOn to accept executionContextId instead of
  objectId.
- adds the optional objectGroup parameter to the Runtime.callFunctionOn.

R=kozy

Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel
Change-Id: Ia29ee37f37a1e8cbe2d9f15ae75e841534ecf727
Reviewed-on: https://chromium-review.googlesource.com/639751Reviewed-by: Pavel Feldman <pfeldman@chromium.org>
Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Commit-Queue: Andrey Lushnikov <lushnikov@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47659}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/2887ee5..48a2b7b

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/68a8df6..7149cbf

TBR=machenbach@chromium.org,hablich@chromium.org

Change-Id: Ib8667ab4ff0b2310f725a0942732ac861d25b57a
Reviewed-on: https://chromium-review.googlesource.com/640350Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47658}

The validator was trying to finalize virtual register assignments in
phi cases, however, since phis may create aliases, we ended up with
an unnecessarily complex design that was the source of pretty much all
validator bugs since its introduction.

This change embraces the fact that phis may create aliases: pending
assessments (==phis) carry a bag of aliased virtual registers. 

Bug: chromium:758778
Change-Id: Ib7ded350a726fbc77e9d0ff3eeda7f00acc4de13
Reviewed-on: https://chromium-review.googlesource.com/639530
Commit-Queue: Mircea Trofin <mtrofin@chromium.org>
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47657}

As part of J2V8 development (https://github.com/eclipsesource/J2V8),
we realized that we had a subtle bug in how Isolate scope was created
and it's lifetime managed, see:
https://github.com/eclipsesource/J2V8/issues/313.

Mentioned above bug was fixed, however, what we also noticed is that
V8 API has been constantly and slowly moving to such an API, in which
one has to pass Isolate explicitly to methods and/or constructors. We
found two more places that might have been overlooked. This contribution
adds passing of Isolate pointer explicitly to constructors of
String::Utf8Value and String::Value classes.

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng;master.tryserver.v8:v8_linux_noi18n_rel_ng
Change-Id: I61984285f152aba5ca922100cf3df913a9cb2cea
Reviewed-on: https://chromium-review.googlesource.com/593309
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47656}

Change-Id: I62e3ad6dc294b575d2b50a68d7dd7c8167fa517d
Reviewed-on: https://chromium-review.googlesource.com/637309
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47655}

Per https://tc39.github.io/ecma262/#sec-array.prototype.concat, step 6.

Bug: v8:6707, v8:6708
Change-Id: Iad3eb94a3b5fe35e5ecd1b8632612a7f2f169434
Reviewed-on: https://chromium-review.googlesource.com/636695
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47654}

Bug: 
Change-Id: I857f8b3f992faf950917060b3fe705bdd45c3ada
Reviewed-on: https://chromium-review.googlesource.com/638339Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47653}

R=ahaas@chromium.org,mtrofin@chromium.org

Bug: chromium:759624
Change-Id: I032755698c4f404cfd5bf3298df57a4bcfbe6f2c
Reviewed-on: https://chromium-review.googlesource.com/638590Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47652}

Now we create merges, effect phis and phis eagerly. This should make it
easier to add loop support in future.

Bug: v8:5267
Change-Id: I5324aec323feff581f5b34235a0b3d3b8987127c
Reviewed-on: https://chromium-review.googlesource.com/637834
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47651}

Bug: v8:6211
Change-Id: I0f15c59b7b786ab327e4ab548523095dd85ba83e
Reviewed-on: https://chromium-review.googlesource.com/637835Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47650}

We now only require API references to be provided when we
actually deserialize them. Also changed the internal implementation
to avoid copying API references into V8.

R=petermarshall@chromium.org

Bug: v8:6448
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Iddb0465ff6e95020006d41b5e87614dce8f0140b
Reviewed-on: https://chromium-review.googlesource.com/632098Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47649}

This reverts commit 49e3bfd5.

Reason for revert: Primary suspect for blocked roll: 759552

Original change's description:
> [snapshot] Move builtins to dedicated snapshot area
> 
> As a first step towards lazy builtin deserialization, this CL moves
> builtins to their own dedicated area in the snapshot blob, physically
> located after startup data and before context-specific data.
> 
> The startup- and partial serializers now serialize all seen builtins as
> references, i.e. they only encode the relevant builtin id (taking care
> to preserve special behavior around the interpreter trampoline and
> CompileLazy). Builtins are later fully serialized by the
> BuiltinSerializer. The separate blobs are finally glued together by
> CreateSnapshotBlob.
> 
> Deserialization takes the same steps: when we see builtin reference
> bytecodes before builtins have been deserialized, we push to a list of
> deferred builtin references. After builtin deserialization, this list is
> iterated and all builtin references are fixed up.
> 
> Bug: v8:6624
> Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
> Change-Id: Idee42fa9c92bdbe8d5b8c4b8bf3ca9dd39634004
> Reviewed-on: https://chromium-review.googlesource.com/610225
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#47596}

TBR=yangguo@chromium.org,mlippautz@chromium.org,jgruber@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:6624
Change-Id: I9906c9ea15a623226b890f63bc65876a6f5203f8
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/638331Reviewed-by: Michael Hablich <hablich@chromium.org>
Commit-Queue: Michael Hablich <hablich@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47648}

The deadlock can happen when we lock a page for processing old to new
references as part of the scavenger while at the same time trying to
lazily sweep another page for retrieving memory. If two tasks decide to
sweep each others pages they will deadlock.

Bug: v8:6754
Change-Id: Ic9fae0eafa5b5a5cb5eaa1c0aac61de24d1b9486
Reviewed-on: https://chromium-review.googlesource.com/636371
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47647}

This makes sure the minimum memory size for WebAssembly modules derived
from asm.js is set to zero. It allows instatiation without allocating an
underlying memory, when such memory is unused. It also fixes a bug in
patching of embedded memory sizes for asm.js modules.

R=ahaas@chromium.org
TEST=mjsunit/regress/regress-crbug-759327
BUG=chromium:759327

Change-Id: If5a965b96a03cbb5ba15bc41fbaf359f74961f41
Reviewed-on: https://chromium-review.googlesource.com/637912
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47646}

Bug: v8:6333
Change-Id: Ic47c1f60d32b9dabfcbe85f5b6e2586dd7e1fd11
Reviewed-on: https://chromium-review.googlesource.com/637995Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47645}

Bug: 
Change-Id: Ied0ef1fc7fbcd9f58d793b9b2ecd87ae6c549dca
Reviewed-on: https://chromium-review.googlesource.com/635590
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47644}

This removes dangerous accessors method from the arguments object
accessor classes. The shape of an arguments object might transition,
turning the fields into dictionary mode, making the accessors invalid.

It also fixes a bug in the reported number of embedder fields on the
arguments object.

R=ishell@chromium.org
TEST=cctest/test-api/InternalFieldsOfRegularObjects

Change-Id: Ib7a73608c6236fe8864434e0cfdcb754ae012a75
Reviewed-on: https://chromium-review.googlesource.com/636368
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47643}

This reverts commit 1169f55b.

Reason for revert: http://crbug.com/758994

Original change's description:
> Remove obsolete kNumber binop feedback.
> 
> With the removal of Crankshaft, kNumber has become obsolete as
> BinaryOperationFeedback. Turbofan uses kNumberOrOddball.
> 
> Bug: 
> Change-Id: If577f5efcc81d7c08f43908f2764ff0ec6f8747c
> Reviewed-on: https://chromium-review.googlesource.com/628376
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Reviewed-by: Mythri Alle <mythria@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#47555}

TBR=jkummerow@chromium.org,jarin@chromium.org,neis@chromium.org,mythria@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Change-Id: I1b33f572f3e6865e00d2468bffcce2ea466814b3
Reviewed-on: https://chromium-review.googlesource.com/637711Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47642}

Get the old table size after converting integer of 'delta' argument.
Converting integer of the argument can execute another javascript code,
and the code can trigger mismatching between table sizes of instance and
table object, which causes redundant memory allocation.

http://webassembly.org/docs/js/#webassemblytableprototypegrow

Bug: chromium:752423
Change-Id: If9a576d20625d0c39342ea5de114e9fc9f230125
Reviewed-on: https://chromium-review.googlesource.com/627248Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47641}

This is just a refactoring in preparation for typing the speculative
integer operation as safe integers.

Bug: v8:5267
Change-Id: I56da91a72655a0733b2cf04afcf33cb1d2aa1415
Reviewed-on: https://chromium-review.googlesource.com/637830Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47640}

This reverts commit f6d73509.

Reason for revert: Perf regressions https://crbug.com/758126

Original change's description:
> [csa] Refactor large-object handling in string allocation
> 
> CSA::AllocateSeq{One,Two}ByteString used its own home-grown handling to
> allocate very large strings. This CL refactors both methods to use
> AllocationFlags::kAllowLargeObjectAllocation instead. Callers now need
> to specify explicitly if large-object allocation is possible or not.
> 
> Bug: chromium:636391
> Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng
> Change-Id: I0b7ffb0b083f4e977cea42c500f8f2ee1c60519f
> Reviewed-on: https://chromium-review.googlesource.com/625738
> Reviewed-by: Camillo Bruni <cbruni@chromium.org>
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#47504}

TBR=cbruni@chromium.org,jgruber@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: chromium:636391
Change-Id: Iab88ce400f489a677df821d4053bd3678289ae2e
Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/637392Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47639}

Derived projects need easy access to the original V8's implementation of
time to implement Platform interface.

Bug: chromium:751993
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I97ee77929fda5930e7d75ca8609797673485cec3
Reviewed-on: https://chromium-review.googlesource.com/636884Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Sergei Datsenko <dats@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47638}

Bug: chromium:694255
Change-Id: I58be876aa6db2e528f7d2e045e042657354575c7
Reviewed-on: https://chromium-review.googlesource.com/637393Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47637}