R=franzih@chromium.org, kozyatinskiy@chromium.org, machenbach@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2540323003
Cr-Commit-Position: refs/heads/master@{#41406}

This code is no longer used in full-codegen since all computed property
names in object literals go through Ignition first.

BUG=v8:5657

Review-Url: https://codereview.chromium.org/2543643002
Cr-Commit-Position: refs/heads/master@{#41405}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/4e4ff82..ac12d5e

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/buildtools/+log/991f459..102c163

Rolling v8/third_party/android_tools: https://chromium.googlesource.com/android_tools/+log/811a2c3..b43a6a2

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/2dd86f1..582ccd4

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/f81598c..ccd4a12

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2538233003
Cr-Commit-Position: refs/heads/master@{#41404}

Incremental parsing of asm.js means we can see function tables that
are unused in the AsmWasmBuilder before they've been initialized.

BUG=669899
R=aseemgarg@chromium.org

Review-Url: https://codereview.chromium.org/2546553002
Cr-Commit-Position: refs/heads/master@{#41403}

This roll includes:
  - [inspector_protocol] always use weak pointer in DispatcherImpl::{command.name} [1]

[1] https://codereview.chromium.org/2545613002/

BUG=chromium:668358
TBR=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2541253002
Cr-Commit-Position: refs/heads/master@{#41402}

If we just call CreateDebugInfo in GetPossibleBreakpoints then we won't call PrepareFunctionForBreakPoints and won't be able to step into this function or pause at breakpoint inside.

BUG=v8:5695
R=dgozman@chromium.org,yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2540943002
Cr-Commit-Position: refs/heads/master@{#41401}

During codegen, we build a list mapping protected instructions to their
associated landing pads. This will ultimately by used by the signal handler to
recover from out of bounds faults and throw a JS exception.

This is mostly pulled from my larger in-progress CL at
https://codereview.chromium.org/2371833007/.

BUG= https://bugs.chromium.org/p/v8/issues/detail?id=5277

Review-Url: https://codereview.chromium.org/2500443004
Cr-Commit-Position: refs/heads/master@{#41400}

R=jarin@chromium.org

BUG=v8:668517

Review-Url: https://codereview.chromium.org/2536353003
Cr-Commit-Position: refs/heads/master@{#41399}

This is necessary for signal-based out of bounds handling in WebAssembly.

Adds a ProtectedStore instruction that is analogous to the previously added
ProtectedLoad instruction. Rather than using bounds checks, ProtectedStore emits
an out of line section of code that throws a JavaScript exception and provides
the necessary metadata for a signal handler to be able to find the out of line
code.

BUG= https://bugs.chromium.org/p/v8/issues/detail?id=5277

Review-Url: https://codereview.chromium.org/2516413003
Cr-Commit-Position: refs/heads/master@{#41398}

Attempt to fix or get insight into failing vswp test on V8 ARM bot.

LOG=N
BUG=

Review-Url: https://codereview.chromium.org/2539533005
Cr-Commit-Position: refs/heads/master@{#41397}

The "writable" property descriptor may legally change during the call to
AnythingToArrayLength(). This change needs to be honoured before calling
JSArray::SetLength(). The change is only honoured when the "length"
property was previously writable, so that changes during a call to
DefineOwnPropertyIgnoreAttributes() is ignored.

BUG=v8:5688
R=cbruni@chromium.org, verwaest@chromium.org, jkummerow@chromium.org

Review-Url: https://codereview.chromium.org/2543553002
Cr-Commit-Position: refs/heads/master@{#41396}

BUG=

R=jyan@ca.ibm.com,joransiu@ca.ibm.com,michael_dawson@ca.ibm.com,bjaideep@ca.ibm.com

Review-Url: https://codereview.chromium.org/2536203003
Cr-Commit-Position: refs/heads/master@{#41395}

Before, we were treating objects with the builtin ArrayValues iterator
method as array-like, where the iterator would iterate through to the
full length of the object.

This optimization was not sound, because it does not ensure that the
next method hasn't been modified. Even if it hasn't been modified,
it's entirely possible to be modified during iteration. Thus, this
optimization has been removed due to its observability.

BUG=v8:5699
R=littledan@chromium.org, cbruni@chromium.org

Review-Url: https://codereview.chromium.org/2544503002
Cr-Commit-Position: refs/heads/master@{#41394}

This was causing more confusion than benefit, so we're removing it.

It's re-defined to empty for now, to avoid touching the ~100 files which
use it, we can remove it completely during a quiet period when it's less
likely to conflict with other work.

Review-Url: https://codereview.chromium.org/2535383005
Cr-Commit-Position: refs/heads/master@{#41393}

JS operators always have an implicit context input, so just use that instead.

BUG=

Review-Url: https://codereview.chromium.org/2541813002
Cr-Commit-Position: refs/heads/master@{#41392}

This is an experiment to see the impact of the limit on OOM crashes.

BUG=chromium:667388

Review-Url: https://codereview.chromium.org/2514313004
Cr-Commit-Position: refs/heads/master@{#41391}

BUG=chromium:666947

Review-Url: https://codereview.chromium.org/2539013002
Cr-Commit-Position: refs/heads/master@{#41390}

BUG=chromium:669024

Review-Url: https://codereview.chromium.org/2531163006
Cr-Commit-Position: refs/heads/master@{#41389}

These byte pointers (module_start and module_end) were only valid
during decoding. During instantiation or execution, they can get
invalidated by garbage collection.
This CL removes them from the WasmModule struct, and introduces a new
ModuleStorage struct as interface to the wasm wire bytes.
Since the storage is often needed together with the ModuleEnv, a new
ModuleStorageEnv struct holds both a ModuleEnv and a ModuleStorage.
The pointers in the ModuleStorage should never escape the live range of
this struct, as they might point into a SeqOneByteString or ArrayBuffer.
Therefore, the WasmInterpreter needs to create its own copy of the
whole module.
Runtime functions that previously used the raw pointers in WasmModule
(leading to memory errors) now have to use the SeqOneByteString in the
WasmCompiledModule.

R=titzer@chromium.org
BUG=chromium:669518

Review-Url: https://codereview.chromium.org/2540133002
Cr-Commit-Position: refs/heads/master@{#41388}

JSFrameSpecialization depends on the layout of the frame and doesn't work
with interpreted frames. Disable it since it is only used for OSR from asmjs code, which shouldn't go through the bytecode graph builder in many cases.

BUG=669517

Review-Url: https://codereview.chromium.org/2538823002
Cr-Commit-Position: refs/heads/master@{#41387}

Also move them to a separate interface header to avoid having to include
parser.h so much

BUG=v8:5589
R=verwaest@chromium.org,marja@chromium.org

Review-Url: https://codereview.chromium.org/2534393002
Cr-Commit-Position: refs/heads/master@{#41386}

Remove redundant operands swap for compare operation.

BUG=

Review-Url: https://codereview.chromium.org/2507683002
Cr-Commit-Position: refs/heads/master@{#41385}

Defining the subclass within the loop significantly affects subsequent
test results. For instance, the Search benchmark is 50% slower if the
subclass is defined within the loop.

BUG=v8:5339

Review-Url: https://codereview.chromium.org/2537253003
Cr-Commit-Position: refs/heads/master@{#41384}

[heap] Reduce store buffer size to increase chance to run concurrent store buffer processing thread more often.

BUG=

Review-Url: https://codereview.chromium.org/2529623002
Cr-Commit-Position: refs/heads/master@{#41383}

I removed {IsWasmInstance} because it is not used anywhere, and I moved
ThrowWasmError to runtime-wasm.cc

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2541633003
Cr-Commit-Position: refs/heads/master@{#41382}

R=ahaas@chromium.org,bradnelson@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2528033002
Cr-Commit-Position: refs/heads/master@{#41381}

JSLoadContext and JSStoreContext are always reduced in js-typed-lowering.

R=mstarzinger@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2535253002
Cr-Commit-Position: refs/heads/master@{#41380}

v8::Global is movable, so no need to heap-allocate them.

R=yangguo@chromium.org, kozyatinskiy@chromium.org

Review-Url: https://codereview.chromium.org/2537433002
Cr-Commit-Position: refs/heads/master@{#41379}

BUG=v8:4680

Review-Url: https://codereview.chromium.org/2541563002
Cr-Commit-Position: refs/heads/master@{#41378}

  port df2578d2 (r41368)

  original commit message:
  Improves performance in simple, single element case by 5% and in multiple
  elements cases by 2%.

BUG=

Review-Url: https://codereview.chromium.org/2540803004
Cr-Commit-Position: refs/heads/master@{#41377}

Blocking roll: https://codereview.chromium.org/2537173002/

NOTRY=true

Review-Url: https://codereview.chromium.org/2532103004
Cr-Commit-Position: refs/heads/master@{#41376}

This adds consistency checks for function kind and scope type to
SharedFunctionInfoVerify.

It also fixes an inconsistency in the creation of a ScopeInfo.

R=adamk@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2537093002
Cr-Commit-Position: refs/heads/master@{#41375}

When removing a scope (see FinalizeBlockScope), remember the removal by making
the scope its own sibling.  This avoid recalculating the information later on.

R=adamk@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2536993003
Cr-Commit-Position: refs/heads/master@{#41374}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/11a223f..4e4ff82

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapul/+log/3950931..2dd86f1

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clan/+log/4d70bef..f81598c

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2539733003
Cr-Commit-Position: refs/heads/master@{#41373}

Make the AsmWasmBuilder drive the process of typing and potentially parsing
function bodies. This will allow us to keep only a single asm.js function's
AST in memory as we convert to WebAssembly.
This is needed to keep our memory footprint low.

Add some additional output to a few tests that's helpful to see which stage they fail at.

BUG= https://bugs.chromium.org/p/v8/issues/detail?id=4203
LOG=N
R=marja@chromium.org,adamk@chromium.org,aseemgarg@chromium.org,titzer@chromium.org

Review-Url: https://codereview.chromium.org/2398023002
Cr-Commit-Position: refs/heads/master@{#41372}

BUG=chromium:350797
R=dgozman@chromium.org
TBR=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2527473004
Cr-Commit-Position: refs/heads/master@{#41371}

Port df2578d2

Original Commit Message:

    Improves performance in simple, single element case by 5% and in multiple
    elements cases by 2%.

R=danno@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, bjaideep@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=chromium:608675
LOG=N

Review-Url: https://codereview.chromium.org/2537513005
Cr-Commit-Position: refs/heads/master@{#41370}

Rename it to better represent the reason. Also makes the inspector sentence
"Not Optimized: Optimized too many times" look less confusing.

Review-Url: https://codereview.chromium.org/2530423003
Cr-Commit-Position: refs/heads/master@{#41369}

Improves performance in simple, single element case by 5% and in multiple
elements cases by 2%.

BUG=chromium:608675
LOG=N

Review-Url: https://codereview.chromium.org/2497243002
Cr-Commit-Position: refs/heads/master@{#41368}

Functions with asm-wasm data shouldn't be marked for optimization, since
they will be optimized using the asm-wasm data instead.

Review-Url: https://codereview.chromium.org/2537103002
Cr-Commit-Position: refs/heads/master@{#41367}