V8 can bundle user scripts in the start up snapshot. These are
shared across contexts, and do not work well context groups.

R=kozyatinskiy@chromium.org
BUG=v8:6274

Review-Url: https://codereview.chromium.org/2836623002
Cr-Commit-Position: refs/heads/master@{#44847}

Traditionally, we had a prefix for a function name of "~" for
unoptimized code and "*" for optimized code. Restore this prefix
in v8/tools/ic-processor. It's really cool to know if an IC was
called from optimized code (often a hint of poor performance!).

NOTRY=true
R=cbruni@chromium.org

Review-Url: https://codereview.chromium.org/2835923004
Cr-Commit-Position: refs/heads/master@{#44846}

This header file is only used from tests.
Also, move the LoadStoreOpcodeOf method (only used in tests) from
wasm-opcodes.h to wasm-macro-gen.h.

R=ahaas@chromium.org

Change-Id: I8d4691be494b5c1fbe3084441329850930bad647
Reviewed-on: https://chromium-review.googlesource.com/486861
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44845}

Ideally they are already filtered on the embedder side. Sometimes
howevever, embedders end up with a Local<T> pointing to a nullptr
object. In this case the best way to filter this is right at the
beginning of the registration process.

BUG=chromium:713667

Review-Url: https://codereview.chromium.org/2836013003
Cr-Commit-Position: refs/heads/master@{#44844}

Adds a micro benchmark in js-perf-test to measure the performance of
compare bytecode handlers.

Bug:v8:4280

Change-Id: Ic86d670f8f09147076a22cfeff2e1ec052afe20c
Reviewed-on: https://chromium-review.googlesource.com/485522Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44843}

Instead of using the WASM_I32V_* macros (and other) from
wasm-macro-gen.h, use the appropriate methods to encode LEB integers.
This also saves some spaces for the wasm bytecode generated from asm.js.

Specifically, this CL
1) renames EmitVarInt to EmitI32V and EmitVarUint to EmitU32V (on
   WasmFunctionBuilder).
2) introduces more methods on the WasmFunctionBuilder to emit i64v,
   u64v, f32, and f64 values.
3) uses the ZoneBuffer instead of a plain ZoneVector<char> in the
   WasmFunctionBuilder to build the body of the function.
4) introduces more helper functions on the ZoneBuffer to encode i64v,
   u64v, f32 and f64 values.

R=ahaas@chromium.org

Change-Id: Ifa59a6a67380ecf9a3823c382daf00855f5bc61e
Reviewed-on: https://chromium-review.googlesource.com/486803Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44842}

Until now JIC and JIALC compact branches were emited without using their
offset. Here we optimize their use by using offset after addition and/or
load immediate operations.

The CL also fixes a problem with deserialization that occurs when a code
object ends with an optimized LUI/AUI and JIC/JIALC instruction pair.
Deserializer processed these instruction pairs by moving to a location
immediately after it, but when this location is the end of the object it
would finish with the current object before doing relocation. This is
fixed by moving the deserializer one instruction before the location of
the instruction pair end.

BUG=

Review-Url: https://codereview.chromium.org/2542403002
Cr-Commit-Position: refs/heads/master@{#44841}

Some of these tests pass the pattern as a string, and in this case
there's a subtle distinction between

"/\u{0041}/"  // Unicode escape interpreted in string literal.

and

"/\\u{0041}/"  // Unicode escape interpreted by regexp parser.

Extend these tests to check both cases.

Thanks littledan@ for pointing this out.

BUG=v8:5437

Review-Url: https://codereview.chromium.org/2839923002
Cr-Commit-Position: refs/heads/master@{#44840}

BUG=v8:6093

Change-Id: I7fa591c70a0db3ce158b9a9aa798ee7cdbaf0ae1
Reviewed-on: https://chromium-review.googlesource.com/485679
Commit-Queue: Wiktor Garbacz <wiktorg@google.com>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44839}

wasm-macro-gen.h is mainly used from tests, but LocalDeclEncoder is
also used from various other places.
This CL moves the LocalDeclEncoder to an own compilation unit. We want
to later move wasm-macro-gen.h to the tests folder.
It also refactors the LocalDeclEncoder to reuse the
LEBHelper::write_u32v and LEBHelper::sizeof_u32v methods instead of
reimplementing it.

R=ahaas@chromium.org

Change-Id: Ia4651436f0544578da7c1c43596d343571942e97
Reviewed-on: https://chromium-review.googlesource.com/486724Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44838}

Instead of dynamically tracking the block nesting, precompute the
information statically.
The interpreter was already using a side table to store the pc diff for
each break, conditional break and others. The information needed to
adjust the stack was tracked dynamically, however. This CL also
precomputes this information, as it is statically known.
Instead of just storing the pc diff in the side table, we now store the
pc diff, the stack height diff and the arity of the target block.

Local measurements show speedups of 5-6% on average, sometimes >10%.

R=ahaas@chromium.org
BUG=v8:5822

Change-Id: I986cfa989aabe1488f2ff79ddbfbb28aeffe1452
Reviewed-on: https://chromium-review.googlesource.com/485482Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44837}

This unifies the memory management of identifier strings passed between
the scanner, parser and module builder. The following scheme is used:
 - The scanner does not create copies of identifier strings itself, it
   exposes a reference to the current identifier. This reference becomes
   invalid as soon as the scanner advanced.
 - The parser preserves a single copy of each identifier that is stored
   in any data structure. That copy is allocated in the zone, lifetime
   is coupled to that of the zone.
 - The module builder can use all such identifiers by reference, as long
   as its lifetime is also coupled to the same zone.

Note that the module builder still creates redundant copies for some
identifiers (in order to maintain backwards compatibility with the old
AST-based parser). This can be fixed once the "old validator" has been
removed.

R=clemensh@chromium.org
BUG=v8:6127

Change-Id: I8611d162e87730045a6061d08c3fe841daae8a7d
Reviewed-on: https://chromium-review.googlesource.com/484439
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44836}

The data produced by the preparser scope analysis might be large.

ByteArrays are already allowed in the large object space.

This fixes mjsunit/asm/poppler/poppler.js with the flag on.

First version landed as https://chromium-review.googlesource.com/c/484459/
this version includes gen-postmortem-metadata fixes.

BUG=v8:5516

Change-Id: I2218c4729ba9feefd6595a93e5cc6d2e52ebda0e
Reviewed-on: https://chromium-review.googlesource.com/486641Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44835}

Do not bail out when passed a flags string with length > 5, use a
meaningful named constant instead.

Found by https://github.com/tc39/test262/pull/997#issuecomment-296963675

BUG=v8:6300

Review-Url: https://codereview.chromium.org/2841633004
Cr-Commit-Position: refs/heads/master@{#44834}

When looking for receiver maps, we need to account for the renaming
performed by FinishRegion, and look for the original receiver instead
from that point on.

Drive-by-fix: Abort effect chain walk as soon as the definition of the
receiver is seen on the effect chain.

BUG=v8:5267

Review-Url: https://codereview.chromium.org/2836853002
Cr-Commit-Position: refs/heads/master@{#44833}

I think the WebAssembly format changed since the last time we updated
the corpus.

R=bradnelson@chromium.org

Change-Id: Ic4e24bade8cffbd43025d0961b805757a5e6f4d6
Reviewed-on: https://chromium-review.googlesource.com/485801Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44832}

For polymorphic loads that refer to the same underlying field, but
differ in either representation or field maps, try harder to merge
them into a simple field load by going to Tagged representation or
throwing away the field maps (this is essentially what Crankshaft
is doing).

R=jarin@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2836893002
Cr-Commit-Position: refs/heads/master@{#44831}

BUG=chromium:714483

Review-Url: https://codereview.chromium.org/2833423004
Cr-Commit-Position: refs/heads/master@{#44830}

R=clemensh@chromium.org

Change-Id: I3aad1b4058eb464dee80c08332a186109efb7208
Reviewed-on: https://chromium-review.googlesource.com/485622
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44829}

Avoid TransitionElementsKind when storing to objects which only differ
in holeyness of their elements kind. Instead go for polymorphic
CheckMaps, which can often by optimized and avoid the mutation of the
array map.

This generalizes the approach https://codereview.chromium.org/2836943003
which covered only element loads.

R=yangguo@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2836913004
Cr-Commit-Position: refs/heads/master@{#44828}

Bug:chromium:617892

Change-Id: I9993191fb632ca49f020e8073e7e409c86932a29
Reviewed-on: https://chromium-review.googlesource.com/485202
Commit-Queue: Hitoshi Yoshida <peria@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44827}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/4636d31..87cefe1

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/4d43438..892a0b6

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: I291fb57adab75a15c8b7c44f672192e543f3f2de
Reviewed-on: https://chromium-review.googlesource.com/486500Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44826}

TBR=machenbach@chromium.org
Bug: v8:5193

Change-Id: Ic24a59895b29ee8a0a97f97e5009be98bd34f10f
Reviewed-on: https://chromium-review.googlesource.com/486266Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44825}

See this v8-dev thread for more background:
https://groups.google.com/d/msg/v8-dev/71PVa9fMzoc/AvBZ9Fw4BQAJ

TBR=hpayer@chromium.org

Change-Id: I49957a72c8faec4cf5032cbf6437a461d7139b83
Reviewed-on: https://chromium-review.googlesource.com/486062Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44824}

Change-Id: I27b1463ba14e34f3302b51c25c6efaf40ca7e3e0
Reviewed-on: https://chromium-review.googlesource.com/486185Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44823}

Bug: v8:5549
Change-Id: I32b9853b6542c6ad04d12a9d54f31be9e3c76da8
Reviewed-on: https://chromium-review.googlesource.com/486245Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44822}

This patch removes JSFunction::SetInstancePrototype() from
JSFunction's public API and makes it an implementation detail
of SetPrototype().

Also clear out constructor field of JSFunction Map when
transitioning from non-instance prototype to instance
prototype.

Change-Id: If51d37bf6047b51b934d1b370fb52bb5cf5ffed4
Reviewed-on: https://chromium-review.googlesource.com/483961Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44821}

The AsyncGeneratorYield builtin just invoked the
AsyncGeneratorResolve() stub anyways, so this removes the middle-man.

Really minor refactoring, but clears out a bit of snapshot size and
another context index.

BUG=v8:5855
R=rmcilroy@chromium.org, bmeurer@chromium.org

Change-Id: I3385a5c5412e8d58493601874c2ad6b60e613012
Reviewed-on: https://chromium-review.googlesource.com/471913
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44820}

BUG=v8:6291, v8:811
R=marja@chromium.org, vogelheim@chromium.org

Change-Id: I978ea446d7b42092592b0a3ae3c99626e36d40fd
Reviewed-on: https://chromium-review.googlesource.com/485099
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44819}

BUG=v8:6291, v8:811
R=marja@chromium.org, vogelheim@chromium.org

Change-Id: Icf18b1cba8562aab87d233d383eb1d73a8e6aa9d
Reviewed-on: https://chromium-review.googlesource.com/485059
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44818}

BUG=

Review-Url: https://codereview.chromium.org/2833373003
Cr-Commit-Position: refs/heads/master@{#44817}

This lived in the JS natives for a long time, but it seems to work
just fine in the bootstrapper, and looks much cleaner there.

Change-Id: I9f5723cd840d83dde536db842b294ff1ccac294b
Reviewed-on: https://chromium-review.googlesource.com/483963Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44816}

This changes behavior of TurboFan to match the behavior of Crankshaft
when it comes to polymorphic loads of similar elements kind (i.e. all
tagged or all double), where we should use the "worst case" code without
a transition. This is often much faster than transitioning the elements
to the worst case first, trading a TransitionElementsKind for a CheckMaps
and avoiding mutation of the array.

This is beneficial for various crypto benchmarks, which don't need to
pay the cost for TransitionElementsKind now.

R=jarin@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2836943003
Cr-Commit-Position: refs/heads/master@{#44815}

VC++ 2017's STL doesn't suppress warnings as aggressively as prior
versions did. This causes warnings on code which mixes signed and
unsigned types. In this case a deque of unsigned integers was being
queried to see how many signed integers it contains. This could be
fixed by passing in unsigned 0, 1, and 2 to std::count but changing
the deque from unsigned to int is simpler.

R=adamk@chromium.org
BUG=chromium:683729

Review-Url: https://codereview.chromium.org/2834293002
Cr-Commit-Position: refs/heads/master@{#44814}

This makes it easier to set the value for embedders where it is
difficult to plumb through to the Isolate constructor.

BUG=chromium:711809
R=jochen@chromium.org

Review-Url: https://codereview.chromium.org/2829223002
Cr-Commit-Position: refs/heads/master@{#44813}

- Adds new F32x4AddHoriz, I32x4AddHoriz, etc. to WASM opcodes.
- Implements them for ARM.

LOG=N
BUG=v8:6020

Review-Url: https://codereview.chromium.org/2804883008
Cr-Commit-Position: refs/heads/master@{#44812}

R=adamk@chromium.org
BUG=v8:1569

Review-Url: https://codereview.chromium.org/2833773002
Cr-Commit-Position: refs/heads/master@{#44811}

- All ARM hardware has 32 single precision float registers; save all
  s-registers regardless of the number of d-registers (16 or 32).

LOG=N
BUG=v8:6077

Review-Url: https://codereview.chromium.org/2821273004
Cr-Commit-Position: refs/heads/master@{#44810}

Bug:

Change-Id: I116591b80af41e8d210445ba4c2bc3b25577b15d
Reviewed-on: https://chromium-review.googlesource.com/480619Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Pavel Feldman <pfeldman@chromium.org>
Commit-Queue: Franziska Hinkelmann <franzih@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44809}

In general, deleting a property from a fast-properties object
requires transitioning the object to dictionary mode. However,
when the most-recently-added property is deleted, we can simply
roll back the last map transition that the object went through.

This is a performance experiment: it should make things faster,
but if it turns out to have more negative than positive impact,
we will have to revert it.

TBR=bmeurer@chromium.org (just adding a comment)

Previously reviewed at https://codereview.chromium.org/2830093002
Previously landed as 98acfb36 / r44799

Review-Url: https://codereview.chromium.org/2840583002
Cr-Commit-Position: refs/heads/master@{#44808}