This is a rewrite of the ASM validator. This one follows the spec instead of using the AST visitors.

BUG= https://bugs.chromium.org/p/v8/issues/detail?id=4203
TEST=cctest/asmjs/test-asm-typer
TEST=cctest/asmjs/test-typing-asm
LOG=N

Review-Url: https://codereview.chromium.org/2071343003
Cr-Commit-Position: refs/heads/master@{#37694}

BUG=618608
R=bradnelson@chromium.org
TEST=regress-618608.js

Review-Url: https://codereview.chromium.org/2138243002
Cr-Commit-Position: refs/heads/master@{#37693}

To correctly support instantiating a compiled module multiple times, we clone the
compiled module each time we create an instance, since some of the data is specific
to the instance - e.g. export code, wasm functions, indirect table.

BUG=v8:5072

Review-Url: https://codereview.chromium.org/2134593002
Cr-Commit-Position: refs/heads/master@{#37692}

BUG=v8:4483, v8:5190

R=caitp@igalia.com, nikolaos@chromium.org

Review-Url: https://codereview.chromium.org/2139063002
Cr-Commit-Position: refs/heads/master@{#37691}

Revert of [gn] Experiment: Reset -O3 to -O2. (patchset #1 id:1 of https://codereview.chromium.org/2135313002/ )

Reason for revert:
Data collected

Original issue's description:
> [gn] Experiment: Reset -O3 to -O2.
>
> Temporary commit to see performance data. Will be reverted
> shortly after.
>
> BUG=chromium:622332
> TBR=vogelheim, jochen
> NOTRY=true
>
> Committed: https://crrev.com/bbb61d8aea732457e1d5a0c9abdd79eacf1622ae
> Cr-Commit-Position: refs/heads/master@{#37667}

TBR=vogelheim@chromium.org,jochen@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:622332

Review-Url: https://codereview.chromium.org/2141113002
Cr-Commit-Position: refs/heads/master@{#37690}

As required by the spec.

BUG=v8:5113

Review-Url: https://codereview.chromium.org/2141603002
Cr-Commit-Position: refs/heads/master@{#37689}

Revert of Implement .eh_frame writer and disassembler. (patchset #72 id:2030001 of https://codereview.chromium.org/2023503002/ )

Reason for revert:
The STATIC_CONST_MEMBER_DEFINITION in eh-frame-writer-unittest.cc causes a compiler error on V8 Win64 - clang buildbot. Removing that bit should be sufficient.

Original issue's description:
> Implement .eh_frame writer and disassembler.
>
> Also, CodeGenerator::MakeCodeEpilogue now accepts an optional pointer
> to a EhFrameWriter and will attach unwinding information to the code
> object when passed one.
>
> BUG=v8:4899
> LOG=N
>
> Committed: https://crrev.com/27d810e63b744b5b3d9aa28ff21413247773e6c2
> Cr-Commit-Position: refs/heads/master@{#37683}

TBR=rmcilroy@chromium.org,jarin@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4899

Review-Url: https://codereview.chromium.org/2143033002
Cr-Commit-Position: refs/heads/master@{#37688}

When trying to clone a branch, the ControlFlowOptimizer gave up as soon as it found a Phi/EffectPhi node that could not be placed directly below the IfTrue or IfFalse control paths.

Moving the step in the EffectControlLinearizer phase, after the first schedule, works around the problem by looking at the successor blocks.

BUG=

Review-Url: https://codereview.chromium.org/2139593002
Cr-Commit-Position: refs/heads/master@{#37687}

This solves an issue with throws inside for-of always being marked as caught.

BUG=v8:5183

Review-Url: https://codereview.chromium.org/2146493002
Cr-Commit-Position: refs/heads/master@{#37686}

BUG=

Review-Url: https://codereview.chromium.org/2139133003
Cr-Commit-Position: refs/heads/master@{#37685}

LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2144613002
Cr-Commit-Position: refs/heads/master@{#37684}

Also, CodeGenerator::MakeCodeEpilogue now accepts an optional pointer
to a EhFrameWriter and will attach unwinding information to the code
object when passed one.

BUG=v8:4899
LOG=N

Review-Url: https://codereview.chromium.org/2023503002
Cr-Commit-Position: refs/heads/master@{#37683}

Revert of making heap verification more aggressive (patchset #7 id:120001 of https://codereview.chromium.org/2126613002/ )

Reason for revert:
failing gc stress tests: https://build.chromium.org/p/client.v8/builders/V8%20Mac%20GC%20Stress/builds/7223/steps/Mjsunit/logs/stdio

Original issue's description:
> [runtime] making heap verification more aggressive
>
> - check that packed elements do not contain the_hole (with fix)
> - verify argument objects with elements kind
> - use JSObjectVerifiy in all JSObject "subclasses"
> - change initialization order for ArrayLiteralBoilerplate to simplify verification
>
> BUG=v8:5188
>
> Committed: https://crrev.com/599aa2e106ca8ab79f5cc489d1b93b6a26b19714
> Cr-Commit-Position: refs/heads/master@{#37680}

TBR=ishell@chromium.org,ulan@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5188

Review-Url: https://codereview.chromium.org/2140163002
Cr-Commit-Position: refs/heads/master@{#37682}

The manual input trimming inside the EffectControlLinearizer is no
longer necessary, since we have to do explicit graph trimming before
running the MemoryOptimizer anyways these days.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2144603002
Cr-Commit-Position: refs/heads/master@{#37681}

- check that packed elements do not contain the_hole (with fix)
- verify argument objects with elements kind
- use JSObjectVerifiy in all JSObject "subclasses"
- change initialization order for ArrayLiteralBoilerplate to simplify verification

BUG=v8:5188

Review-Url: https://codereview.chromium.org/2126613002
Cr-Commit-Position: refs/heads/master@{#37680}

BUG=chromium:474921,chromium:626064

Review-Url: https://codereview.chromium.org/2134223003
Cr-Commit-Position: refs/heads/master@{#37679}

R=machenbach@chromium.org

Review-Url: https://codereview.chromium.org/2141013002
Cr-Commit-Position: refs/heads/master@{#37678}

R=machenbach@chromium.org

Review-Url: https://codereview.chromium.org/2141563002
Cr-Commit-Position: refs/heads/master@{#37677}

LOG=N
BUG=

Review-Url: https://codereview.chromium.org/2135573002
Cr-Commit-Position: refs/heads/master@{#37676}

The step fails on windows. This'll help investigating why.

BUG=chromium:474921
TBR=tandrii@chromium.org, vogelheim@chromium.org, jochen@chromium.org
NOTRY=true

Review-Url: https://codereview.chromium.org/2141903002
Cr-Commit-Position: refs/heads/master@{#37675}

This widens the set of binary operator reductions that are applied by
TurboFan when graphs are built from bytecode. By now we only insert
number conversions to inputs of integer binary ops (i.e. bitwise and
shifts), others no longer require a "before" frame state input.

R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2135973003
Cr-Commit-Position: refs/heads/master@{#37674}

This is another point where we add inconsistent behavior between simple and
detailed stack traces. The functionality also does not seem to be used in
chrome anymore when uncaught exceptions are thrown.  Remove it to reduce
maintenance burden.

BUG=624285
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2141523002
Cr-Commit-Position: refs/heads/master@{#37673}

Turn the retyping pass of SimplifiedLowering into a proper phase, and
make it possible to propagate feedback types through non-speculative
operators. This defers the output representation selection to the
retyping phase, and checks that we don't mess up.

As a first user, we consume input type feedback for NumberAbs as well.
Long-term we can add all other operators to the mix.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2139203002
Cr-Commit-Position: refs/heads/master@{#37672}

I removed or replaced some values in the list of float and double values
in value-helper.h which cannot be represented precisely as floats or
doubles, respectively.

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2135243004
Cr-Commit-Position: refs/heads/master@{#37671}

This removes the checking for use-def and def-use chain links from the
graph verification. Presence of such links can only be violated by a bug
in the actual {Node} implementation itself. That container class is also
covered by unit tests.

The verification in question was useful in the early days when the graph
implementation itself was prone to bugs. By now it has stabilized and
spending O(n^2) time during graph verification is too wasteful to still
be considered a reasonable trade-off.

R=jarin@chromium.org
TEST=unittests/NodeTest.*

Review-Url: https://codereview.chromium.org/2140973003
Cr-Commit-Position: refs/heads/master@{#37670}

The PlainPrimitiveToNumber operator performs a superset of the operations
previously performed by the BooleanToNumber and StringToNumber operators,
so we can just use the special lowering rules for PlainPrimitiveToNumber
based on the input type and get rid of the specialized operators.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2139183002
Cr-Commit-Position: refs/heads/master@{#37669}

This CL separates the check whether something is tail-callable from
the computation of the size of the stack parameters that a function
takes.

In order to track this precisely, the stack parameter size calculation
uses the recently landed MachineType information that's embedded
in return and parameter value LinkageLocations.

Review-Url: https://codereview.chromium.org/2121753002
Cr-Commit-Position: refs/heads/master@{#37668}

Temporary commit to see performance data. Will be reverted
shortly after.

BUG=chromium:622332
TBR=vogelheim, jochen
NOTRY=true

Review-Url: https://codereview.chromium.org/2135313002
Cr-Commit-Position: refs/heads/master@{#37667}

R=jgruber@chromium.org

Review-Url: https://codereview.chromium.org/2139613002
Cr-Commit-Position: refs/heads/master@{#37666}

Remove obsolete definitions from macros.py, and drop the now obsolete
%_ToPrimitive, %_ToPrimitive_Number, %_ToPrimitive_String, %_ToName
and the %ToPrimitive_String intrinsics/runtime entries.

R=yangguo@chromium.org
BUG=v8:5049

Review-Url: https://codereview.chromium.org/2137203002
Cr-Commit-Position: refs/heads/master@{#37665}

R=franzih@chromium.org
BUG=chromium:515897

Review-Url: https://codereview.chromium.org/2137033002
Cr-Commit-Position: refs/heads/master@{#37664}

Added trace printout for replacements in Turbofan reducers.
Renamed graph trimmer trace flag to avoid confusion.

Review-Url: https://codereview.chromium.org/2123283006
Cr-Commit-Position: refs/heads/master@{#37663}

Rolling v8/build to 3cd1ead0173f28d3aa6b28590495ae67340a3a5e

Rolling v8/third_party/icu to b5ecbb29a26532f72ef482569b223d5a51fd50bf

Rolling v8/tools/mb to 9a768a4d908ec89978a95e1c04c62336f5cfbcd2

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2144483002
Cr-Commit-Position: refs/heads/master@{#37662}

AllocateSpillSlot can now handle requests for 16 byte slots.

LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2139663002
Cr-Commit-Position: refs/heads/master@{#37661}

BUG=v8:4789

Committed: https://crrev.com/c3a16f0a9f0976411ee25df627534be5f6955c32
Review-Url: https://codereview.chromium.org/2133533002
Cr-Original-Commit-Position: refs/heads/master@{#37618}
Cr-Commit-Position: refs/heads/master@{#37660}

Port d49d3864

R=jgruber@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=v8:5173
LOG=N

Review-Url: https://codereview.chromium.org/2141723003
Cr-Commit-Position: refs/heads/master@{#37659}

Graph trimmer can set Input as null and subsequent
printing call could cause segmentation fault.

R=bmeurer@chromium.org, jarin@chromium.org

Review-Url: https://codereview.chromium.org/2134443002
Cr-Commit-Position: refs/heads/master@{#37658}

Instead just return undefined

A side effect of this is that it's no longer possible to compile
functions in a detached context.

BUG=chromium:541703
R=verwaest@chromium.org,bmeurer@chromium.org
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng

Review-Url: https://codereview.chromium.org/2034083002
Cr-Commit-Position: refs/heads/master@{#37657}

When the scanner finds a '-->', it's either part of an HTMLCloseComment
or a '--' followed by a '>'. Previously, only a preceding newline would
make it an HTMLCloseComment. Now, a preceding multiline comment also
makes it an HTMLCloseComment. The effect is that now the following is
not a SyntaxError:

x/*
*/-->this is now a comment

BUG=v8:5142
LOG=y

Review-Url: https://codereview.chromium.org/2119763003
Cr-Commit-Position: refs/heads/master@{#37656}

This patch just checks for a stack overflow and returns failure
from the cases which Clusterfuzz found. However, there may be
more locations in the parser which need similar treatment.

R=caitpotter88@gmail.com,neis
BUG=v8:4483,chromium:624300

Review-Url: https://codereview.chromium.org/2135503002
Cr-Commit-Position: refs/heads/master@{#37655}