Port 4e207a42

Original Commit Message:

    This switches the "code entry" field on JSFunction to no longer be an
    inner pointer into a Code object (i.e. to the start of the instruction
    stream), but a properly tagged pointer instead.

    Motivation behind this is the ability to treat this field regularly as
    part of escape analysis in the optimizing compiler. Also simplifies the
    object visitation for JSFunction objects.

R=mstarzinger@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: Ifa5998551e041c8de647df7306dd549455936699
Reviewed-on: https://chromium-review.googlesource.com/588468Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Jaideep Bajwa <bjaideep@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#46934}

Test mjsunit/optimized-map walked an array through different
ElementsKind transitions, but it failed to verify that the
expected ElementsKind was in place. Although we have a regression
test for the bug, it's a good idea to make sure the basic
test covers all paths.

Bug: chromium:747075
Change-Id: I1424880801857f3356bfd63839d351d6fd1521e0
Reviewed-on: https://chromium-review.googlesource.com/584837Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46933}

This reverts commit e4bbf92b.

Reason for revert: Crashes: https://build.chromium.org/p/client.v8/builders/V8%20Linux64/builds/19156

Original change's description:
> [compiler-dispatcher] Make compiler jobs abstract
> 
> Makes compiler dispatcher jobs an abstract interface, with unoptimized
> compile jobs as an implementation of this interface.
> 
> Bug: v8:6537
> Change-Id: I6569060a89c92d35e4bc7962623f77082a354934
> Reviewed-on: https://chromium-review.googlesource.com/558290
> Reviewed-by: Georg Neis <neis@chromium.org>
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Commit-Queue: Leszek Swirski <leszeks@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46931}

TBR=rmcilroy@chromium.org,neis@chromium.org,leszeks@chromium.org

Change-Id: I023c0455929180fdcde3caf581f483f794ca2368
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6537
Reviewed-on: https://chromium-review.googlesource.com/589153Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46932}

Makes compiler dispatcher jobs an abstract interface, with unoptimized
compile jobs as an implementation of this interface.

Bug: v8:6537
Change-Id: I6569060a89c92d35e4bc7962623f77082a354934
Reviewed-on: https://chromium-review.googlesource.com/558290Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46931}

The code generated for the TestTypeOf bytecode was not ideal, mostly
because of the default case that just aborted. If we do CSA_ASSERT to
check the validity of the literal_flag instead anf then just use the
last label as the default, the bytecode handler no longer builds a
stack frame and generated code quality is now really close to ideal.

The TestTypeOf bytecode handler was found to be among the three
hottest bytecode handlers in the Speedometer/AngularJS benchmark.

R=jarin@chromium.org

Change-Id: I47705a0ca0a436d5c42899001064e77d44845a64
Reviewed-on: https://chromium-review.googlesource.com/589207Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46930}

This replaces the linked list of weak cells with a worklist.

TBR=yangguo@chromium.org

BUG=chromium:694255

Change-Id: Ia877e25010ebbec9c05fbbe48cff460a92d3a132
Reviewed-on: https://chromium-review.googlesource.com/587067
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46929}

NOTRY=true

Bug: chromium:738865
Change-Id: I8e3ac86bf6f0b3356398053b157ec03217e78a08
Reviewed-on: https://chromium-review.googlesource.com/589129Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46928}

MSVC's macro VA_ARGS support behaves slightly differently from
gcc/clang, where VA_ARGS is treated as a single token when passed to
other macros, e.g.

    #define FIRST(X, ...) 'X'
    #define FOO(...) FIRST(__VA_ARGS__)
    FOO(a,b,c)

expands to

    gcc/clang: 'a'
    MSVC: 'a,b,c'

The workaround to this is to wrap the call in a no-op macro, which
expands VA_ARGS first, and only then passes it through:

    #define EXPAND(x) x
    #define FOO(...) EXPAND(FIRST(__VA_ARGS__))

This was causing errors on windows builds when CSA_ASSERT was passed
multiple additional expressions.

Change-Id: Ia40bf23baf97af29c7f6f67c8a83918ecca15364
Reviewed-on: https://chromium-review.googlesource.com/586831Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46927}

This is a step in making shared function info visitor side effect free.

Change-Id: I5e7a713d2d782590c4988abc69b2068dc85b9bae
Reviewed-on: https://chromium-review.googlesource.com/586927Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46926}

Debug::ClearCoverageInfo may be called multiple times, for example
whenever coverage mode is switched to BestEffort. When encountering a
DebugInfo that does not have a CoverageInfo attached, simply do nothing
instead of failing a DCHECK.

TBR=yangguo@chromium.org

Bug: v8:6000
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I3910b21ab40e7db02af5f3b6add3ec3f86e5bd91
Reviewed-on: https://chromium-review.googlesource.com/588788
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46925}

We need to write the slot with a relaxed write. No additional barrier is
needed because the new object has been published using Release_CAS and
reading either value is fine (as long as all initializing stores have
been published).

NOTRY=true

Bug: chromium:738865
Change-Id: Ieeacccf00e0a7e8eb950eee01060bd1963e30a42
Reviewed-on: https://chromium-review.googlesource.com/589007
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46924}

This reverts commit 7bb6cd63.

Reason for revert: layout tests

Original change's description:
> [coverage] Ship block coverage
> 
> Enables block coverage by default.
> 
> Design doc: http://goo.gl/hSJhXn
> Tracking bug: http://crbug.com/v8/6000
> 
> Bug: v8:6000
> Change-Id: I8c56474473b60e4707b75dc601b3e88455861a27
> Reviewed-on: https://chromium-review.googlesource.com/583093
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46898}

NOTRY=true
TBR=yangguo@chromium.org,jgruber@chromium.org

Change-Id: I51d6f13d3ad0d2d2262bdd8d67135931cbc27032
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6000
Reviewed-on: https://chromium-review.googlesource.com/588789Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46923}

Adding (very) small tests for deoptimization.
Some of these tests were failing when the safepoints were not found,
after setting the return address.

BUG=V8:6563

Change-Id: I3af36b193a5982cd73414cc1884c5f0a7a727f5a
Reviewed-on: https://chromium-review.googlesource.com/584751Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Juliana Patricia Vicente Franco <jupvfranco@google.com>
Cr-Commit-Position: refs/heads/master@{#46922}

... when generalizing const fields to mutable fields.

Bug: chromium:748539, chromium:747979, chromium:738763
Change-Id: Iee772a5d0cddd23599f1f68bca00b8beecb76da0
Reviewed-on: https://chromium-review.googlesource.com/586709Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46921}

                       -+ssssssyyssssooossooooooo+:`                   
                    :ys+///////oyo//////////////+oy:                  
                   +y+///////////ss///////////////+y/        ``       
                  +y//////////////oy+///////////////yo`   .:o/        
                `oy////////////////sy+///////////////ss-/syh/         
               `ss////////////////+y/yo///////////////oo+oy:          
              .ss////////////////oy- .ss////////////////oy-           
             .yo////////////////oy.   `os//////////////oy.            
             +ss+//////////////ss.     `+y+///////////ss.             
              `./oso+/////////ss`     `-+yo//////////ss.     `        
                  `-+oso+////so`   .:oyysoooooooooooso`  `-/os/       
./ooooooooooooooooo: `.:+ss+y+`  .:///::::-----.....``.:+so+/+y+      
  `-+sso+/////////+y/    `-//                     `-/oso+//////yo`    
     `/yo///////////so`                        .:+oo+///////////ss`   
     :yo/////////////ss.                      .sy+///////////////ss.  
    /y+///////////////oy-                      -yo////////////////oy- 
   +y+//////////////+o++y/                   `  .ss////////////////oy-
  :h///////////////+y+ossy+`                `o   .ss////////////////ss
  :h//////////////oy-  `:+so.              `oy    `os///////////////oy
   oy////////////ss.      `-/`            `sys     `+y+/////////////y/
    +y//////////so`                      .ssss       /y+//////////oy/ 
     +y+///////yyo++++++++++++++++      .yo/ss::::::--oyo++++++osyy-  
      /y+////+yo////////////////sy     -yo//++++++++++ooooooo++oyo.   
       /y+//+yo/////////////////oy    -yo/////////////////////+y+`    
        /y++y+//////////////////oy   :y+/////////////////////+y:      
         :yys///////////////////oy  -y+/////////////////////os-       
          :ys///////////////////oy  `os////////////////////so`        
           -y+//////////////////oy   `oy/////////////////+y+          
            -ss/////////////////oy     +y+//////////////oy:           
             `:ossooooooooooooooss      :y+/oyssssssssso/`            
                 `................       -yooy                        
                                          .yyy                        
                                           `sy                        
                                            `+                        

Bug: chromium:738865
Change-Id: I202f9c61c13fcacfb8fff37458931d91c6f831e5
Reviewed-on: https://chromium-review.googlesource.com/584835Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46920}

This reverts commit 862d605c.

Reason for revert: fixed compile issue

Original change's description:
> Revert "[wasm] Consolidate function table representation."
> 
> This reverts commit 4a45f35f.
> 
> Reason for revert: https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20debug%20builder/builds/25471 
> 
> Original change's description:
> > [wasm] Consolidate function table representation.
> > 
> > This CL avoids the need to reference the function tables (and signatures)
> > as either fixed arrays or vectors, preferring vectors.
> > 
> > The only place we need fixed arrays is on the compiled module, to support
> > serialization. When we move off the GC heap, we'll also move away
> > from fixed arrays in that last case.
> > 
> > The CL aids with getting wasm of the GC heap, by reducing the places 
> > and representations we'll need to change  when changing the way we 
> > reference fixed tables.
> > 
> > Bug: 
> > Change-Id: Id4e43905a3df39062bf2839fa72dd5d9a0fe87da
> > Reviewed-on: https://chromium-review.googlesource.com/588334
> > Commit-Queue: Mircea Trofin <mtrofin@chromium.org>
> > Reviewed-by: Brad Nelson <bradnelson@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#46917}
> 
> TBR=bradnelson@chromium.org,titzer@chromium.org,mtrofin@chromium.org,ahaas@chromium.org
> 
> Change-Id: Ie7d04f7ec74d6d0b3783df1c78c91c100ab784f4
> No-Presubmit: true
> No-Tree-Checks: true
> No-Try: true
> Reviewed-on: https://chromium-review.googlesource.com/588627
> Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
> Commit-Queue: Mircea Trofin <mtrofin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46918}

TBR=bradnelson@chromium.org,titzer@chromium.org,mtrofin@chromium.org,ahaas@chromium.org

Change-Id: Ic0ba8097c13f2b1afd263b6243360e8ab95ae474
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/588667
Commit-Queue: Mircea Trofin <mtrofin@chromium.org>
Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46919}

This reverts commit 4a45f35f.

Reason for revert: https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20debug%20builder/builds/25471 

Original change's description:
> [wasm] Consolidate function table representation.
> 
> This CL avoids the need to reference the function tables (and signatures)
> as either fixed arrays or vectors, preferring vectors.
> 
> The only place we need fixed arrays is on the compiled module, to support
> serialization. When we move off the GC heap, we'll also move away
> from fixed arrays in that last case.
> 
> The CL aids with getting wasm of the GC heap, by reducing the places 
> and representations we'll need to change  when changing the way we 
> reference fixed tables.
> 
> Bug: 
> Change-Id: Id4e43905a3df39062bf2839fa72dd5d9a0fe87da
> Reviewed-on: https://chromium-review.googlesource.com/588334
> Commit-Queue: Mircea Trofin <mtrofin@chromium.org>
> Reviewed-by: Brad Nelson <bradnelson@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46917}

TBR=bradnelson@chromium.org,titzer@chromium.org,mtrofin@chromium.org,ahaas@chromium.org

Change-Id: Ie7d04f7ec74d6d0b3783df1c78c91c100ab784f4
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/588627Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
Commit-Queue: Mircea Trofin <mtrofin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46918}

This CL avoids the need to reference the function tables (and signatures)
as either fixed arrays or vectors, preferring vectors.

The only place we need fixed arrays is on the compiled module, to support
serialization. When we move off the GC heap, we'll also move away
from fixed arrays in that last case.

The CL aids with getting wasm of the GC heap, by reducing the places 
and representations we'll need to change  when changing the way we 
reference fixed tables.

Bug: 
Change-Id: Id4e43905a3df39062bf2839fa72dd5d9a0fe87da
Reviewed-on: https://chromium-review.googlesource.com/588334
Commit-Queue: Mircea Trofin <mtrofin@chromium.org>
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46917}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/b77c52d..11685b6

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/b5d2ffa..0f1f20d

TBR=machenbach@chromium.org,hablich@chromium.org

Change-Id: I65a486293524354675f999f328bf5c286947d4c0
Reviewed-on: https://chromium-review.googlesource.com/588467Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46916}

Check for these UMA stats were in functions only used for testing. Moved the
checks to code inside module decoding.

Note that the module decoder is used both to validate and generate the
intermediate (turbofan) graph of function bodies.  This CL assumes
that the validation phase (of function bodies) is the correct place to
track decoding time.

Bug: v8:6361
Change-Id: I791281daae96473d53cb8ae332fff8bb2673bf6c
Reviewed-on: https://chromium-review.googlesource.com/586974
Commit-Queue: Karl Schimpf <kschimpf@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46915}

Port fe046627
Port d594a6d9
Port 53553f5d

R=mslekova@google.com, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I2c160f8e3a1c3a809de6a6631864104ed95900d7
Reviewed-on: https://chromium-review.googlesource.com/587610Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Jaideep Bajwa <bjaideep@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#46914}

The global objects lookup code mistakingly reports weakly referenced
JSGlobalObject's as normal one. It should not.

The fix just adds is_weak check into V8HeapExplorer::SetGcSubrootReference
the rest is formatting.

Bug: chromium:747382
Change-Id: I3fc62317dd3d8728d261f27bd58654aff13eb6fe
Reviewed-on: https://chromium-review.googlesource.com/585385Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Alexei Filippov <alph@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46913}

Port 7f50476b
Port 1769f892

Original Commit Message:

    - Add more conformance tests for proxy call and calling undetectable
    - This improves the performance of calling a proxy by ~5x

R=mslekova@google.com, adamk@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: If5e66093aee815225053c1d3d2a99cfac270aea4
Reviewed-on: https://chromium-review.googlesource.com/587228Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Jaideep Bajwa <bjaideep@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#46912}

Internally, the module status type has one additional value, namely
PreInstantiating. I previously mapped this to Instantiating when
crossing the API boundary but it really should be mapped to
Uninstantiated. That's because when instantiation fails, typically all
modules not yet visited will remain in the PreInstantiating state, yet
they must appear Uninstantiated to the outside.

A relevant test will be added to chromium shortly.

Bug: v8:1569, chromium:748544
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Icb33c7f90db5e62375b6c09d14e3d2d5342b0879
Reviewed-on: https://chromium-review.googlesource.com/586602Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46911}

- No need for multiple assertAsyncRan() calls, just do t.plan(count)

- Previously, if you forget to call assertAsyncRan(), the test will still
  pass, which is no longer true.

- No longer hold global state (with
  asyncAssertsExpected). Previously if one assert wasn't hit then
  there's no way to find out which test failed. You'd have to
  comment each test and try again.

- Each test runs independently in the microtask queue.

- Better failure reporting by printing the entire function.

Example error :
=== mjsunit/harmony/promise-prototype-finally ===
abort: Expected asserts: 2, Actual asserts: 1
in test: reject/finally/then
assert => {
  assert.plan(2);
  Promise.reject(3).finally().then(
    assert.unreachable,
    x => {
      assert.equals(3, x);
    });
}


Change-Id: Ic3f6272e1e87b8b0121b8c8c7cce19cf90d1f1be
Reviewed-on: https://chromium-review.googlesource.com/455555
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Daniel Ehrenberg <littledan@chromium.org>
Reviewed-by: Caitlin Potter <caitp@igalia.com>
Cr-Commit-Position: refs/heads/master@{#46910}

Port 1edb46cc

Original Commit Message:

    This improves the general Array constructor call performance (w/o
    usable AllocationSite feedback) in TurboFan by ~2x, i.e. for example
    invoking the Array constructor like this

      var a = Array.call(undefined, n);

    instead of

      var a = Array(n);

    such that the CallIC doesn't know that it's eventually calling the
    Array constructor.

    It also thus changes the single argument Array constructor to always
    return holey arrays. Previously the single argument case for the Array
    constructor was somehow trying to dynamically detect 0 and in that case
    returned a packed array instead of a holey one. That adds quite a lot
    of churn, and doesn't seem to be very useful, especially since this
    might lead to unnecessary feedback pollution later.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I6a50ae016556ed38a7d7ca5546b575ca25e91b4a
Reviewed-on: https://chromium-review.googlesource.com/586641Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Jaideep Bajwa <bjaideep@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#46909}

Port 6ace4a50

Original Commit Message:

    In debug mode (SLOW_DCHECK), Handle<T>::cast accesses the object to
    check its type.  Obviously we can no longer do that now that we run
    on a background thread.

    problem. I will look into fixing those as well.

R=neis@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I2140cd7b3e27a6deb24fe3f462d99ad31eeb8276
Reviewed-on: https://chromium-review.googlesource.com/586675Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Jaideep Bajwa <bjaideep@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#46908}

Calls to this method are currently being wrongly categorized as Blink C++
when it is cast to a GenericNamedPropertySetterCallback in
Object::GetPropertyWithAccessor and called.

Bug: 
Change-Id: I691346d0d1e6b22dfc12cf4cfb07cfff71a36baf
Reviewed-on: https://chromium-review.googlesource.com/585169Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Adithya Srinivasan <adithyas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46907}

This is for debugging only.

R=adamk@chromium.org

Bug: v8:1569
Change-Id: I6526d3a98e96bb1267f1850268c5dc83a64587a6
Reviewed-on: https://chromium-review.googlesource.com/586590
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46906}

This fixes undefined behavior in the arithmetic negation operation by
switching to a branch-free implementation.

R=clemensh@chromium.org
TEST=unittests/MachineOperatorReducerTest.Int32DivWithConstant

Change-Id: I518f0e4343fc331607b8bbeefd2bb06285621fe6
Reviewed-on: https://chromium-review.googlesource.com/584870Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46905}

Moves parser internalization of ast values out of 
ParseAny/Program/Function and instead internalizes during compile 
finalization. Currently also internalizes during scope analysis if
there is a ScopeInfo to enable variable name lookups. We also 
internalize early for FCG / AstGraphBuilder.

BUG=v8:5203

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Ia766795947d847517b87cd5ea39797347083174b
Reviewed-on: https://chromium-review.googlesource.com/582407Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46904}

R=ahaas@chromium.org

Bug: 
Change-Id: Ic2331617624ce724ba33e07a1a42ebe2549f8054
Reviewed-on: https://chromium-review.googlesource.com/586547Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46903}

R=yangguo@chromium.org

Bug: 
Change-Id: I1174bd88c252a0c9d16dca270088a0100ac4eb35
Reviewed-on: https://chromium-review.googlesource.com/584869
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46902}

Bug: v8:6520
Change-Id: I3d5a019885516d7cbc4f43bfb3892bed655a9628
Reviewed-on: https://chromium-review.googlesource.com/586708Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46901}

Port dfdcaf43
Port 2e1f5567

Original Commit Message:

    This CL introduces TurboAssembler, a super-class of Assembler and sub-class
    of MacroAssembler. TurboAssembler contains all the functionality that is used
    by Turbofan and previously was part of MacroAssembler. TurboAssembler has
    access to the isolate but, in contrast to MacroAssembler, does not expect to
    be running on the main thread.

R=neis@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:6048
LOG=N

Change-Id: I3f51771afefe46410db7cda2625472d78c87f8c6
Reviewed-on: https://chromium-review.googlesource.com/583584Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Jaideep Bajwa <bjaideep@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#46900}

Reland of https://chromium-review.googlesource.com/c/543042/.

Now the OSR phase is only used when OSRing from the ast graph builder.
When OSRing from Turbofan, the implementation is now in the graph
building phase, at the beginning of the VisitBytecode function.
We are no longer generating any OSRLoopEntry or OSRNormalEntry nodes,
nor nodes for the possible code of the OSRed function which is before
the OSRed loops.

The trimming and reducing of the OSR phase is not done either. This
change in the way the way the OSR is done enabled to remove the
workaround to the bug mentioned below.

Bug: v8:6112
Bug: v8:6518
Change-Id: Ia02f2138f54fc79cab2f02fed68d9bb522d6ce14
Reviewed-on: https://chromium-review.googlesource.com/584756
Commit-Queue: Alexandre Talon <alexandret@google.com>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46899}

Enables block coverage by default.

Design doc: http://goo.gl/hSJhXn
Tracking bug: http://crbug.com/v8/6000

Bug: v8:6000
Change-Id: I8c56474473b60e4707b75dc601b3e88455861a27
Reviewed-on: https://chromium-review.googlesource.com/583093
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46898}

TBR=mstarzinger@chromium.org
NOTRY=true

Bug: chromium:748981
Change-Id: I2043d283bd4eb6d98082f202d88638b3ca96a7c8
Reviewed-on: https://chromium-review.googlesource.com/586687
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46897}

Previously we would shift the length of the string by three, which
could overflow with the new larger string length limit. Now we check
that the length will fit without extra allocation before and after
the shift, because really large strings will never fit, and will
always go to the Checked case.

Bug: chromium:748069, v8:6148
Change-Id: I41cac14b0fde6c5e8ca92305a052cbb743111554
Reviewed-on: https://chromium-review.googlesource.com/584611
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46896}

R=clemensh@chromium.org

Bug: 
Change-Id: I5e4cd8dcb9c22cd261b48598c021f84ad712ba58
Reviewed-on: https://chromium-review.googlesource.com/586249Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46895}