Change-Id: Ie741a8e4452b6d65ec73bd91ecdea869d7eedc25
BUG: v8:8192
Reviewed-on: https://chromium-review.googlesource.com/1230100
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56011}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/c4b8ad9..786a3d9

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/460fd88..c968ea0

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/ea4301e..79c6513

Rolling v8/third_party/fuchsia-sdk: https://chromium.googlesource.com/chromium/src/third_party/fuchsia-sdk/+log/0953bbd..dc90d99

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: I524678f69b7810ce492d73395178067024c6237f
Reviewed-on: https://chromium-review.googlesource.com/1232692Reviewed-by: V8 Autoroller <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: V8 Autoroller <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#56010}

V8 does not abort incremental marking anymore.

Bug: chromium:843903
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: Id39e9cf8ef2afc388bab2bbad1d458ee2649f8e8
Reviewed-on: https://chromium-review.googlesource.com/1226889Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56009}

This is the next step to support large array buffers. On 64-bit archs
the full safe integer range is available (up to 2^53-1 bytes in theory).
On 32-bit platforms the full Unsigned31 range is allowed, so that we can
continue to use CheckBounds for typed arrays and data views in the
optimizing compiler (it's generally unlikely that the kernel will give
you more than 1GiB of contiguous memory anyways).

Drive-by-fix: This introduces proper chokepoints for the byte_offset
and byte_length accesses in the CSA code, and also does some renaming
for consistency.

Bug: v8:4153, v8:7881, v8:8171
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I92a767638532ca9f86084398ce72556c5180cc6e
Reviewed-on: https://chromium-review.googlesource.com/1228377Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56008}

This is a reland of bf5ea813

Original change's description:
> [tracing] allow dynamic control of tracing
> 
> If the trace_buffer_ was null, we were returning a pointer to a static
> flag back that permanently disabled that particular trace point.
> 
> This implied an assumption that tracing will be statically enabled at
> process startup, and once it is disabled, it will never be enabled
> again. On Node.js side we want to dynamically enable/disable tracing as per
> programmer intent.
> 
> Change-Id: Ic7a7839b8450ab5c356d85e8e0826f42824907f4
> Reviewed-on: https://chromium-review.googlesource.com/1161518
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Commit-Queue: Ali Ijaz Sheikh <ofrobots@google.com>
> Cr-Commit-Position: refs/heads/master@{#54903}

Change-Id: Ie2a9ebbaf59d3be1918864cc3c192671fb5550c3
Reviewed-on: https://chromium-review.googlesource.com/1188529
Commit-Queue: Ali Ijaz Sheikh <ofrobots@google.com>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56007}

For 64-bit indices it's not safe to pass Truncation::Word32() for
indices, as operations will incorrectly truncate the outputs to
32-bit integers. There's also not really a point in not passing
Truncation::Any(), but it might have performance impact (since we
misuse IsUsedAsWord32 in various places).

Bug: v8:8178
Change-Id: Ie33b8e03a82e46e314dfb3f268c74c9356653aec
Reviewed-on: https://chromium-review.googlesource.com/1230653Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56006}

Change-Id: Icf7ff0661cb5d5866af0ffa7bd4aa3d78da84754
Reviewed-on: https://chromium-review.googlesource.com/1228419Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Ali Ijaz Sheikh <ofrobots@google.com>
Cr-Commit-Position: refs/heads/master@{#56005}

Handle the case when one or both of the output nodes of an I64Atomic op
are optimized, for code-gen instructions that use a set of fixed
registers, use temp registers to ensure the registers are not
clobbered.

BUG:v8:6532


Change-Id: I52763c48d615cdf3ae8d754402b11da2df31a4a1
Reviewed-on: https://chromium-review.googlesource.com/1195910Reviewed-by: Bill Budge <bbudge@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56004}

Liftoff increases code size, and people start deploying bigger modules.
Increase the wasm code space limit from 512 MB to 1024 MB to account
for this.

R=titzer@chromium.org

Bug: chromium:883639, chromium:872684
Change-Id: I3a2ca29d456635f7f3aa1daef5fa2b0249dc1645
Reviewed-on: https://chromium-review.googlesource.com/1226971
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56003}

Change-Id: I93726a98978b8b18a16a253f55fc698704d27be4
Reviewed-on: https://chromium-review.googlesource.com/1228376
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56002}

The WasmMemoryTracker keeps track of reserved memory in order to avoid
running out of virtual address space. So far, we were only tracking
reservations for wasm memory, and not for code. This CL changes that to
also include code reservations.

Drive-by: Some cleanup around the allocation of the WasmCodeManager.

R=titzer@chromium.org

Bug: chromium:883639
Change-Id: I0c2586a742022ae00752132e048346d54e2a1a7c
Reviewed-on: https://chromium-review.googlesource.com/1230134Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56001}

This CL is the first in a series of work that will remove ebx (the new
kRootRegister) use from all ia32 ASM builtins and stubs.

Bug: v8:6666
Change-Id: If417f1194a27ddae9e38d50e0a651dfc129e8b05
Reviewed-on: https://chromium-review.googlesource.com/1230095Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56000}

Indirect calls need a scratch register to load the target address. On
ia32 there's no easily-available scratch register.

This removes invalid code and documents a potential solution. But
ideally, this will remain unreachable since all inter-builtin calls
will be pc-relative.

Bug: v8:6666
Change-Id: I19e0ac699ee4757e3d5ec130b3e34a67cd1f851c
Reviewed-on: https://chromium-review.googlesource.com/1230096Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55999}

This fixes a race on the {WasmCodeManager::lookup_map} data structure
when requesting more code memory on architectures for which we have the
corresponding {kCanAllocateMoreMemory} flag set. Note that there is no
TSAN coverage for these architectures.

R=clemensh@chromium.org
BUG=chromium:875189

Change-Id: I11a082359b4cb6cc69c3168a956c5152f1dcc833
Reviewed-on: https://chromium-review.googlesource.com/1230136
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55998}

This function was only used in one place and its name was confusing
because it was fundamentally different from the other Serialize
functions.

Bug: v8:7790
Change-Id: I2af384e41ecc2d97e644e6797a4200e00e840b23
Reviewed-on: https://chromium-review.googlesource.com/1230099
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55997}

This reverts commit f4c14fd9.

Reason for revert: Breaks noi18n build

Original change's description:
> [regexp] implement regexp property sequence proposal
> 
> Also-By: mathias@chromium.org
> Bug: v8:7467
> Change-Id: I9fd6e61f4da1097c2375f671b4801e9730f792c4
> Reviewed-on: https://chromium-review.googlesource.com/1227974
> Commit-Queue: Yang Guo <yangguo@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Mathias Bynens <mathias@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#55991}

TBR=yangguo@chromium.org,jgruber@chromium.org,mathias@chromium.org

Change-Id: I10c67ad3ade35af920d32a7eea8ae0297677fa07
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7467
Reviewed-on: https://chromium-review.googlesource.com/1230137Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55996}

It is moved to a recipe module as a resource in https://crrev.com/i/678188.

R=machenbach@chromium.org

Bug: chromium:880732
Change-Id: If64b349d92d5da8452b32474d9d0c22d18155bc8
Reviewed-on: https://chromium-review.googlesource.com/1222126Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55995}

This removes the last unconditional read accesses to the heap, but
required a significant refactoring.

- Remove HeapObjectRef::type().
- Change HeapObjectData::Is* testers to look at the instance type
  in HeapObjectData::map().

- Remove ObjectRef::oddball_type()
- Add MapRef::oddball_type()
- Add MapRef::is_undetectable().
- Add MapRef::is_callable().

- Remove JSHeapBroker::HeapObjectTypeFromMap()
- Remove Type::For(JSHeapBroker*, Handle<Map>)
- Add BitsetType::Lub(MapRef).
- Add Type::For(MapRef).
- Add Type::For(HeapObjectType).

- Add HeapObjectRef::GetHeapObjectType(). THIS IS TEMPORARY.

As the last item suggests, I couldn't actually remove the
HeapObjectType class yet. See the explanation in the code.

Bug: v8:7790
Change-Id: I508e4bd5337277b0050f2204392fc36f41032fe9
Reviewed-on: https://chromium-review.googlesource.com/1228033Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55994}

TBR=leszeks@chromium.org
NOTRY=true

Cq-Include-Trybots: luci.chromium.try:linux_chromium_headless_rel;master.tryserver.blink:linux_trusty_blink_rel
Change-Id: Ic993310653d7e9351383253f8a1a65193d925b89
Reviewed-on: https://chromium-review.googlesource.com/1230101
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55993}

In the near future all ia32 ASM builtins must be audited & possibly refactored
to ensure they do not address ebx (= kRootRegister).

This CL adds mechanisms to verify ebx usage. SupportsRootRegisterScope marks
regions that are root-register-ready (i.e. does not use ebx).
AllowExplicitEbxAccessScope marks regions that are explicitly allowed to use
ebx, e.g. because they spill and restore its value at all boundaries and do not
contain any root-relative accesses.

Consistency is verified by calling the new AssertIsAddressable function at
strategic spots in the Assembler.

All of this code is temporary and should be removed once ia32 fully supports
the kRootRegister.

Bug: v8:6666
Change-Id: I7c5514794db0da889bdae9e3c23bc0d54780879d
Reviewed-on: https://chromium-review.googlesource.com/1226805Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55992}

Also-By: mathias@chromium.org
Bug: v8:7467
Change-Id: I9fd6e61f4da1097c2375f671b4801e9730f792c4
Reviewed-on: https://chromium-review.googlesource.com/1227974
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55991}

Fixing clang-tidy warning.

Bug: v8:8015
Change-Id: I33858c6f6bb577f39f697a1d3094990a57044fca
Reviewed-on: https://chromium-review.googlesource.com/1228065
Commit-Queue: Florian Sattler <sattlerf@google.com>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55990}

Fixing clang-tidy warning.

Bug: v8:8015
Change-Id: I9f76c7d530b22a030c9969dfee821e0896c358fb
Reviewed-on: https://chromium-review.googlesource.com/1224171
Commit-Queue: Florian Sattler <sattlerf@google.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55989}

BUG=v8:8157

Change-Id: I66bac3897eaad640b5723cdd0ec900e40cce1214
Reviewed-on: https://chromium-review.googlesource.com/1226917
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Rodolph Perfetta <rodolph.perfetta@arm.com>
Cr-Commit-Position: refs/heads/master@{#55988}

If type checks in simplified lowering produced dead value (i.e., of
type Type::None()), we have only propagated deadness along value
edges. With this CL, we also insert an Unreachable node after every
effectful node that produces dead value.

This is more consistent with dead code elimination, which also inserts
unreachable nodes after effectful nodes with value output None.

Bug: chromium:884052
Change-Id: Idcb168461f05f1811b2c9c16ab8ff179b259fbd3
Reviewed-on: https://chromium-review.googlesource.com/1228125Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55987}

Fixing clang-tidy warning.

Bug: v8:8015
Change-Id: I1fdd9210d92725701f413ff410e3a39d96bccf66
Reviewed-on: https://chromium-review.googlesource.com/1224111
Commit-Queue: Florian Sattler <sattlerf@google.com>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55986}

R=tebbi@chromium.org

Bug: v8:7793
Change-Id: I6690ae59743054e8171bffbf722eb486f468ac48
Reviewed-on: https://chromium-review.googlesource.com/1228062Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Simon Zünd <szuend@google.com>
Cr-Commit-Position: refs/heads/master@{#55985}

Fixing clang-tidy warning.

Bug: v8:8015
Cq-Include-Trybots: luci.chromium.try:linux_chromium_headless_rel;luci.chromium.try:linux_chromium_rel_ng;master.tryserver.blink:linux_trusty_blink_rel
Change-Id: I78bdf30b54a75fd96de0ca3d9243e1b55e9988ef
Reviewed-on: https://chromium-review.googlesource.com/1224090
Commit-Queue: Florian Sattler <sattlerf@google.com>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55984}

Word8 and Word16 representation is treated like Word32 for the sake of
TurboFan's representation selection, but this was missing from the
Word64 conversions.

Bug: chromium:884933, v8:4153, v8:7881, v8:8171, v8:8178
Change-Id: If7b69cdd02b12546d87bba0643e9ee9cb35cb299
Reviewed-on: https://chromium-review.googlesource.com/1229953Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55983}

Bug: v8:7790
Change-Id: Ic48c7d869d98b64195f699c47b1a250ae6ad2440
Reviewed-on: https://chromium-review.googlesource.com/1227127Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55982}

I'm also changing the function signature to take the descriptor_index
instead of the FieldIndex, because this lets me reuse the vector of
property descriptors as storage.

Bug: v8:7790
Change-Id: Ie9dadcba2204b6825e5791f9c630fc8b1079a930
Reviewed-on: https://chromium-review.googlesource.com/1227873
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55981}

Fixing clang-tidy warning.

Bug: v8:8015
Cq-Include-Trybots: luci.chromium.try:linux_chromium_headless_rel;master.tryserver.blink:linux_trusty_blink_rel
Change-Id: I82a169545724fca7757b2fce6b64b56d1b6264ba
Reviewed-on: https://chromium-review.googlesource.com/1225794Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Florian Sattler <sattlerf@google.com>
Cr-Commit-Position: refs/heads/master@{#55980}

Fixing clang-tidy warning.

Bug: v8:8015
Change-Id: If912b9d43f577ca3e9f3b8b27acf957c49e269dc
Reviewed-on: https://chromium-review.googlesource.com/1224113Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Florian Sattler <sattlerf@google.com>
Cr-Commit-Position: refs/heads/master@{#55979}

Fixing clang-tidy warning.

Bug: v8:8015
Change-Id: I46b96899f0a5973f2fbf8af94eb43d14955a3f45
Reviewed-on: https://chromium-review.googlesource.com/1227072Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Florian Sattler <sattlerf@google.com>
Cr-Commit-Position: refs/heads/master@{#55978}

Fixing clang-tidy warning.

Bug: v8:8015
Cq-Include-Trybots: luci.chromium.try:linux_chromium_headless_rel;master.tryserver.blink:linux_trusty_blink_rel
Change-Id: I641c72959470471747221f94da545a053dfcc0b0
Reviewed-on: https://chromium-review.googlesource.com/1228064Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Florian Sattler <sattlerf@google.com>
Cr-Commit-Position: refs/heads/master@{#55977}

Fixing clang-tidy warning.

Bug: v8:8015
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I2204967cff3e50d967a9c6f4685f0df5a6ba84af
Reviewed-on: https://chromium-review.googlesource.com/1226793Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Florian Sattler <sattlerf@google.com>
Cr-Commit-Position: refs/heads/master@{#55976}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/dc14f7b..c4b8ad9

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/c9dc040..460fd88

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/2174136..ea4301e

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/9bd40b2..b170cc8

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: Ia2de587c342206cebb46cc65e72f378e2e1303c6
Reviewed-on: https://chromium-review.googlesource.com/1229616Reviewed-by: V8 Autoroller <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: V8 Autoroller <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#55975}

Add tests.

Bug: v8:5367
Cq-Include-Trybots: luci.chromium.try:linux_chromium_headless_rel;master.tryserver.blink:linux_trusty_blink_rel
Change-Id: I2a4215a87ba1dae98c4b25547494165f534b4a66
Reviewed-on: https://chromium-review.googlesource.com/1218046
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55974}

R=joransiu@ca.ibm.com

Change-Id: I975eb3eb0e896b4409e923638f5644dd404e8689
Reviewed-on: https://chromium-review.googlesource.com/1228640Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#55973}

- Removes ApiNativeType enum, using InstanceType instead.
- Replaces switch with JSObject::GetInstanceSize call.

Bug: v8:8015
Change-Id: I1c952792a068ec4f46a03ec47dce578d632e7cc3
Reviewed-on: https://chromium-review.googlesource.com/1199905Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55972}