- Throw TypeError in ValidateTypedArray, matching JSC, SpiderMonkey
  and ChakraCore.
- Validate typed arrays at start of each typed array prototype
  methods in src/js/typedarrays.js
- Add tests to check detached buffers
- Remove an unnecessary parameter of TypedArraySpeciesCreate
  in src/js/typedarrays.js
- Standardize TypedArray.prototype.subarray
- Update test262.status to pass detached buffer tests

Reland of https://codereview.chromium.org/2778623003

BUG=v8:4648, v8:4665, v8:4953
CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_trusty_blink_rel

Review-Url: https://codereview.chromium.org/2827443002
Cr-Commit-Position: refs/heads/master@{#44878}

Previously API function calls would only be optimized in TurboFan when
the receiver was a (compile-time) known constant, which was probably
only true for certain cases where functions where called on the global
proxy (the window object).

BUG=v8:5267,v8:6304
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2839953002
Cr-Commit-Position: refs/heads/master@{#44877}

Although we currently only support up to 1GB memory, we want to raise
this issue in the future. This test illustrates several issues we need
to be sure to fix first.

Bug: v8:6306
Change-Id: I362b7a9e51e8eb33a50e3b172a6f01d41995c3cb
Reviewed-on: https://chromium-review.googlesource.com/487047
Commit-Queue: Brad Nelson <bradnelson@chromium.org>
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44876}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/87cefe1..95c219b

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/892a0b6..380124f

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/5d201de..dc087f5

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: I2e0f396b5c52ab4d40318b2856852a4f4a0f2942
Reviewed-on: https://chromium-review.googlesource.com/487561Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44875}

We should be ready for gone agent.

BUG=chromium:714819
R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2842903002
Cr-Commit-Position: refs/heads/master@{#44874}

BUG=chromium:714486
R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2834363003
Cr-Commit-Position: refs/heads/master@{#44873}

Port 46d0e481

Original Commit Message:

    The CallApiCallbackStub can avoid loading undefined in case the
    call_data is already undefined, which doubles the number of versions of
    the stub and adds unnecessary complexity (at the benefit of saving one
    stupid load). The idea is to turn the CallApiCallbackStub into a single
    builtin instead, which does the right thing, so this is the first step
    towards that goal.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:6304
LOG=N

Review-Url: https://codereview.chromium.org/2837283004
Cr-Commit-Position: refs/heads/master@{#44872}

- introduced pausedContextGroupId,
- added targetContextGroupId param for V8Debugger::continueProgram method.

BUG=chromium:714955
R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2842733002
Cr-Commit-Position: refs/heads/master@{#44871}

Revert of [snapshot] full setup delegate should also be able to deserialize. (patchset #2 id:20001 of https://codereview.chromium.org/2840493002/ )

Reason for revert:
prime suspect for https://bugs.chromium.org/p/chromium/issues/detail?id=714976

Original issue's description:
> [snapshot] full setup delegate should also be able to deserialize.
>
> Also move the responsibility of marking builtins as initialized
> to the deserializer.
>
> R=jkummerow@chromium.org
>
> Review-Url: https://codereview.chromium.org/2840493002
> Cr-Commit-Position: refs/heads/master@{#44802}
> Committed: https://chromium.googlesource.com/v8/v8/+/a2b3a2fbc562584ec298dfe674c97662a125a59e

TBR=jkummerow@chromium.org,yangguo@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.

BUG=chromium:714976

Review-Url: https://codereview.chromium.org/2841993002
Cr-Commit-Position: refs/heads/master@{#44870}

The CallApiCallbackStub can avoid loading undefined in case the
call_data is already undefined, which doubles the number of versions of
the stub and adds unnecessary complexity (at the benefit of saving one
stupid load). The idea is to turn the CallApiCallbackStub into a single
builtin instead, which does the right thing, so this is the first step
towards that goal.

R=yangguo@chromium.org
BUG=v8:6304

Review-Url: https://codereview.chromium.org/2838143003
Cr-Commit-Position: refs/heads/master@{#44869}

Revert of [inspector] always include user scripts in the snapshot. (patchset #3 id:40001 of https://codereview.chromium.org/2836623002/ )

Reason for revert:
So that https://codereview.chromium.org/2841993002/ can be reverted.

Original issue's description:
> [inspector] always include user scripts in the snapshot.
>
> V8 can bundle user scripts in the start up snapshot. These are
> shared across contexts, and do not work well context groups.
>
> R=kozyatinskiy@chromium.org
> BUG=v8:6274
>
> Review-Url: https://codereview.chromium.org/2836623002
> Cr-Commit-Position: refs/heads/master@{#44847}
> Committed: https://chromium.googlesource.com/v8/v8/+/9685cfd310a51b2b32f97223069abaaca77405a8

TBR=kozyatinskiy@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:6274

Review-Url: https://codereview.chromium.org/2840923002
Cr-Commit-Position: refs/heads/master@{#44868}

In preparation for adding another verifier that only considers a subset
of the graph.

BUG=chromium:651354

Review-Url: https://codereview.chromium.org/2844473002
Cr-Commit-Position: refs/heads/master@{#44867}

BUG=chromium:651354

Review-Url: https://codereview.chromium.org/2842803002
Cr-Commit-Position: refs/heads/master@{#44866}

Also add more local variables to regress-v8-6077 to force
register spill on platform with 32 float registers.

BUG=

Review-Url: https://codereview.chromium.org/2822073003
Cr-Commit-Position: refs/heads/master@{#44865}

Evacuators shoud know their associated collector and thus figure out the
marking state themselves.

BUG=chromium:651354

Review-Url: https://codereview.chromium.org/2840863002
Cr-Commit-Position: refs/heads/master@{#44864}

This reverts commit 28930128.

Reason for revert: GC stress failures:
https://build.chromium.org/p/client.v8/builders/V8%20Mac%20GC%20Stress/builds/12958

Original change's description:
> [runtime] Keep FAST_SLOPPY_ARGUMENTS packed
> 
> With this CL SloppyArguments immediately go to dictionary elements on 
> deletion, keeping the arguments backing store packed.
> 
> Bug: v8:6251
> Change-Id: I2afa4fb5f0af9942eee0a1606942f5f289539330
> Reviewed-on: https://chromium-review.googlesource.com/480379
> Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#44857}

TBR=jkummerow@chromium.org,cbruni@chromium.org,v8-reviews@googlegroups.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Change-Id: I9482bf693a745d1301d068869ddae39f11143827
Reviewed-on: https://chromium-review.googlesource.com/486885Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44863}

Bug: chromium:713367
Change-Id: I3f5960f5b2da22c6468ca5a5ea9dc847b30c7fc7
Reviewed-on: https://chromium-review.googlesource.com/486360
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44862}

R=clemensh@chromium.org
TEST=mjsunit/asm/asm-validation
BUG=chromium:715068,v8:5877

Change-Id: I26e0b84c94e5f036336f39e9d764f0588ff3ec0d
Reviewed-on: https://chromium-review.googlesource.com/486882Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44861}

This makes an ObjectVisitor as powerful as a StaticVisitor and allows
slots recording in ObjectVisitor.

This patch also renames VisitCell method of ObjectVisitor to
VisitCellPointer, so that VisitCell is free to be used for actually
visiting a cell.

BUG=chromium:709075

Review-Url: https://codereview.chromium.org/2810653002
Cr-Commit-Position: refs/heads/master@{#44860}

This reverts commit 56a6fda3.

Reason for revert: Makes tsan flaky:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20TSAN/builds/15038

Original change's description:
> [parser] Inital parallel parse tasks implementation.
> 
> While parsing top-level code eager functions are skipped just like lazy
> ones, but also a parse task is created for each.
> 
> The parse tasks are run by the compiler dispatcher and can be executed
> either on background thread or in idle time.
> After parsing of top-level code finishes it waits for all unfinished
> parser tasks - possibly picking up and executing them on current thread.
> Afterwards parse task results are stitched together with top-level AST,
> in case of failures eager functions are treated just like lazy -
> parsing/compilation is retriggered for them in the runtime and proper
> errors are generated (performance is not optimized for error case at
> all).
> 
> BUG=v8:6093
> 
> Change-Id: I718dd2acc8a70ae1b09c2dea2616716605d7b05d
> Reviewed-on: https://chromium-review.googlesource.com/483439
> Commit-Queue: Wiktor Garbacz <wiktorg@google.com>
> Reviewed-by: Marja Hölttä <marja@chromium.org>
> Reviewed-by: Jochen Eisinger <jochen@chromium.org>
> Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#44849}

TBR=marja@chromium.org,vogelheim@chromium.org,jochen@chromium.org,wiktorg@google.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:6093

Change-Id: I17e689efee7d216d28a94a5c8147022ae7e830dd
Reviewed-on: https://chromium-review.googlesource.com/486883Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44859}

Port 3337cccc

Original Commit Message:

    Consistently support calls to host-C-linkage functions with up to 9 arguments
    from the simulator, and check that these limits aren't exceeded accidentally.

R=jgruber@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:6281
LOG=N

Review-Url: https://codereview.chromium.org/2841693003
Cr-Commit-Position: refs/heads/master@{#44858}

With this CL SloppyArguments immediately go to dictionary elements on 
deletion, keeping the arguments backing store packed.

Bug: v8:6251
Change-Id: I2afa4fb5f0af9942eee0a1606942f5f289539330
Reviewed-on: https://chromium-review.googlesource.com/480379
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44857}

Revert of [d8] console methods must not throw. (patchset #1 id:1 of https://codereview.chromium.org/2838143002/ )

Reason for revert:
Breaks no-intl builds.

Original issue's description:
> [d8] console methods must not throw.
>
> R=jarin@chromium.org
> BUG=chromium:714696
>
> Review-Url: https://codereview.chromium.org/2838143002
> Cr-Commit-Position: refs/heads/master@{#44854}
> Committed: https://chromium.googlesource.com/v8/v8/+/87b5b53f6f3321ad33b15e686590da7b57df2ff9

TBR=jarin@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:714696

Review-Url: https://codereview.chromium.org/2840853002
Cr-Commit-Position: refs/heads/master@{#44856}

At the moment all tasks which are spawned during asynchronous
compilation are CancelableTasks. However, we don't ever really cancel
tasks, and in the cases where we do it actually makes no sense.
Additionally, using CancelableTasks causes problems when V8 shuts down.
Therefore this CL switches to normal v8::Tasks instead of
CancelableTasks.

R=clemensh@chromium.org, mtrofin@chromium.org
BUG=v8:6253

Change-Id: Idf972fa042e2614a3b25faa4537416a772990bd3
Reviewed-on: https://chromium-review.googlesource.com/485760Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44855}

R=jarin@chromium.org
BUG=chromium:714696

Review-Url: https://codereview.chromium.org/2838143002
Cr-Commit-Position: refs/heads/master@{#44854}

usage: backport_node.py <v8 dir> <node dir> <commit hash> [--no-review]

R=franzih@chromium.org, machenbach@chromium.org

Review-Url: https://codereview.chromium.org/2838843002
Cr-Commit-Position: refs/heads/master@{#44853}

This patch adds a new interface called RootVisitor and changes the root
iteration functions to accept a RootVisitor instead of an ObjectVisitor.

Future CLs will change ObjectVisitor to provide the host object to all
visiting functions, which will bring it in sync with static visitors.

Having separate visitors for roots and objects removes ambiguity in
VisitPointers and reduces chances of forgetting to record slots.

This is intended as pure refactoring. All places that require behavior
change are marked with TODO and will addressed in future CLs.

BUG=chromium:709075

Review-Url: https://codereview.chromium.org/2801073006
Cr-Commit-Position: refs/heads/master@{#44852}

This fixes propagation of validation failures that happen during the
validation of a heap access expression in {ValidateHeapAccess}.

R=clemensh@chromium.org
TEST=mjsunit/regress/regress-crbug-714971
BUG=chromium:714971

Change-Id: I8f91ac1da34ae50fdde2938f61b6468cdac92b6e
Reviewed-on: https://chromium-review.googlesource.com/486801Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44851}

This CL is purely refactoring, no behavior changes.

Remove InitializeBasedOnLength and combine it with a new Stub-ified
TypedArrayInitialize which now allocates the buffer in both the
on-heap and off-heap cases.

Add TypedArrayInitializeWithBuffer because this was essentially a
special case that didn't share much logic with Initialize.
Factor out the common pieces into SetupTypedArray and AttachBuffer.

We can also always pass in the elementsSize, so there is no need
to calculate this again. LoadMapAndElementsSize is changed to 
LoadMapForType.

This reduces code size by ~8k.

Bug: chromium:711275,chromium:701768
Change-Id: I6ad8701e9c72f53bfd9484725fb82055be568c25
Reviewed-on: https://chromium-review.googlesource.com/483481
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44850}

While parsing top-level code eager functions are skipped just like lazy
ones, but also a parse task is created for each.

The parse tasks are run by the compiler dispatcher and can be executed
either on background thread or in idle time.
After parsing of top-level code finishes it waits for all unfinished
parser tasks - possibly picking up and executing them on current thread.
Afterwards parse task results are stitched together with top-level AST,
in case of failures eager functions are treated just like lazy -
parsing/compilation is retriggered for them in the runtime and proper
errors are generated (performance is not optimized for error case at
all).

BUG=v8:6093

Change-Id: I718dd2acc8a70ae1b09c2dea2616716605d7b05d
Reviewed-on: https://chromium-review.googlesource.com/483439
Commit-Queue: Wiktor Garbacz <wiktorg@google.com>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44849}

We collect function data for 2 purposes:
- Variable allocation data for lazy parsed functions which contain skippable functions.
- Data needed for creating FunctionLiterals for skippable functions.

In some cases, recompilation happens, and we need to make sure we're not trying
to skip a non-skippable function.

At the moment, we don't collect data for eagerly parsed scopes, since the
assumption is that they'll never get recompiled. (Fixing that will bigger design
changes.)

After this, we're down to 2 failures for mjsunit + --experimental-preparser-scope-analysis.


BUG=v8:5516

Change-Id: I704d488269f6d20a4b14596f2a0acc342ede32cb
Reviewed-on: https://chromium-review.googlesource.com/486802
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44848}

V8 can bundle user scripts in the start up snapshot. These are
shared across contexts, and do not work well context groups.

R=kozyatinskiy@chromium.org
BUG=v8:6274

Review-Url: https://codereview.chromium.org/2836623002
Cr-Commit-Position: refs/heads/master@{#44847}

Traditionally, we had a prefix for a function name of "~" for
unoptimized code and "*" for optimized code. Restore this prefix
in v8/tools/ic-processor. It's really cool to know if an IC was
called from optimized code (often a hint of poor performance!).

NOTRY=true
R=cbruni@chromium.org

Review-Url: https://codereview.chromium.org/2835923004
Cr-Commit-Position: refs/heads/master@{#44846}

This header file is only used from tests.
Also, move the LoadStoreOpcodeOf method (only used in tests) from
wasm-opcodes.h to wasm-macro-gen.h.

R=ahaas@chromium.org

Change-Id: I8d4691be494b5c1fbe3084441329850930bad647
Reviewed-on: https://chromium-review.googlesource.com/486861
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44845}

Ideally they are already filtered on the embedder side. Sometimes
howevever, embedders end up with a Local<T> pointing to a nullptr
object. In this case the best way to filter this is right at the
beginning of the registration process.

BUG=chromium:713667

Review-Url: https://codereview.chromium.org/2836013003
Cr-Commit-Position: refs/heads/master@{#44844}

Adds a micro benchmark in js-perf-test to measure the performance of
compare bytecode handlers.

Bug:v8:4280

Change-Id: Ic86d670f8f09147076a22cfeff2e1ec052afe20c
Reviewed-on: https://chromium-review.googlesource.com/485522Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44843}

Instead of using the WASM_I32V_* macros (and other) from
wasm-macro-gen.h, use the appropriate methods to encode LEB integers.
This also saves some spaces for the wasm bytecode generated from asm.js.

Specifically, this CL
1) renames EmitVarInt to EmitI32V and EmitVarUint to EmitU32V (on
   WasmFunctionBuilder).
2) introduces more methods on the WasmFunctionBuilder to emit i64v,
   u64v, f32, and f64 values.
3) uses the ZoneBuffer instead of a plain ZoneVector<char> in the
   WasmFunctionBuilder to build the body of the function.
4) introduces more helper functions on the ZoneBuffer to encode i64v,
   u64v, f32 and f64 values.

R=ahaas@chromium.org

Change-Id: Ifa59a6a67380ecf9a3823c382daf00855f5bc61e
Reviewed-on: https://chromium-review.googlesource.com/486803Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44842}

Until now JIC and JIALC compact branches were emited without using their
offset. Here we optimize their use by using offset after addition and/or
load immediate operations.

The CL also fixes a problem with deserialization that occurs when a code
object ends with an optimized LUI/AUI and JIC/JIALC instruction pair.
Deserializer processed these instruction pairs by moving to a location
immediately after it, but when this location is the end of the object it
would finish with the current object before doing relocation. This is
fixed by moving the deserializer one instruction before the location of
the instruction pair end.

BUG=

Review-Url: https://codereview.chromium.org/2542403002
Cr-Commit-Position: refs/heads/master@{#44841}

Some of these tests pass the pattern as a string, and in this case
there's a subtle distinction between

"/\u{0041}/"  // Unicode escape interpreted in string literal.

and

"/\\u{0041}/"  // Unicode escape interpreted by regexp parser.

Extend these tests to check both cases.

Thanks littledan@ for pointing this out.

BUG=v8:5437

Review-Url: https://codereview.chromium.org/2839923002
Cr-Commit-Position: refs/heads/master@{#44840}

BUG=v8:6093

Change-Id: I7fa591c70a0db3ce158b9a9aa798ee7cdbaf0ae1
Reviewed-on: https://chromium-review.googlesource.com/485679
Commit-Queue: Wiktor Garbacz <wiktorg@google.com>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44839}