Rolling v8/build to 6d9becf753310daf17f04ac4f0d8c109c364cdd2

Rolling v8/buildtools to aa47d9773d8f4d6254a587a1240b3dc023d54f06

Rolling v8/tools/gyp to bac4680ec9a5c55ab692490b6732999648ecf1e9

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2123853004
Cr-Commit-Position: refs/heads/master@{#37568}

Port b86ac0e0

Original commit message:

    Both of these were broken in different ways:
    * On arm, the loop counter was passed as argc on the stack.
    * On arm64, we passed argc + 1 instead of argc.

    The result in both cases was an incorrect receiver for the builtin frame
    when generating stack traces.

R=jgruber@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=v8:4815
LOG=N

Review-Url: https://codereview.chromium.org/2125913004
Cr-Commit-Position: refs/heads/master@{#37567}

Revert of [esnext] ship --harmony-object-values-entries (patchset #1 id:1 of https://codereview.chromium.org/2116053003/ )

Reason for revert:
Revert to see if it addresses the performance regression observed in chromium:625956 in automated graphs

Original issue's description:
> [esnext] ship --harmony-object-values-entries
>
> BUG=v8:4663
> R=littledan@chromium.org, adamk@chromium.org
>
> Committed: https://crrev.com/ab529234853a1768642f8f6c907aaaa5ea8b19bf
> Cr-Commit-Position: refs/heads/master@{#37485}

TBR=adamk@chromium.org,caitpotter88@gmail.com
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=v8:4663

Review-Url: https://codereview.chromium.org/2129533004
Cr-Commit-Position: refs/heads/master@{#37566}

Working on eliminating the use of ClassOf(). This function was checking IS_ARRAYBUFFER.

BUG=

Review-Url: https://codereview.chromium.org/2126603003
Cr-Commit-Position: refs/heads/master@{#37565}

We want to eventually move the profiling functionality out of V8 as library,
this patch exposes TickSample and its APIs in v8-profiler.h so that when
embedders use library, they can have more details.

Minor change: Rename tick-sample.[h|cc] to simulator-helper.[h|cc].

BUG=v8:4789
LOG=N

Review-Url: https://codereview.chromium.org/2105943002
Cr-Commit-Position: refs/heads/master@{#37564}

Port f59a2335

Original commit message:

    Stack trace generation requires access to the receiver; and while the
    receiver is already on the stack, we cannot determine its position
    during stack trace generation (it's stored in argv[0], and argc is only
    stored in a callee-saved register).

    This patch grants access to the receiver by pushing argc onto builtin
    exit frames as an extra argument. Compared to simply pushing the
    receiver, this requires an additional dereference during stack trace
    generation, but one fewer during builtin calls.

R=jgruber@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=v8:4815
LOG=N

Review-Url: https://codereview.chromium.org/2129643002
Cr-Commit-Position: refs/heads/master@{#37563}

PPC: [fullcode][mips][mips64][ppc][s390] Avoid trashing of a home object when doing a keyed store to a super.

Port 43aee033

    Fixed minor typo in ppc file.

R=ishell@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=chromium:625590
LOG=N

Review-Url: https://codereview.chromium.org/2125933002
Cr-Commit-Position: refs/heads/master@{#37562}

Port bd0d9e7d

Original commit message:

    This optimizes the passing of stack parameters in function calls.

    For some architectures (ia32/x64), using pushes when possible instead
    of bumping the stack and then storing parameters generates much
    smaller code, and in some cases is faster (e.g. when a push of a memory
    location can implement a memory-to-memory copy and thus elide an
    intermediate load. On others (e.g. ARM), the benefit is smaller, where
    it's only possible to elide direct stack pointer adjustment in certain cases
    or combine multiple register stores into a single instruction in other limited
    situations. On yet other platforms (ARM64, MIPS), there are no push instructions,
    and this optimization isn't used at all.

    Ideally, this mechanism would be used for both tail calls and normal calls,
    but "normal" calls are currently pretty efficient, and tail calls are very
    inefficient, so this CL sets the bar low for building a new mechanism to
    handle parameter pushing that only needs to raise the bar on tail calls for now.

    The key aspect of this change is that adjustment to the stack pointer
    for tail calls (and perhaps later real calls) is an explicit step separate from
    instruction selection and gap resolution, but aware of both, making it possible
    to safely recognize gap moves that are actually pushes.

R=danno@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2123983002
Cr-Commit-Position: refs/heads/master@{#37561}

Add temporary bots that continuously test with gyp until its
deprecation.

BUG=chromium:474921
NOTRY=true

Review-Url: https://codereview.chromium.org/2123173002
Cr-Commit-Position: refs/heads/master@{#37560}

And in so doing, enable a handful of excluded tests.

BUG=

Review-Url: https://codereview.chromium.org/2127713003
Cr-Commit-Position: refs/heads/master@{#37559}

Reland of [gn] Switch more linux32 bots to gn (patchset #1 id:1 of https://codereview.chromium.org/2128493002/ )

Reason for revert:
Should be fixed after https://codereview.chromium.org/2123223002/

Original issue's description:
> Revert of [gn] Switch more linux32 bots to gn (patchset #3 id:40001 of https://codereview.chromium.org/2122933002/ )
>
> Reason for revert:
> Breaks test isolation on shared library bot.
>
> Original issue's description:
> > [gn] Switch more linux32 bots to gn
> >
> > This switches nosnap and shared library bots to gn.
> >
> > This also unsets external startup data if no snapshot is
> > used.
> >
> > BUG=chromium:474921
> > NOTRY=true
> >
> > Committed: https://crrev.com/ab4d8fc07d9d35e6fc129098f42aa0317a02244a
> > Cr-Commit-Position: refs/heads/master@{#37546}
>
> TBR=vogelheim@chromium.org,jochen@chromium.org
> # Skipping CQ checks because original CL landed less than 1 days ago.
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=chromium:474921
>
> Committed: https://crrev.com/a5fa2984257a50ee9440914c7d1a199f64a86194
> Cr-Commit-Position: refs/heads/master@{#37548}

TBR=vogelheim@chromium.org,jochen@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:474921

Review-Url: https://codereview.chromium.org/2126843002
Cr-Commit-Position: refs/heads/master@{#37558}

HashField is a 32-bit field.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com, bjaideep@ca.ibm.com
BUG=

Review-Url: https://codereview.chromium.org/2117403002
Cr-Commit-Position: refs/heads/master@{#37557}

Because the release_bot mixin includes the 'static' config,
the shared-library bots included both 'static' and 'shared'.

This removes the wrong 'static' config.

BUG=chromium:474921
TBR=vogelheim@chromium.org, jochen@chromium.org

Review-Url: https://codereview.chromium.org/2123243002
Cr-Commit-Position: refs/heads/master@{#37556}

This version of the isolate_driver includes a feature
that automatically derives shared libraries for inclusion.

This is needed for GN as the shared library location is
different compared to gyp and having different configs
would be tedious.

This also removes the shared-library-specific configs as
they are no longer needed with the new driver.

BUG=chromium:474921

Review-Url: https://codereview.chromium.org/2123223002
Cr-Commit-Position: refs/heads/master@{#37555}

R=rossberg@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2127833002
Cr-Commit-Position: refs/heads/master@{#37554}

BUG=v8:5105

Review-Url: https://codereview.chromium.org/2126693003
Cr-Commit-Position: refs/heads/master@{#37553}

Revert of Add crash instrumentation for crbug.com/621147 (patchset #1 id:1 of https://codereview.chromium.org/2114743002/ )

Reason for revert:
Bug found and fixed: crrev.com/7614362b

Instrumentation no longer needed.

Original issue's description:
> Add crash instrumentation for crbug.com/621147
>
> BUG=chromium:621147
> LOG=N
> R=ishell@chromium.org,cbruni@chromium.org
>
> Committed: https://crrev.com/5ff508a82299f20a0d9828cf73072a4f4772fab8
> Cr-Commit-Position: refs/heads/master@{#37328}

TBR=verwaest@chromium.org,cbruni@chromium.org,ishell@chromium.org,mlippautz@chromium.org,adamk@chromium.org
BUG=chromium:621147, chromium:624764

Review-Url: https://codereview.chromium.org/2127813002
Cr-Commit-Position: refs/heads/master@{#37552}

While the test was useful to reproduce the issue locally it creates a lot of
heap pressure and causes all sorts of troubles (OOM, slowness) on the bots, so
let's drop it.

R=hpayer@chromium.org

Review-Url: https://codereview.chromium.org/2127803002
Cr-Commit-Position: refs/heads/master@{#37551}

BUG=608675

Review-Url: https://codereview.chromium.org/2113673002
Cr-Commit-Position: refs/heads/master@{#37550}

BUG=chromium:625823
R=verwaest@chromium.org

Review-Url: https://codereview.chromium.org/2123143002
Cr-Commit-Position: refs/heads/master@{#37549}

Revert of [gn] Switch more linux32 bots to gn (patchset #3 id:40001 of https://codereview.chromium.org/2122933002/ )

Reason for revert:
Breaks test isolation on shared library bot.

Original issue's description:
> [gn] Switch more linux32 bots to gn
>
> This switches nosnap and shared library bots to gn.
>
> This also unsets external startup data if no snapshot is
> used.
>
> BUG=chromium:474921
> NOTRY=true
>
> Committed: https://crrev.com/ab4d8fc07d9d35e6fc129098f42aa0317a02244a
> Cr-Commit-Position: refs/heads/master@{#37546}

TBR=vogelheim@chromium.org,jochen@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:474921

Review-Url: https://codereview.chromium.org/2128493002
Cr-Commit-Position: refs/heads/master@{#37548}

This removes explicit uses of the RUNTIME_ASSERT macro from some runtime
methods. The implicit ones in CONVERT_FOO_ARG_CHECKED will be addressed
in a separate CL for all runtime modules at once.

R=titzer@chromium.org
BUG=v8:5066

Review-Url: https://codereview.chromium.org/2125793002
Cr-Commit-Position: refs/heads/master@{#37547}

This switches nosnap and shared library bots to gn.

This also unsets external startup data if no snapshot is
used.

BUG=chromium:474921
NOTRY=true

Review-Url: https://codereview.chromium.org/2122933002
Cr-Commit-Position: refs/heads/master@{#37546}

This removes explicit uses of the RUNTIME_ASSERT macro from some runtime
methods. The implicit ones in CONVERT_FOO_ARG_CHECKED will be addressed
in a separate CL for all runtime modules at once.

R=yangguo@chromium.org
BUG=v8:5066

Review-Url: https://codereview.chromium.org/2053573004
Cr-Commit-Position: refs/heads/master@{#37545}

This is a quick fix for the hole leaking from generators via the debugger's frame
inspection feature: when collecting the arguments, convert each hole to undefined.
In the long term, we probably want to remember and restore the actual arguments
rather than pushing these dummy arguments on each resume.

BUG=v8:5164

Review-Url: https://codereview.chromium.org/2122923003
Cr-Commit-Position: refs/heads/master@{#37544}

BUG=chromium:621147

Review-Url: https://codereview.chromium.org/2126623003
Cr-Commit-Position: refs/heads/master@{#37543}

We don't explicitly switch off v8_use_external_startup_data
when not using a snapshot. Therefore we also shouldn't assert
this.

BUG=chromium:474921
NOTRY=true

Review-Url: https://codereview.chromium.org/2127633002
Cr-Commit-Position: refs/heads/master@{#37542}

It would be nice for 'jst' to work even when no handle scope has been created yet.

R=cbruni@chromium.org

Review-Url: https://codereview.chromium.org/2119313002
Cr-Commit-Position: refs/heads/master@{#37541}

Rolling v8/build to b0d7c1e69e15dbf1c341d2fa90565f1b497c0f1d

Rolling v8/tools/clang to 5fe81a4bccaa62fa983c0d83b9024e973f293116

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2122603006
Cr-Commit-Position: refs/heads/master@{#37540}

Port 0a0fe8fb

Original commit message:

Import fdlibm versions of acos, acosh, asin and asinh, which are more
    precise and produce the same result across platforms (we were using
    libm versions for asin and acos so far, where both speed and precision
    depended on the operating system so far). Introduce appropriate TurboFan
    operators for these functions and use them both for inlining and for the
    generic builtin.

    Also migrate the Math.imul and Math.fround builtins to TurboFan builtins
    to ensure that their behavior is always exactly the same as the inlined
    TurboFan version (i.e. C++ truncation semantics for double to float
    don't necessarily meet the JavaScript semantics).

    For completeness, also migrate Math.sign, which can even get some nice
    love in TurboFan.

    Drive-by-fix: Some alpha-sorting on the Math related functions, and
    cleanup the list of Math intrinsics that we have to export via the
    native context currently.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=v8:3266,v8:3496,v8:3509,v8:3952,v8:5169,v8:5170,v8:5171,v8:5172
LOG=N

Review-Url: https://codereview.chromium.org/2125723002
Cr-Commit-Position: refs/heads/master@{#37539}

Pointer updating requires the all slots to be valid. If we write zap values in
the sweeper we need to filter out invalid slots before.

BUG=chromium:625748
LOG=N
R=ulan@chromium.org

Review-Url: https://codereview.chromium.org/2122963002
Cr-Commit-Position: refs/heads/master@{#37538}

The dependency would only happen if we have a smi overflow for the length and
have create a heap number. In this case the heap number would've to survive
until the array buffer is collected.

To avoid this dependency we track the length (as we previously used to).

BUG=chromium:625752
LOG=N
TEST=test/mjsunit/regress/regress-625752.js
R=hpayer@chromium.org

This reverts commit 1791d7bb.

Review-Url: https://codereview.chromium.org/2127643002
Cr-Commit-Position: refs/heads/master@{#37537}

This CL removes unnecessary complexity from crankshaft, possible due to the
move of ArrayConstructor to code-stub-assembler. Making the code easier
hopefully helps us find bugs.

BUG=

Review-Url: https://codereview.chromium.org/2117383002
Cr-Commit-Position: refs/heads/master@{#37536}

BUG=chromium:621147

Review-Url: https://codereview.chromium.org/2122943002
Cr-Commit-Position: refs/heads/master@{#37535}

BUG=
R=cbruni@chromium.org

Review-Url: https://codereview.chromium.org/2119823002
Cr-Commit-Position: refs/heads/master@{#37534}

Revert of [heap] Track length for array buffers to avoid free-ing dependency (patchset #2 id:20001 of https://codereview.chromium.org/2122603004/ )

Reason for revert:
[Sheriff] This makes mjsunit/regress/regress-625752 extremely slow on all gc stress bots and leads to timeouts with custom snapshot:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/builds/6602

Original issue's description:
> [heap] Track length for array buffers to avoid free-ing dependency
>
> The dependency would only happen if we have a smi overflow for the length and
> have create a heap number. In this case the heap number would've to survive
> until the array buffer is collected.
>
> To avoid this dependency we track the length (as we previously used to).
>
> BUG=chromium:625748,chromium:625752
> LOG=N
> TEST=test/mjsunit/regress/regress-625752.js
> R=hpayer@chromium.org
>
> Committed: https://crrev.com/ddc75cc1356a58b6cfd63f9da0586e1150496b3d
> Cr-Commit-Position: refs/heads/master@{#37530}

TBR=hpayer@chromium.org,mlippautz@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:625748,chromium:625752

Review-Url: https://codereview.chromium.org/2127483003
Cr-Commit-Position: refs/heads/master@{#37533}

Since the intention of using AllStatic class is to provide classes that
only contain static method functions without member variables so it
doesn't have to be instantiated at all.

However, current implementation only disables dynamic instantiation, and
it can be detected at runtime by reaching UNREACHABLE().  And it can
still have instances allocated inside stack.

This blocks all those cases by deleting default constructor of AllStatic
class to prevent undesirable usage of it.

BUG=
R=jochen@chromium.org

Review-Url: https://codereview.chromium.org/2108273003
Cr-Commit-Position: refs/heads/master@{#37532}

Introduces fused bytecodes for fusing LdaSmi followed by a binary op bytecode.
The chosen bytecodes are used frequently in Octane: AddSmi, SubSmi,
BitwiseOrSmi, BitwiseAndSmi, ShiftLeftSmi, ShiftRightSmi.

There are additional code stubs for these operations that are biased towards
both the left hand and right hand operands being Smis.

BUG=v8:4280
LOG=N

Review-Url: https://codereview.chromium.org/2111923002
Cr-Commit-Position: refs/heads/master@{#37531}

The dependency would only happen if we have a smi overflow for the length and
have create a heap number. In this case the heap number would've to survive
until the array buffer is collected.

To avoid this dependency we track the length (as we previously used to).

BUG=chromium:625748,chromium:625752
LOG=N
TEST=test/mjsunit/regress/regress-625752.js
R=hpayer@chromium.org

Review-Url: https://codereview.chromium.org/2122603004
Cr-Commit-Position: refs/heads/master@{#37530}

This removes the usage of {FrameStateBeforeAndAfter} from the graph
building for count operations. The {JSAdd} or {JSSubtract} node in
question no longer needs the frame-state attached.

R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2127523002
Cr-Commit-Position: refs/heads/master@{#37529}