BUG=v8:5294

Review-Url: https://codereview.chromium.org/2662393004
Cr-Commit-Position: refs/heads/master@{#42857}

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2667123002
Cr-Commit-Position: refs/heads/master@{#42856}

Using .caller, one can get access to the internal function that invokes the
handler passed to Promise.prototype.then.  This internal function is a TF
builtin that was set up as non-native and without an argument adaptor.  As a
consequence of this, when accessing .arguments on it, the frame-walking logic in
the .arguments accessor thinks the number of arguments is -1 and we try to
allocate an array of size -1.

This CL marks the builtin function as native (making its .arguments be null),
along with a few others that may have been incorrect in the same way.

BUG=chromium:682349

Review-Url: https://codereview.chromium.org/2672453002
Cr-Commit-Position: refs/heads/master@{#42855}

Move set_native(true) from InstallFunction into CreateFunction in order to
emphasize the places where we create non-native functions.

No change in semantics overall.

BUG=

Review-Url: https://codereview.chromium.org/2667993005
Cr-Commit-Position: refs/heads/master@{#42854}

This is the first step to reduce the size of the out-of-line code of
TrapIf. Instead of passing the context to the runtime call as a
parameter, we pass Smi::kZero to the runtime call and then get the
actual context from the WasmFrame on the stack.

BUG=v8:5908
R=titzer@chromium.org, clemensh@chromium.org

Review-Url: https://codereview.chromium.org/2664273002
Cr-Commit-Position: refs/heads/master@{#42853}

Properly attribute all builtins, bytecode handlers and other stubs to
the calling function unless --separate-ic is passed.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2668953002
Cr-Original-Commit-Position: refs/heads/master@{#42849}
Committed: https://chromium.googlesource.com/v8/v8/+/42011d29975898c3648241749cf1e96eac074b85
Review-Url: https://codereview.chromium.org/2668953002
Cr-Commit-Position: refs/heads/master@{#42852}

Revert of [tools] Fix RegExp for ticksprocessor. (patchset #2 id:20001 of https://codereview.chromium.org/2668953002/ )

Reason for revert:
AAAAAHHHHHHH

Original issue's description:
> [tools] Fix RegExp for ticksprocessor.
>
> Properly attribute all builtins, bytecode handlers and other stubs to
> the calling function unless --separate-ic is passed.
>
> R=jarin@chromium.org
> NOTRY=true
>
> Review-Url: https://codereview.chromium.org/2668953002
> Cr-Commit-Position: refs/heads/master@{#42849}
> Committed: https://chromium.googlesource.com/v8/v8/+/42011d29975898c3648241749cf1e96eac074b85

TBR=jarin@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2664033005
Cr-Commit-Position: refs/heads/master@{#42851}

I removed some constant folding optimizations for float instruction in
https://codereview.chromium.org/2647353007 because they were incorrect
if the input was a signalling NaN. Removing these optimizations, however
had an unexpectedly big impact on asm.js performance. With this CL I
restore the optimizations again when the source origin is not wasm. In
JavaScript signalling NaNs are not observable and therefore the
optimizations are correct.

R=titzer@chromium.org
BUG=chromium:686654

Review-Url: https://codereview.chromium.org/2666903002
Cr-Commit-Position: refs/heads/master@{#42850}

Properly attribute all builtins, bytecode handlers and other stubs to
the calling function unless --separate-ic is passed.

R=jarin@chromium.org
NOTRY=true

Review-Url: https://codereview.chromium.org/2668953002
Cr-Commit-Position: refs/heads/master@{#42849}

This is sound because the slot never changes, and it enables optimization by
JSContextSpecialization.

R=mstarzinger@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2662093004
Cr-Commit-Position: refs/heads/master@{#42848}

Review-Url: https://codereview.chromium.org/2666783007
Cr-Commit-Position: refs/heads/master@{#42847}

Reland of:
https://codereview.chromium.org/2592663004/

BUG=chromium:656900
TBR=yangguo@chromium.org, glider@chromium.org, titzer@chromium.org

Change-Id: I89b5c6b7a4214e25b4fea6d2ee33cd31b47320cc
Reviewed-on: https://chromium-review.googlesource.com/435319Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#42846}

Revert of [turbofan] Constant propagation for JumpIfFalse/JumpIfTrue. (patchset #4 id:60001 of https://codereview.chromium.org/2666283002/ )

Reason for revert:
Breaks win64 it seems.

Original issue's description:
> [turbofan] Constant propagation for JumpIfFalse/JumpIfTrue.
>
> The JumpIfFalse and JumpIfTrue bytecodes test the accumulator, and
> branch based on whether the accumulator is true or false (no other
> value allowed, and in fact TurboFan would blow up if you would pass
> anything else, since Branch operator can only deal with Boolean).
> So for either branch we know exactly the value of the accumulator,
> and we can update the environment to this constant value instead.
>
> This helps to avoid the useless bit materialization that currently
> happens when || or && is being used in a value context.
>
> R=jarin@chromium.org
> BUG=v8:5267
>
> Review-Url: https://codereview.chromium.org/2666283002
> Cr-Commit-Position: refs/heads/master@{#42843}
> Committed: https://chromium.googlesource.com/v8/v8/+/158ac9287193f315342ad31c38fe451620d176eb

TBR=jarin@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2668933002
Cr-Commit-Position: refs/heads/master@{#42845}

The function being tested is forced to go through Turbofan anyway (since it references a module variable).

Adding --turbo explicitly just to make a check happy.

BUG=

Review-Url: https://codereview.chromium.org/2664393003
Cr-Commit-Position: refs/heads/master@{#42844}

The JumpIfFalse and JumpIfTrue bytecodes test the accumulator, and
branch based on whether the accumulator is true or false (no other
value allowed, and in fact TurboFan would blow up if you would pass
anything else, since Branch operator can only deal with Boolean).
So for either branch we know exactly the value of the accumulator,
and we can update the environment to this constant value instead.

This helps to avoid the useless bit materialization that currently
happens when || or && is being used in a value context.

R=jarin@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2666283002
Cr-Commit-Position: refs/heads/master@{#42843}

The String.prototype was altered after snapshot time (during
experimental natives setup), invalidating the stored map used for
fast-path checks.

BUG=

Review-Url: https://codereview.chromium.org/2663303003
Cr-Commit-Position: refs/heads/master@{#42842}

The InstructionSelector on x64 didn't properly implement
VisitWord32Equal via VisitWordCompareZero, and thus it didn't
properly combined useless Word32Equal comparisons with zero
(which we use to implement bit negation).

R=jarin@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2662123004
Cr-Commit-Position: refs/heads/master@{#42841}

Rename to Construct and ConstructWithSpread, to match the names of
the JSOperators used.

Unfortunately, I can't find a way for auto-formatting to stay happy unless we
change the indentation for the whole BYTECODE_LIST macro.

Review-Url: https://codereview.chromium.org/2663963003
Cr-Commit-Position: refs/heads/master@{#42840}

We already had an optimization in the CommonOperatorReducer that would
duplicate a Return with Phi, EffectPhi and Merge inputs into the
respective branches. But we can also do the same if the effect input of
the Return dominates all branches, i.e. if the Return and Phi nodes are
the only users of the Merge node.

This helps with the awkward code generation that we currently observe
for || and && in return position.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2668903002
Cr-Commit-Position: refs/heads/master@{#42839}

This implements storing named captures on the regexp result object.
For instance, /(?<a>.)/u.exec("b") will return a result such that:

result.group.a  // "b"

https://tc39.github.io/proposal-regexp-named-groups/

BUG=v8:5437

Review-Url: https://codereview.chromium.org/2630233003
Cr-Original-Original-Original-Commit-Position: refs/heads/master@{#42532}
Committed: https://chromium.googlesource.com/v8/v8/+/70000946eb2a9155679528702a766219a1fcf154
Review-Url: https://codereview.chromium.org/2630233003
Cr-Original-Original-Commit-Position: refs/heads/master@{#42570}
Committed: https://chromium.googlesource.com/v8/v8/+/ee94fa11ed63477393c6534c352ebac6e502396c
Review-Url: https://codereview.chromium.org/2630233003
Cr-Original-Commit-Position: refs/heads/master@{#42676}
Committed: https://chromium.googlesource.com/v8/v8/+/8bf52534f6bf86821a1589dcbcb7335052c1f94f
Review-Url: https://codereview.chromium.org/2630233003
Cr-Commit-Position: refs/heads/master@{#42838}

BUG=

Review-Url: https://codereview.chromium.org/2659573002
Cr-Commit-Position: refs/heads/master@{#42837}

Review-Url: https://codereview.chromium.org/2662263002
Cr-Commit-Position: refs/heads/master@{#42836}

BUG=v8:5516

Review-Url: https://codereview.chromium.org/2666053003
Cr-Commit-Position: refs/heads/master@{#42835}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/02f71fd..47e07d6

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/buildtools/+log/c302711..a7cc7a3

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/986b4e8..4ee31ea

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2663373002
Cr-Commit-Position: refs/heads/master@{#42834}

Previously we allowed unreachable returns to be skipped.
This won't work if we strictly follow the spec.

BUG=None
TEST=Manual against more strict wasm validation
R=titzer@chromium.org,rossberg@chromium.org

Review-Url: https://codereview.chromium.org/2668873003
Cr-Commit-Position: refs/heads/master@{#42833}

Revert of [Turbofan] Macro-ize instruction selection for ia32. (patchset #1 id:1 of https://codereview.chromium.org/2669683002/ )

Reason for revert:
Breaks Issue 1398

Original issue's description:
> [Turbofan] Macro-ize instruction selection for ia32.
> - Uses macros to reduce code duplication.
> - Uses calls to VisitRO, VisitRR, VisitRROFloat, and VisitFloatUnop to
>   reduce code bloat.
>
> LOG=N
> BUG=v8:4124
>
> Review-Url: https://codereview.chromium.org/2669683002
> Cr-Commit-Position: refs/heads/master@{#42830}
> Committed: https://chromium.googlesource.com/v8/v8/+/5e6eb91d0d66c9a118f1cc576accb649a17c5a9d

TBR=titzer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2664403002
Cr-Commit-Position: refs/heads/master@{#42832}

Revert of [Turbofan] Macro-ize instruction selection for x64. (patchset #1 id:1 of https://codereview.chromium.org/2668753004/ )

Reason for revert:
Breaks array_concat

Original issue's description:
> [Turbofan] Macro-ize instruction selection for x64.
> - Uses macros to reduce code duplication.
> - Uses calls to VisitRO and VisitRR to reduce code bloat.
>
> LOG=N
> BUG=v8:4124
>
> Review-Url: https://codereview.chromium.org/2668753004
> Cr-Commit-Position: refs/heads/master@{#42828}
> Committed: https://chromium.googlesource.com/v8/v8/+/e8e2e3c826d42490f809e1c45750bbb438b60d8c

TBR=titzer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2668053004
Cr-Commit-Position: refs/heads/master@{#42831}

- Uses macros to reduce code duplication.
- Uses calls to VisitRO, VisitRR, VisitRROFloat, and VisitFloatUnop to
  reduce code bloat.

LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2669683002
Cr-Commit-Position: refs/heads/master@{#42830}

- Uses macros to reduce code duplication.
- Uses calls to VisitRR and VisitRRR to reduce code bloat.

LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2668633003
Cr-Commit-Position: refs/heads/master@{#42829}

- Uses macros to reduce code duplication.
- Uses calls to VisitRO and VisitRR to reduce code bloat.

LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2668753004
Cr-Commit-Position: refs/heads/master@{#42828}

Throw a syntax error on "new import(1)"  expression. Adds a new error msg as well.

BUG=v8:5785

Review-Url: https://codereview.chromium.org/2661113002
Cr-Commit-Position: refs/heads/master@{#42827}

Also updated some tests due to the change. The general pattern is when a
trailing comma is expected to cause a SyntaxError, an additional comma was
added.

BUG=v8:5051
CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_trusty_blink_rel

Review-Url: https://codereview.chromium.org/2638513002
Cr-Commit-Position: refs/heads/master@{#42826}

BUG=v8:5516
R=vogelheim@chromium.org

Review-Url: https://codereview.chromium.org/2661173003
Cr-Commit-Position: refs/heads/master@{#42825}

[parser] Skipping inner funcs: make preparser scope analysis test work w/ destructuring declarations.

If hidden scopes are ignored, the scopes and variable produced by the PreParser
already matched the scopes and variables produced by the Parser.

BUG=v8:5516
R=vogelheim@chromium.org

Review-Url: https://codereview.chromium.org/2663043003
Cr-Commit-Position: refs/heads/master@{#42824}

Revert of [wasm] include JS conformance tests in Wasm mjsunit tests (patchset #5 id:80001 of https://codereview.chromium.org/2660903003/ )

Reason for revert:
http://crbug.com/687279

Original issue's description:
> [wasm] include JS conformance tests in Wasm mjsunit tests
>
> BUG=
>
> Review-Url: https://codereview.chromium.org/2660903003
> Cr-Commit-Position: refs/heads/master@{#42821}
> Committed: https://chromium.googlesource.com/v8/v8/+/eb9b5edffb8c5acb0abdff0729901f95dbd3ccac

TBR=mtrofin@chromium.org,titzer@chromium.org,bradnelson@chromium.org,eholk@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review-Url: https://codereview.chromium.org/2663063005
Cr-Commit-Position: refs/heads/master@{#42823}

BUG=v8:4741

Review-Url: https://codereview.chromium.org/2658143003
Cr-Commit-Position: refs/heads/master@{#42822}

BUG=

Review-Url: https://codereview.chromium.org/2660903003
Cr-Commit-Position: refs/heads/master@{#42821}

Rewrites import expression into a runtime call. Uses peekahead to
determine if parsing an import declaration or import expression.

The runtime call doesn't actually do the import yet, will be added in
follow on patch.

Adds a new --harmony-dynamic-import flag.

Adds a ignore_error_msg parameter to the test runner to ignore the
discrepancy in the error messages while parsing import expression with
parser and pre parser. This discrepancy will actually never happen in
real code.

BUG=v8:5785

Review-Url: https://codereview.chromium.org/2661933003
Cr-Commit-Position: refs/heads/master@{#42820}

BUG=v8:5501

Review-Url: https://codereview.chromium.org/2661233002
Cr-Commit-Position: refs/heads/master@{#42819}

R=joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2661133004
Cr-Commit-Position: refs/heads/master@{#42818}