When peeking into descriptor arrays (for Function.prototype.bind
inlining), we need to check the number of descriptors rather than
the length of the DescriptorArray.

Bug: chromium:825045
Change-Id: I55dbe1544e5e4cb8e23d873961c71ed12294d89c
Reviewed-on: https://chromium-review.googlesource.com/991812Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52315}

This reverts commit 6031412e.

Reason for revert: Tanks quite a few benchmarks (crbug.com/827854).

Original change's description:
> [x64] Reuse scratch register for ExternalReference
> 
> This reduces CEntryStub code size by 64 bytes, and reduces CallApiCallbackStub
> by 27 bytes.
> 
> Change-Id: I46479077f61fdae6b260ca28c67df3509dee5c1a
> Reviewed-on: https://chromium-review.googlesource.com/963652
> Commit-Queue: Kanghua Yu <kanghua.yu@intel.com>
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52005}

TBR=bmeurer@chromium.org,kanghua.yu@intel.com
Bug: chromium:827854

# Not skipping CQ checks because original CL landed > 1 day ago.

Change-Id: Ief0905a7bdba86f7b9fd20888eecdfd58bc6ea7d
Reviewed-on: https://chromium-review.googlesource.com/991712Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52314}

Bug: v8:7611
Change-Id: Ia5467fd4da3b385568bcc3f3fdc1a8c56bd6340e
Reviewed-on: https://chromium-review.googlesource.com/987321Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52313}

TBR=sergiyb@chromium.org

Bug: chromium:773297
Change-Id: I51a9cff42adb477bc089a869741e34513426e5b6
Reviewed-on: https://chromium-review.googlesource.com/989715
Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org>
Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52312}

Remove a call to `icu::toUCharPtr()` that wasn't present in other
similar looking call sites either, just reinterpret_cast directly.

Fixes https://github.com/nodejs/node/issues/19656.

Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: If281ce0a39356aa8bd20efb24c3e4b52b06841a3
Reviewed-on: https://chromium-review.googlesource.com/987953Reviewed-by: Daniel Ehrenberg <littledan@chromium.org>
Commit-Queue: Ben Noordhuis <info@bnoordhuis.nl>
Cr-Commit-Position: refs/heads/master@{#52311}

This change makes full 8 GiB guard regions always enabled on 64-bit
platforms.

Additionally, since all Wasm memory allocation paths have some form of
guard regions, this removes and simplifies most of the logic around
whether to enable guard regions.

R=gdeepti@chromium.org

Change-Id: Idf3fbcc11ac70ea2ee7eb88c2173d6a1410395e1
Reviewed-on: https://chromium-review.googlesource.com/985142
Commit-Queue: Eric Holk <eholk@chromium.org>
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52310}

crtdbg.h provides the declarations for _CrtSetReportMode and the _CRT_*
constants. It should have moved in
https://chromium-review.googlesource.com/968244, but the MSVC C++
headers appear to include crtdbg.h transitively, so we only noticed this
on the libc++ Windows buildbot.

Tbr: mlippautz@chromium.org
Bug: chromium:801780
Change-Id: Ia07f6136e4b8d1f25014e00b0b9f662029ab5a2b
Reviewed-on: https://chromium-review.googlesource.com/981399
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52309}

Bug: v8:6600
Change-Id: Ieec3b7b9fcfd278c844c9591164e14247743e218
Reviewed-on: https://chromium-review.googlesource.com/987852Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#52308}

This is a reland of 16aecc5d

Intent to ship:
https://groups.google.com/d/msg/v8-users/ShhW0Xewph0/1-OT9q0_DQAJ

Originally reviewed at:
Reviewed-on: https://chromium-review.googlesource.com/981596

Bug: v8:6791
Change-Id: I772af807b9486081d7cd96b538bf5bc98d4dcffe
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng;luci.v8.try:v8_linux_blink_rel
Reviewed-on: https://chromium-review.googlesource.com/984857Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52307}

TBR=sergiyb@chromium.org

Bug: chromium:616879
No-Try: true
Change-Id: I55d89aa3ef4cd2a112fd6ff3b4e977d73117c747
Reviewed-on: https://chromium-review.googlesource.com/983414
Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org>
Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52306}

Because the GC is not aware of address space usage, this CL causes Wasm to
explicitly trigger a GC when its address space limit is reached in hopes of
being able to successfully allocate memory.

R=mlippautz@chromium.org
R=gdeepti@chromium.org

Change-Id: I2dcc560dd3d351dbfc4dda2f7c321c470a4d9fff
Reviewed-on: https://chromium-review.googlesource.com/985103Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Eric Holk <eholk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52305}

Port f0f22341

Original Commit Message:

    Add Rcpps and Rsqrtps macros.
    Rename SIMD_UNOP macros.

R=jing.bao@intel.com, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I269f553353827a2f36271cdc27c336438cb6488b
Reviewed-on: https://chromium-review.googlesource.com/986279Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#52304}

We cannot rely on base::OS::GetCurrentProcessId() as it is sandboxed.

BUG=chromium:823874

Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel
Change-Id: I6aaa7f7f7dacbc8aba43581f9d489e4cc47799ff
Reviewed-on: https://chromium-review.googlesource.com/985425Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
Commit-Queue: Alexei Filippov <alph@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52303}

R=titzer@chromium.org

Change-Id: I7c467adaff73ed0d3836edfeac435e5065d99892
Reviewed-on: https://chromium-review.googlesource.com/983774Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52302}

Register x25 is not reserved for anything else, so return it to the
Turbofan register allocator.

Change-Id: Ic905831683a825a1e1dd682552fd459dfc2323fe
Reviewed-on: https://chromium-review.googlesource.com/980976Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Martyn Capewell <martyn.capewell@arm.com>
Cr-Commit-Position: refs/heads/master@{#52301}

Optimize implementation of i32_set_cond using new macro-assembler
instruction LoadZeroOnCondition. This way, emitting branches is
avoided.

Bug: v8:6600
Change-Id: Icccb2f3714645851fac68a666ddb33db4a9d8062
Reviewed-on: https://chromium-review.googlesource.com/985976
Commit-Queue: Sreten Kovacevic <sreten.kovacevic@mips.com>
Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#52300}

R=leszeks@chromium.org, mythria@chromium.org

Bug: v8:7554
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I3eb29d67dfa64887fb52ac706d069e15dd2d0e85
Reviewed-on: https://chromium-review.googlesource.com/980944Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52299}

This CL prepares ground for adding CSA implementation of TransitionArray lookup.

Bug: v8:7310
Change-Id: Ie82e4db8f8a0cdb1dd7bbb759fd60ad55855fe72
Reviewed-on: https://chromium-review.googlesource.com/983920
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52298}

Properly print the new context types in HeapObjectShortPrint() so we see
what kind of context it is, and the number of context slots.

Bug: v8:7570, v8:7588
Change-Id: I43414996fd953f77e140e8750b2dc4923c9bce95
Reviewed-on: https://chromium-review.googlesource.com/986135Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52297}

For the wasm2js wrappers we have an optimization to call a JavaScript
function directly if the signature of the JavaScript function matches
the signature of the WebAssembly import. However, we are not supposed
to do this optimization if the imported function is a constructor,
because constructors can only be called with `new`. With this CL we
do not apply this optimization when the imported function is a
constructor.

R=titzer@chromium.org

Bug: chromium:824859
Change-Id: I1722367bd865d0b129eadf7d4849182410447179
Reviewed-on: https://chromium-review.googlesource.com/985974Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52296}

Original description:
Code in Isolate::Deinit may trigger a GC, e.g. wasm_engine()->TearDown.
However, the gin platform in Chrome does not allow to post tasks within
Isolate::Deinit. By initializing heap tear down at the beginning of
Isolate::Deinit, we can make that no tasks are posted anymore within
Isolate::Deinit.

R=ulan@chromium.org

Bug: chromium:826105
Change-Id: I28c4d40b3ce3bc58e42acec14e350e04379c0006
Reviewed-on: https://chromium-review.googlesource.com/984534Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52295}

Change-Id: I371804f47264344651bad7f328f114d1cc71cd24
Reviewed-on: https://chromium-review.googlesource.com/980539Reviewed-by: Daniel Clifford <danno@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52294}

This way we can teach the debugger to disable liveness analysis when
running with (potential) breakpoints, so that the developers always
have (read) access to all scoped variable values.

Bug: v8:7608, chromium:826613
Change-Id: I7e6cea105f111c99d2620546144201624dfe1d8b
Reviewed-on: https://chromium-review.googlesource.com/985838Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52293}

Rolling v8/base/trace_event/common: https://chromium.googlesource.com/chromium/src/base/trace_event/common/+log/8c1ce86..211b3ed

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/cc2d66c..e7b36e5

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/db4e76d..b1c9ad5

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: I71bffacf7c5032db4be0cfd7d2b3d894aafc28df
Reviewed-on: https://chromium-review.googlesource.com/985463
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52292}

Add Rcpps and Rsqrtps macros.
Rename SIMD_UNOP macros.

Change-Id: I7e9418a835f085cc0fdd31fc3815c17c8f413b67
Reviewed-on: https://chromium-review.googlesource.com/982575Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Jing Bao <jing.bao@intel.com>
Cr-Commit-Position: refs/heads/master@{#52291}

Just a simple cleanup CL. TryAllocateBackingStore function is only needed in
wasm-memory.cc, so this makes that stronger by putting it in an anonymous
namespace. Additionally, the whole function is moved to the top of the file.

No functional change.

R=gdeepti@chromium.org

Change-Id: I0c5ea07c1ab81f3083eb75f0a6177c503fc827b5
Reviewed-on: https://chromium-review.googlesource.com/985023Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Eric Holk <eholk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52290}

No-Try: true
Bug: chromium:824214
TBR: hpayer@chromium.org
Change-Id: I8095da413b5ca0ebba65b264b7310afd88d7a499
Reviewed-on: https://chromium-review.googlesource.com/984872
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52289}

R=clemensh@chromium.org

Bug: v8:7539

Change-Id: I1bd02ba84803055dd9e8b808c17622aa4fca42d4
Reviewed-on: https://chromium-review.googlesource.com/984520Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#52288}

R=joransiu@ca.ibm.com

Change-Id: I066b6d14694393cae43285a71bfc6aff91418505
Reviewed-on: https://chromium-review.googlesource.com/984593Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#52287}

This relands commit 496d0596.

Original change's description:
> [heap] Detect ineffective GCs near the heap limit.
>
> Currently V8 can enter CPU thrashing GC loop near the heap limit. In
> such cases it is better to trigger an out-of-memory failure earlier to
> avoid wasting CPU time and to avoid unresponsiveness.
>
> This patch adds a mechanism for tracking consecutive ineffective GCs.
> A GC is considered ineffective if the heap size after the GC is still
> close to the heap limit and if the average mutator utilization dropped
> below a fixed threshold.
>
> V8 execution is aborted after four consecutive ineffective GCs.
>
> Bug: chromium:824214

TBR: hpayer@chromium.org
Change-Id: Ib09d24d6280078ce6c33519309a2563c70fb68e1
Reviewed-on: https://chromium-review.googlesource.com/980555Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52286}

Change-Id: I9d418605b6fe2180f9812fb529af89fa05e7ab8b
Reviewed-on: https://chromium-review.googlesource.com/984352Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52285}

This reverts commit 3f6686c2.

Reason for revert: https://luci-milo.appspot.com/buildbot/client.v8/V8%20Mac64%20GC%20Stress/196

Original change's description:
> [heap] Initialize the heap tear down at the beginning of Isolate::Deinit
> 
> Code in Isolate::Deinit may trigger a GC, e.g. wasm_engine()->TearDown.
> However, the gin platform in Chrome does not allow to post tasks within
> Isolate::Deinit. By initializing heap tear down at the beginning of
> Isolate::Deinit, we can make that no tasks are posted anymore within
> Isolate::Deinit.
> 
> R=​ulan@chromium.org
> 
> Bug: chromium:826105
> Change-Id: I246c324aa23efe82cc8e7059a1cae5efca33a1b0
> Reviewed-on: https://chromium-review.googlesource.com/983598
> Commit-Queue: Andreas Haas <ahaas@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52283}

TBR=ulan@chromium.org,ahaas@chromium.org

Change-Id: I98461449b16ae8dcf3b03c51daec92df9f5f6366
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:826105
Reviewed-on: https://chromium-review.googlesource.com/984193Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52284}

Code in Isolate::Deinit may trigger a GC, e.g. wasm_engine()->TearDown.
However, the gin platform in Chrome does not allow to post tasks within
Isolate::Deinit. By initializing heap tear down at the beginning of
Isolate::Deinit, we can make that no tasks are posted anymore within
Isolate::Deinit.

R=ulan@chromium.org

Bug: chromium:826105
Change-Id: I246c324aa23efe82cc8e7059a1cae5efca33a1b0
Reviewed-on: https://chromium-review.googlesource.com/983598
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52283}

Launching too many parallel tasks near OOM increases risk of allocation
failure during GC and OOM crash.

Bug: chromium:824214, v8:7605
Change-Id: I336d1f01e4005fb2a8e16ef92f40532b8ed83f2c
TBR: mlippautz@chromium.org
Reviewed-on: https://chromium-review.googlesource.com/983919
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52282}

Bug: v8:7310
Change-Id: I942d038d8d213b394fe5c6e158a5eb0fc32912db
Reviewed-on: https://chromium-review.googlesource.com/983778Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52281}

R=jgruber@chromium.org

Change-Id: I887d31bcb55a52de6fa984bd9b5854f90182cf1f
Reviewed-on: https://chromium-review.googlesource.com/983776Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52280}

The archiving was removed as part of:
https://crrev.com/c/983573

Bug: v8:5881
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: I0c991d4c56c760e6d6ddcaa392e003a46ff96672
Reviewed-on: https://chromium-review.googlesource.com/983772Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52279}

Change-Id: Ifdeda00ad55aa937a6a414e7e566e6640ccd83c0
Reviewed-on: https://chromium-review.googlesource.com/980936Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Daniel Clifford <danno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52278}

All conversions, reinterpretations, promotions and demotions are
implemented in Liftoff on MIPS.

Bug: v8:6600
Change-Id: I8920aea1cabdb59676c2c03fbb6de6156ebf0a62
Reviewed-on: https://chromium-review.googlesource.com/983554Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#52277}

We need to bypass shortcuts when executing accessors defined via FunctionTemplate
if we have break points at function entry.

R=ishell@chromium.org, jgruber@chromium.org

Bug: v8:7596
Change-Id: I0e1bdbbba0f7dcd0fb7fe90d35b18234d073fe94
Reviewed-on: https://chromium-review.googlesource.com/980316
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52276}