Use the base::bits::SignedAddOverflow32() function instead, which
performs an addition and checks for overflow.

Bug: v8:5267, v8:7109
Change-Id: I20a5316957a3f72131d318282e8b8e8bb500b4a7
Reviewed-on: https://chromium-review.googlesource.com/797451Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51028}

It was already always high-resolution on POSIX but was never high
resolution on Windows. Windows does support low latency high-resolution
timers for the majority of our user base.

TimeTicks::HighResolutionNow() was only explicitly requested in testing
frameworks. As such I left the call in place but made it DCHECK that
it's running on a Windows machine on which high-resolution clocks are
used. This confirms that none of our test fleet has regressed with this
change (the previous HighResolutionNow() used to be slightly more
aggressive and also do it in a few configurations where we now fallback
to low-resolution now).

This implementation was copied as-is (modulo minor v8 API
compatibility tweaks). These implementations were the same in the
past but had diverged when, sadly, the same bug was fixed separately
years apart, in Chromium and V8:
chromium: https://codereview.chromium.org/1284053004 + https://codereview.chromium.org/2393953003
v8: https://codereview.chromium.org/1304873011

This is a prerequisite to add metrics around parallel task execution
(low-resolution clocks are useless at that level, but we also don't want
to incur high-latency clocks on machines that can't afford it cheaply).

Bug: chromium:807606
Change-Id: Id18e7be895d8431ebd0e565a1bdf358fe7838489
Reviewed-on: https://chromium-review.googlesource.com/897485Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Gabriel Charette <gab@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51027}

Change-Id: I2e9a6e706d75a579033a3bdaf275a5af4512c8d1
Reviewed-on: https://chromium-review.googlesource.com/897492Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51026}

System tests updated to pass. I will cleanup the code in a
separate CL removing the old code.

Bug: v8:6917
Change-Id: Ie49efe06c43faade846e322b35c4a2068137a88b
Reviewed-on: https://chromium-review.googlesource.com/897565Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michał Majewski <majeski@google.com>
Cr-Commit-Position: refs/heads/master@{#51025}

Bug: v8:6917
Change-Id: Ibc6a7e049a17b8f9bef6b2f5cb187c11f89cf638
Reviewed-on: https://chromium-review.googlesource.com/897564Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michał Majewski <majeski@google.com>
Cr-Commit-Position: refs/heads/master@{#51024}

Bug: v8:6917
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: Id5a7b41502dfd4be43496b1edb958522a8eb0c31
Reviewed-on: https://chromium-review.googlesource.com/895588
Commit-Queue: Michał Majewski <majeski@google.com>
Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51023}

See https://chromium-review.googlesource.com/c/v8/v8/+/869932

Bug: v8:6972
Change-Id: I012210a31265adb7f7038a9b447f24e2d40ebca7
Reviewed-on: https://chromium-review.googlesource.com/895762Reviewed-by: Franziska Hinkelmann <franzih@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Franziska Hinkelmann <franzih@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51022}

Because of complexity macro instructions LDC1 and SDC1, which use
temporary registers on MIPS32, trampolines are prevented in these
instructions.

TEST=
BUG=

Change-Id: I40f50853f8dad195814007894ba1ad7c77c01892
Reviewed-on: https://chromium-review.googlesource.com/897422Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#51021}

R=machenbach@chromium.org

Change-Id: I9ecd8ef2e34a49b969e3fe38a7daea06ef4b7274
Reviewed-on: https://chromium-review.googlesource.com/895536Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51020}

Otherwise bots with a low number of cores will hang trying to schedule
a mere 4 tasks.
This change allowing scheduling of an arbitrary number of test tasks,
the count was also augmented to better stress test the system.

Bug: chromium:805932
Change-Id: Ia10cd583c0675c256b4fd5d2765b50855d77a7f9
Reviewed-on: https://chromium-review.googlesource.com/895584
Commit-Queue: Gabriel Charette <gab@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51019}

The case that required it is no longer in the tree.

Change-Id: Ie4c82f2799c381a5a5f2f57e7e3255ebb69f02b6
Reviewed-on: https://chromium-review.googlesource.com/893262Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51018}

R=machenbach@chromium.org

Fixes https://github.com/nodejs/node/issues/15784

Change-Id: I4453023a5a6c8ace45b898ea227870fb6cbc20b2
Reviewed-on: https://chromium-review.googlesource.com/893261
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51017}

That patch introduces EmbedderGraph interface that embedders can use to
represent C++ objects that retain or are retained by V8 JS objects.

The heap snapshot generator adds nodes and edges of the EmbedderGraph to
the heap snapshot, allowing arbitrarily complex retaining paths that
cross V8/Embedder boundary.

The new functionality is enabled only if the embedder sets the
BuildEmbedderGraph callback.


Bug: chromium:749490

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I10a1fa000d6d4ba47fc19d84c7cfc2c619d496fc
Reviewed-on: https://chromium-review.googlesource.com/890521Reviewed-by: Alexei Filippov <alph@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51016}

If enabled, this mode moves code for isolate-independent builtins off
the JS heap at Isolate creation. The Code object itself is rewritten
to tail-call the off-heap instruction stream.

Drive-by-fix: Support lazy deserialization in asm-wasm instantiation.

Bug: v8:6666
Change-Id: Ic109527ff478cfc6e8942e924413fc7532da6eaf
Reviewed-on: https://chromium-review.googlesource.com/888562Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51015}

This is a reland of 957ac364.

To avoid a race condition TSAN found when accessing FLAG_turbo_disable_switch_jump_table
in the InstructionSelector, this now threads the flag through the CompilationInfo.

Original change's description:
> [turbofan] disable indirect jumps in Turbofan generated switches
>
> Bug:
> Change-Id: I326bf518f895e7c030376210e7797f3dd4a9ae1f
> Reviewed-on: https://chromium-review.googlesource.com/873643
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#50984}

Change-Id: I76c2804f140cc116e30881bfd05365a09240e605
Reviewed-on: https://chromium-review.googlesource.com/895643Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51014}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/2e93695..8222c43

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/7c98d04..f384e37

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: I6b305ee31207bee9fcc8ed36a7347b9ed3452fdc
Reviewed-on: https://chromium-review.googlesource.com/896804Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51013}

Change-Id: I46a46bacda356b838f3b7a7a9c7fb79f703dbae3
Reviewed-on: https://chromium-review.googlesource.com/892497Reviewed-by: Aseem Garg <aseemgarg@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Jing Bao <jing.bao@intel.com>
Cr-Commit-Position: refs/heads/master@{#51012}

--- Optimized code ---
optimization_id = 26
kind = OPTIMIZED_FUNCTION
compiler = turbofan
...
    leaq rcx,[rip+0x0]             => TO BE REDUCED
    movq rcx,[rcx-0x37]            => movq rcx,[rip-0x37]
    testb [rcx+0xf],0x1
    jnz CompileLazyDeoptimizedCode

Change-Id: I06c10ebd33af6524c4ad9ce466fd0880268f4a83
Reviewed-on: https://chromium-review.googlesource.com/880642Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Kanghua Yu <kanghua.yu@intel.com>
Cr-Commit-Position: refs/heads/master@{#51011}

Previously we would directly take the result from a fulfilled native
promise bypassing the microtask queue. This is observably different
from the spec.

Note: Our variant of the bluebird benchmark is heavily favored towards
fulfilled native promises because we don't use setTimeout (unlike the
original benchmark). I suspect this pattern doesn't appear often in
the wild so it's fine to take this hit for now.

PSA for Perf sheriffs: this is going to tank some benchmarks.

Bug: chromium:800651, v8:5691, v8:6007
Change-Id: Ic273bf2195529424b0d87359d28d5267060d5252
Reviewed-on: https://chromium-review.googlesource.com/895416
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51010}

No behavior change since that warning isn't enabled anywhere yet, and
it's opt-in.  This is a prerequisite for
https://chromium-review.googlesource.com/c/chromium/src/+/895726

Whil here, also remove -Wsign-compare, since that's enabled by default for -Wextra
(http://llvm-cs.pcc.me.uk/tools/clang/include/clang/Basic/DiagnosticGroups.td#723)
and v8 builds with the chromium_code config which sets -Wextra.

Bug: chromium:177475
Change-Id: I32f140296cab13ed57be08168a3f6b1d1218e4e6
Reviewed-on: https://chromium-review.googlesource.com/895704Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Nico Weber <thakis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51009}

We still avoid the "then" lookup using the current fast-path
mega-guard in the baseline case, but in TurboFan we simply
constant-fold the "then" lookup in the JSCallReducer. So all
further optimizations on Promise#then in TurboFan will automatically
apply to Promise#catch as well.

Bug: v8:7253
Change-Id: Idf7252157375a0ae3a91c7a3b42c30c5f367c0a8
Reviewed-on: https://chromium-review.googlesource.com/895446
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51008}

Port c9941af2

R=rmcilroy@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=chromium:798964
LOG=N

Change-Id: Id1f6a45169a24f06605297a404461a6cbdf78347
Reviewed-on: https://chromium-review.googlesource.com/894305Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#51007}

Bug: v8:7092, v8:7326, chromium:806758
Change-Id: Id8a3bc2455875af9dfdc01619d8217e033099e7e
Reviewed-on: https://chromium-review.googlesource.com/895690
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51006}

TBR=majeski@google.com
NOTRY=true

Bug: v8:6917
Change-Id: I8ca2297ab9641b81a91ee7f8ff594bbe4b9e369b
Reviewed-on: https://chromium-review.googlesource.com/895366Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51005}

A given JSPromise can either be in pending state, and accumulates
reactions, or in settled state, where all reactions are scheduled
as microtasks, and it carries a result. So we can use a single field
on the JSPromise instance to hold both the result and the reactions
and that field is interpreted differently depending on the status of
the JSPromise.

Bug: v8:7253
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I19a7d499c88f452f0d35979ab95deb110021cde9
Reviewed-on: https://chromium-review.googlesource.com/895528Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51004}

This allows base::nullopt to be used instead of base::Optional<Foo>()
and implicit conversion to Optional<T> from T.

Also added NOLINT comments to the implicit constructors.

Change-Id: I4c688045685e2a50e0c0d38a959570f77454ec61
Reviewed-on: https://chromium-review.googlesource.com/893268Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51003}

This prevents unnecessary switching back and forth between internal and
public API boundaries. It is also a step towards making all WebAssembly
internals completely independent of "scheduled exception" values.

R=ahaas@chromium.org

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I46e8cb4fad3d255d9bd20b9c343901a03a25426c
Reviewed-on: https://chromium-review.googlesource.com/895742Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51002}

Implements the saturating opcode i64.trunc_s:sat/f32.

Also does some refactoring of the i32 saturating opcodes use a simplier
solution (calling a single method to handle all i32 values).

Also refactors code so that the remaining i64 saturating conversions
should be easy to add to the wasm compiler.

Bug: v8:7226
Change-Id: I031aca1e059b4baa989a56ecbc16941f591ff9b3
Reviewed-on: https://chromium-review.googlesource.com/887333
Commit-Queue: Karl Schimpf <kschimpf@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51001}

TBR=majeski@google.com
NOTRY=true

Bug: v8:6917
Change-Id: I088dc4492df6c1dda1f86fbd6d7153a46a4117e0
Reviewed-on: https://chromium-review.googlesource.com/895600Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51000}

This downloads the mips tool chain into tools/mips_toolchain via
runhooks if the flag download_mips_toolchain is specified for
gclient.

The currently uploaded version is 2015/1/7.

Bug: chromium:632390
Change-Id: Ied396d1a980db962773a96e9dadd3f282c7541c0
Reviewed-on: https://chromium-review.googlesource.com/892864Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50999}

Bug: v8:6917
Change-Id: I543c232489e6b93f5f98ccf63eea475535d82613
Reviewed-on: https://chromium-review.googlesource.com/893566
Commit-Queue: Michał Majewski <majeski@google.com>
Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50998}

The FeedbackNexus classes initially were one-to-one with IC classes,
but over time this got out of date. We also found Nexus' useful, so
we made more classes even for cases that weren't ICs.

The inheritence and polymorphism became confusing and led to
duplication. Better, to just talk about a (single) FeedbackNexus.

Bug: v8:7344
Change-Id: I509dc9657895d56c3859de6e6589695cdff9e73e
Reviewed-on: https://chromium-review.googlesource.com/890452
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Franziska Hinkelmann <franzih@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50997}

Bug: v8:6917
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: I254d2e545709029346f585b02a9edf91d3f27893
Reviewed-on: https://chromium-review.googlesource.com/893321Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michał Majewski <majeski@google.com>
Cr-Commit-Position: refs/heads/master@{#50996}

This reverts commit 957ac364.

Reason for revert: Breaks roll (crbug.com/v8/7388)

Original change's description:
> [turbofan] disable indirect jumps in Turbofan generated switches
> 
> Bug: 
> Change-Id: I326bf518f895e7c030376210e7797f3dd4a9ae1f
> Reviewed-on: https://chromium-review.googlesource.com/873643
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#50984}

TBR=jarin@chromium.org,tebbi@chromium.org

Change-Id: Id2546e722179e6d8f2f102ce02fb18d696a79764
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/894385Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50995}

Bug: v8:6917
Change-Id: Ie18390ae0849e8d5341e4c2a7b757fae886c2986
Reviewed-on: https://chromium-review.googlesource.com/895582
Commit-Queue: Michał Majewski <majeski@google.com>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50994}

R=clemensh@chromium.org
BUG=chromium:807508

Change-Id: I0b90b93a796c67f557e392cf6123a48cd0942bd7
Reviewed-on: https://chromium-review.googlesource.com/895303Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50993}

The hash avoids assigning all CHECK failures to the same clusterfuzz
report.

Bug: chromium:805970
Change-Id: Ia52da335ea86fbc7cc924dd81a893722a6d3d92e
Reviewed-on: https://chromium-review.googlesource.com/894323Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50992}

The fuzzer found a couple of cases that exploited comments of the
form:

  function test() {
    const re = /*.../;
    const str = '...*/...';
    let result;
    try { result = re.exec(str); } catch (e) { /* ... */ }
  }

Note that the first line does not contain a regexp literal, it starts
a comment instead. The second line terminates the comment.

This fixes detection of such cases by initializing `result` to null.

TBR=yangguo@chromium.org

Bug: chromium:805970
Change-Id: I5d46db9892e2b4e71cdc2907cebf07a2e33b7a0e
Reviewed-on: https://chromium-review.googlesource.com/894403Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50991}

Bug: chromium:806388
Change-Id: Ieb343f0d532c16b6102e85222b77713f23bacf8c
Reviewed-on: https://chromium-review.googlesource.com/894942Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50990}

Bug: v8:6917
Change-Id: I562680ebbc4b3140fb0e5be7cab7d5ebb658bbac
Reviewed-on: https://chromium-review.googlesource.com/893272Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Commit-Queue: Michał Majewski <majeski@google.com>
Cr-Commit-Position: refs/heads/master@{#50989}