Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/63fb52b..7571a8a

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: Ibd90b14f080b21f7283a09ea28366f3eafab8df4
Reviewed-on: https://chromium-review.googlesource.com/505557Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45321}

BUG=

Review-Url: https://codereview.chromium.org/2861113002
Cr-Commit-Position: refs/heads/master@{#45320}

This reverts commit 98927ea5.

Reason for revert: Breaks Mac GC Stress bot.
https://uberchromegw.corp.google.com/i/client.v8/builders/V8%20Mac%20GC%20Stress/builds/13299/steps/Mjsunit/logs/for-await-of

Original change's description:
> [ignition] Be smarter about register allocation in VisitSuspend
> 
> Split BytecodeGenerator::VisitSuspend into two pieces, one for
> building the suspension code and one for resumption (these
> are split into separate Build methods for convenience).
> Each gets its own RegisterAllocationScope, which allows us to
> reduce the register file size of the empty generator by 1.
> 
> For consistency, rename VisitGeneratorPrologue() to
> BuildGeneratorPrologue() to match the names of the two
> newly-created methods.
> 
> Bug: v8:6379
> Change-Id: I08a617a44f99706cfff09bf86fb0a25a9cd6e032
> Reviewed-on: https://chromium-review.googlesource.com/503593
> Commit-Queue: Adam Klein <adamk@chromium.org>
> Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#45318}

TBR=rmcilroy@chromium.org,adamk@chromium.org,neis@chromium.org,kozyatinskiy@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
Bug: v8:6379

Change-Id: I787fc3811c4f33a8021cf9170d43a74ed9b55d1c
Reviewed-on: https://chromium-review.googlesource.com/506548Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45319}

Split BytecodeGenerator::VisitSuspend into two pieces, one for
building the suspension code and one for resumption (these
are split into separate Build methods for convenience).
Each gets its own RegisterAllocationScope, which allows us to
reduce the register file size of the empty generator by 1.

For consistency, rename VisitGeneratorPrologue() to
BuildGeneratorPrologue() to match the names of the two
newly-created methods.

Bug: v8:6379
Change-Id: I08a617a44f99706cfff09bf86fb0a25a9cd6e032
Reviewed-on: https://chromium-review.googlesource.com/503593
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45318}

NOTRY=true

Bug: chromium:718739
Change-Id: Ie28b3848a3809473d6c8757e7a86e3a786483ef1
Reviewed-on: https://chromium-review.googlesource.com/506090Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45317}

Bug: v8:5536
Change-Id: Ia3129222e3eb67239fe05411bfb42f3eaf250357
Reviewed-on: https://chromium-review.googlesource.com/505931Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45316}

The output of disassemblers was changed to display instruction offsets as
hexadecimal numbers instead of a decimal numbers. Reflect this change in
turbolizer.

BUG=

Review-Url: https://codereview.chromium.org/2885453002
Cr-Commit-Position: refs/heads/master@{#45315}

Introduce a new SwitchSmiTable bytecode for generators, which does a
table lookup for the accumulator value in a jump table stored in the
constant array pool. This removes the if-else chains at resumable
function/loop headers.

As a drive-by, add a scoped environment saving struct to the bytecode
graph builder.

Bug: v8:6351
Bug: v8:6366
Change-Id: I63be15a8b599d6684c7df19dedb8860562678fb0
Reviewed-on: https://chromium-review.googlesource.com/500271
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45314}

This reverts commit 7ef1df85.

Reason for revert: Breaks inspector/debugger/get-possible-breakpoints-restrict-to-function: https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap%20-%20debug/builds/13191/steps/Check/logs/get-possible-breakpoi..

Original change's description:
> [builtins] port Promise.all to CSA
> 
> Introduces CodeStubAssembler helpers for common Iterator operations
> (GetIterator, IteratorStep, IteratorClose).
> 
> Moves the Promise.all resolveElement closure and it's caller to
> builtins-promise-gen.cc.
> 
> Instead of creating an internal array (and copying its elements into a result
> array), a single JSArray is allocated, and appended with BuildAppendJSArray(),
> falling back to %CreateDataProperty(), and elements are updated in the resolve
> closure the same way. This should always be unobservable.
> 
> This CL increases the size of snapshot_blob.bin on an x64.debug build by 11.44kb
> 
> BUG=v8:5343
> R=​cbruni@chromium.org, gsathysa@chromium.org, jgruber@chromium.org
> 
> Change-Id: Id69b7f76866b29caccd97f35870154c4be85f418
> Reviewed-on: https://chromium-review.googlesource.com/497974
> Commit-Queue: Caitlin Potter <caitp@igalia.com>
> Reviewed-by: Camillo Bruni <cbruni@chromium.org>
> Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#45306}

TBR=adamk@chromium.org,cbruni@chromium.org,gsathya@chromium.org,caitp@igalia.com,jgruber@chromium.org,ishell@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5343

Change-Id: I831738003643561fa628266af2bcebbb18000e55
Reviewed-on: https://chromium-review.googlesource.com/506014Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45313}

Add support for I16x8Mul, I16x8MaxS, I16x8MinS, I16x8Eq, I16x8Ne,
I16x8LtS, I16x8LeS, I16x8AddSaturateU, I16x8SubSaturateU, I16x8MaxU,
I16x8MinU, I16x8LtU, I16x8LeU, I8x16Splat, I8x16ExtractLane,
I8x16ReplaceLane, I8x16Neg, I8x16Shl, I8x16ShrS, S16x8Select,
S8x16Select for mips32 and mips64 architectures.

BUG=

Review-Url: https://codereview.chromium.org/2791213003
Cr-Commit-Position: refs/heads/master@{#45312}

Change-Id: I102558ee4fac29e5bc259117129a47632cc8bd58
Reviewed-on: https://chromium-review.googlesource.com/505508Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45311}

DEPS.chromium allows the Chromium build system's DEPS to recurse into V8's own
dependencies. Initially, this is populated with some tests files for the ARM64
simulator.

BUG=chromium:718439

Review-Url: https://codereview.chromium.org/2880293002
Cr-Commit-Position: refs/heads/master@{#45310}

This reverts commit 7be0159e.

Reason for revert: Breaks node integration:
https://build.chromium.org/p/client.v8.fyi/builders/V8%20-%20node.js%20integration/builds/5555

Original change's description:
> [objects.h splitting] Move Map and related classes.
> 
> BUG=v8:5402
> 
> Change-Id: I64fae0a0271eb0f1b71f4ec5d9bd5d22deb1cf59
> Reviewed-on: https://chromium-review.googlesource.com/502808
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Commit-Queue: Marja Hölttä <marja@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#45305}

TBR=marja@chromium.org,mstarzinger@chromium.org,jarin@chromium.org,ishell@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5402

Change-Id: I7abbe535484f89288f11d963317e1552e1dac17f
Reviewed-on: https://chromium-review.googlesource.com/506012Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45309}

Speed up LEB decoding by forcing the decoding loop to be unrolled.
Even though the compiler was free to unroll the loop before, clang did
not do so. We now manually unroll by using a template function which
calls itself recursively, passing the byte index to be decoded next.
For efficient execution, we still depend on the compiler to inline the
recursive calls (which clang does).

This optimization speeds up interpreted execution of the Jetstream
benchmarks by 15 percent.
Speedup on module decoding is negligible though.

Drive-by: Change "unsigned" to "uint32_t".

R=ahaas@chromium.org
BUG=v8:5822

Change-Id: I06d4230f92bfb2a80cdc5029d965fc3bf84ca1cc
Reviewed-on: https://chromium-review.googlesource.com/506188
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45308}

This reverts commit 7be0159e.

Reason for revert: Broke node by generating a broken debug-support.cc

Original change's description:
> [objects.h splitting] Move Map and related classes.
> 
> BUG=v8:5402
> 
> Change-Id: I64fae0a0271eb0f1b71f4ec5d9bd5d22deb1cf59
> Reviewed-on: https://chromium-review.googlesource.com/502808
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Commit-Queue: Marja Hölttä <marja@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#45305}

TBR=marja@chromium.org,mstarzinger@chromium.org,jarin@chromium.org,ishell@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5402

Change-Id: Ifa65537447eb0a1ef947b9d0dae6f07a8b150968
Reviewed-on: https://chromium-review.googlesource.com/506011Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45307}

Introduces CodeStubAssembler helpers for common Iterator operations
(GetIterator, IteratorStep, IteratorClose).

Moves the Promise.all resolveElement closure and it's caller to
builtins-promise-gen.cc.

Instead of creating an internal array (and copying its elements into a result
array), a single JSArray is allocated, and appended with BuildAppendJSArray(),
falling back to %CreateDataProperty(), and elements are updated in the resolve
closure the same way. This should always be unobservable.

This CL increases the size of snapshot_blob.bin on an x64.debug build by 11.44kb

BUG=v8:5343
R=cbruni@chromium.org, gsathysa@chromium.org, jgruber@chromium.org

Change-Id: Id69b7f76866b29caccd97f35870154c4be85f418
Reviewed-on: https://chromium-review.googlesource.com/497974
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45306}

BUG=v8:5402

Change-Id: I64fae0a0271eb0f1b71f4ec5d9bd5d22deb1cf59
Reviewed-on: https://chromium-review.googlesource.com/502808Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45305}

BUG=chromium:721078,v8:6246

Change-Id: I10f20d9cc2c7cabff8a3fba02aff351fcecc0ce2
Reviewed-on: https://chromium-review.googlesource.com/505611Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45304}

- Default constructor scopes won't need the scope data for deciding the scope
allocation of variables inside them. Also, PreParser doesn't construct them. So
they should be just skipped when applying the scope data.

- PreParser needs to declare the class name + have a proper end position for
the class scope.

- This makes all mjsunit tests pass with --experimental-preparser-scope-analysis.

- Also added several DCHECKs which were useful for debugging.

BUG=v8:5516

Change-Id: I5b3e6c60ed79efe25f33576a3547d707c700c6dd
Reviewed-on: https://chromium-review.googlesource.com/503208
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45303}

Bug: chromium:651354
Change-Id: Ie940c8715a33e5fc8e8859c4660ab14ecc6f9233
Reviewed-on: https://chromium-review.googlesource.com/505488Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45302}

Change-Id: Ie141097c12ad578c752f51393bd5a5df176b3cad
Reviewed-on: https://chromium-review.googlesource.com/504528
Commit-Queue: Wiktor Garbacz <wiktorg@google.com>
Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45301}

This timer is disabled since the switch to the new validator.
This CL brings it back.

R=mstarzinger@chromium.org

Change-Id: Ie454af72205564d6fec05dd4b7b44c1e3d0c37d6
Reviewed-on: https://chromium-review.googlesource.com/505610Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45300}

This makes sure that the evaluation result of the first expression in
for-statements is properly dropped, to leave the stack in a balanced
state after the statement. It also makes sure validation failures in
said expression are handled correctly.

R=clemensh@chromium.org
TEST=mjsunit/regress/regress-crbug-721835
BUG=chromium:721835

Change-Id: I7e6cff4cea0bbf5aad6a3459e27a08ea814dbdbe
Reviewed-on: https://chromium-review.googlesource.com/506148
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45299}

Crankshaft flag and opt flag mostly serve the same purpose. Using 
crankshaft to mean use optimizing compiler is a bit confusing.
This cl: https://chromium-review.googlesource.com/c/490206/ fixes 
the tests to use opt instead of crankshaft flag.

One difference between --no-crankshaft and --no-opt would be that 
--no-opt would mean no optimizations at all where as with --no-crankshaft
would mean we can force optimizations using %OptimizeFunctionOnNextCall.

Bug: v8:6325
Change-Id: If17393ac5b6af4ea6e9a98e092f0261c2e0899c5
Reviewed-on: https://chromium-review.googlesource.com/490307Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45298}

BUG=

Review-Url: https://codereview.chromium.org/2871863003
Cr-Commit-Position: refs/heads/master@{#45297}

This is the last in the series of simplifying the logic to collect feedback
in compare bytecode handlers. This cl inlines the type feedback collection
for the relational compare (lessthan, lessthan or equal, greater than,
gerater than or equal) bytecode handlers.

Bug: v8:4280
Change-Id: I4a896c9cbe5628c76785882c0632bfa07b18b099
Reviewed-on: https://chromium-review.googlesource.com/500309Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45296}

- Add BasicBlock::Print method for easier inspection in gdb
- Print detailed error message in InstructionSelector::VisitControl instead
  of just a check failure

Change-Id: Ice9d70567114f014b244c1b4e41e450900030994
Reviewed-on: https://chromium-review.googlesource.com/504388
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45295}

For a polymorphic access to o.x we would only merge it into a single
PropertyAccessInfo so far, if x is at the same offset in all maps and
the property index of x (in the descriptor arrays) is the same. But that
doesn't matter for code generation and blocks optimizations even.

BUG=v8:6278,v8:6344,v8:6396
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2883883002
Cr-Commit-Position: refs/heads/master@{#45294}

instr(xmm, xmm/mem)
vinstr(xmm, xmm/mem)

BUG=

Review-Url: https://codereview.chromium.org/2870253003
Cr-Commit-Position: refs/heads/master@{#45293}

BUG=chromium:718820

Review-Url: https://codereview.chromium.org/2878343003
Cr-Commit-Position: refs/heads/master@{#45292}

Introduce a flag --max_inlined_nodes_small (defaults to 10), which gives
the upper limit of AST nodes for a function to be considered "small" by
the inlining heuristic. These functions will always be inlined
immediately, independent of the budget.

R=jarin@chromium.org
BUG=v8:6395,v8:6278,v8:6344,v8:6394

Review-Url: https://codereview.chromium.org/2883853002
Cr-Commit-Position: refs/heads/master@{#45291}

No semantic changes, just a readability refactoring that removes
a couple of unnecessary variables and labels.

BUG=v8:6371

Review-Url: https://codereview.chromium.org/2881763003
Cr-Commit-Position: refs/heads/master@{#45290}

R=clemensh@chromium.org

Change-Id: I616a972283cc85ccaf63c46d0cc11ccbb7563a46
Reviewed-on: https://chromium-review.googlesource.com/504527Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45289}

250K was probably still too generous and 80K leads to improvements
locally.

BUG=v8:6348

Review-Url: https://codereview.chromium.org/2876413002
Cr-Commit-Position: refs/heads/master@{#45288}

Smis can easily be handled outside the stub call without adding much to code
size.

The ToString inlining adds overhead of repeated instance type loads and checks,
but under the assumption that it is called with mostly string values it should
speed things up (a local RegExp.p[@@replace] microbenchmark shows consistent
1.6% improvements).

Drive-by-fix: Remove duplication in ToString implementations.

BUG=

Review-Url: https://codereview.chromium.org/2874423003
Cr-Commit-Position: refs/heads/master@{#45287}

With this CL SloppyArguments immediately go to dictionary elements on
deletion, keeping the arguments backing store packed.

Bug: v8:6251
Change-Id: I90d1972179447bf6810e7fe2b8e0bc8703b38d9d
Reviewed-on: https://chromium-review.googlesource.com/486921Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45286}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/cb040e9..63fb52b

Rolling v8/third_party/icu: https://chromium.googlesource.com/chromium/deps/icu/+log/4b06aad..87232d8

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: Ie82d5813078e93ce03eb5161199971efef264b7e
Reviewed-on: https://chromium-review.googlesource.com/505712Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45285}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/3639cca..cb040e9

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/ff3b45d..37015fb

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: I8fa21ea36bec3f6f235b6c0a82eef358abceeb82
Reviewed-on: https://chromium-review.googlesource.com/505868Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45284}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/00764a8..3639cca

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/1ff6ffc..ff3b45d

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/4dfb853..162cac4

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: Ia06ca0b5c6f911d86fc6e6fdae197a79a84675a3
Reviewed-on: https://chromium-review.googlesource.com/505707Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45283}

This is almost identical to V8's default array buffer allocator.  The only
difference is that 0 byte allocations are changed into 1 byte allocations.  We
do not seem to need this behavior, so it does not seem worth maintaining yet
another allocator.

Bug: 
Change-Id: I94f45f1276958791be9a6f2405fcfba8fa6eaa38
Reviewed-on: https://chromium-review.googlesource.com/505199Reviewed-by: Ben Smith <binji@chromium.org>
Commit-Queue: Eric Holk <eholk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45282}