Bug: chromium:722783
Change-Id: Id4612f3d45fb26daca8b4ef2efb0f7bc9ac39ed3
Reviewed-on: https://chromium-review.googlesource.com/579268Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46795}

This is reland of 34ed2470.
Fixed build error:

https: //build.chromium.org/p/client.v8.ports/builders/V8%20Mips%20-%20builder/builds/10881
Bug: 
Change-Id: Ie49ac7097b12780ab1f2f3a8559a4a5f25bc73ab
Reviewed-on: https://chromium-review.googlesource.com/579433Reviewed-by: Miran Karić <Miran.Karic@imgtec.com>
Commit-Queue: Miran Karić <Miran.Karic@imgtec.com>
Cr-Commit-Position: refs/heads/master@{#46794}

This patch implements a recent spec change [1] which increases the
bounds of precision for toFixed, toExponential and toPrecision.
The bounds are a compromise between SpiderMonkey and the other
engines.

[1] https://github.com/tc39/ecma262/pull/857

Bug: v8:6539
Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng
Change-Id: I877aa35e08f3dcda63f5f9181fdecf3c227f2c35
Reviewed-on: https://chromium-review.googlesource.com/553378
Commit-Queue: Daniel Ehrenberg <littledan@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46793}

Bug: chromium:744584
Change-Id: Ie25c2ba63e4764f359de38e53c2f3f3222877e0e
Reviewed-on: https://chromium-review.googlesource.com/577690Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46792}

Apparently the name float.h causes problems on Windows when V8 is
compiled with Visual Studio, see the bug description.

R=clemensh@chromium.org

Bug: v8:6588
Change-Id: Iaa9c1e93e62509a779f1a8ddecbb03a53981cf8a
Reviewed-on: https://chromium-review.googlesource.com/578029Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46791}

TBR=machenbach@chromium.org
NOTRY=true

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Iead81c633b9c0712524a348b106f267ddede24ff
Reviewed-on: https://chromium-review.googlesource.com/579427
Commit-Queue: Michael Hablich <hablich@chromium.org>
Reviewed-by: Michael Hablich <hablich@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46790}

The size of parent function is not considered when taking decisions
on which functions to inline. This cl, includes the size of the
parent function to the cumulative count. 

Bug: 
Change-Id: Ib8f4ec684f8313f7c2e29237580bb3c0403930bd
Reviewed-on: https://chromium-review.googlesource.com/506205
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46789}

... between % and a function name.

Change-Id: I4d06e2623abb6fdd50af748649d0f8e9fae3897d
Reviewed-on: https://chromium-review.googlesource.com/575053Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46788}

The link between the JS weak collection object and its backing store
was missing.

Change-Id: If8293a8d43fb52bc4fc9f156ccda578233a1991c
Reviewed-on: https://chromium-review.googlesource.com/579267Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46787}

CSA::Print() is only used during development and can often be useful
in release builds.

Bug: 
Change-Id: Ib6baf5f5275439a468a0f63a00ed446ae11a8de2
Reviewed-on: https://chromium-review.googlesource.com/579190Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46786}

Unscaled memory operations were missing disassembly output for vector registers,
so add support and rewrite as a macro.

Bug: 
Change-Id: I6f388952dbe5a3b9f8a9b9c46e69ef63dc6655ba
Reviewed-on: https://chromium-review.googlesource.com/576177Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Martyn Capewell <martyn.capewell@arm.com>
Cr-Commit-Position: refs/heads/master@{#46785}

This reverts commit 34ed2470.

Reason for revert: Compile on mips builder:
https://build.chromium.org/p/client.v8.ports/builders/V8%20Mips%20-%20builder/builds/10881

Original change's description:
> MIPS[64]: Implement MSA I10 instructions in simulator
> 
> Bug: 
> Change-Id: Ib252b157977fe97f6f4ceb6e7f696f14ca12680e
> Reviewed-on: https://chromium-review.googlesource.com/574595
> Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@imgtec.com>
> Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@imgtec.com>
> Cr-Commit-Position: refs/heads/master@{#46783}

TBR=ivica.bogosavljevic@imgtec.com,Ilija.Pavlovic@imgtec.com,dusan.simicic@imgtec.com,Miran.Karic@imgtec.com

Change-Id: Ic855904b3f93e5ef941a27bcc67c61c15303422a
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/579048Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46784}

Bug: 
Change-Id: Ib252b157977fe97f6f4ceb6e7f696f14ca12680e
Reviewed-on: https://chromium-review.googlesource.com/574595
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@imgtec.com>
Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@imgtec.com>
Cr-Commit-Position: refs/heads/master@{#46783}

This removes support for dropping arguments adaptor frames as part of
the JSFunction-to-JSFunction tail-call mechanism. The need for having
dedicated {kArchTailCallJSFunctionFromJSFunction} instructions is gone.

R=bmeurer@chromium.org
BUG=v8:4698

Change-Id: Id3d35d06800bee68e06b9554c4315e6ad304de5f
Reviewed-on: https://chromium-review.googlesource.com/575975Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46782}

Scavenger and full MC now rely on the same allocation behavior for their
evacuation.

Bug: 
Change-Id: Iddb0affe171187308e5b77ab0d3cfa75211bd8b8
Reviewed-on: https://chromium-review.googlesource.com/575983Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46781}

This inlines the allocation of regexp literals when a boilerplate exists.

Bug: v8:6605,v8:6556
Change-Id: If0f1b9dedf8a7de1ec51c394fe39cf21d2413ac5
Reviewed-on: https://chromium-review.googlesource.com/575240
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46780}

In contrast to other internal fields (data, source, and flags), last_index is
an in-object property. But we can still use the standard accessor macros to
access it.

Bug: 
Change-Id: If77f2bb01c6ddccebdde09d7a316c2ddaaf9b277
Reviewed-on: https://chromium-review.googlesource.com/577549Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46779}

- Change indentation from 4 to 2 in accordance with Node.js guidelines.
- Fix --no-review option.

R=petermarshall@chromium.org

Change-Id: Ia525297292b0f13776e2264d5cf82dcc7ec449ad
Reviewed-on: https://chromium-review.googlesource.com/574860Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46778}

It used to be that immortal immovable objects have to be on the first page to
not be moved. This is no longer true since we flag pages wrt whether they are
allowed to move.

R=mlippautz@chromium.org

Change-Id: I5c9c88fa358636df119108e16e871815b126ab27
Reviewed-on: https://chromium-review.googlesource.com/575976Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46777}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/543ec6e..37f4a78

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/a4770ef..c7c5420

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/844603c..76b8b39

TBR=machenbach@chromium.org,hablich@chromium.org

Change-Id: I252c26150fe01d55107ac705cbd9d851936b6568
Reviewed-on: https://chromium-review.googlesource.com/577924Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46776}

Check the receiver_map for the dictionary mode bit instead of
comparing the properties map against the HashTableMap.

Bug: 
Change-Id: Iebf3118f00fd0afc8f7f13e88f373282c099f682
Reviewed-on: https://chromium-review.googlesource.com/578324
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46775}

We already have all the functionality available in the
CodeStubAssembler, so this is merely connecting the dots.

Drive-by-fix: Improve code generation for StringCharCodeAt
to properly mark runtime entries as deferred and just use
a single slow-path.

Bug: v8:5049
Change-Id: I76793c823b23f676e65cdb717558473edb6b91cd
Reviewed-on: https://chromium-review.googlesource.com/577533
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46774}

Before the existence of "= delete", we were enforcing that the
DISALLOW_* macros were used in the private: section of classes only.
This is not needed any more, hence remove the comment on the macros.

Also, introduce macros for making types move-only, and use them
instead of our special macro in wasm.

R=bmeurer@chromium.org
CC=titzer@chromium.org

Change-Id: Iceba456fb0a32ae67defe16e35b865db8c8da500
Reviewed-on: https://chromium-review.googlesource.com/577687Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46773}

R=ishell@chromium.org,clemensh@chromium.org
BUG=chromium:742659

Review-Url: https://codereview.chromium.org/2977113002
Cr-Commit-Position: refs/heads/master@{#46772}

Inlining heuristics in Turbofan used ast node count. Bytecode size
is a better approximation of the size of the graph than the
ast node count. This cl changes the heuristics to use the bytecode
size instead. Also removing the ast_node_count filed in the shared
function info. It was used only for the inlining heuristics.

Also removed the max_inlined_source_size flag which is no longer used.

Bug: 
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I8a2d2509c8e8d2779b33b817bb217de203d54ec3
Reviewed-on: https://chromium-review.googlesource.com/570055
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46771}

Async functions and generator declarations are only permitted as
StatementListItems, not as ExpressionStatements, and therefore not
as the entire body of an if statement, etc. Previously, they were
incorrectly permitted. However, ChakraCore and SpiderMonkey seem
to ban them in this context, and the feature was introduced relatively
recently, so it is likely to be web-compatible to ship the prohibition.

This patch also unifies the error message wording of async functions
and generators to ordinary functions, explaining more clearly what
the issue is.

Bug: v8:4483
Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng
Change-Id: I31ed7818d6ab3e7e325031bfabb933dbf4512143
Reviewed-on: https://chromium-review.googlesource.com/568979
Commit-Queue: Daniel Ehrenberg <littledan@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46770}

There remained a few of regressions and we didn't see any significant
improvement in the real world with this turned on. This CL reverts all the
StringConcat bytecode work which landed.

BUG=v8:6243

Change-Id: I832eb72e880ad41411dbec8fe29f71ef0f2025c8
Reviewed-on: https://chromium-review.googlesource.com/575130
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46769}

Change-Id: I1a89833e51ad92102dece1aed850144d18380df0
Reviewed-on: https://chromium-review.googlesource.com/576178
Commit-Queue: Daniel Clifford <danno@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46768}

This copies a necessary suppression from Chromium's blacklist.

NOTRY=true
TBR=ishell@chromium.org

Bug: chromium:726584
Change-Id: I7dfa13ad4a929b28bccb782be0a0faa9d29be1eb
Reviewed-on: https://chromium-review.googlesource.com/576001Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46767}

This patch adds a new intrinsic: %DebugTrackRetainingPath(object).
Calling the intrinsic in JS code saves a weak reference to the given
object in GC internal table of tracked objects.

Each subsequent full GC prints to stdout the retaining path for each
tracked object (if it is still alive). The retaining path is the real
path that the marker took from the root set to the tracked object.

This is useful for investigating of memory leaks:
1) Add %DebugTrackRetainingPath(leaking_object) in JS code.
For example:
  function foo() {
    let x = { bar: "bar"};
    %DebugTrackRetainingPath(x);
    return () => { return x; }
  }

  let closure = foo();
  gc();

2) Run d8 with --allow-natives-syntax --track-retaining-path --expose-gc.

3) Check the retaining path in stdout.

For more detailed inspection, run d8 in gdb and set breakpoint in

v8: :internal::Heap::PrintRetainingPath.
Change-Id: I01a0faac1e009bc6c321fa75613900b49d2b036f
Reviewed-on: https://chromium-review.googlesource.com/575972
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46766}

The outer_zone_ is only used to determine if the graph may be
unverifiable.

R=bmeurer@chromium.org

Change-Id: Idad2bbb0d2a4ba9006c852276651e6780c1128c5
Reviewed-on: https://chromium-review.googlesource.com/566821Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46765}

Add support for slli, srai, srli, bclri, bseti, bnegi, binsli, binsri,
sat_s, sat_u, srari, srlri MSA instructions in mips32 and mips64
simulators.

Bug: 
Change-Id: I1a351a23c733f0bfbc829f25874df26295327afc
Reviewed-on: https://chromium-review.googlesource.com/568020Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@imgtec.com>
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@imgtec.com>
Cr-Commit-Position: refs/heads/master@{#46764}

This patch changes the semi-space size to 512K.

> Original commit message:
> Revert "[heap] Allow a minimum semi-space size of 512K."
> This reverts commit 0d2ed6c3.
> The CL introduced perf regressions: crbug.com/735649.
> We are going to reland the CL in an isolated V8 roll to ensure
> that perf regressions are attributed correctly.

> Original commit message:
> > [heap] Allow a minimum semi-space size of 512K.
> > This CL also reduces the minimum semi-space size to 512K.
> > BUG=chromium:716032
> BUG=chromium:735649

Change-Id: Iabc377cba2911b28d51b98bb5b85134d4e893632
Reviewed-on: https://chromium-review.googlesource.com/575066Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46763}

This relands parts of "[heap] Allow a minimum semi-space size of 512K."
excluding the actual semi-space size change.

This partially reverts commit f341bb0f

> Original commit message:
> Revert "[heap] Allow a minimum semi-space size of 512K."
> This reverts commit 0d2ed6c3.
> The CL introduced perf regressions: crbug.com/735649.
> We are going to reland the CL in an isolated V8 roll to ensure
> that perf regressions are attributed correctly.

> Original commit message:
> > [heap] Allow a minimum semi-space size of 512K.
> > This CL also reduces the minimum semi-space size to 512K.
> > BUG=chromium:716032
> BUG=chromium:735649

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I5ed66b72104aa877d67fcd20bdadc807ea1551c3
Reviewed-on: https://chromium-review.googlesource.com/575065
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46762}

Also remove UnsafeAcquire from UseScratchRegisterScope, which was only used for
these stubs.

Bug: 
Change-Id: Ia8648e53f1165ae489c0475dbb2d10c6978e4e84
Reviewed-on: https://chromium-review.googlesource.com/576181Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Georgia Kouveli <georgia.kouveli@arm.com>
Cr-Commit-Position: refs/heads/master@{#46761}

This adds a copy of tools/ubsan/vptr_blacklist.txt to V8, which is
needed for ubsan compilation.

NOTRY=true
TBR=ishell@chromium.org

Bug: chromium:726584
Change-Id: Ie06a031ce501d7f83121d45b04ac34672eb1ca9e
Reviewed-on: https://chromium-review.googlesource.com/575977
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46760}

This is a reland of b90e83f5
Original change's description:
> [runtime] Add shortcuts for elements kinds transitions.
>
> The shortcuts ensure that field type generalization is properly
> propagated in the transition graph.
>
> Bug: chromium:738763
> Change-Id: Id701a6f95ed6ea093c707fbe0bac228f1f856e9f
> Reviewed-on: https://chromium-review.googlesource.com/567992
> Commit-Queue: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46622}

Bug: chromium:738763, chromium:742346, chromium:742381, chromium:745844
Change-Id: I93974e3906b2c7710bd525f15037a2dd97f263ad
Reviewed-on: https://chromium-review.googlesource.com/575227
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46759}

This makes {NeedsDebugHookCheck} the default for all invocations, as
there is no call-site left that doesn't perform said check. All other
pieces of the {CallWrapper} are dead since Crankshafts removal.

R=jgruber@chromium.org

Change-Id: I158b816c089ede42972e8a7bdfc6ef0c02053a6b
Reviewed-on: https://chromium-review.googlesource.com/577531Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46758}

Bug: v8:6559, v8:6557
Change-Id: Ide0114a5cdcce3cf948a070465460662c56bad8d
Reviewed-on: https://chromium-review.googlesource.com/577527Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Franziska Hinkelmann <franzih@chromium.org>
Commit-Queue: Maya Lekova <mslekova@google.com>
Cr-Commit-Position: refs/heads/master@{#46757}

Remove SetForceInlineFlag from the js builtins. 

Bug: 
Change-Id: I962982509c82e4baba8dc32a0f163147c47daf34
Reviewed-on: https://chromium-review.googlesource.com/571803Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46756}