This CL implements general infrastructure for block coverage together with
initial support for if-statements.

Coverage output can be generated in lcov format by d8 as follows:

$ d8 --block-coverage --lcov=$(echo ~/simple-if.lcov) ~/simple-if.js
$ genhtml ~/simple-if.lcov -o ~/simple-if
$ chrome ~/simple-if/index.html

A high level overview of the implementation follows:

The parser now collects source ranges unconditionally for relevant AST nodes.
Memory overhead is very low and this seemed like the cleanest and simplest
alternative.

Bytecode generation uses these ranges to allocate coverage slots and insert
IncBlockCounter instructions (e.g. at the beginning of then- and else blocks
for if-statements). The slot-range mapping is generated here and passed on
through CompilationInfo, and is later accessible through the
SharedFunctionInfo.

The IncBlockCounter bytecode fetches the slot-range mapping (called
CoverageInfo) from the shared function info and simply increments the counter.
We don't collect native-context-specific counts as they are irrelevant to our
use-cases.

Coverage information is finally generated on-demand through Coverage::Collect.
The only current consumer is a d8 front-end with lcov-style output, but the
short-term goal is to expose this through the inspector protocol.

BUG=v8:6000
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_chromium_rel_ng

Review-Url: https://codereview.chromium.org/2882973002
Cr-Commit-Position: refs/heads/master@{#45737}

Revert of [inspector] Test how Profiler interacts with multiple sessions (patchset #3 id:30001 of https://codereview.chromium.org/2920313002/ )

Reason for revert:
DCHECKS triggering in debug build.

Original issue's description:
> [inspector] Test how Profiler interacts with multiple sessions
>
> BUG=chromium:590878
>
> Review-Url: https://codereview.chromium.org/2920313002
> Cr-Original-Commit-Position: refs/heads/master@{#45715}
> Committed: https://chromium.googlesource.com/v8/v8/+/754f81e20e9e7abfb3ce82e73a3389a72f4657a6
> Review-Url: https://codereview.chromium.org/2920313002
> Cr-Commit-Position: refs/heads/master@{#45717}
> Committed: https://chromium.googlesource.com/v8/v8/+/679604bdd2991a19cadf7ab5c462fc6f368f32fc

TBR=alph@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:590878

Review-Url: https://codereview.chromium.org/2926533003
Cr-Commit-Position: refs/heads/master@{#45736}

Inline SMI checks in ICs are performed with a TBZ/TBNZ instruction, which has a
32 kB range. To allow patching the SMI check, the location of the TBZ/TBNZ
instruction is stored after the call to the IC using a MOVZ instruction, in
particular using 11 bits of the immediate (so the number of instructions
between the inline data and the SMI check must be encodable in 11 bits).

To make sure we do not exceed these ranges, we need to block pool emission
between the check, the patch info, and the label the check branches to.

BUG=

Review-Url: https://codereview.chromium.org/2917403002
Cr-Commit-Position: refs/heads/master@{#45735}

This takes into account the type of the type guard when choosing
representation for a node. To make the representation changes
unambiguous, we pass the restricted type to the changer.

BUG=chromium:726554

Review-Url: https://codereview.chromium.org/2920193004
Cr-Commit-Position: refs/heads/master@{#45734}

This reverts commit 0d06e42b.

Reason for revert: clusterfuzz and canary crashes.

BUG=chromium:729209,v8:6456

Original change's description:
> [heap] Use partial free when shrinking instead of uncommitting
> 
> This fixes the counter inconsistencies while leaving the memory in an
> inaccessible state.
> 
> Bug: chromium:724947
> Change-Id: I431eb6fda84922a52dfb9380c6b482ada55bccee
> Reviewed-on: https://chromium-review.googlesource.com/519164
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Hannes Payer <hpayer@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#45647}

TBR=hpayer@chromium.org,mlippautz@chromium.org
# Not skipping CQ checks because original CL landed > 1 day ago.
Bug: chromium:724947

Change-Id: I6c52b478b89a858ba984fe17f86cdf15fcfa974c
Reviewed-on: https://chromium-review.googlesource.com/525716Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45733}

Previously Ignition would collect precise Number feedback for binary
operators, but TurboFan would just ignore that and treat it the same as
NumberOrOddball. That however generates a lot of unnecessary code, plus
it defeats redundancy elimination if the same input is also used by
compare operations, which do properly distinguish feedback Number and
NumberOrOddball.

This CL adds the missing bits to connect the existing functionality
properly, i.e. adding the missing BinaryOperationHint and using the
NumberOperationHint::kNumber in the representation selection for tagged
inputs.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2923543003
Cr-Commit-Position: refs/heads/master@{#45732}

The boundary cells of the mark-bitmap can be access concurrently,
so they need to be updated with atomic CAS.

BUG=chromium:694255

Change-Id: Ibe85f00c8b4ccc61edc43b400c5b08a6d0ba620e
Reviewed-on: https://chromium-review.googlesource.com/521103
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45731}

... by using CSA::Word32BinaryNot() instead.

Change-Id: I04e2ceafc205d5667b92cfa276faed741ad3a917
Reviewed-on: https://chromium-review.googlesource.com/525695Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45730}

Change-Id: Ibd0cfc0c03b94ed6e15c6496cf16d9059447467c
Reviewed-on: https://chromium-review.googlesource.com/525472Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Daniel Ehrenberg <littledan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45729}

BUG=chromium:713699

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Ibe30fe7922a421af1596070fde4519bd2f870c4e
Reviewed-on: https://chromium-review.googlesource.com/525535
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45728}

When optimizing stores to data properties in literals, we need to first
migrate deprecated maps before we lookup the property access infos for
those.

BUG=chromium:724608
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2930433003
Cr-Commit-Position: refs/heads/master@{#45727}

BUG=chromium:728228
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_chromium_rel_ng

Review-Url: https://codereview.chromium.org/2921883002
Cr-Commit-Position: refs/heads/master@{#45726}

This reverts commit 7fa071a4.

Reason for revert: https://bugs.chromium.org/p/chromium/issues/detail?id=729482

Original change's description:
> Reland [parser] Refactor streaming scanner streams.
> 
> Unify, simplify logic, reduce UTF8 specific handling.
> 
> Intend of this is also to have stream views.
> Stream views can be used concurrently by multiple threads, but
> only one thread may fetch new data from the underlying source.
> This together with unified stream view creation is intended to be
> used for parse tasks.
> 
> BUG=v8:6093
> 
> Change-Id: I3bce48185fa2c986d16619a9a8ece3ff4c4f5e60
> Reviewed-on: https://chromium-review.googlesource.com/509489
> Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
> Reviewed-by: Marja Hölttä <marja@chromium.org>
> Commit-Queue: Wiktor Garbacz <wiktorg@google.com>
> Cr-Commit-Position: refs/heads/master@{#45688}

TBR=marja@chromium.org,vogelheim@chromium.org,wiktorg@google.com
# Not skipping CQ checks because original CL landed > 1 day ago.
BUG=v8:6093

Change-Id: Iefa7c43a2f6ae3a7f3ef0f77d87b6ae36ae4be99
Reviewed-on: https://chromium-review.googlesource.com/525712Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45725}

Runtime::kStringSplit's result caching is only enabled when limit equals
kMaxUInt32.

BUG=v8:6463

Review-Url: https://codereview.chromium.org/2923183002
Cr-Commit-Position: refs/heads/master@{#45724}

This avoids write barrier when writing smis to tagged fields.

This includes writing to contexts, see example below:

var f = (function() {
  var i = 0;
  return function f() {
    return i++;  // Write barrier when writing to context.
  }
})();

f(); f(); %OptimizeFunctionOnNextCall(f);
f();

Review-Url: https://codereview.chromium.org/2925793002
Cr-Commit-Position: refs/heads/master@{#45723}

Change-Id: I865d7d4d4d88997127771b10449d1b794264e252

CQ_INCLUDE_TRYBOTS=master.tryserver.v8:v8_linux_noi18n_rel_ng
NOTREECHECKS=true

Change-Id: I865d7d4d4d88997127771b10449d1b794264e252
Reviewed-on: https://chromium-review.googlesource.com/524047
Commit-Queue: Daniel Ehrenberg <littledan@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45722}

For now skip WASM SIMD tests that fail when MIPS SIMD extension
is not available. Turn on these tests again when simd scalar lowering
mechanism supports all WASM SIMD operations.

Bug: 
Change-Id: I4589680147c04716ed66680aaa06639f4f2452d0
Reviewed-on: https://chromium-review.googlesource.com/524082Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@imgtec.com>
Reviewed-by: Miran Karić <Miran.Karic@imgtec.com>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@imgtec.com>
Cr-Commit-Position: refs/heads/master@{#45721}

Introduces ThrowReferenceErrorIfHole / ThrowSuperNotCalledIfHole 
/ ThrowSuperAlreadyCalledIfNotHole bytecodes to handle hole checks.
In the bytecode-graph builder they are handled by introducing a deopt point
instead of adding explicit control flow. JumpIfNotHole / JumpIfNotHoleConstant
bytecodes are removed since they are no longer required.


Bug: v8:4280, v8:6383
Change-Id: I58b70c556b0ffa30e41a0cd44016874c3e9c5fe1
Reviewed-on: https://chromium-review.googlesource.com/509613
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45720}

This wraps up the move to explicit APIs, i.e.
instantiateStreaming/compileStreaming.

Bug: 
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Icc8280b2b3ad35acb90cc0beebe3acd7581179d7
Reviewed-on: https://chromium-review.googlesource.com/525141
Commit-Queue: Mircea Trofin <mtrofin@chromium.org>
Commit-Queue: Brad Nelson <bradnelson@chromium.org>
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45719}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/31e28f7..cd94ef8

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/6866edf..e7bf345

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: I0e182955a4d253843ccd0796324308d104702d1d
Reviewed-on: https://chromium-review.googlesource.com/525173Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45718}

BUG=chromium:590878

Review-Url: https://codereview.chromium.org/2920313002
Cr-Original-Commit-Position: refs/heads/master@{#45715}
Committed: https://chromium.googlesource.com/v8/v8/+/754f81e20e9e7abfb3ce82e73a3389a72f4657a6
Review-Url: https://codereview.chromium.org/2920313002
Cr-Commit-Position: refs/heads/master@{#45717}

Revert of [inspector] Test how Profiler interacts with multiple sessions (patchset #2 id:10003 of https://codereview.chromium.org/2920313002/ )

Reason for revert:
Bot failure:

https://build.chromium.org/p/client.v8/builders/V8%20Linux%20gcc%204.8/builds/13172

Original issue's description:
> [inspector] Test how Profiler interacts with multiple sessions
>
> BUG=chromium:590878
>
> Review-Url: https://codereview.chromium.org/2920313002
> Cr-Commit-Position: refs/heads/master@{#45715}
> Committed: https://chromium.googlesource.com/v8/v8/+/754f81e20e9e7abfb3ce82e73a3389a72f4657a6

TBR=alph@chromium.org,dgozman@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:590878

Review-Url: https://codereview.chromium.org/2928493002
Cr-Commit-Position: refs/heads/master@{#45716}

BUG=chromium:590878

Review-Url: https://codereview.chromium.org/2920313002
Cr-Commit-Position: refs/heads/master@{#45715}

BUG=v8:6325

Review-Url: https://codereview.chromium.org/2904193003
Cr-Commit-Position: refs/heads/master@{#45714}

The change also moves creation of the iterator result from the parser to the bytecode generator.

Unfortunately, async generators will stay on the old scheme (try-finally around generator body) because I am not exactly sure how they work.

Review-Url: https://codereview.chromium.org/2917263002
Cr-Commit-Position: refs/heads/master@{#45713}

Capture the place we call the verifier as part of the investigation
into the referenced bug.

Bug: chromium:725559
Change-Id: I08fa91636f73994f8d77ac6ab66aa7165a12ef0b
Reviewed-on: https://chromium-review.googlesource.com/524266
Commit-Queue: Brad Nelson <bradnelson@chromium.org>
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45712}

Instead of going through debugger agent, this patch implements
console.assert pause similar to debugger statement and OOM break.

New test uncovered a bug, where pause on exceptions state mix up
between different context groups. Added a TODO to fix it.

BUG=chromium:590878

Review-Url: https://codereview.chromium.org/2916363002
Cr-Commit-Position: refs/heads/master@{#45711}

Now that the BytecodeGenerator has a dedicated register holding
the generator object, BytecodeGenerator::VisitSuspend can
access the generator directly from that register. This reduces
by one the number of live registers at each suspend point.

Bug: v8:6351, v8:6460
Change-Id: I380a9d2bd8ca7eec6720e5392c1ca07dd0df0e2d
Reviewed-on: https://chromium-review.googlesource.com/522982
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45710}

Bug: v8:6358
Change-Id: Ia7a9de3b60138c489276cd2ed4bd018a8f4ef8f6
Reviewed-on: https://chromium-review.googlesource.com/496126
Commit-Queue: Daniel Ehrenberg <littledan@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45709}

This gives sessions separate remote objects space and also
makes command line api respect the session it was called from.

BUG=chromium:590878

Review-Url: https://codereview.chromium.org/2916803005
Cr-Commit-Position: refs/heads/master@{#45708}

Bug: v8:4280
Change-Id: Iedd3182301ad6cde4e63c65dca6cd280e3f05198
Reviewed-on: https://chromium-review.googlesource.com/524044Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45707}

Fixes a crash in PrintRegisters() with --trace-ignition and the
RestoreGeneratorRegisters bytecode.

BUG=v8:4280, v8:6351
R=rmcilroy@chromium.org, mythria@chromium.org, adamk@chromium.org

Change-Id: I09e86523b71fb9e5763e0373c567925f38227913
Reviewed-on: https://chromium-review.googlesource.com/523843
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45706}

Bug: v8:6351
Change-Id: Iad82fcfb4172d7a9cbadffa1e40fd1cd26866895
Reviewed-on: https://chromium-review.googlesource.com/521107
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45705}

Macro-ization of Turbofan's SIMD Visitor methods in the same way it was
done for ARM and x64 architectures.

BUG=

Review-Url: https://codereview.chromium.org/2910533003
Cr-Commit-Position: refs/heads/master@{#45704}

Reland 84ff6e4c

In Wasm-to-interpeter entry creation, arguments for the interpreter
are stored in an argument buffer. Depending on the order of the
arguments some arguments may be misaligned and this causes crashes
on those architectures that do not support unaligned memory access.

TEST=mjsunit/wasm/interpreter
BUG=

Review-Url: https://codereview.chromium.org/2887053003
Cr-Commit-Position: refs/heads/master@{#45703}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/f6841a1..31e28f7

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/64ea479..6866edf

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: I72c69196f0ab831f949239f4f3f1aba9cdbe760b
Reviewed-on: https://chromium-review.googlesource.com/523603Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45702}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/d1e77ff..f6841a1

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/b0384fe..64ea479

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: Ie2d61593f2f62398b8a8004141fea78efe97b1cb
Reviewed-on: https://chromium-review.googlesource.com/523245Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45701}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/a055d2e..d1e77ff

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/buildtools/+log/1045741..31d4daa

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/b33525e..b0384fe

Rolling v8/third_party/icu: https://chromium.googlesource.com/chromium/deps/icu/+log/ae18d60..dfa798f

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: I95d8046bf6e4d226785271365360f0e224b68d9f
Reviewed-on: https://chromium-review.googlesource.com/523063Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45700}

TBR=ishell@chromium.org

Bug: v8:6457
Change-Id: I09d7d6ff8460688b7ddf25f733aea73a620db953
Reviewed-on: https://chromium-review.googlesource.com/523037Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45699}

The code was already careful to use memcpy() here, but then it
added needless casts to wider types that made the compiler think
that it can do 4-byte-aligned accesses when it couldn't.

(It's also a bug that the snapshot got loaded at an unaligned
address, but we can fix both bugs.)

BUG=chromium:729059

Review-Url: https://codereview.chromium.org/2915323002
Cr-Commit-Position: refs/heads/master@{#45698}