Port 21701297

Original Commit Message:

    Add a new JSConstructWithArrayLike operator that is backed by the
    ConstructWithArrayLike builtin (similar to what was done before
    for the JSCallWithArrayLike operator), and use that operator to
    optimize Reflect.construct inlining in TurboFan. This is handled
    uniformly with JSConstructWithSpread in the JSCallReducer.

    Also add missing test coverage for Reflect.construct in optimized
    code, especially for some interesting corner cases.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:4587,v8:5269
LOG=N

Change-Id: Idaf247317036ddec74b9aa3addd2e7d75b65bfaf
Reviewed-on: https://chromium-review.googlesource.com/546716
Commit-Queue: Jaideep Bajwa <bjaideep@ca.ibm.com>
Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#46189}

Port 767ce788

Original Commit Message:

    Add a new JSCallWithArrayLike operator that is backed by the
    CallWithArrayLike builtin, and use that operator for both
    Function.prototype.apply and Reflect.apply inlining. Also unify
    the handling of JSCallWithArrayLike and JSCallWithSpread in
    the JSCallReducer to reduce the copy&paste overhead.

    Function.prototype.apply in optimized code, especially for some
    corner cases, which was missing so far.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:4587,v8:5269
LOG=N

Change-Id: I930845df7e87b8962588cc79f6069477865fa086
Reviewed-on: https://chromium-review.googlesource.com/546735Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Jaideep Bajwa <bjaideep@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#46188}

Port a971a64d

Original Commit Message:

    We can remove a lot of native code and rely on CallOrConstructVarargs
    to do the stack manipulation for us.

    This will also take advantage of the fast-path for double arrays in
    CallOrConstructDoubleVarargs.

    We can also remove Runtime_SpreadIterableFixed because it isn't used
    anymore. We just call directly into spread_iterable from CSA.

R=petermarshall@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: Idad830c9aace4151db866c9f863158cd7525e881
Reviewed-on: https://chromium-review.googlesource.com/546575Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Jaideep Bajwa <bjaideep@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#46187}

Each frame within an optimized frame needs to be re-verified as being
subject to debugging. The specific crash from the linked bug was caused
by the fact that non-user JS frames don't necessarily have an associated
script. We'd ignore that and attempt to call
Script::GetPositionInfo() on the Undefined constant.

BUG=chromium:732408

Change-Id: Ib2982890529623d150092fa57e26fcb237fef59f
Reviewed-on: https://chromium-review.googlesource.com/545895Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46186}

When executing a script that does import("foo"), "foo" should be
relative to the script's directory, not relative to the current working
directory of the d8 process.

R=gsathya@chromium.org

Bug: v8:5785
Change-Id: Id6ceccb242905bd6b54b07038ece60b93d92e4a0
Reviewed-on: https://chromium-review.googlesource.com/546375
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46185}

In bits.h, instead of relying on C++ overloading for 32/64 bits integers
(which can be ambiguous when the input isn't the exact type typedef-ed
by uint64_t or uint32_t), use templates and std::enable_if to switch
between integers of different sizes.

This means that we can get rid of an awkward sizeof check in
bit-vector.cc, which was necessary to compile on Mac.

Change-Id: Id0eaf0f855cdbd2dc4d7bc1c481037fcd9b73953
Reviewed-on: https://chromium-review.googlesource.com/543480
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46184}

Move bytecode array writing logic into the array builder, allowing us to
remove the bytecode array writer and bytecode node, and convert runtime
operand writing to compile-time bytecode operand writing using the
information statically known at compile time.

Bug: v8:6474
Change-Id: I210cd9897fd41293745614e4a253c7c251dfffc9
Reviewed-on: https://chromium-review.googlesource.com/533055
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46183}

BUG=chromium:694255

Change-Id: I80657c5ec11fb36766a79af8584c1f1e3afaa497
Reviewed-on: https://chromium-review.googlesource.com/545595
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46182}

Bug: chromium:662388
Change-Id: Ia50889a6f4313270f1aadd19cc3f91eb25989c96
Reviewed-on: https://chromium-review.googlesource.com/544882
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46181}

Bug: 
Change-Id: Ice0781822308ba44934abbe5802585a70e744eb0
Reviewed-on: https://chromium-review.googlesource.com/544994
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46180}

Bug: v8:126
Change-Id: I13d42f0dccb0899f0aad572d33501e856073db9d
Reviewed-on: https://chromium-review.googlesource.com/544968
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46179}

This prepares ground for switching mark-compactor to use
Worklist data-structure instead of the existing marking deque.

BUG=chromium:694255

Change-Id: I0ac4c563018a9619962fb4bf388b5f3cceffb86d
Reviewed-on: https://chromium-review.googlesource.com/544933Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46178}

Bug: 
Change-Id: I0415b3946e6efd97c3b2fb770fda7dba265ee8cd
Reviewed-on: https://chromium-review.googlesource.com/545000Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46177}

This removes the include from:
assembler.h (moved Isolate::AddressId to globals.h / IsolateAddressId)
counters.h (ditto)
elements.h (trivial)
keys.h (trivial + iwyu fixes)
property.h (trivial)
transitions.h (trivial)
vm-state.h (trivial)
heap/code-stats.h (trivial + drive-by iwyuing)

BUG=v8:5294

Change-Id: I36b8c07d4edf4177f1a987a393569f5191167ed3
Reviewed-on: https://chromium-review.googlesource.com/532879Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46176}

The race happens when the layout descriptor is evacuated at the same
time as an object that has this layout descriptor is evacuated.

Change-Id: I0a5fc545cf359fdfe738d8b6359713f5ea170986
Reviewed-on: https://chromium-review.googlesource.com/544953
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46175}

This partially reverts commit 015edc60.

Reason for revert: Performance regression on richards

Bug: v8:6211
Change-Id: Ib69a1ed90b2015addcc54d7f299bdd654d964b54
Reviewed-on: https://chromium-review.googlesource.com/544992Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46174}

Bug: 
Change-Id: I240356157c71a544d94f8898029d54010b2f4d37
Reviewed-on: https://chromium-review.googlesource.com/544309
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46173}

NOTRY=true
NOTREECHECKS=true
TBR=ulan@chromium.org

Bug: chromium:735951
Change-Id: I8b54ba272d353b1fb499fcfccef1f49b9c47a137
Reviewed-on: https://chromium-review.googlesource.com/544828
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46172}

This reverts commit 217d654c.

Reason for revert: Changes layout tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/16520

Original change's description:
> [parser] moved load property position after dot
> 
> Currently LdaNamedProperty bytecode for expressions like a.b has position before dot. This CL moves this location after dot.
> It's important for later removing of Nop bytecodes in expressions like a.b() where a is local variable, property call and property load should have the same position.
> 
> R=​jgruber@chromium.org
> 
> Bug: v8:6425
> Change-Id: I528c5007de52215beba80851ab04693ecec038e2
> Reviewed-on: https://chromium-review.googlesource.com/543047
> Reviewed-by: Marja Hölttä <marja@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46163}

TBR=marja@chromium.org,kozyatinskiy@chromium.org,jgruber@chromium.org

Change-Id: I94543526f39f0a20452fbce1a7bc6744cac66621
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6425
Reviewed-on: https://chromium-review.googlesource.com/544993Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46171}

For correct error positions, the FunctionBody struct stored a {base}
pointer to the beginning of the wasm module bytes, in addition to the
{start} and {end} pointer of the function body within the module bytes.
For streaming compilation, we do not have all module bytes in a single
chunk of memory. Therefore this CL changes the FunctionBody such that it
does not store the base pointer but the offset of the function body
within the module. I did the same change already some time ago for the
{Decoder}.

R=clemensh@chromium.org, mtrofin@chromium.org

Change-Id: I5138fbe270d0f5166a7dcc5cb8f3fe78a298bff6
Reviewed-on: https://chromium-review.googlesource.com/544863Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46170}

Make PreParser match what Parser does.

BUG=v8:5516

Change-Id: I2801206fd17b9a5047bc43c6112f4945971596b7
Reviewed-on: https://chromium-review.googlesource.com/544949
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46169}

Drive-by-fixes: Singleton ranges past EOF, disable optimization
for block count mode.

Bug: v8:6000
Change-Id: I718891f8821285ce3d7d8360faaa91a43de5b93d
Reviewed-on: https://chromium-review.googlesource.com/541300Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46168}

This removes the --turbo flag and solely relies on the filter pattern
provided via --turbo-filter when deciding whether to use TurboFan. Note
that disabling optimization wholesale can still be done with --no-opt,
which should be used in favor of --no-turbo everywhere.

Also note that this contains semantic changes to the TurboFan activation
criteria. We respect the filter pattern more stringently and no longer
activate TurboFan just because the source contains patterns forcing use
of Ignition via {AstNumberingVisitor::DisableFullCodegenAndCrankshaft}.

R=rmcilroy@chromium.org
BUG=v8:6408

Change-Id: I0c855f6a62350eb62283a3431c8cc1baa750950e
Reviewed-on: https://chromium-review.googlesource.com/528121Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46167}

Factory::NewUninitializedFixedArray is unsafe for GC. If performance
allows, we should remove the function.

Change-Id: I3f80352797e9768b788c2996c3f29e823c067f74
Reviewed-on: https://chromium-review.googlesource.com/517794Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46166}

Async generator yield* is still desugared in the parser, to be moved to the BytecodeGenerator in a future CL.

Bug: v8:6472
Change-Id: I8b33e2f9e931949f7375540099cd8ec3a6b27cf1
Reviewed-on: https://chromium-review.googlesource.com/539335
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46165}

Change-Id: I5d5df00a38b7196001fb91e2642914271d8e66d0
Reviewed-on: https://chromium-review.googlesource.com/544932
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46164}

Currently LdaNamedProperty bytecode for expressions like a.b has position before dot. This CL moves this location after dot.
It's important for later removing of Nop bytecodes in expressions like a.b() where a is local variable, property call and property load should have the same position.

R=jgruber@chromium.org

Bug: v8:6425
Change-Id: I528c5007de52215beba80851ab04693ecec038e2
Reviewed-on: https://chromium-review.googlesource.com/543047Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46163}

Completely shares first-level visitation with the Scavenger.

Remove marking recursively on the way as we cannot reliable check for
stack overflow on background tasks.

Bug: chromium:651354
Change-Id: I6da1dc787cdfb4232ea4b6cb8e72e0f736cabf10
Reviewed-on: https://chromium-review.googlesource.com/544967
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46162}

This also adds libraries recursively under the obj dir.

Dropping v8_shell from globs since it's not included in the targets.

NOTRY=true

Bug: v8:5918
Change-Id: Ibfadb60dd7b347cf4a742f07e8b110c70e67cb06
Reviewed-on: https://chromium-review.googlesource.com/544308
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46161}

Reduces binary size, see bug.

Bug: chromium:736097
Change-Id: I89b4b873accf2de85d5913a30fac53972d98e78d
Reviewed-on: https://chromium-review.googlesource.com/544984Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46160}

Remove PageParallelJob as it is completely replaced now. It served us
well.

Bug: chromium:651354
Change-Id: I620fa7bb0dcaf7cd3710492913c501bcb162c781
Reviewed-on: https://chromium-review.googlesource.com/544950Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46159}

Bug: 
Change-Id: I90e0c469d096cbffbecf01add6cfabbf3af275fa
Reviewed-on: https://chromium-review.googlesource.com/544307Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46158}

This piggy-backs on top of existing precise and best-effort coverage to expose
block coverage through the inspector protocol.

Coverage collection now implicitly reports block-granularity coverage when
available.  A new 'isBlockCoverage' property on Inspector's FunctionCoverage
type specifies the granularity of reported coverage.

For now, only count-based block coverage is supported, but binary block
coverage should follow soon.

Support is still gated behind the --block-coverage flag.

Bug: v8:6000
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I9c4d64e1d2a098e66178b3a68dcee800de0081af
Reviewed-on: https://chromium-review.googlesource.com/532975
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46157}

Should've been part of https://chromium-review.googlesource.com/544300

BUG=v8:5516

Change-Id: I315b37d313b64c738174a6cd7461e5c46e362734
Reviewed-on: https://chromium-review.googlesource.com/544939Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46156}

TBR=vogelheim@chromium.org
NOTRY=true

Bug: chromium:645890
Change-Id: Ib5aa315d32c374c2bc755dc67255f84ce544e85f
Reviewed-on: https://chromium-review.googlesource.com/544846
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46155}

This reverts commit d4a10807.

Reason:
Fails on gpu bots:
https://build.chromium.org/p/client.v8.fyi/builders/Linux%20Release%20%28NVIDIA%29/builds/2145

# Fatal error in ../../v8/src/isolate.h, line 878
# Check failed: !IsIsolateInBackground().

BUG=v8:6361
TBR=kschimpf@chromium.org,cbruni@chromium.org,mtrofin@chromium.org,jochen@chromium.org,ulan@chromium.org

NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true

Change-Id: I5cf0241b3932b3c500598207b684a4b37936d0f8
Reviewed-on: https://chromium-review.googlesource.com/544825
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46154}

Object.create is most often called with a single parameter, the
prototype, and the properties are usually omitted. So optimizing
for the common case, we remove the argument adaption.

R=jgruber@chromium.org
BUG=v8:5989

Review-Url: https://codereview.chromium.org/2953913002
Cr-Commit-Position: refs/heads/master@{#46153}

`libStart` already has ALSR slide added to it. Do not add it twice.

https: //codereview.chromium.org/2696903002/
Review-Url: https://codereview.chromium.org/2928083004
Cr-Commit-Position: refs/heads/master@{#46152}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/68d4fc6..a4ae1b7

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/buildtools/+log/b92ff91..38477c2

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/76def89..e810453

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: Ia4c5bf404be1f3dd3c6bd49f32aa92b15c88f21c
Reviewed-on: https://chromium-review.googlesource.com/545059Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46151}

HistoryTimer's can't run in the background because they use a timer
with a simple api of Start() and Stop(). This CL fixes this problem
by building a base class TimedHistogram that doesn't have a timer.

The class HistoryTimer is modified to use this base class so that
uses that run on the foreground thread do not need to be modified.

It also adds a new class TimedHistogramScope that defines the timer
in this class. This allows the corresopnding TimedHistogram class to
be type safe.

BUG=v8:6361

Review-Url: https://codereview.chromium.org/2929853003
Cr-Commit-Position: refs/heads/master@{#46150}