R=ishell@chromium.org
BUG=chromium:686102

Review-Url: https://codereview.chromium.org/2662793002
Cr-Commit-Position: refs/heads/master@{#42767}

Review-Url: https://codereview.chromium.org/2658253002
Cr-Commit-Position: refs/heads/master@{#42766}

Where the arguments have already been inlined, we can replace these calls with a
direct call to construct. We have to make sure that the iteration over the arguments is not observable.

BUG=v8:5895

Review-Url: https://codereview.chromium.org/2659623002
Cr-Commit-Position: refs/heads/master@{#42765}

We need it to be a PropertyCell so that we can list it as a dependency for
optimised code.

Also drive-by clean up some variable names in src/isolate-inl.h.

BUG=v8:5895

Review-Url: https://codereview.chromium.org/2658573008
Cr-Commit-Position: refs/heads/master@{#42764}

R=adamk@chromium.org
BUG=v8:1569

Review-Url: https://codereview.chromium.org/2657773006
Cr-Commit-Position: refs/heads/master@{#42763}

These tests pass without further changes.

BUG=v8:5516

Review-Url: https://codereview.chromium.org/2654163008
Cr-Commit-Position: refs/heads/master@{#42762}

We shouldn't block during GC for arbitrarily long intervals.

BUG=chromium:686153,chromium:642532
R=verwaest@chromium.org,hpayer@chromium.org

Review-Url: https://codereview.chromium.org/2658313002
Cr-Commit-Position: refs/heads/master@{#42761}

emit %DebugPrint(tagged_value) instead of %GlobalPrint(tagged_value) to
avoid a CONVERT_ARG_CHECKED() failure when tagged value is not a string.

BUG=v8:5268
R=ishell@chromium.org, bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2663633002
Cr-Commit-Position: refs/heads/master@{#42760}

BUG=v8:5906
NOTRY=true
TBR=binji@chromium.org

Review-Url: https://codereview.chromium.org/2659273002
Cr-Commit-Position: refs/heads/master@{#42759}

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/9907db5..c3f2575

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2666443002
Cr-Commit-Position: refs/heads/master@{#42758}

Return a regular JSObject in the asm.js -> wasm case.

BUG=v8:5877
R=mtrofin@chromium.org,aseemgarg@chromium.org,titzer@chromium.org

Review-Url: https://codereview.chromium.org/2664493002
Cr-Commit-Position: refs/heads/master@{#42757}

This avoids using kTaggedSigned and kTaggedPointer because the
semantic information of those type could be invalid in unreachable
code.

For example, SmiCheck(0.1) has representation TaggedSigned, but it is
later compiled to DeoptimizeUnless(ObjectIsSmi(0.1)) with the constant
0.1 directly connected to the uses. If the use is state-values, which
recorded the TaggedSigned representation of CheckSmi, the code
generator will be confused because it will see constant 0.1 that
claims to be TaggedSigned value.

BUG=chromium:675704

Review-Url: https://codereview.chromium.org/2656243004
Cr-Commit-Position: refs/heads/master@{#42756}

Revert of [turbofan] Enable escape analysis. (patchset #1 id:1 of https://codereview.chromium.org/2626013002/ )

Reason for revert:
Temporarily turn off escape analysis to get a clean canary.

Original issue's description:
> [turbofan] Enable escape analysis.
>
> Review-Url: https://codereview.chromium.org/2626013002
> Cr-Commit-Position: refs/heads/master@{#42229}
> Committed: https://chromium.googlesource.com/v8/v8/+/30176976e857d4eb84a93fface84849c44bab793

TBR=tebbi@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.

Review-Url: https://codereview.chromium.org/2660063002
Cr-Commit-Position: refs/heads/master@{#42755}

Revert of [stubs] KeyedLoadIC_Generic: prototype chain lookup support (patchset #2 id:20001 of https://codereview.chromium.org/2652213003/ )

Reason for revert:
Speculative revert for breaking a layout test:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/13113

Unfortunately, the test results archive is not giving much info this time.

Original issue's description:
> [stubs] KeyedLoadIC_Generic: prototype chain lookup support
>
> Performing lookups on the prototype chain in the stub avoids a
> bunch of slow-path runtime calls. For now, only receivers with
> dictionary-mode properties do this; fast-mode receivers will follow
> if it's beneficial.
>
> Review-Url: https://codereview.chromium.org/2652213003
> Cr-Commit-Position: refs/heads/master@{#42751}
> Committed: https://chromium.googlesource.com/v8/v8/+/82e10f5fbacbbd71bc65e99322f432470692bf41

TBR=ishell@chromium.org,jkummerow@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2657393002
Cr-Commit-Position: refs/heads/master@{#42754}

memcpy is faster than UTF-8 encoding/decoding. This yields 10-20% wins on
serializing and deserializing long ASCII strings, according to
blink_perf.bindings -- and these are already in a fast path where the entire
string is known to be ASCII (but this has to be checked). The win may be
larger for strings in Latin-1 but not ASCII (though I suspect this is an
uncommon case).

A change is also made to make ValueSerializerTest.EncodeTwoByteStringUsesPadding
survive wire format version number changes.

This is the first of a series of wire format changes from the previous Blink
format. The deserializer continues to be able to read the old format, but
Chromium M56 will no longer be able to read the messages written by this, in M58.

BUG=chromium:686159

Review-Url: https://codereview.chromium.org/2658793004
Cr-Commit-Position: refs/heads/master@{#42753}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/c3da457..3dada45

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/buildtools/+log/a7cc7a3..c302711

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/683b84f..9907db5

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/dbc7572..0b3a445

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2659873003
Cr-Commit-Position: refs/heads/master@{#42752}

Performing lookups on the prototype chain in the stub avoids a
bunch of slow-path runtime calls. For now, only receivers with
dictionary-mode properties do this; fast-mode receivers will follow
if it's beneficial.

Review-Url: https://codereview.chromium.org/2652213003
Cr-Commit-Position: refs/heads/master@{#42751}

This is needed to insulate generated code from blink::protocol namespace
from naming changes that we plan to do in the Great Blink Rename (which
in particular will change wtf::StringBuilder::toString into ToString,
and similarily will rename reserveCapacity and append methods).

This CL also includes roll of inspector_protocol which starts to
generate code that uses the new methods of StringUtil adapter:
rolling third_party/inspector to 1a131872167f0f7653629326891aa3ec94417f27.

BUG=683447

Review-Url: https://codereview.chromium.org/2660503002
Cr-Commit-Position: refs/heads/master@{#42750}

Review-Url: https://codereview.chromium.org/2643723010
Cr-Commit-Position: refs/heads/master@{#42749}

Port 3f47c63d

Original Commit Message:

    Previously, when restarting a frame, we would rewrite all frames
    between the debugger activation and the frame to restart to squash
    them, and replace the return address with that of a builtin to
    leave that rewritten frame, and restart the function by calling it.

    We now simply remember the frame to drop to, and upon returning
    from the debugger, we check whether to drop the frame, load the
    new FP, and restart the function.

R=yangguo@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:5587
LOG=N

Review-Url: https://codereview.chromium.org/2663453004
Cr-Commit-Position: refs/heads/master@{#42748}

BUG=chromium:682521

Review-Url: https://codereview.chromium.org/2659913002
Cr-Commit-Position: refs/heads/master@{#42747}

Previously (and still currently for some of them), post-mortem debugging
tools were using StandardFrameConstants::kContextOffset as the offset to
get the value that represents a frame's type.

However since https://codereview.chromium.org/1696043002, a new, more
general offset was introduced:
CommonFrameConstants::kContextOrFrameTypeOffset.

In order for post-mortem debugging tools to use this constant, it is
included in the generated post-mortem metadata.

R=danno@chromium.org,bmeurer@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2655553006
Cr-Commit-Position: refs/heads/master@{#42746}

Port 69747e26

Original Commit Message:

    We turn a JSCallFunction node for

      f.apply(receiver, arguments)

    into a JSCallForwardVarargs node, when the arguments refers to the
    arguments of the outermost optimized code object, i.e. not an inlined
    arguments, and the apply method refers to Function.prototype.apply,
    and there's no other user of arguments except in frame states.

    We also replace the arguments node in the graph with a marker for
    the Deoptimizer similar to Crankshaft to make sure we don't materialize
    unused arguments just for the sake of deoptimization. We plan to replace
    this with a saner EscapeAnalysis based solution soon.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:5267,v8:5726
LOG=N

Review-Url: https://codereview.chromium.org/2656363002
Cr-Commit-Position: refs/heads/master@{#42745}

This unifies the behavior of Scope::DeclareVariableName with
Scope::DeclareVariable.

BUG=v8:5516

Review-Url: https://codereview.chromium.org/2658063005
Cr-Commit-Position: refs/heads/master@{#42744}

BUG=chromium:685561
NOTRY=true
TBR=danno@chromium.org, kjellander@chromium.org

Review-Url: https://codereview.chromium.org/2650383008
Cr-Commit-Position: refs/heads/master@{#42743}

BUG=v8:5402

Review-Url: https://codereview.chromium.org/2663513002
Cr-Commit-Position: refs/heads/master@{#42742}

Some tests require a lot of memory and they fail on buildbots if they run
in parallel with other tests of the same kind.
We try to limit this by disabling multiple vairants of the same tests,
assuming this would stop the failures in most of the cases.

BUG=

Review-Url: https://codereview.chromium.org/2653603002
Cr-Commit-Position: refs/heads/master@{#42741}

These headers only need forward declarations.

BUG=v8:5294

Review-Url: https://codereview.chromium.org/2654253002
Cr-Commit-Position: refs/heads/master@{#42740}

BUG=v8:5516

Review-Url: https://codereview.chromium.org/2659053002
Cr-Commit-Position: refs/heads/master@{#42739}

This makes sure all use-site of {ObjectLiteral::constant_properties} are
adapted to use the correct {BoilerplateDescription} type instead of just
the {FixedArray} base type.

R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2659603003
Cr-Commit-Position: refs/heads/master@{#42738}

R=mstarzinger@chromium.org

BUG=chromium:683566

Review-Url: https://codereview.chromium.org/2653953010
Cr-Commit-Position: refs/heads/master@{#42737}

The StringIndexOf operation is pure on the JS level, but the actual stub
call must be in the effect chain later so that the Scheduler doesn't
place it inside some allocation region (The %StringIndexOf runtime
function may trigger a GC for string flattening).

BUG=chromium:685580
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2657243002
Cr-Commit-Position: refs/heads/master@{#42736}

Basically, with --deopt-every-n-times flag all bets are off since
the functions can be optimized and deoptimized at any time.

BUG=v8:5890

Review-Url: https://codereview.chromium.org/2655263004
Cr-Commit-Position: refs/heads/master@{#42735}

BUG=chromium:685561

Review-Url: https://codereview.chromium.org/2650273006
Cr-Commit-Position: refs/heads/master@{#42734}

Review-Url: https://codereview.chromium.org/2661483002
Cr-Commit-Position: refs/heads/master@{#42733}

This patch fixes an issue with compilation with MIPS Android compiler
NDK r12b, gcc version mipsel-linux-android-g++ (GCC) 4.9.x 20150123
(prerelease).
The problem has been reported to the compiler team, the workaround
should be reverted when the issue with compiler is resolved.

BUG=

Review-Url: https://codereview.chromium.org/2652673002
Cr-Commit-Position: refs/heads/master@{#42732}

The mentioned asserts did not work properly with interpreted and turbofanned functions.

To fix this issue %GetOptimizationStatus() now returns a set of flags instead of a single value.

This CL also adds more helper functions to mjsunit, like isNeverOptimize(), isAlwaysOptimize(),
isOptimized(fun), etc.

BUG=v8:5890

Review-Url: https://codereview.chromium.org/2654733004
Cr-Original-Commit-Position: refs/heads/master@{#42703}
Committed: https://chromium.googlesource.com/v8/v8/+/d1ddec785725a184fe6d01bd0813262e3ba24966
Review-Url: https://codereview.chromium.org/2654733004
Cr-Commit-Position: refs/heads/master@{#42731}

Always execute the implicit return if we fell off the function bytes.
This is not considered an additional "step" as it is not executing a
wasm instruction.
Otherwise, we might pause at an invalid position (one after the
function bytes).

R=titzer@chromium.org
BUG=v8:5822

Review-Url: https://codereview.chromium.org/2650293003
Cr-Commit-Position: refs/heads/master@{#42730}

This also fixes bugs found by the new test. It only tests stepping
inside of wasm code. Wasm to JS and vice versa will follow in another
CL.

R=yangguo@chromium.org, titzer@chromium.org, kozyatinskiy@chromium.org
BUG=v8:5822

Review-Url: https://codereview.chromium.org/2651043004
Cr-Commit-Position: refs/heads/master@{#42729}

BUG=chromium:685633
NOTRY=true

Review-Url: https://codereview.chromium.org/2654273004
Cr-Commit-Position: refs/heads/master@{#42728}