The StringIndexOf operation is pure on the JS level, but the actual stub
call must be in the effect chain later so that the Scheduler doesn't
place it inside some allocation region (The %StringIndexOf runtime
function may trigger a GC for string flattening).

BUG=chromium:685580
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2657243002
Cr-Commit-Position: refs/heads/master@{#42736}

Basically, with --deopt-every-n-times flag all bets are off since
the functions can be optimized and deoptimized at any time.

BUG=v8:5890

Review-Url: https://codereview.chromium.org/2655263004
Cr-Commit-Position: refs/heads/master@{#42735}

BUG=chromium:685561

Review-Url: https://codereview.chromium.org/2650273006
Cr-Commit-Position: refs/heads/master@{#42734}

Review-Url: https://codereview.chromium.org/2661483002
Cr-Commit-Position: refs/heads/master@{#42733}

This patch fixes an issue with compilation with MIPS Android compiler
NDK r12b, gcc version mipsel-linux-android-g++ (GCC) 4.9.x 20150123
(prerelease).
The problem has been reported to the compiler team, the workaround
should be reverted when the issue with compiler is resolved.

BUG=

Review-Url: https://codereview.chromium.org/2652673002
Cr-Commit-Position: refs/heads/master@{#42732}

The mentioned asserts did not work properly with interpreted and turbofanned functions.

To fix this issue %GetOptimizationStatus() now returns a set of flags instead of a single value.

This CL also adds more helper functions to mjsunit, like isNeverOptimize(), isAlwaysOptimize(),
isOptimized(fun), etc.

BUG=v8:5890

Review-Url: https://codereview.chromium.org/2654733004
Cr-Original-Commit-Position: refs/heads/master@{#42703}
Committed: https://chromium.googlesource.com/v8/v8/+/d1ddec785725a184fe6d01bd0813262e3ba24966
Review-Url: https://codereview.chromium.org/2654733004
Cr-Commit-Position: refs/heads/master@{#42731}

Always execute the implicit return if we fell off the function bytes.
This is not considered an additional "step" as it is not executing a
wasm instruction.
Otherwise, we might pause at an invalid position (one after the
function bytes).

R=titzer@chromium.org
BUG=v8:5822

Review-Url: https://codereview.chromium.org/2650293003
Cr-Commit-Position: refs/heads/master@{#42730}

This also fixes bugs found by the new test. It only tests stepping
inside of wasm code. Wasm to JS and vice versa will follow in another
CL.

R=yangguo@chromium.org, titzer@chromium.org, kozyatinskiy@chromium.org
BUG=v8:5822

Review-Url: https://codereview.chromium.org/2651043004
Cr-Commit-Position: refs/heads/master@{#42729}

BUG=chromium:685633
NOTRY=true

Review-Url: https://codereview.chromium.org/2654273004
Cr-Commit-Position: refs/heads/master@{#42728}

The v8 waterfall currently doesn't run MIPS tests in the debug configuration,
so although there are tests that would have found them, they currently are
not running in the standard CI setup. A bug has been fixed to add the debug
configuration of MIPS & MIPS64, too.

Review-Url: https://codereview.chromium.org/2654263002
Cr-Commit-Position: refs/heads/master@{#42727}

BUG=chromium:685633
NOTRY=true
TBR=yangguo@chromium.org, jarin@chromium.org

Review-Url: https://codereview.chromium.org/2658223002
Cr-Commit-Position: refs/heads/master@{#42726}

Previously, when restarting a frame, we would rewrite all frames
between the debugger activation and the frame to restart to squash
them, and replace the return address with that of a builtin to
leave that rewritten frame, and restart the function by calling it.

We now simply remember the frame to drop to, and upon returning
from the debugger, we check whether to drop the frame, load the
new FP, and restart the function.

R=jgruber@chromium.org, mstarzinger@chromium.org
BUG=v8:5587

Review-Url: https://codereview.chromium.org/2636913002
Cr-Commit-Position: refs/heads/master@{#42725}

As Blink needs to set Symbol.toPrimitive, exposes the symbol in C++ APIs
as Symbol::GetToPrimitive.

BUG=chromium:680409

Review-Url: https://codereview.chromium.org/2657933003
Cr-Commit-Position: refs/heads/master@{#42724}

Review-Url: https://codereview.chromium.org/2655243003
Cr-Commit-Position: refs/heads/master@{#42723}

and add an inspector test for it. Also test that a breakpoint can be
set on each reported position, and that it is also hit during
execution.
This CL also fixes two little things which were uncovered by the new
test.

R=yangguo@chromium.org, titzer@chromium.org, kozyatinskiy@chromium.org
BUG=v8:5822

Review-Url: https://codereview.chromium.org/2655653003
Cr-Commit-Position: refs/heads/master@{#42722}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/6f17189..c3da457

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/e1e778d..683b84f

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/017f4e5..dbc7572

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2650853009
Cr-Commit-Position: refs/heads/master@{#42721}

BUG=v8:5753

Review-Url: https://codereview.chromium.org/2655963003
Cr-Commit-Position: refs/heads/master@{#42720}

Reloc info often means that the constant will be patched later, and for
this patching we have to make sure that there is enough space in the
code for the new value.

R=bmeurer@chromium.org, titzer@chromium.org, gdeepti@chromium.org
BUG=chromium:684407
TEST=cctest/test-assembler-x64/Regression684407

Review-Url: https://codereview.chromium.org/2655213003
Cr-Commit-Position: refs/heads/master@{#42719}

wasm::ErrorThrower doesn't actually throw exceptions, it just schedules them.
As a result, this exception isn't handled properly by code which expects
ValueDeserializer to actually throw. For instance, the unit tests use a
TryCatch to catch and handle expected exceptions in unit tests.

Before this patch, I see local unit test failures because a wasm decode test
schedules one, but it isn't caught (and instead causes Context::New to fail
at the beginning of the next test).

BUG=685713

Review-Url: https://codereview.chromium.org/2659483004
Cr-Commit-Position: refs/heads/master@{#42718}

Memory.Grow should detach the ArrayBuffer associated with the Mem object after Grow. Currently, when guard pages are enabled protection is changed to make more of the buffer accessible. This does not work for when the buffer should be detached after grow, because the memory object has a reference to the same buffer befor/after grow.

R=titzer@chromium.org, eholk@chromium.org

Review-Url: https://codereview.chromium.org/2653183003
Cr-Commit-Position: refs/heads/master@{#42717}

This is a flag useful for testing/perf investigations for asm-wasm.

We can dump the internal representation of a asm.js module (when asm-wasm is
enabled with --validate-asm) using --dump-wasm-module. We can't pick that
module afterwards because it contains non-compliant opcodes - used as
implementation detail of our asm-wasm pipeline.

This flag forces asm.js origin on the decoder.

BUG=

Review-Url: https://codereview.chromium.org/2656103003
Cr-Commit-Position: refs/heads/master@{#42716}

BUG=v8:5842, chromium:583193
R=yangguo@chromium.org,dgozman@chromium.org,alph@chromium.org

Review-Url: https://codereview.chromium.org/2656743003
Cr-Commit-Position: refs/heads/master@{#42715}

- and fixed test.

BUG=v8:5842, chromium:583193
R=yangguo@chromium.org,dgozman@chromium.org,alph@chromium.org

Review-Url: https://codereview.chromium.org/2651683005
Cr-Commit-Position: refs/heads/master@{#42714}

BUG=chromium:685634
R=ishell@chromium.org

Review-Url: https://codereview.chromium.org/2658853002
Cr-Commit-Position: refs/heads/master@{#42713}

Chrome now uses the default_args system for specifying its own definitions of
these variables so the separate file in build_overrides is no longer necessary.

BUG=684096

Review-Url: https://codereview.chromium.org/2652263003
Cr-Commit-Position: refs/heads/master@{#42712}

There is a print in AstNumbering which needs to dereference the string
containing the function name, which clashes with the disallowed handle
reference scope used to allow ast-numbering to run off-thread.

This could be fixed by pushing the print out of this function, and
somehow propagating disable_crankshaft_reason out of the visitor, but in
reality this check will soon be removed anyway, and until it is this
function will be on the main thread, so we may as well just hack it.

Review-Url: https://codereview.chromium.org/2653953006
Cr-Commit-Position: refs/heads/master@{#42711}

This corrects the case when we need to allocate a
blocked register, but the blockage happens after a
use as an instruction input, and there's no place to
split before that.

BUG=v8:5888

Review-Url: https://codereview.chromium.org/2652153005
Cr-Original-Commit-Position: refs/heads/master@{#42706}
Committed: https://chromium.googlesource.com/v8/v8/+/ca779b29a60785d962d7cd636f6b0f09e66130b3
Review-Url: https://codereview.chromium.org/2652153005
Cr-Commit-Position: refs/heads/master@{#42710}

This CL adds --crankshaft and --no-always-opt flags to the tests that use
assertOptimized() and assertUnoptimized() respectively.

This CL also adds presubmit checks that ensure that tests have the proper
flags set.

BUG=v8:5890

Review-Url: https://codereview.chromium.org/2653753007
Cr-Commit-Position: refs/heads/master@{#42709}

Port f9367847
Port bf782ec5

Original Commit Message:

    We can share almost all of the architecture-specific builtin code with super-call-with-spread.

    Info to port-writers: The code in CheckSpreadAndPushToStack has changed slightly
    from what was in Generate_ConstructWithSpread, in that we take the length of the
    spreaded parameters from the JSArray rather than the FixedArray backing store.

R=petermarshall@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:5511
LOG=N

Review-Url: https://codereview.chromium.org/2655043004
Cr-Commit-Position: refs/heads/master@{#42708}

Revert of [turbofan] Correct regalloc blocked register behavior (patchset #2 id:60001 of https://codereview.chromium.org/2652153005/ )

Reason for revert:
Introduces new crashers, e.g.

load("test/mjsunit/wasm/wasm-constants.js");
load("test/mjsunit/wasm/wasm-module-builder.js");

(function() {
  var builder = new WasmModuleBuilder();
  builder.addMemory(16, 32, false);
  builder.addFunction("test", kSig_i_iii)
    .addBodyWithEnd([
// body:
kExprI64Const, 0x42,
kExprI64Const, 0x7a,
kExprI64Ctz,
kExprI64Mul,
kExprI64Ctz,
kExprI64Const, 0x41,
kExprI64Ctz,
kExprI64Ctz,
kExprI64Shl,
kExprI64Const, 0x41,
kExprI64Ctz,
kExprI64Ctz,
kExprI64Shl,
kExprF32SConvertI64,
kExprUnreachable,
kExprEnd,   // @20
            ])
            .exportFunc();
  var module = builder.instantiate();
  module.exports.test(1, 2, 3);
})();

Original issue's description:
> [turbofan] Correct regalloc blocked register behavior
>
>
> This corrects the case when we need to allocate a
> blocked register, but the blockage happens after a
> use as an instruction input, and there's no place to
> split before that.
>
> BUG=v8:5888
>
> Review-Url: https://codereview.chromium.org/2652153005
> Cr-Commit-Position: refs/heads/master@{#42706}
> Committed: https://chromium.googlesource.com/v8/v8/+/ca779b29a60785d962d7cd636f6b0f09e66130b3

TBR=bmeurer@chromium.org,jarin@chromium.org,mtrofin@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5888

Review-Url: https://codereview.chromium.org/2654993007
Cr-Commit-Position: refs/heads/master@{#42707}

This corrects the case when we need to allocate a
blocked register, but the blockage happens after a
use as an instruction input, and there's no place to
split before that.

BUG=v8:5888

Review-Url: https://codereview.chromium.org/2652153005
Cr-Commit-Position: refs/heads/master@{#42706}

Port d287c819

Original Commit Message:

    [RELAND with one change: until literal arrays are rooted in the outer
    feedback vector (coming in the next days), the runtime-scope.cc change
    is held off.]

    When a function is declared in global scope, the closure is created
    by the DeclareGlobals runtime service. It needs a pointer to the
    literals array, already allocated in the feedback vector. This
    fixes a bug where it's behavior wasn't in sync with CreateClosure,
    which accepts the literals from the vector.

    This enables a follow-on performance improvement in the CompileLazy
    builtin.

R=mvstanton@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=680637
LOG=N

Review-Url: https://codereview.chromium.org/2658053002
Cr-Commit-Position: refs/heads/master@{#42705}

Revert of [tests] Make assertOptimized()/assertUnoptimized() great again. (patchset #6 id:130042 of https://codereview.chromium.org/2654733004/ )

Reason for revert:
Mac gc stress failures:
https://build.chromium.org/p/client.v8/builders/V8%20Mac%20GC%20Stress/builds/11195

There's also this flake, but maybe unrelated:
https://build.chromium.org/p/client.v8/builders/V8%20Win64/builds/15422

Original issue's description:
> [tests] Make assertOptimized()/assertUnoptimized() great again.
>
> The mentioned asserts did not work properly with interpreted and turbofanned functions.
>
> To fix this issue %GetOptimizationStatus() now returns a set of flags instead of a single value.
>
> This CL also adds more helper functions to mjsunit, like isNeverOptimize(), isAlwaysOptimize(),
> isOptimized(fun), etc.
>
> BUG=v8:5890
>
> Review-Url: https://codereview.chromium.org/2654733004
> Cr-Commit-Position: refs/heads/master@{#42703}
> Committed: https://chromium.googlesource.com/v8/v8/+/d1ddec785725a184fe6d01bd0813262e3ba24966

TBR=mstarzinger@chromium.org,ishell@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5890

Review-Url: https://codereview.chromium.org/2655223003
Cr-Commit-Position: refs/heads/master@{#42704}

The mentioned asserts did not work properly with interpreted and turbofanned functions.

To fix this issue %GetOptimizationStatus() now returns a set of flags instead of a single value.

This CL also adds more helper functions to mjsunit, like isNeverOptimize(), isAlwaysOptimize(),
isOptimized(fun), etc.

BUG=v8:5890

Review-Url: https://codereview.chromium.org/2654733004
Cr-Commit-Position: refs/heads/master@{#42703}

TBR=mvstanton@chromium.org

Review-Url: https://codereview.chromium.org/2658463004
Cr-Commit-Position: refs/heads/master@{#42702}

When testing turning --verify-csa off to generate better code for builtins, mips
started failing mksnapshot due to an assert in instruction-selection-mips.cc's
VisitBinop routine, which creates a buffer to hold InstructionOperand of size 4
that would be overflowed. This fix is somewhat speculative, assuming that either
the LHS or the RHS operand of a mips binary op can be an immediate (as opposed
to the current code which seems to have a code path where both the left and
right operands are added, leading to the buffer overflow). With this fix, the
assert doesn't fire and all of the mips tests run through successfully in debug
mode.

R=ishell@chromium.org
TBR=dusan.m.milosavljevic@gmail.com

Review-Url: https://codereview.chromium.org/2647283009
Cr-Commit-Position: refs/heads/master@{#42701}

BUG=chromium:685561
NOTRY=true
TBR=danno@chromium.org, kjellander@chromium.org

Review-Url: https://codereview.chromium.org/2652653013
Cr-Commit-Position: refs/heads/master@{#42700}

The instance type of an object cannot change, only the concrete map
might. So when searching for an instance type witness, we don't need
to pay attention to potentially side-effecting nodes.

R=mstarzinger@chromium.org

Review-Url: https://codereview.chromium.org/2652893011
Cr-Commit-Position: refs/heads/master@{#42699}

This adds MB configs for the four verify-csa bots (gn only).

BUG=chromium:685561
NOTRY=true
NOTREECHECKS=true
TBR=danno@chromium.org, kjellander@chromium.org

Review-Url: https://codereview.chromium.org/2659583002
Cr-Commit-Position: refs/heads/master@{#42698}

This makes sure that static guarantees about object maps are not used
accross operations on the effect chain that might trigger a map change.
Such operations are missing the {Operator::kNoWrite} property.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-685506
BUG=chromium:685506

Review-Url: https://codereview.chromium.org/2653273004
Cr-Commit-Position: refs/heads/master@{#42697}