Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/ee1c1b5..08e8c31

Rolling v8/third_party/android_tools: https://chromium.googlesource.com/android_tools/+log/25d57ea..3d6ba29

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapul/+log/c73d4a1..c1cc028

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2414363003
Cr-Commit-Position: refs/heads/master@{#40330}

Currently when memory size references are updated with zero initial memory during GrowMemory/Relocation of Instance objects, the bounds check does not take into account the size of memtype.

R=titzer@chromium.org, bradnelson@chromium.org

Committed: https://crrev.com/70416a2b360c0d993cffb48284b143d484d1e290
Review-Url: https://codereview.chromium.org/2416543002
Cr-Original-Commit-Position: refs/heads/master@{#40326}
Cr-Commit-Position: refs/heads/master@{#40329}

Revert of [wasm] Fix bounds check for zero initial memory. (patchset #11 id:200001 of https://codereview.chromium.org/2416543002/ )

Reason for revert:
Reverting because of failure on V8 Linux64 GC Stress

http://build.chromium.org/p/client.v8/builders/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/builds/8572

Original issue's description:
> [wasm] Fix bounds check for zero initial memory.
>
> Currently when memory size references are updated with zero initial memory during GrowMemory/Relocation of Instance objects, the bounds check does not take into account the size of memtype.
>
> R=titzer@chromium.org, bradnelson@chromium.org
>
> Committed: https://crrev.com/70416a2b360c0d993cffb48284b143d484d1e290
> Cr-Commit-Position: refs/heads/master@{#40326}

TBR=bradnelson@chromium.org,titzer@chromium.org,bradnelson@google.com,mtrofin@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2416393002
Cr-Commit-Position: refs/heads/master@{#40328}

If the catch prediction machinery in the middle of some async op, we
shouldn't send invalid events to the debugger.

Instead of sending events with an undefined id, we don't send them at
all.

Review-Url: https://codereview.chromium.org/2417093003
Cr-Commit-Position: refs/heads/master@{#40327}

Currently when memory size references are updated with zero initial memory during GrowMemory/Relocation of Instance objects, the bounds check does not take into account the size of memtype.

R=titzer@chromium.org, bradnelson@chromium.org

Review-Url: https://codereview.chromium.org/2416543002
Cr-Commit-Position: refs/heads/master@{#40326}

BUG=

Review-Url: https://codereview.chromium.org/2421883002
Cr-Commit-Position: refs/heads/master@{#40325}

BUG=

Review-Url: https://codereview.chromium.org/2418063003
Cr-Commit-Position: refs/heads/master@{#40324}

It will allow timeline to show JS profile on code evaluated from console.

BUG=chromium:655430

Committed: https://crrev.com/6882c91ecd222f3ee2feb42ad73fbc796d5c8172
Review-Url: https://codereview.chromium.org/2413943002
Cr-Original-Commit-Position: refs/heads/master@{#40289}
Cr-Commit-Position: refs/heads/master@{#40323}

Introduce CSA_ASSERT macro that outputs a message, file name and line number to
console before calling DebugBreak.

Committed: https://crrev.com/23836e9c14f3df9b675fe02e2c23bb11e728b83d
Review-Url: https://codereview.chromium.org/2419433008
Cr-Original-Commit-Position: refs/heads/master@{#40307}
Cr-Commit-Position: refs/heads/master@{#40322}

A test where the deserialization data has a header, but the
header is invalid. This is in addition to the current test
where we have empty deserialization data.

BUG=

Review-Url: https://codereview.chromium.org/2418483002
Cr-Commit-Position: refs/heads/master@{#40321}

This allows people writing code stubs to just verify the graph of the stub they're working on, at least until we fix all of the issues we have and enable the verification by default.

Also fixes representations in CodeStubAssembler::SmiOr and InterpreterAssembler::StarDispatchLookahead.

R=bmeurer@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2413653006
Cr-Commit-Position: refs/heads/master@{#40320}

Used to be:

Failure: expected <foo> is not an instance of <Bar> but of < Baz>> found <undefined>

Should be:

Failure: <foo> is not an instance of <Bar> but of <Baz>

BUG=

Review-Url: https://codereview.chromium.org/2413153004
Cr-Commit-Position: refs/heads/master@{#40319}

BUG=

Review-Url: https://codereview.chromium.org/2414383002
Cr-Commit-Position: refs/heads/master@{#40318}

promoted and semi_space_copied are still int type, so it is needed to use V8PRIdPTR
as their printf format specifier.

R=mlippautz@chromium.org, ulan@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2415183003
Cr-Commit-Position: refs/heads/master@{#40317}

There is no user for this log entry, and a large part of regexp log
output has long been removed already.

R=jgruber@chromium.org

Review-Url: https://codereview.chromium.org/2422593003
Cr-Commit-Position: refs/heads/master@{#40316}

It doesn't need to have this logic.

ParseLazyFunctionLiteralBody is basically just ParseStatementList
+ log the function position. But PreParser doesn't need to have
the "which functions to log" logic, since logging the function is
always done exactly when Parser falls back to PreParser. (See
PreParseLazyFunction.)

So in the current state, PreParser would log several functions in
a SingletonLogger, and only the last one would take
effect (that's the one Parser also logs in SkipLazyFunctionBody).

Also updated test-parsing/Regress928 to produce the preparse data
the way we do now (i.e., not running the PreParser directly, but
running the Parser).

Error reporting: when PreParser finds an error, it doesn't need
to ReportUnexpectedToken in PreParseLazyFunction, since it
already has reported the error whenever it found it.

BUG=v8:5515

Review-Url: https://codereview.chromium.org/2421833002
Cr-Commit-Position: refs/heads/master@{#40315}

... to keep all the pieces in one place for easier modifications.

This CL also adds a new runtime call stats bucket: KeyedLoadIC_LoadElementDH.

BUG=

Review-Url: https://codereview.chromium.org/2412983008
Cr-Commit-Position: refs/heads/master@{#40314}

Revert of Improve CodeStubAssembler assert functionality (patchset #3 id:40001 of https://codereview.chromium.org/2419433008/ )

Reason for revert:
[Sheriff] Fails leak checker:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20debug/builds/12393

Original issue's description:
> Improve CodeStubAssembler assert functionality
>
> Introduce CSA_ASSERT macro that outputs a message, file name and line number to
> console before calling DebugBreak.
>
> Committed: https://crrev.com/23836e9c14f3df9b675fe02e2c23bb11e728b83d
> Cr-Commit-Position: refs/heads/master@{#40307}

TBR=epertoso@chromium.org,ishell@google.com,ishell@chromium.org,danno@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2414373002
Cr-Commit-Position: refs/heads/master@{#40313}

R=jgruber@chromium.org

Review-Url: https://codereview.chromium.org/2418123002
Cr-Commit-Position: refs/heads/master@{#40312}

R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2410303009
Cr-Commit-Position: refs/heads/master@{#40311}

Let AdvanceStringIndex return the incremented index instead of the
increment, and adjust all use sites.

BUG=v8:5339

Review-Url: https://codereview.chromium.org/2415383002
Cr-Commit-Position: refs/heads/master@{#40310}

GetCapture can reuse the bool pointer argument of GenericCaptureGetter
instead of duplicating that logic with additional checks.

The check also incorrectly checks for undefined while
GenericCaptureGetter returns the empty string on failure.

BUG=v8:5339

Review-Url: https://codereview.chromium.org/2422563002
Cr-Commit-Position: refs/heads/master@{#40309}

Now that all accesses to the last match info are in C++ and TF code, we can
finally turn the last match info into a FixedArray. Similar to the ArrayList,
it uses its first field to store its length and grows dynamically in amortized
O(1) time.

Unlike previously, this means that the last match info pointer stored on the
context can actually change (in case the FixedArray needs to grow).

BUG=v8:5339

Review-Url: https://codereview.chromium.org/2415103002
Cr-Commit-Position: refs/heads/master@{#40308}

Introduce CSA_ASSERT macro that outputs a message, file name and line number to
console before calling DebugBreak.

Review-Url: https://codereview.chromium.org/2419433008
Cr-Commit-Position: refs/heads/master@{#40307}

These accessors also always call into C++ anyways, so there's no point
in having the JavaScript wrappers.

R=yangguo@chromium.org
BUG=v8:5049, chromium:655963

Committed: https://crrev.com/ede69cfabd790fe9f171b5d1f426ea0fc55e3c98
Review-Url: https://codereview.chromium.org/2417183002
Cr-Original-Commit-Position: refs/heads/master@{#40298}
Cr-Commit-Position: refs/heads/master@{#40306}

BUG=chromium:654343

Review-Url: https://codereview.chromium.org/2419783004
Cr-Commit-Position: refs/heads/master@{#40305}

This differentiates sancov files from several runs of the
same test. This situation happens when a test fails and is
rerun for flake checking.

BUG=v8:5502

Review-Url: https://codereview.chromium.org/2414093003
Cr-Commit-Position: refs/heads/master@{#40304}

Revert of [builtins] Also port the Object.prototype.__proto__ accessors to C++. (patchset #1 id:1 of https://codereview.chromium.org/2417183002/ )

Reason for revert:
[Sheriff] Speculative revert for webkit tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/10656

Was broken before, but this one test failure started with this CL:
inspector/console/console-dir.htm

All other errors stopped after another revert.

See also:
https://github.com/v8/v8/wiki/Blink-layout-tests

Original issue's description:
> [builtins] Also port the Object.prototype.__proto__ accessors to C++.
>
> These accessors also always call into C++ anyways, so there's no point
> in having the JavaScript wrappers.
>
> R=yangguo@chromium.org
> BUG=v8:5049
>
> Committed: https://crrev.com/ede69cfabd790fe9f171b5d1f426ea0fc55e3c98
> Cr-Commit-Position: refs/heads/master@{#40298}

TBR=yangguo@chromium.org,bmeurer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5049

Review-Url: https://codereview.chromium.org/2415173003
Cr-Commit-Position: refs/heads/master@{#40303}

'RETURN_RESULT(isolate, call, type)' is equivalent to 'return call' in
all current use cases.

BUG=

Review-Url: https://codereview.chromium.org/2415993003
Cr-Commit-Position: refs/heads/master@{#40302}

It's always JSFunction.

R=bmeurer@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2422573002
Cr-Commit-Position: refs/heads/master@{#40301}

R=machenbach@chromium.org,jgruber@chromium.org,mythria@chromium.org
CQ_INCLUDE_TRYBOTS=master.tryserver.v8:v8_win_dbg,v8_mac_dbg;master.tryserver.chromium.android:android_arm64_dbg_recipe

Review-Url: https://codereview.chromium.org/2410353005
Cr-Commit-Position: refs/heads/master@{#40300}

Revert of [inspector] Record EvaluateScript trace event upon console evaluation (patchset #2 id:20001 of https://codereview.chromium.org/2413943002/ )

Reason for revert:
Breaks layout tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/10647

See also:
https://github.com/v8/v8/wiki/Blink-layout-tests

Original issue's description:
> [inspector] Record EvaluateScript trace event upon console evaluation
>
> It will allow timeline to show JS profile on code evaluated from console.
>
> BUG=chromium:655430
>
> Committed: https://crrev.com/6882c91ecd222f3ee2feb42ad73fbc796d5c8172
> Cr-Commit-Position: refs/heads/master@{#40289}

TBR=caseq@chromium.org,paulirish@chromium.org,dgozman@chromium.org,alph@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:655430

Review-Url: https://codereview.chromium.org/2416213002
Cr-Commit-Position: refs/heads/master@{#40299}

These accessors also always call into C++ anyways, so there's no point
in having the JavaScript wrappers.

R=yangguo@chromium.org
BUG=v8:5049

Review-Url: https://codereview.chromium.org/2417183002
Cr-Commit-Position: refs/heads/master@{#40298}

R=machenbach@chromium.org,jgruber@chromium.org
CQ_INCLUDE_TRYBOTS=master.tryserver.v8:v8_win_dbg,v8_mac_dbg;master.tryserver.chromium.android:android_arm64_dbg_recipe

Review-Url: https://codereview.chromium.org/2417703003
Cr-Commit-Position: refs/heads/master@{#40297}

BUG=

Review-Url: https://codereview.chromium.org/2421493002
Cr-Commit-Position: refs/heads/master@{#40296}

R=ulan@chromium.org,cbruni@chromium.org,rmcilroy@chromium.org
BUG=v8:5215

Review-Url: https://codereview.chromium.org/2413243002
Cr-Commit-Position: refs/heads/master@{#40295}

This is done to introduce the correct bitcasts operator on the right nodes.

R=bmeurer@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2415133002
Cr-Commit-Position: refs/heads/master@{#40294}

This calls into C++ anyways, so no need to add the JavaScript wrapper
around it.

R=yangguo@chromium.org
BUG=v8:5049

Review-Url: https://codereview.chromium.org/2421803002
Cr-Commit-Position: refs/heads/master@{#40293}

Revert of [heap] Move slot filtering logic into sweeper. (patchset #4 id:60001 of https://codereview.chromium.org/2418773002/ )

Reason for revert:
[Sheriff] Speculative revert for heap corruption on all platforms, e.g.:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20debug/builds/12377
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20debug/builds/12379
https://build.chromium.org/p/client.v8/builders/V8%20Win32/builds/4819
https://build.chromium.org/p/client.v8/builders/V8%20Win32%20-%20nosnap%20-%20shared/builds/16783
https://build.chromium.org/p/client.v8/builders/V8%20Mac64%20-%20debug/builds/10007

Original issue's description:
> [heap] Move slot filtering logic into sweeper.
>
> BUG=chromium:648568
>
> Committed: https://crrev.com/18db69c38c93450c1ae957999fc48c465f111f00
> Cr-Commit-Position: refs/heads/master@{#40267}

TBR=ulan@chromium.org,mlippautz@chromium.org,hpayer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:648568

Review-Url: https://codereview.chromium.org/2418053002
Cr-Commit-Position: refs/heads/master@{#40292}

Rolling v8/base/trace_event/common: https://chromium.googlesource.com/chromium/src/base/trace_event/common/+log/98499f3..06294c8

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/f9e6643..ee1c1b5

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapul/+log/5b5774b..c73d4a1

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clan/+log/6551b7f..6ba3d23

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2418033002
Cr-Commit-Position: refs/heads/master@{#40291}