BUG=v8:4741

Review-Url: https://codereview.chromium.org/2658143003
Cr-Commit-Position: refs/heads/master@{#42822}

BUG=

Review-Url: https://codereview.chromium.org/2660903003
Cr-Commit-Position: refs/heads/master@{#42821}

Rewrites import expression into a runtime call. Uses peekahead to
determine if parsing an import declaration or import expression.

The runtime call doesn't actually do the import yet, will be added in
follow on patch.

Adds a new --harmony-dynamic-import flag.

Adds a ignore_error_msg parameter to the test runner to ignore the
discrepancy in the error messages while parsing import expression with
parser and pre parser. This discrepancy will actually never happen in
real code.

BUG=v8:5785

Review-Url: https://codereview.chromium.org/2661933003
Cr-Commit-Position: refs/heads/master@{#42820}

BUG=v8:5501

Review-Url: https://codereview.chromium.org/2661233002
Cr-Commit-Position: refs/heads/master@{#42819}

R=joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2661133004
Cr-Commit-Position: refs/heads/master@{#42818}

Port 56429fc1

Original Commit Message:

    Introduced MachineType::TaggedSigned() and TaggedPointer().

    The idea is to quit using the representational dimension of Type, and
    instead encode this information in the MachineRepresentation (itself
    lightly wrapped in MachineType, along with MachineSemantic).

    There are three parts to the whole change:

    1) Places that set the machine representation - constant nodes, loads nad
       stores, global object and native context specialization.

    2) Places that propagate type/representation - this is representation
       inference (aka simplified lowering). At the end of this process we
       expect to have a MachineRepresentation for every node. An interesting
       part of this is phi merging.

    3) Places that examine representation - WriteBarrier elimination does this.
       Currently it's looking at the Type representation dimension, but as
       a part of this change (or in a soon-to-follow change) it can simply
       examine the MachineRepresentation.

R=mvstanton@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2662223003
Cr-Commit-Position: refs/heads/master@{#42817}

Revert of [test] Add back lsan leak detection (patchset #4 id:60001 of https://codereview.chromium.org/2592663004/ )

Reason for revert:
Breaks mac asan. Need to keep leak check off on mac.

Original issue's description:
> [test] Add back lsan leak detection
>
> BUG=chromium:662388
> TBR=yangguo@chromium.org, glider@chromium.org, titzer@chromium.org
>
> Review-Url: https://codereview.chromium.org/2592663004
> Cr-Commit-Position: refs/heads/master@{#42815}
> Committed: https://chromium.googlesource.com/v8/v8/+/e196d00df587b6513eb79059cd96e259dd0a763f

TBR=yangguo@chromium.org,glider@chromium.org,titzer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:662388

Review-Url: https://codereview.chromium.org/2667993002
Cr-Commit-Position: refs/heads/master@{#42816}

BUG=chromium:662388
TBR=yangguo@chromium.org, glider@chromium.org, titzer@chromium.org

Review-Url: https://codereview.chromium.org/2592663004
Cr-Commit-Position: refs/heads/master@{#42815}

With this fix we generate straightline code again for the fast case,
just like Crankshaft.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2666893003
Cr-Commit-Position: refs/heads/master@{#42814}

A previous CL (https://codereview.chromium.org/2634123002) did that for
let-declared variables.  This CL also does it for var- and function-declared
variables.

BUG=v8:5636

Review-Url: https://codereview.chromium.org/2656753003
Cr-Commit-Position: refs/heads/master@{#42813}

Revert of [Test] Do a set number of runs to trigger optimisation for SuperSpread. (patchset #1 id:1 of https://codereview.chromium.org/2669523002/ )

Reason for revert:
Causes test timeouts.

Original issue's description:
> [Test] Do a set number of runs to trigger optimisation for SuperSpread.
>
> BUG=v8:5895
>
> Review-Url: https://codereview.chromium.org/2669523002
> Cr-Commit-Position: refs/heads/master@{#42811}
> Committed: https://chromium.googlesource.com/v8/v8/+/d4c22c3084f55a0c0baf88362f7ef652a7dc450b

TBR=bmeurer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5895

Review-Url: https://codereview.chromium.org/2669553002
Cr-Commit-Position: refs/heads/master@{#42812}

BUG=v8:5895

Review-Url: https://codereview.chromium.org/2669523002
Cr-Commit-Position: refs/heads/master@{#42811}

The KeyedStoreMode that we get out of the FeedbackNexus doesn't
necessarily need to apply when we have "static knowledge" about
the receiver, i.e. when the receiver is a known JSTypedArray, but
the KEYED_STORE_IC has seen only JSArray instances so far. The
DCHECK was too restrictive in this case, since we can just ignore
the KEYED_STORE_IC mode (like we ignore the maps).

BUG=chromium:685050
R=ishell@chromium.org

Review-Url: https://codereview.chromium.org/2668643002
Cr-Commit-Position: refs/heads/master@{#42810}

We were missing a case for Tagged->TaggedSigned conversions when the
input type is known to be Type::SignedSmall.

BUG=chromium:687029
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2666863002
Cr-Commit-Position: refs/heads/master@{#42809}

These counters were used during the initial implementation to gather
statistics about comparative effectiveness of the two escape analysis
approaches in practice. The counters are not thread-safe and cannot be
used for the analysis any longer as it is now running off main thread.
We deprecate the counters in question in favor of maintaining deferred
statistics until the need for such statistics arises again.

R=bmeurer@chromium.org
BUG=chromium:685942

Review-Url: https://codereview.chromium.org/2667453003
Cr-Commit-Position: refs/heads/master@{#42808}

This will be used for perf tests:
https://chromereviews.googleplex.com/565327014/

R=titzer@chromium.org, bradnelson@chromium.org

Review-Url: https://codereview.chromium.org/2663713003
Cr-Commit-Position: refs/heads/master@{#42807}

We cannot eliminate unused CheckFloat64Hole nodes, since loading from a
holey array can have side-effects, i.e. triggering getters in the
prototype chain.

R=mvstanton@chromium.org
BUG=chromium:686737

Review-Url: https://codereview.chromium.org/2665123002
Cr-Commit-Position: refs/heads/master@{#42806}

This is essentially a port of http://crrev.com/2403003002 to TurboFan,
adding support for fast access to JSGlobalObject properties through the
current native contexts' JSGlobalProxy.

It's a slightly bigger change, since JSNativeContextSpecialization and
JSGlobalObjectSpecialization needs merging for this to work, as due to
different type feedback layout we cannot just turn a JSLoadNamed into
JSLoadGlobal operator (and same for JSStoreNamed vs. JSStoreGlobal).
This part of the change is mostly mechanical.

CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_chromium_rel_ng
R=ishell@chromium.org, jochen@chromium.org
BUG=chromium:634276,v8:5267

Review-Url: https://codereview.chromium.org/2664853002
Cr-Commit-Position: refs/heads/master@{#42805}

Review-Url: https://codereview.chromium.org/2663713002
Cr-Commit-Position: refs/heads/master@{#42804}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/3dada45..02f71fd

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/c3f2575..986b4e8

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/0b3a445..960cc3e

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2661143002
Cr-Commit-Position: refs/heads/master@{#42803}

Previously this information was encoded in a FixedArray dangling off the
Code object. This extra field seems to be responsible for increased memory
usage, as seen in the linked bugs. In this change, we instead encode this
in the RelocInfo and remove the field from the Code object.

BUG= https://bugs.chromium.org/p/chromium/issues/detail?id=678583
BUG= https://bugs.chromium.org/p/chromium/issues/detail?id=671180
BUG= https://bugs.chromium.org/p/chromium/issues/detail?id=670733

Review-Url: https://codereview.chromium.org/2651833003
Cr-Commit-Position: refs/heads/master@{#42802}

R=bradnelson@chromium.org, ahaas@chromium.org

BUG=5553

Review-Url: https://codereview.chromium.org/2662153002
Cr-Commit-Position: refs/heads/master@{#42801}

Dealing with this case requires a wire format change. It is possible that an
element can be absent even in an array where the dense format was chosen
(because the array initially had no holes), if the elements are modified while
they are being serialized. In this case, a new tag for the "hole" is emitted.

The logic to treat undefined in dense arrays as an absent property is restricted
to versions of the wire format that this tag did not exist.

BUG=chromium:686159,chromium:665820

Review-Url: https://codereview.chromium.org/2660093002
Cr-Original-Commit-Position: refs/heads/master@{#42784}
Committed: https://chromium.googlesource.com/v8/v8/+/dc85f4c8338c1c824af4f7ee3274dc9f95d14e49
Review-Url: https://codereview.chromium.org/2660093002
Cr-Commit-Position: refs/heads/master@{#42800}

- Uses macros for splat, extract lane, replace lane, unary
ops and binary ops.
- Renames ARM SIMD instruction codes to match machine
operator names.

LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2652893013
Cr-Commit-Position: refs/heads/master@{#42799}

This groups together all the promise related runtime functions.

BUG=v8:5343

Review-Url: https://codereview.chromium.org/2665983002
Cr-Commit-Position: refs/heads/master@{#42798}

The spec for String.split() requires loading "separator[@@split]".
The KeyedLoadIC for this goes generic right away, but still requires
a runtime call. To avoid that, reshuffle checks in the generic stub
and do the primitive-string -> String-function translation inline.

Review-Url: https://codereview.chromium.org/2654893003
Cr-Commit-Position: refs/heads/master@{#42797}

Test just checks that all basic features are working correctly with modules.

BUG=v8:1569
R=dgozman@chromium.org,alph@chromium.org,adamk@chromium.org

Review-Url: https://codereview.chromium.org/2663743002
Cr-Commit-Position: refs/heads/master@{#42796}

Issues with instance wrapper allocation and JS Api errata have been fixed over the last few weeks, test in the bug no longer fails - enabling tests for imported memory.

BUG=5683

R=bradnelson@chromium.org, ahaas@chromium.org

Review-Url: https://codereview.chromium.org/2666763002
Cr-Commit-Position: refs/heads/master@{#42795}

The existing unit test explicitly checked for this case, but was - under
the right circumstances - defeated by the optimization to not re-run the
whole position search if we were close enough.

BUG=chromium:685618

Review-Url: https://codereview.chromium.org/2663883002
Cr-Commit-Position: refs/heads/master@{#42794}

Port ca8d3ba7

Original Commit Message:

    Original commit message:
    [wasm] Introduce the TrapIf and TrapUnless operators to generate trap code.

    Some instructions in WebAssembly trap for some inputs, which means that the
    execution is terminated and (at least at the moment) a JavaScript exception is
    thrown. Examples for traps are out-of-bounds memory accesses, or integer
    divisions by zero.

    Without the TrapIf and TrapUnless operators trap check in WebAssembly introduces 5
    TurboFan nodes (branch, if_true, if_false, trap-reason constant, trap-position
    constant), in addition to the trap condition itself. Additionally, each
    WebAssembly function has four TurboFan nodes (merge, effect_phi, 2 phis) whose
    number of inputs is linear to the number of trap checks in the function.
    Especially for functions with high numbers of trap checks we observe a
    significant slowdown in compilation time, down to 0.22 MiB/s in the sqlite
    benchmark instead of the average of 3 MiB/s in other benchmarks. By introducing
    a TrapIf common operator only a single node is necessary per trap check, in
    addition to the trap condition. Also the nodes which are shared between trap
    checks (merge, effect_phi, 2 phis) would disappear. First measurements suggest a
    speedup of 30-50% on average.

    This CL only implements TrapIf and TrapUnless on x64. The implementation is also
    hidden behind the --wasm-trap-if flag.

    Please take a special look at how the source position is transfered from the
    instruction selector to the code generator, and at the context that is used for
    the runtime call.

R=ahaas@chromium.org, titzer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2666433002
Cr-Commit-Position: refs/heads/master@{#42793}

BUG=685318

Change-Id: I6654410beaca18f5d8e0791ed18d0daa46edcae0
Reviewed-on: https://chromium-review.googlesource.com/434177Reviewed-by: Aaron Gable <agable@chromium.org>
Cr-Commit-Position: refs/heads/master@{#42792}

R=joransiu@ca.ibm.com, bjaideep@ca.ibm.com
BUG=

Review-Url: https://codereview.chromium.org/2662963002
Cr-Commit-Position: refs/heads/master@{#42791}

The bug used to show up when
- we were streaming a script starting with 0xef 0xbb 0xbf
- we aborted preparsing a function (and reset to a bookmark)

BUG=chromium:685618

Review-Url: https://codereview.chromium.org/2663773002
Cr-Commit-Position: refs/heads/master@{#42790}

BUG=chromium:685318
TBR=tandrii@chromium.org

Review-Url: https://codereview.chromium.org/2666563002
Cr-Commit-Position: refs/heads/master@{#42789}

Revert of ValueSerializer: Distinguish between 'undefined' and an absent property. (patchset #2 id:20001 of https://codereview.chromium.org/2660093002/ )

Reason for revert:
Seems to break layout tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/13146

https://github.com/v8/v8/wiki/Blink-layout-tests

Original issue's description:
> ValueSerializer: Distinguish between 'undefined' and an absent property.
>
> Dealing with this case requires a wire format change. It is possible that an
> element can be absent even in an array where the dense format was chosen
> (because the array initially had no holes), if the elements are modified while
> they are being serialized. In this case, a new tag for the "hole" is emitted.
>
> The logic to treat undefined in dense arrays as an absent property is restricted
> to versions of the wire format that this tag did not exist.
>
> BUG=chromium:686159,chromium:665820
>
> Review-Url: https://codereview.chromium.org/2660093002
> Cr-Commit-Position: refs/heads/master@{#42784}
> Committed: https://chromium.googlesource.com/v8/v8/+/dc85f4c8338c1c824af4f7ee3274dc9f95d14e49

TBR=jkummerow@chromium.org,jbroman@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:686159,chromium:665820

Review-Url: https://codereview.chromium.org/2667553003
Cr-Commit-Position: refs/heads/master@{#42788}

R=mtrofin@chromium.org,verwaest@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2662883003
Cr-Commit-Position: refs/heads/master@{#42787}

On ia32/x64 when casting a sNan to double, the signalling
bit is flipped to qNan.

R=joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2660873003
Cr-Commit-Position: refs/heads/master@{#42786}

Performing lookups on the prototype chain in the stub avoids a
bunch of slow-path runtime calls. For now, only receivers with
dictionary-mode properties do this; fast-mode receivers will follow
if it's beneficial.

(previously landed as r42751 / 82e10f5f)

Review-Url: https://codereview.chromium.org/2652213003
Cr-Commit-Position: refs/heads/master@{#42785}

Dealing with this case requires a wire format change. It is possible that an
element can be absent even in an array where the dense format was chosen
(because the array initially had no holes), if the elements are modified while
they are being serialized. In this case, a new tag for the "hole" is emitted.

The logic to treat undefined in dense arrays as an absent property is restricted
to versions of the wire format that this tag did not exist.

BUG=chromium:686159,chromium:665820

Review-Url: https://codereview.chromium.org/2660093002
Cr-Commit-Position: refs/heads/master@{#42784}

BUG=chromium:685504

Review-Url: https://codereview.chromium.org/2660823002
Cr-Commit-Position: refs/heads/master@{#42783}