AstGraphBuilder overrides Visit(Expression*) to ensure that even if there is a
stack overflow, a value still gets produced. However, if there was no stack
overflow in the overriden function, but calling
AstVisitor<AstGraphBuilder>::Visit(expr) pushes us over the stack limit, then
the stack overflow check in that function will return without visiting the
expression, and the result will never get pushed.

To fix this, we add a new VisitNoStackOverflowCheck function which avoids the
inner stack check, and call that instead.

Since this depends on the size of C++ stack frames, there is no reliable test
I can add, however regress-635429.js exibits this behavior after
https://codereview.chromium.org/2240463002/ lands.

Review-Url: https://codereview.chromium.org/2262703002
Cr-Commit-Position: refs/heads/master@{#38774}

BUG=

Review-Url: https://codereview.chromium.org/2266843002
Cr-Commit-Position: refs/heads/master@{#38773}

This detects loops with integer decrements.

Drive-by fix: Add lower bounds to lower_bounds
zone vector instead of upper_bounds.

BUG=

Review-Url: https://codereview.chromium.org/2260153002
Cr-Commit-Position: refs/heads/master@{#38772}

Now it just relies on NeedsContext and hence is guaranteed to be in sync.

BUG=v8:5209

Review-Url: https://codereview.chromium.org/2262133002
Cr-Commit-Position: refs/heads/master@{#38771}

Rebuilding (after touching certain files) is crazy slow because
includes are out of control.

Fixing it:
- Don't include stuff in headers unless necessary.
- Include the stuff you need, not some other stuff that happens to include the
stuff you need.

BUG=v8:5294

Review-Url: https://codereview.chromium.org/2258603003
Cr-Commit-Position: refs/heads/master@{#38770}

This adds cached versions of the DeoptimizeIf, DeoptimizeUnless and
Deoptimize operators that occur most often in various benchmarks.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2266743002
Cr-Commit-Position: refs/heads/master@{#38769}

Rolling v8/build to 3345815406d21b1ec594b95711ade879fa486241

Rolling v8/tools/clang to 781e8b3df3bbd631eae9560c1175aec8ce77f77d

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2266723002
Cr-Commit-Position: refs/heads/master@{#38768}

parser and the preparser, so that they contain the same set of methods,
with the same signatures.  It mainly flags some traits methods as const.
It also contains a small cosmetic change in the definition of CHECK_OK.

R=adamk@chromium.org, marja@chromium.org
BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2258123002
Cr-Commit-Position: refs/heads/master@{#38767}

This patch simply reorders the elements of classes ParserTraits
and PreParserTraits (mainly method headers), so that in both
classes the elements are defined in the same order.  This is
useful for easily verifying the consistency between these two
classes.

R=adamk@chromium.org, marja@chromium.org
BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2264483003
Cr-Commit-Position: refs/heads/master@{#38766}

Rolling v8/build to 38a9cfaa10bf2b91c52f8a9ef4449723dd7aa706

Rolling v8/tools/mb to 99788b8b516c44d7db25cfb68695bc234fdee5ed

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2267513002
Cr-Commit-Position: refs/heads/master@{#38765}

This patch subsumes CoverInitializedNameProduction to create an ObjectLiteralProduction which is now used to report the duplicate proto error as well.

This patch also changes ObjectLiteralChecker::CheckProperty
to record an ObjectLiteralProduction error instead of
bailing out immediately. Once we realize that we're in a
pattern, we rewind the error, otherwise we report the
error.

BUG=v8:5121

Review-Url: https://codereview.chromium.org/2255353002
Cr-Commit-Position: refs/heads/master@{#38764}

Also removed the "StandardProductions" enum value as its name is unhelpful
in deciding when to use it (and it only had a single reference).

R=gsathya@chromium.org

Review-Url: https://codereview.chromium.org/2260183003
Cr-Commit-Position: refs/heads/master@{#38763}

Currently when redefining eval or arguments in non-simple parameter list and
destructuring binding, V8 doesn't throw any error, this patch fixes it.

BUG=v8:5201
LOG=N

Review-Url: https://codereview.chromium.org/2185223002
Cr-Commit-Position: refs/heads/master@{#38762}

This is only needed to set a flag on the SharedFunctionInfo generated for a function literal. Hence we only need it in 1 scope, and only read it once. Recursing in that case will be more efficient than always tracking it.

BUG=v8:5209

Review-Url: https://codereview.chromium.org/2261693002
Cr-Commit-Position: refs/heads/master@{#38761}

Record which asm.js stdlib members are used and add a check that NaN is actually correctly set. Other stdlib members to be added in a later change.

Also add a stdlib argument to Wasm.instantiateModuleFromAsm, in preparation for that function to be replaced by normal asm.js instantiation.

BUG= https://bugs.chromium.org/p/v8/issues/detail?id=4203
LOG=N
R=jpp@chromium.org,titzer@chromium.org

Review-Url: https://codereview.chromium.org/2251433002
Cr-Commit-Position: refs/heads/master@{#38760}

While they have not been observed to slow down real-world use cases,
some blink_layout microbenchmarks feel better with these methods
disabled. In order to be concervative at the launch time, lift
the CFI defense for these methods.

8/10 of these methods will become much faster when an optimization
proposed in https://crbug.com/638056 -- we only need to load vptr
once (before the loop) and have a single CFI check instead of
a check per iteration.

BUG=638056,634139

Review-Url: https://codereview.chromium.org/2258003002
Cr-Commit-Position: refs/heads/master@{#38759}

BUG=

Review-Url: https://codereview.chromium.org/2259883002
Cr-Commit-Position: refs/heads/master@{#38758}

Fix d0e52555

Typo in builtin-mips64.cc caused crashes in test mjsunit/asm/asm-validation.js

TEST=mjsunit/asm/asm-validation
BUG=

Review-Url: https://codereview.chromium.org/2258093002
Cr-Commit-Position: refs/heads/master@{#38757}

This isn't the most elegant fix, but I'd prefer to not rework the logic
right now. What happens is:
- Most parts of the Scanner use nullptr to mean, no literal buffer.
- The bookmarking logic may end up with a state where there's a non-nullptr
  literal buffer, but it's empty. (length 0)
- These are functionally equivalent, so there's no 'real' bug.
- But it makes it hard to reason. This patch hence checks for length-0
  literal buffers, and uses nullptr instead.

R=marja@chromium.org
BUG=chromium:639191 v8:4947

Review-Url: https://codereview.chromium.org/2258073003
Cr-Commit-Position: refs/heads/master@{#38756}

R=adamk@chromium.org, verwaest@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2263523002
Cr-Commit-Position: refs/heads/master@{#38755}

Version 0 dense arrays cannot be deserialized by current Chromium, which
suggests that this is not necessary.

BUG=chromium:148757

Review-Url: https://codereview.chromium.org/2256413002
Cr-Commit-Position: refs/heads/master@{#38754}

BUG=v8:5209

Review-Url: https://codereview.chromium.org/2253913002
Cr-Commit-Position: refs/heads/master@{#38753}

BUG=

Review-Url: https://codereview.chromium.org/2255973004
Cr-Commit-Position: refs/heads/master@{#38752}

BUG=v8:5273
R=rmcilroy@chromium.org

Review-Url: https://codereview.chromium.org/2250513005
Cr-Commit-Position: refs/heads/master@{#38751}

BUG=chromium:630386

Review-Url: https://codereview.chromium.org/2258083002
Cr-Commit-Position: refs/heads/master@{#38750}

Implement Neg_d and Neg_s in macro-assembler.
Floating point negate instructions are removed in release 6.
On r2, these instructoin do not change the sign of NaN operands.

TEST=cctest/test-run-wasm/RunWasmCompiled_Float32Neg, cctest/test-run-wasm/RunWasmCompiled_Float64Neg
BUG=

Review-Url: https://codereview.chromium.org/2256963003
Cr-Commit-Position: refs/heads/master@{#38749}

BUG=

Review-Url: https://codereview.chromium.org/2255263002
Cr-Commit-Position: refs/heads/master@{#38748}

This fixes the self-healing mechanism for closures in the interpreter
entry trampoline not that bytecode can be preserved even when baseline
code is already available.

R=rmcilroy@chromium.org
TEST=cctest/test-compiler/IgnitionEntryTrampolineSelfHealing
BUG=chromium:638225

Review-Url: https://codereview.chromium.org/2257143002
Cr-Commit-Position: refs/heads/master@{#38747}

Unify the representation selection rules for NumberAdd/Subtract and
SpeculativeNumberAdd/Subtract wrt. Int32Add/Sub selection. We can
safely use Int32Add/Sub as long as the inputs are in the safe additive
integer range and the output is either truncated to Word32 or provably
in Signed32 or Unsigned32 range.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2253293005
Cr-Commit-Position: refs/heads/master@{#38746}

BUG=chromium:508898

Review-Url: https://codereview.chromium.org/2237443002
Cr-Commit-Position: refs/heads/master@{#38745}

Changes the control flow builder classes to make use of the
BytecodeLabels helper class.

BUG=v8:4280
LOG=n

Review-Url: https://codereview.chromium.org/2254493002
Cr-Commit-Position: refs/heads/master@{#38744}

BUG=

Review-Url: https://codereview.chromium.org/2257393002
Cr-Commit-Position: refs/heads/master@{#38743}

TEST=mjsunit/wasm/stack.js:testStackOverflow

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2256603002
Cr-Commit-Position: refs/heads/master@{#38742}

R=mstarzinger@chromium.org, rmcilroy@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2263493002
Cr-Commit-Position: refs/heads/master@{#38741}

Rebuilding (after touching certain files) is crazy slow because
includes are out of control.

Fixing it:
- Don't include stuff in headers unless necessary.
- Include the stuff you need, not some other stuff that happens to include the
stuff you need.

BUG=v8:5294

Review-Url: https://codereview.chromium.org/2260483002
Cr-Commit-Position: refs/heads/master@{#38740}

Revert of [heap] Improve size profiling for ArrayBuffer tracking (patchset #6 id:140001 of https://codereview.chromium.org/2210263002/ )

Reason for revert:
Tanks octane

Original issue's description:
> [heap] Improve size profiling for ArrayBuffer tracking
>
> Eagerly account for retained sizes during ArrayBuffer tracking. Following up on this,
> we can now do Scavenges if the amount of memory retained from new space is too large.
>
> BUG=chromium:621829
> R=jochen@chromium.org,hpayer@chromium.org
>
> Committed: https://crrev.com/28e13bd6a75c9467dae43043e7b741a1387d5252
> Cr-Commit-Position: refs/heads/master@{#38731}

TBR=jochen@chromium.org,hpayer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:621829

Review-Url: https://codereview.chromium.org/2261513003
Cr-Commit-Position: refs/heads/master@{#38739}

R=adamk@chromium.org, marja@chromium.org
BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2256163002
Cr-Commit-Position: refs/heads/master@{#38738}

BUG=chromium:630386

Review-Url: https://codereview.chromium.org/2264493002
Cr-Commit-Position: refs/heads/master@{#38737}

This patch refactors the traits objects, used by the parser and the
preparser, so that they contain the same set of methods, with the same
signatures.

R=adamk@chromium.org
BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2179423002
Cr-Commit-Position: refs/heads/master@{#38736}

BUG=

Review-Url: https://codereview.chromium.org/2261643002
Cr-Commit-Position: refs/heads/master@{#38735}