Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/31a054c..244ad31

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: Ie4cb30a5c5524787703855e55265d099e8a656ff
Reviewed-on: https://chromium-review.googlesource.com/1074534Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53378}

Port 111c5735

Original Commit Message:

    Calls from embedded builtins to stubs are expensive due to the
    indirection through the builtins constants table. This moves
    the ArrayConstructorStub to a builtin.

R=jgruber@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: Icc6af15d80eb5c95a191832eb9636ebe97e61e07
Reviewed-on: https://chromium-review.googlesource.com/1074548Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#53377}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/f86e77c..31a054c

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/0e97383..0043a4a

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/4d2e8bf..f16fdf3

Rolling v8/tools/swarming_client: https://chromium.googlesource.com/infra/luci/client-py/+log/34f5f28..3543e21

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: Icc3a21fc3cd6f39cbcbab2f6e7f4b6ef63476962
Reviewed-on: https://chromium-review.googlesource.com/1074069Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53376}

R=gdeepti@chromium.org,bbudge@chromium.org,clemensh@chromium.org,titzer@chromium.org
BUG=v8:6020

Change-Id: I9d307a70d44504dc0e84e3e09d48bcc9b9542462
Reviewed-on: https://chromium-review.googlesource.com/1071095
Commit-Queue: Aseem Garg <aseemgarg@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53375}

R=gdeepti@chromium.org,bbudge@chromium.org,clemensh@chromium.org,titzer@chromium.org
BUG=v8:6020

Change-Id: I05bb2124751f64565ad4e22f267fe42a3e0f1845
Reviewed-on: https://chromium-review.googlesource.com/1070935
Commit-Queue: Aseem Garg <aseemgarg@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53374}

R=ahaas@chromium.org

Also-by: ahaas@chromium.org
Change-Id: Ieb7e20dedcbd3def7e6c4f42e6392306ac3ed1f7
Reviewed-on: https://chromium-review.googlesource.com/1073505Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53373}

Port 0094defa

Original Commit Message:

    Calls from embedded builtins to stubs are expensive due to the
    indirection through the builtins constants table. This moves
    the ArrayNArgumentsConstructorStub to a builtin.

R=jgruber@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: Ibf5e33cd14ef5baece9ddb660ab54b07233e8a20
Reviewed-on: https://chromium-review.googlesource.com/1073056Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#53372}

R= ahaas@chromium.org

Also-By: ahaas@chromium.org
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: I8e34bb93df0cb7174e6c2fc2c36fe8697f4f88c4
Reviewed-on: https://chromium-review.googlesource.com/1073608Reviewed-by: Eric Holk <eholk@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Eric Holk <eholk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53371}

Port of commit 8ac37bc3.
RelocInfo::INTERNAL_REFERENCE_ENCODED is used only on mips, mips64
and ppc.

Original commit message:
`The RelocInfo::RUNTIME_ENTRY relocation mode is only used for deopt
points in JavaScript code and should never appear in WebAssembly code.`

Change-Id: Ic595103740dc3c349836114f9cbc815865c5b54c
Reviewed-on: https://chromium-review.googlesource.com/1073420Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Sreten Kovacevic <sreten.kovacevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#53370}

Port 70cede39

Original Commit Message:

    Calls from embedded builtins to stubs are expensive due to the
    indirection through the builtins constants table. This moves
    CallApiGetter and the 0/1 argument case of CallApiCallback to
    builtins.

R=jgruber@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I15677f91ad1f5cac05d4760f4cdd1561982a0621
Reviewed-on: https://chromium-review.googlesource.com/1073055Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#53369}

R=mstarzinger@chromium.org

Change-Id: I0976bfa57b9ec48fae2b912e78bacfee4f8eeafb
Reviewed-on: https://chromium-review.googlesource.com/1072654
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53368}

R=titzer@chromium.org

Change-Id: Ia2217d4f3ff9c8f1929ac622c96d6c4b75e6c091
Reviewed-on: https://chromium-review.googlesource.com/1072655Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53367}

Port 5674812c

Original Commit Message:

    At runtime, calls to embedded builtins do not need to take the
    indirection through the off-heap trampoline. We can simply inline the
    trampoline instead.

R=jgruber@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I4b18f3a957a41af28da34b503015271573949888
Reviewed-on: https://chromium-review.googlesource.com/1073193Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#53366}

This was originally a flag for debugging the compilation of a module
by skipping compilation of the first N functions in a module. This
flag is not properly respected anymore, and is an unnecessary complication.

R=herhut@chromium.org

Change-Id: If9bf80245f6982a8383ca3865c599d58319feba9
Reviewed-on: https://chromium-review.googlesource.com/1061468Reviewed-by: Stephan Herhut <herhut@chromium.org>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53365}

Bug: v8:6666
Change-Id: Ibb5b8b2012041e908ac7f109abf0a724b12c0e72
Reviewed-on: https://chromium-review.googlesource.com/1073447Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53364}

Its contents are now inlined into the one remaining call site.

Bug: v8:6666
Change-Id: Icfcf89013506fec880ffd84eaa88b91e818e28c0
Reviewed-on: https://chromium-review.googlesource.com/1073311Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53363}

Modifies several Type:: methods to take an Isolate to pass through to
BitSetType::Lub as well as their call sites.

Bug: v8:7786
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I9ac769c4c658995421fd28b9b1d77d6f84627116
Reviewed-on: https://chromium-review.googlesource.com/1071515
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53362}

Removes use of HeapObject::GetIsolate() from Object::BooleanValue in
preparation for removing the method.

Requires adding Isolate parameter to CommonOperatorReducer constructor.

Bug: v8:7786
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: If735e71df3288bf1eb11576605c2d95a19472181
Reviewed-on: https://chromium-review.googlesource.com/1071653Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53361}

Calls from embedded builtins to stubs are expensive due to the
indirection through the builtins constants table. This moves
the InternalArrayConstructorStub to a builtin.

Bug: v8:6666
Change-Id: I8cd801bd9218ca9ef0853ed99c7a69090af5c9f9
Reviewed-on: https://chromium-review.googlesource.com/1072608Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53360}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/1e1a86d..f86e77c

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/buildtools/+log/94288c2..893eb86

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/1986f5a..0e97383

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/ebdd0db..4d2e8bf

Rolling v8/tools/swarming_client: https://chromium.googlesource.com/infra/luci/client-py/+log/833f5eb..34f5f28

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: I2f80f295c0d5a2c527eb1d609051378151110333
Reviewed-on: https://chromium-review.googlesource.com/1073188
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53359}

If the optional fields are not set, trying to cast to the Object subtype fails.

Change-Id: I386c6b23cbd3d282a72093dfc78966d0046578c3
Reviewed-on: https://chromium-review.googlesource.com/1073307Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53358}

Calls from embedded builtins to stubs are expensive due to the
indirection through the builtins constants table. This moves
the ArrayConstructorStub to a builtin.

Bug: v8:6666
Change-Id: Iff4bff99cd911a7f5f138819801c7812b75ea969
Reviewed-on: https://chromium-review.googlesource.com/1071519
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53357}

Calls from embedded builtins to stubs are expensive due to the
indirection through the builtins constants table. This moves
the ArrayNArgumentsConstructorStub to a builtin.

Bug: v8:6666
Change-Id: Ied303334874251415a9057abf612d76dd8330aa6
Reviewed-on: https://chromium-review.googlesource.com/1071450
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53356}

Calls from embedded builtins to stubs are expensive due to the
indirection through the builtins constants table. This moves
CallApiGetter and the 0/1 argument case of CallApiCallback to
builtins.

Bug: v8:6666
Change-Id: I49c4917253f790a3b947f42c50d6308a1ab99d91
Reviewed-on: https://chromium-review.googlesource.com/1070980Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53355}

At runtime, calls to embedded builtins do not need to take the
indirection through the off-heap trampoline. We can simply inline the
trampoline instead.

Bug: v8:6666
Change-Id: Idb7d504fdfee173a0b134fbc74bd5dc6d09629cb
Reviewed-on: https://chromium-review.googlesource.com/1068742Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53354}

Bug: v8:7754
Change-Id: I4664a86ca0daccdd977f6a1b89c0f33294f084a1
Reviewed-on: https://chromium-review.googlesource.com/1073149Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53353}

This loads references to {null} values from the instance object instead
of embedding them into the generated code. It is one step towards making
the {WasmCode} objects independent of the Isolate.

Note that this also fixes an issue with the serializer/deserializer that
failed to properly serialize {null} values and accidentally collapsed
them to {undefined} values instead.

R=ahaas@chromium.org
TEST=mjsunit/regress/wasm/regress-7785
BUG=v8:7424,v8:7785

Change-Id: Ie436c2d96890e7c8c89ffe2bd4189a759254775b
Reviewed-on: https://chromium-review.googlesource.com/1070981
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53352}

This adds basic support to emit IA disassembly to the json files
digested by turbolizer.

Change-Id: I8964c2f44565e8242e09c9be879c7db2654b65b6
Reviewed-on: https://chromium-review.googlesource.com/1071669Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Stephan Herhut <herhut@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53351}

BUG=v8:7308

Change-Id: Ia74e5696133ec183ff550da011452b0c12a06e40
Reviewed-on: https://chromium-review.googlesource.com/1068883
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53350}

This addresses one of the major remaining slowdowns with embedded
builtins on x64.

When generating code for a call to a builtin callee from a builtin
caller, we'd look up the Code target object from the builtins constant
list, calculate the location of the first instruction, and jump to it.
Note that for embedded builtin callees, the Code object is itself only
a trampoline to the off-heap code and thus an additional indirection.
An example of the call sequence in pseudo-asm:

// Load from the constants list.
mov reg, [kRootPointer, kBuiltinsConstantListOffset]
mov reg, [reg, offset_of_the_code_constant]
// Calculate first instruction and call it.
add reg, Code::kHeaderOffset
call reg
// The trampoline forwards to the off-heap area.
mov kOffHeapTrampolineRegister, <off-heap instruction_start>
jmp kOffHeapTrampolineRegister

This CL changes calls to embedded builtin targets to use pc-relative
addressing. This reduces the above instruction sequence to:

call <pc-relative offset to target instruction_start>

Embedded-to-embedded calls jump directly to the embedded instruction
stream, bypassing the trampoline. Heap-to-embedded calls (and all
calls to heap-builtins) use pc-relative addressing targeting the
on-heap Code object.

Other relevant platforms (arm,arm64,mips,mips64) do not use pc-relative
calls. For these, we'll need a different solution, e.g. a table of
embedded builtin addresses reachable from the root pointer, similar to
the external reference table.

Bug: v8:6666
Change-Id: Ic0317d454e2da37d74eaecebcdfcbc0d5f5041ad
Reviewed-on: https://chromium-review.googlesource.com/1068732
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53349}

Port ea7499f5

Original Commit Message:

    Currently, we context allocate all parameters for generators.

    With this CL, we keep arguments on stack (unless they escape to inner
    closure) and copy them between the stack and the generator's register
    file on suspend/resume. This will save context allocation in most cases.

    - Suspend copies arguments and registers to the generator.
    - Resume copies only the registers from the generator, the arguments
      are copied by the ResumeGenerator trampoline.

R=jarin@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I4a22024ce4e29a4e0217697a3b53b1c7bba0ddf1
Reviewed-on: https://chromium-review.googlesource.com/1072309Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#53348}

At the moment, WebAssembly.instantiate(bytes) is implemented by
desugaring it to WebAssembly.compile(bytes).then(WebAssembly.instantiate).
The problem is that the {then} in this snippet is observable. With this
CL I introduce a CompilationResultResolver which allows to do the
desugaring internally and thereby make the {then} unobservable.
Unfortunately the result of WebAssembly.instantiate(bytes) is different
than the result of WebAssembly.instantiate(module). Therefore I also
introduced an InstantiationResultResolver for symmetry with
WebAssembly.compile.

R=mstarzinger@chromium.org
Bug: chromium:837417

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I2d98e03d65f2ada19041d5a9e2df5da91b24ccca
Reviewed-on: https://chromium-review.googlesource.com/1059783
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53347}

R=gdeepti@chromium.org,bbudge@chromium.org,clemensh@chromium.org,titzer@chromium.org
BUG=v8:6020

Change-Id: Ibc4e45df65ad8fc649e42b2166545cbc5fcb4296
Reviewed-on: https://chromium-review.googlesource.com/1070933Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Aseem Garg <aseemgarg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53346}

Bug: chromium:846360
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I5376d4f6f9c8df768d60c63e0a767bf41b51b8b3
Reviewed-on: https://chromium-review.googlesource.com/1071531Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53345}

TBR=sigurds@chromium.org
NOTRY=true

Bug: chromium:820416
Change-Id: Ibd6fec04a9ea610c83c9347b4971f5ffea1fa80d
Reviewed-on: https://chromium-review.googlesource.com/1071521
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53344}

Implement lowering for simd operations I32x4ConvertI16x8 and
I16x8ConvertI8x16. Also, remove skip tests from status files that
were overriden when tests were renamed.

TEST=cctest/test-run-wasm-simd/RunWasm_I16x8ConvertI8x16_turbofan

Change-Id: If428f5039a32995c8ee64294c936419173a87aa7
Reviewed-on: https://chromium-review.googlesource.com/1069007Reviewed-by: Aseem Garg <aseemgarg@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53343}

Aseem is the main auther of simd-scalar-lowering and should therefore be
able to lgtm changes to that file.

No-Try: true
No-Tree-Checks: true

R=titzer@chromium.org
CC=aseemgarg@chromium.org

Change-Id: If62d895fb18e8fd59735fec63faa38ca7a6598c5
Reviewed-on: https://chromium-review.googlesource.com/1070984Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53342}

Change-Id: Ie8bdbcdea8006d3105c419113f9adb2c1d6f162c
Reviewed-on: https://chromium-review.googlesource.com/1070203
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53341}

The RelocInfo::RUNTIME_ENTRY relocation mode is only used for deopt
points in JavaScript code and should never appear in WebAssembly code.

R=titzer@chromium.org

Change-Id: Ied1d61e2b1eb886565d13448442dd6a6ed35d3f0
Reviewed-on: https://chromium-review.googlesource.com/1070197Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53340}

This CL completely removes the C++ builtin implementation of the
DataView.prototype.buffer, DataView.prototype.byteLength, and
DataView.prototype.byteOffset getters, and moves them to
a Torque implementation (that still relies on a bit of CSA).

Change-Id: Id46678ae709c3787b7b93d0f78bd2a6e16e00f7b
Reviewed-on: https://chromium-review.googlesource.com/1070369
Commit-Queue: Théotime Grohens <theotime@google.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53339}