Includes the port of these three builtins: FastNewStrictArguments,
FastNewSloppyArguments and FastNewRestParameter. Also inline
the implementation of these into the corresponding interpreter
byte codes.

BUG=v8:5269
LOG=N
R=ishell@chromium.org, rmcilroy@chromium.org

Review-Url: https://codereview.chromium.org/2645743002
Cr-Commit-Position: refs/heads/master@{#43002}

BUG=v8:5516
R=neis@chromium.org

Change-Id: Iabc8d942ffb8107c5284cc51654792a9e2872d0a
Reviewed-on: https://chromium-review.googlesource.com/439325
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43001}

This introduces LoadImmutableContextSlot and LoadImmutableCurrentContextSlot
bytecodes, which are emitted when reading from never-assigned context slot.

There is a subtlety here: the slot are not immutable, the meaning is
actually undefined-or-hole-or-immutable.

Review-Url: https://codereview.chromium.org/2655733003
Cr-Commit-Position: refs/heads/master@{#43000}

... and TypeFeedbackMetadata to FeedbackMetadata.

BUG=

Change-Id: I2556d1c2a8f37b8cf3d532cc98d973b6dc7e9e6c
Reviewed-on: https://chromium-review.googlesource.com/439244
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#42999}

  port f435d622(r41735)

  original commit message:
  Original commit message:
  [wasm] Introduce the TrapIf and TrapUnless operators to generate trap code.

  Some instructions in WebAssembly trap for some inputs, which means that the
  execution is terminated and (at least at the moment) a JavaScript exception is
  thrown. Examples for traps are out-of-bounds memory accesses, or integer
  divisions by zero.

  Without the TrapIf and TrapUnless operators trap check in WebAssembly introduces 5
  TurboFan nodes (branch, if_true, if_false, trap-reason constant, trap-position
  constant), in addition to the trap condition itself. Additionally, each
  WebAssembly function has four TurboFan nodes (merge, effect_phi, 2 phis) whose
  number of inputs is linear to the number of trap checks in the function.
  Especially for functions with high numbers of trap checks we observe a
  significant slowdown in compilation time, down to 0.22 MiB/s in the sqlite
  benchmark instead of the average of 3 MiB/s in other benchmarks. By introducing
  a TrapIf common operator only a single node is necessary per trap check, in
  addition to the trap condition. Also the nodes which are shared between trap
  checks (merge, effect_phi, 2 phis) would disappear. First measurements suggest a
  speedup of 30-50% on average.

  This CL only implements TrapIf and TrapUnless on x64. The implementation is also
  hidden behind the --wasm-trap-if flag.

  Please take a special look at how the source position is transfered from the
  instruction selector to the code generator, and at the context that is used for
  the runtime call.

BUG=

Review-Url: https://codereview.chromium.org/2679853002
Cr-Commit-Position: refs/heads/master@{#42998}

Cleanup CHECK_EQ order and simplify CHECK_EQ(true/false).
Cleanup callorder for negative numbers
Cleanup callorder order for capital letter constants.
Cleanup callorder for test.x checks.

BUG=

Review-Url: https://codereview.chromium.org/2677183002
Cr-Commit-Position: refs/heads/master@{#42997}

Moves ownership of the parsing Zone to ParseInfo with a shared_ptr. This is
in preperation for enabling background compilation jobs for inner functions
share the AST in the outer-function's parse zone memory (read-only), with the
and zone being released when all compilation jobs have completed.

BUG=v8:5203,v8:5215

Review-Url: https://codereview.chromium.org/2632123006
Cr-Original-Commit-Position: refs/heads/master@{#42993}
Committed: https://chromium.googlesource.com/v8/v8/+/14fb337200d5da09c77438ddd40bea935b1dc823
Review-Url: https://codereview.chromium.org/2632123006
Cr-Commit-Position: refs/heads/master@{#42996}

That was forgotten in:
https://codereview.chromium.org/1652003002

BUG=v8:5861
NOTRY=true
TBR=tandrii@chromium.org

Change-Id: I259539e5827a81bc8e22c44a8a5e374a0329c7af
Reviewed-on: https://chromium-review.googlesource.com/439304Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#42995}

Revert of Reland: [Parse] ParseInfo owns the parsing Zone. (patchset #6 id:120001 of https://codereview.chromium.org/2632123006/ )

Reason for revert:
doesn't compile on ToT

Original issue's description:
> Reland: [Parse] ParseInfo owns the parsing Zone.
>
> Moves ownership of the parsing Zone to ParseInfo with a shared_ptr. This is
> in preperation for enabling background compilation jobs for inner functions
> share the AST in the outer-function's parse zone memory (read-only), with the
> and zone being released when all compilation jobs have completed.
>
> BUG=v8:5203,v8:5215
>
> Review-Url: https://codereview.chromium.org/2632123006
> Cr-Commit-Position: refs/heads/master@{#42993}
> Committed: https://chromium.googlesource.com/v8/v8/+/14fb337200d5da09c77438ddd40bea935b1dc823

TBR=marja@chromium.org,mstarzinger@chromium.org,ahaas@chromium.org,verwaest@chromium.org,rmcilroy@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5203,v8:5215

Review-Url: https://codereview.chromium.org/2685543003
Cr-Commit-Position: refs/heads/master@{#42994}

Moves ownership of the parsing Zone to ParseInfo with a shared_ptr. This is
in preperation for enabling background compilation jobs for inner functions
share the AST in the outer-function's parse zone memory (read-only), with the
and zone being released when all compilation jobs have completed.

BUG=v8:5203,v8:5215

Review-Url: https://codereview.chromium.org/2632123006
Cr-Commit-Position: refs/heads/master@{#42993}

When computing the type info for a given function, make sure to also
count generic BinaryOp and Compare IC slots. TurboFan can deal with
those, and often still generates good code.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2666323002
Cr-Commit-Position: refs/heads/master@{#42992}

BUG=

Review-Url: https://codereview.chromium.org/2686493002
Cr-Commit-Position: refs/heads/master@{#42991}

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2677193002
Cr-Commit-Position: refs/heads/master@{#42990}

Due to hoisting, the value of a 'var'-declared variable may actually change even
if the code contains only the "initial" assignment, namely when that assignment
occurs inside a loop.  For example:

  let i = 10;
  do { var x = i } while (i--):

As a simple and very conservative approximation of this, we explicitly mark
as maybe-assigned any non-lexical variable whose "declaration" does not
syntactically occur in the function scope.  (In the example above, it
occurs in a block scope.)

BUG=v8:5636

Review-Url: https://codereview.chromium.org/2673403003
Cr-Commit-Position: refs/heads/master@{#42989}

Sort experimental flags alphabetically and
add new flag for type profiling.

BUG=v8:5934

Review-Url: https://codereview.chromium.org/2675303002
Cr-Commit-Position: refs/heads/master@{#42988}

This will give us a baseline for upcoming perf work.

BUG=v8:5940

Review-Url: https://codereview.chromium.org/2680763002
Cr-Commit-Position: refs/heads/master@{#42987}

BUG=v8:5516
R=vogelheim@chromium.org

Review-Url: https://codereview.chromium.org/2683573002
Cr-Commit-Position: refs/heads/master@{#42986}

Revert of [regexp] Add stub for RegExpExec instead of inlining (patchset #1 id:1 of https://codereview.chromium.org/2677073004/ )

Reason for revert:
Doesn't fix perf regressions in crbug.com/688972 and introduces new ones for RegExp in crbug.com/689395.

Original issue's description:
> [regexp] Add stub for RegExpExec instead of inlining
>
> The code produced for RegExpExec is quite large, and we ended up completely
> inlining it several spots.  This CL moves RegExpPrototypeExecBody into two
> stubs (one each for fast and slow paths) and converts inlined uses into stub
> calls. This decreases the local x64 snapshot size by around 80K.
>
> BUG=chromium:688972
>
> Review-Url: https://codereview.chromium.org/2677073004
> Cr-Commit-Position: refs/heads/master@{#42965}
> Committed: https://chromium.googlesource.com/v8/v8/+/5ea144afe3fd98896fc097a3523de9ab0cb8cd61

TBR=yangguo@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:688972

Review-Url: https://codereview.chromium.org/2679063003
Cr-Commit-Position: refs/heads/master@{#42985}

For x64, ia32 and x87 we would pop the return address before the stack
overflow check. This meant the stack couldn't be unwound properly if
it was going to overflow. This CL moves the pop of the return address
to after the stack overflow check.

Also adds a regression test to check that a RangeError is thrown.

BUG=689016

Review-Url: https://codereview.chromium.org/2681643004
Cr-Commit-Position: refs/heads/master@{#42984}

BUG=v8:5516
R=vogelheim@chromium.org

Review-Url: https://codereview.chromium.org/2683563002
Cr-Commit-Position: refs/heads/master@{#42983}

BUG=v8:5917

Review-Url: https://codereview.chromium.org/2673383002
Cr-Commit-Position: refs/heads/master@{#42982}

This correctly marks the {JSCreate} operator as potentially throwing,
since it might trigger a property access of the 'prototype' property
during instantiation. This is observable, can throw (not kNoThrow),
might have side-effects (not kNoWrite), or even trigger a lazy deopt
event (not kNoDeopt). The inlining logic has been adapted to wire up
control projections accordingly.

Note that this does not yet take care of the "after" frame-state which
is associated with the {JSCreate} node introduced by the inliner. We
still might re-evaluate the property access upon lazy deoptimization.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-5638
BUG=v8:5638

Review-Url: https://codereview.chromium.org/2671203003
Cr-Commit-Position: refs/heads/master@{#42981}

A script like "{ function foo() {} }" declares a VAR-variable at the
top-level and a LET-variable inside the block.  The LET-variable does
not need to be unconditionally marked as assigned.

BUG=v8:5636

Review-Url: https://codereview.chromium.org/2680443002
Cr-Commit-Position: refs/heads/master@{#42980}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/ed0758e..7968040

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/1e91982..df67b47

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: I80660e6eca542bfe76d5f78656c38583829eab90
Reviewed-on: https://chromium-review.googlesource.com/438964Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#42979}

- entries preview available even if debugger agent is disabled,
- less deprecated mirrors usage in debugger-script.js
- no usage of debugger context - zero probability of leaking it.
- better test coverage.

BUG=v8:5510
R=yangguo@chromium.org,jgruber@chromium.org,alph@chromium.org,luoe@chromium.org

Review-Url: https://codereview.chromium.org/2672213002
Cr-Commit-Position: refs/heads/master@{#42978}

Adding a code path for strings introduces Phi nodes on the fast
(i.e. non-string) path, causing a performance regression.

BUG=chromium:687075

Review-Url: https://codereview.chromium.org/2670353004
Cr-Commit-Position: refs/heads/master@{#42977}

R=adamk

Review-Url: https://codereview.chromium.org/2677373002
Cr-Commit-Position: refs/heads/master@{#42976}

- Removes shared InnerArrayCopyWithin JS builtin from src/js/array.js
- Implements %TypedArray%.prototype.copyWithin as a C++ builtin, which
relies on std::memmove rather than accessing individual eleements.
- Fixes the case where copyWithin is invoked on a TypedArray with a
detached buffer.
- Add tests to ensure that +/-Infinity (for all 3 parameters) is handled correctly by the
algorithm

The C++ version gets through the benchmark more than 25000 times as
quickly as the JS implementation.

BUG=v8:5925, v8:5929, v8:4648
R=cbruni@chromium.org, adamk@chromium.org, littledan@chromium.org

Review-Url: https://codereview.chromium.org/2671233002
Cr-Commit-Position: refs/heads/master@{#42975}

Embedders should use the new EmbedderHeapTracer api.

BUG=v8:5828

Review-Url: https://codereview.chromium.org/2642743008
Cr-Commit-Position: refs/heads/master@{#42974}

The non-determinism of NaNs does not only affect the result of the test
function, it also affects the traps that are thrown.

R=titzer@chromium.org, eholk@chromium.org
BUG=v8:5924

Review-Url: https://codereview.chromium.org/2671813004
Cr-Commit-Position: refs/heads/master@{#42973}

Revert of PPC/s390: [debugger] remove debugger statement support from FCG/CS. (patchset #1 id:1 of https://codereview.chromium.org/2672813002/ )

Reason for revert:
Original CL got reverted https://codereview.chromium.org/2672823007

Original issue's description:
> PPC/s390: [debugger] remove debugger statement support from FCG/CS.
>
> Port eef855a1
>
> R=yangguo@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
> BUG=
> LOG=N
>
> Review-Url: https://codereview.chromium.org/2672813002
> Cr-Commit-Position: refs/heads/master@{#42898}
> Committed: https://chromium.googlesource.com/v8/v8/+/f2d2ebcae8f31a7787778c429018156a432662e2

TBR=joransiu@ca.ibm.com,jyan@ca.ibm.com,michael_dawson@ca.ibm.com,yangguo@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=

Review-Url: https://codereview.chromium.org/2677183003
Cr-Commit-Position: refs/heads/master@{#42972}

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/3ea8977..1e91982

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: I5c635ee102c8e523491285ab96e72278ecbaf5c1
Reviewed-on: https://chromium-review.googlesource.com/437965Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#42971}

Spotted by clang static analyzer, these variables are declared outside of
the condition but only used within.

Review-Url: https://codereview.chromium.org/2668003002
Cr-Commit-Position: refs/heads/master@{#42970}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/ab0bc70..ed0758e

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/d637de7..3ea8977

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2672353002
Cr-Commit-Position: refs/heads/master@{#42969}

This adapts the inlining logic to allow for inlining based solely on a
statically known underlying SharedFunctionInfo instead of a concrete
closure of the call target.

In cases where the closure is known, its bound context is constant
promoted just as before. In the new cases where only the SFI for an
entire class of closures is known, we use the dynamic SSA-value of the
bound context.

R=bmeurer@chromium.org
BUG=v8:2206

Review-Url: https://codereview.chromium.org/2626783003
Cr-Commit-Position: refs/heads/master@{#42968}

It's supposed to be a JSTypedArray, not a JSGeneratorObject

BUG=
R=littledan@chromium.org, adamk@chromium.org, jgruber@chromium.org

Review-Url: https://codereview.chromium.org/2674133002
Cr-Commit-Position: refs/heads/master@{#42967}

Also improve suppression of Math.pow precision.

BUG=chromium:679957
NOTRY=true
TBR=mstarzinger@chromium.org,jarin@chromium.org

Change-Id: I43d0cd6f6f6d0867be9f2337990114c07c716df5
Reviewed-on: https://chromium-review.googlesource.com/438327Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#42966}

The code produced for RegExpExec is quite large, and we ended up completely
inlining it several spots.  This CL moves RegExpPrototypeExecBody into two
stubs (one each for fast and slow paths) and converts inlined uses into stub
calls. This decreases the local x64 snapshot size by around 80K.

BUG=chromium:688972

Review-Url: https://codereview.chromium.org/2677073004
Cr-Commit-Position: refs/heads/master@{#42965}

Keep the order in CHECK_EQ calls consistent as
(expected, actual).

Simplify CHECK_EQ(true, expected) to CHECK(expected) and
CHECK_EQ(false, expected) to CHECK(!expected).

BUG=

Review-Url: https://codereview.chromium.org/2677133002
Cr-Commit-Position: refs/heads/master@{#42964}

BUG=v8:5294
R=mstarzinger@chromium.org

Review-Url: https://codereview.chromium.org/2675233002
Cr-Commit-Position: refs/heads/master@{#42963}