BUG=

Change-Id: I55e41786f3d249ed545c359589894f39b2d89284
Reviewed-on: https://chromium-review.googlesource.com/437385
Commit-Queue: Ali Ijaz Sheikh <ofrobots@google.com>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44538}

Revert of [ARM] Implement D-register versions of vzip, vuzp, and vtrn. (patchset #4 id:60001 of https://codereview.chromium.org/2797923006/ )

Reason for revert:
Breaks:
http://builders/V8%20Arm%20-%20debug/builds/2751

Original issue's description:
> [ARM] Implement D-register versions of vzip, vuzp, and vtrn.
>
> LOG=N
> BUG=v8:6020
>
> Review-Url: https://codereview.chromium.org/2797923006
> Cr-Commit-Position: refs/heads/master@{#44536}
> Committed: https://chromium.googlesource.com/v8/v8/+/6588187ae3acaa5b40762c539ee9fe355551bea3

TBR=martyn.capewell@arm.com,bmeurer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:6020

Review-Url: https://codereview.chromium.org/2810703003
Cr-Commit-Position: refs/heads/master@{#44537}

LOG=N
BUG=v8:6020

Review-Url: https://codereview.chromium.org/2797923006
Cr-Commit-Position: refs/heads/master@{#44536}

This was added in commit 40611, but the std::cout calls are gone so the
header is no longer needed.

Remove trailing spaces in html files rom the same commit and from other
html files in the same directory.

Review-Url: https://codereview.chromium.org/2797253009
Cr-Commit-Position: refs/heads/master@{#44535}

Moves interpreter-generator.cc to a similar model of building handlers as
Turbofan stubs elsewhere, to simplify moving code between stubs / builtins and
bytecode handlers. This removes the "__" hack from the Interpreter generator
code.

Also make SetBytecodeOffset private to InterpreterAssembler and make 
LdaImmutable[Current]ContextSlot and Lda[Current]ContextSlot share
handlers since they are identical.

Change-Id: I9e91e7d37c2ea75513e4dcc3b95b4bb6517f83da
Reviewed-on: https://chromium-review.googlesource.com/471987
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44534}

Make sure that the current bytecode's size is taken into account when
updating the interrupt budget (on jumps and returns), so that jumps are
not "free" from an interrupt point of view.

Also clarifies, corrects and cleans up the interrupt budget update for
returns.

Bug: v8:6238
Change-Id: I1099d53a232fab4c1fcc91115baee610bfbce1d6
Reviewed-on: https://chromium-review.googlesource.com/472809Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44533}

It's possible to get undefined as a result of Object.getOwnPropertyDescriptor. We should be ready for this.

BUG=chromium:707670
R=alph@chromium.org

Review-Url: https://codereview.chromium.org/2801763002
Cr-Commit-Position: refs/heads/master@{#44532}

We assumed that every JSArray would have a JSObject as a prototype,
but it could be null, in which case we bail out to slow path.

Also rename spread_array variable here, because this fast-path
isn't just used by spreads anymore.

Bug: chromium:707675
Change-Id: I8045d83977735dd00c3ebde2e0704f6b04afdedd
Reviewed-on: https://chromium-review.googlesource.com/472907Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44531}

Adds a collection of call bytecodes which have an implicit undefined
receiver argument, for cases such as global calls where we know that the
receiver has to be undefined. This way we can skip an LdaUndefined,
decrease bytecode register pressure, and set a more accurate
ConvertReceiverMode on the interpreter and TurboFan call.

As a side effect, the "normal" Call bytecode now becomes a rare case
(only with calls and super property calls), so we get rid of its 0-2
argument special cases and modify CallProperty[N] to use the
NotNullOrUndefined ConvertReceiverMode.

Change-Id: I9374a32fefd66fc0251b5193bae7a6b7dc31eefc
Reviewed-on: https://chromium-review.googlesource.com/463287
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44530}

Reland of Ensure counters are initialized, to avoid init on non-joinable threads. (patchset #1 id:1 of https://codereview.chromium.org/2812653002/ )

Reason for revert:
Appears to be a flake. Both jgruber and I tried to repro locally and failed. Also change has little change of having had caused those failures.

Original issue's description:
> Revert of Ensure counters are initialized, to avoid init on non-joinable threads. (patchset #1 id:1 of https://codereview.chromium.org/2812543002/ )
>
> Reason for revert:
> https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20gyp/builds/5221
>
> Original issue's description:
> > Ensure counters are initialized, to avoid init on non-joinable threads.
> >
> > This occurs in the wasm scenario described in the referenced bug.
> > DecodeWasmModule collects statistics. Blink inserts a CreateHistogramCallback that
> > can't instantiate a histogram on non-joinable threads. Turns out, DecodeWasmModule
> > is scheduled on such a thread, now that we have async compilation.
> >
> > This fix pre-initializes histograms when the callback is applied, which is assumed to
> > be in a context that can carry out the instantiation. In Blink, this happens on the main
> > thread.
> >
> > BUG=chromium:709684
> >
> > Review-Url: https://codereview.chromium.org/2812543002
> > Cr-Commit-Position: refs/heads/master@{#44522}
> > Committed: https://chromium.googlesource.com/v8/v8/+/022e7ddf232b0696eb595769fa702463c417db5e
>
> TBR=jochen@chromium.org,mtrofin@chromium.org
> # Skipping CQ checks because original CL landed less than 1 days ago.
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=chromium:709684
>
> Review-Url: https://codereview.chromium.org/2812653002
> Cr-Commit-Position: refs/heads/master@{#44527}
> Committed: https://chromium.googlesource.com/v8/v8/+/038bafcb8c0435bc4130228237124331295d4713

TBR=jochen@chromium.org,jgruber@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:709684

Review-Url: https://codereview.chromium.org/2813673002
Cr-Commit-Position: refs/heads/master@{#44529}

Loading the map, performing a side-effect, and then using the stored
pointer for the fast-path check is another antipattern that can lead to
unintended shapes on the fast path.

BUG=chromium:709029

Review-Url: https://codereview.chromium.org/2807153002
Cr-Commit-Position: refs/heads/master@{#44528}

Revert of Ensure counters are initialized, to avoid init on non-joinable threads. (patchset #1 id:1 of https://codereview.chromium.org/2812543002/ )

Reason for revert:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20gyp/builds/5221

Original issue's description:
> Ensure counters are initialized, to avoid init on non-joinable threads.
>
> This occurs in the wasm scenario described in the referenced bug.
> DecodeWasmModule collects statistics. Blink inserts a CreateHistogramCallback that
> can't instantiate a histogram on non-joinable threads. Turns out, DecodeWasmModule
> is scheduled on such a thread, now that we have async compilation.
>
> This fix pre-initializes histograms when the callback is applied, which is assumed to
> be in a context that can carry out the instantiation. In Blink, this happens on the main
> thread.
>
> BUG=chromium:709684
>
> Review-Url: https://codereview.chromium.org/2812543002
> Cr-Commit-Position: refs/heads/master@{#44522}
> Committed: https://chromium.googlesource.com/v8/v8/+/022e7ddf232b0696eb595769fa702463c417db5e

TBR=jochen@chromium.org,mtrofin@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:709684

Review-Url: https://codereview.chromium.org/2812653002
Cr-Commit-Position: refs/heads/master@{#44527}

This patch hooks up concurrent marking (behind the flag) with the rest
of the GC:
1. Incremental marking spawns concurrent marking task seeded with the
root set.
2. Mark-compact waits for concurrent marking tasks to finish.
3. Scavenger does fast promotion if concurrent marking is pending.

BUG=chromium:694255

Review-Url: https://codereview.chromium.org/2735803005
Cr-Commit-Position: refs/heads/master@{#44526}

Ensuring we move forward all the deferred handles, in all cases.

BUG=

Review-Url: https://codereview.chromium.org/2807013002
Cr-Commit-Position: refs/heads/master@{#44525}

The decoder has the assumption that it always holds that pc <= end.
However, in the FunctionBodyDecoder, end was set to start to terminate
the decoding loop. Thereby the assumption was violated, which caused a
crash. I set end to pc now to end the decoding loop, which preserves
the assumption and terminates the loop.

BUG=chromium:709741
TEST=unittests/FunctionBodyDecoderTest.Regression709741
R=clemensh@chromium.org

Change-Id: I5bfd61bdc4809fc16f12ca8611876c66a79aaa36
Reviewed-on: https://chromium-review.googlesource.com/472723
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44524}

Force passing arguments on the stack for PushCodeObjectsAndDie by using
more function arguments.

Change-Id: I7a2e825f3423946a03f5dd988c640a37709f32e3
Reviewed-on: https://chromium-review.googlesource.com/472747Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44523}

This occurs in the wasm scenario described in the referenced bug.
DecodeWasmModule collects statistics. Blink inserts a CreateHistogramCallback that
can't instantiate a histogram on non-joinable threads. Turns out, DecodeWasmModule
is scheduled on such a thread, now that we have async compilation.

This fix pre-initializes histograms when the callback is applied, which is assumed to
be in a context that can carry out the instantiation. In Blink, this happens on the main
thread.

BUG=chromium:709684

Review-Url: https://codereview.chromium.org/2812543002
Cr-Commit-Position: refs/heads/master@{#44522}

We went on decoding the next section, which happened to be the start
section. But since the function section had an error, the signature
pointer was not still {nullptr} on the start function, leading to a
segfault.

Drive-by fix: Improve decoder trace output.

R=ahaas@chromium.org
BUG=chromium:708714, chromium:708787

Change-Id: I5ae2adb32764b9d154f1ca878019f26ac31839b4
Reviewed-on: https://chromium-review.googlesource.com/472847Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44521}

According to the spec the copy step is defined iteratively and with
@@species we can create a TypedArray which shares the buffer with the
receiver which in turn prevents us from using memcpy.

Bug: v8:6223

Change-Id: If1bad085ea1d022bf3fb2cffc81645b2f7f56346
Reviewed-on: https://chromium-review.googlesource.com/471409Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44520}

NOTRY=true

Change-Id: I08b5bf55960d8a2f4e29fc278bd4ff79b8ba7f98
Reviewed-on: https://chromium-review.googlesource.com/472806Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44519}

- Store std::string instead of std::unique_ptr<char[]> for the error
  message.
- Remove ErrorCode, which was just kSuccess and kError anyway. Error is
  now detected on whether error_msg_ is empty or not.
- Refactor constructors for perfect forwarding; this will allow us to
  implement Result<std::unique_ptr<X*>>.
- Refactor Decoder::toResult for perfect forwarding.
- Remove output operators (operator<<) for Result; it was only used in
  the error case anyway. Print error message directly instead.
  The operator was problematic since it assumed the existence of an
  output operator for every T which is used in Result<T>.
- Remove ModuleError and FunctionError, introduce general static
  Result<T>::Error method instead.

R=ahaas@chromium.org

Change-Id: I1e0f602a61ee9780fee2a3ed33147d431fb092ba
Reviewed-on: https://chromium-review.googlesource.com/472748
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44518}

R=ahaas@chromium.org

Change-Id: Ife1b4a20e82544dfe2665ef7c438ee9801be75e4
Reviewed-on: https://chromium-review.googlesource.com/472807Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44517}

We were doing basically the same thing in our own functions, but not
quire right.

R=ahaas@chromium.org

Change-Id: I75409d45982d3edc53e4d12c28a293ed3a2dea97
Reviewed-on: https://chromium-review.googlesource.com/472846
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44516}

Previously we didn't produce all data that we need for creating sensemaking
FunctionLiterals for the skipped functions.

Test in https://chromium-review.googlesource.com/c/457037 .

BUG=v8:5516

Change-Id: I1fd02c1109ef6e07e93da131062fd5101a8c8de9
Reviewed-on: https://chromium-review.googlesource.com/469767
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44515}

Revert of [turbofan] reenable: extend escape analysis to reduce CheckMaps (patchset #1 id:1 of https://codereview.chromium.org/2803643004/ )

Reason for revert:
canary crashes

Original issue's description:
> [turbofan] reenable: extend escape analysis to reduce CheckMaps
>
> R=bmeurer@chromium.org
>
> Review-Url: https://codereview.chromium.org/2803643004
> Cr-Commit-Position: refs/heads/master@{#44461}
> Committed: https://chromium.googlesource.com/v8/v8/+/25aff3448eb1813702d098361437a7e88256a1c1

TBR=bmeurer@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.

Review-Url: https://codereview.chromium.org/2811693002
Cr-Commit-Position: refs/heads/master@{#44514}

The DCHECK added by https://chromium-review.googlesource.com/461827 was not true
in case we failed to compile the function.

BUG=chromium:708598

Change-Id: I6a542c3ac6281c0549396b4ff0af34ea44450006
Reviewed-on: https://chromium-review.googlesource.com/472826Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44513}

R=jgruber@chromium.org
BUG=v8:4743

Review-Url: https://codereview.chromium.org/2803693006
Cr-Commit-Position: refs/heads/master@{#44512}

This relands commit d3e9aade. The original CL was reverted speculatively but didn't cause the buildbot failure.

Original change's description:
> [Interpreter] Move BinaryOp Smi transformation into BytecodeGenerator.
> 
> Perform the transformation to <BinaryOp>Smi for Binary ops which take Smi
> literals in the BytecodeGenerator. This enables us to perform the
> transformation for literals on either side for commutative operations, and
> Avoids having to do the check on every bytecode in the peephole optimizer.
> 
> In the process, adds Smi bytecode variants for all binary operations, adding
>  - MulSmi
>  - DivSmi
>  - ModSmi
>  - BitwiseXorSmi
>  - ShiftRightLogical
> 
> BUG=v8:6194
> 
> Change-Id: If1484252f5385c16957004b9cac8bfbb1f209219
> Reviewed-on: https://chromium-review.googlesource.com/466246
> Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#44477}

TBR=rmcilroy@chromium.org,machenbach@chromium.org,yangguo@chromium.org,mstarzinger@chromium.org,mythria@chromium.org,v8-reviews@googlegroups.com,ishell@chromium.org
# Not skipping CQ checks because original CL landed > 1 day ago.
BUG=v8:6194

Change-Id: I2ccaefa1ce58d3885f5c2648755985c06f25c1d8
Reviewed-on: https://chromium-review.googlesource.com/472746Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44511}

Instead of storing {start} and {error_pc} we now store the
{error_offset}, which is anyways the only value we use.

R=clemensh@chromium.org

Change-Id: Ifd9791eff5c9efce2e7e2a1989bf3b5eaa464a02
Reviewed-on: https://chromium-review.googlesource.com/471527
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44510}

This is inital work in order to utilize CompilerDispatcher in parallel
parsing.

BUG=v8:6093

Change-Id: I6aae4f32ddb2314585d09039c1c5d7e658dc896f
Reviewed-on: https://chromium-review.googlesource.com/469709Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Commit-Queue: Wiktor Garbacz <wiktorg@google.com>
Cr-Commit-Position: refs/heads/master@{#44509}

R=clemensh@chromium.org

Change-Id: I7c7bc0293ad093853d945fb18d7e5cb5bf54c3ec
Reviewed-on: https://chromium-review.googlesource.com/464868
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44508}

The spec requires that we use IterableToList, which we skipped for
some arrays as an optimization. We can't skip this for arrays with
objects though, because the objects may mutate the array during
the copying step via valueOf side effects.

Also clean up the implementation to use a runtime function rather
than a builtin as the helper. Also reverses the result of the helper
because I think it is a bit more intuitive that way.

Bug: v8:6224
Change-Id: I9199491abede4479785df6d9068331bc2d6e9c5e
Reviewed-on: https://chromium-review.googlesource.com/471986Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44507}

R=clemensh@chromium.org
TEST=message/asm-table-mismatch-[def|use]
BUG=v8:6202

Change-Id: I3e87f84591bedbda6366883a850dced149db0c8a
Reviewed-on: https://chromium-review.googlesource.com/471666Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44506}

The Generic access info was introduced to handle transitioning stores
that extend the properties backing store (by reusing the STORE_IC). But
since crrev.com/2778133003 TurboFan handles these by just inlining the
properties backing store (re)allocation, and thus this is now dead code.

BUG=v8:5267

Review-Url: https://codereview.chromium.org/2811593002
Cr-Commit-Position: refs/heads/master@{#44505}

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/8235ac1..e9f3127

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: Icedf6fe686afb85953492e395446e06dd7bc62db
Reviewed-on: https://chromium-review.googlesource.com/472349Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44504}

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/7ec8401..8235ac1

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: I15af028812bd628970f63cc551539e5bb245cd79
Reviewed-on: https://chromium-review.googlesource.com/472487Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44503}

We don't need to do any kind of translation for non-wasm frames. And we need this knowledge for lazy symbolization.
Capturing stack trace is ~7% faster.

BUG=v8:6189
R=dgozman@chromium.org,yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2795103004
Cr-Commit-Position: refs/heads/master@{#44502}

On those architectures that do support unaligned memory access
there is no need to emit heap alignment code in TypedArrayInitialize.

BUG=chromium:708545

Review-Url: https://codereview.chromium.org/2802003003
Cr-Commit-Position: refs/heads/master@{#44501}

This revealed a bug in the TypedArray(typedArray) constructor when the arg is backed by a SharedArrayBuffer.

Also install the species getter and add a test, since it's not tested in
test262 presently.

BUG=v8:5983,v8:5984
R=adamk@chromium.org

Review-Url: https://codereview.chromium.org/2798403004
Cr-Commit-Position: refs/heads/master@{#44500}

TurboFan didn't support transitioning stores that also need to grow the
properties backing store so far. This CL adds support for re-allocating
the properties backing store in-place, so these stores can participate
properly in various optimizations like escape analysis and allocation
folding.

R=ishell@chromium.org
BUG=v8:5267,chromium:708339

Review-Url: https://codereview.chromium.org/2778133003
Cr-Original-Commit-Position: refs/heads/master@{#44183}
Committed: https://chromium.googlesource.com/v8/v8/+/88a7061a53ad200121f7ee2b2bdcc05d793de806
Review-Url: https://codereview.chromium.org/2778133003
Cr-Commit-Position: refs/heads/master@{#44499}