This test runs random sequences of atomic wasm operations on multiple
threads and tries to compute an equivalent sequential interleaving that
would reproduce intermediate results.
By its nature, this test might time out and is flaky.

Bug: v8:6532
Change-Id: Iafdab4561cbf37a5c3fa9b8af9d0fbaaf5681608
Reviewed-on: https://chromium-review.googlesource.com/c/1195366
Commit-Queue: Stephan Herhut <herhut@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56810}

Headers are not included in jumbo builds so excluding
them has no meaning and will cause problems in a future
version of jumbo. This patch removes two such headers.

Change-Id: I19eadf989ff69a4e1116ba265ecb37236d67efd4
Reviewed-on: https://chromium-review.googlesource.com/c/1290793Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Daniel Bratell <bratell@opera.com>
Cr-Commit-Position: refs/heads/master@{#56809}

Bug: v8:6666
Change-Id: Idcccd5467d48263f54cbb5e3c197543f8a2119c8
Reviewed-on: https://chromium-review.googlesource.com/c/1286683Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Michael Hablich <hablich@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56808}

This removes the ad-hoc ramp up period for the step size. The heuristic
was introduced before concurrent marking and is no longer useful.
The heuristic makes incremental marking progress very slow for short
running programs that do not allocate in the old generation.

Replace it with a simple cap on the step size in bytes.

Bug: v8:7253
Change-Id: If50fbd49e38135d006427f607c9a6d212c24fba7
Reviewed-on: https://chromium-review.googlesource.com/c/1288815Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56807}

In the process:

- add volatile types for FastJSArray and remove the length_fast accessor
  from JSArray with the application of more rigorous typing.
- add micro benchmarks for testing all the interesting slice cases

Also update a few assorted places in .tq code to make them more
idiomatic.

Change-Id: I76ec2bb25b65a869180af1f7288419dc1f0a9c37
Reviewed-on: https://chromium-review.googlesource.com/c/1281603
Commit-Queue: Daniel Clifford <danno@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56806}

The configurations are auto-generated using:
https://crrev.com/c/1270796/7

NOTRY=true

Bug: chromium:830557
Change-Id: Ided34b43e065a64d2bea6df00aae954bf291bc55
Reviewed-on: https://chromium-review.googlesource.com/c/1290792Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56805}

R=clemensh@chromium.org
TEST=unittests/WasmModuleVerifyTest

Change-Id: Ibc05e8a6d617cd2a8d623bb9b7ce56bdd87748cf
Reviewed-on: https://chromium-review.googlesource.com/c/1282961
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56804}

This field is redundant in that {ok_ == true} equals
{wasm_code_ != nullptr}. Thus remove it, and simplify some logic.

R=ahaas@chromium.org
CC=gdeepti@chromium.org

Bug: v8:8238
Change-Id: I3e3cfcc3a06c945d836c1a8a388bec54e1af12ea
Reviewed-on: https://chromium-review.googlesource.com/c/1290791Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56803}

Change-Id: Id374d968c38e09c5309d37f010049c36e8733b23
Reviewed-on: https://chromium-review.googlesource.com/c/1288813Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56802}

When --async-stack-traces is on and there's an exception from within an
async_hook "after" handler, we will be faced with a settled promise. In
that case we cannot do anything, since the promise will not have any
reactions on it anymore, but we should also not crash of course.

Bug: chromium:896700, v8:7522
Change-Id: I6e3d212d0433da40740489ff7421c5a98cf9bff3
Reviewed-on: https://chromium-review.googlesource.com/c/1290550Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56801}

TBR=sergiyb@chromium.org
NOTRY=true

Change-Id: I5f7d900a9389872fda69d1ff8d036ee5005f3790
Reviewed-on: https://chromium-review.googlesource.com/c/1290790Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56800}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/5839d1c..0353cd5

Rolling v8/test/wasm-js/data: https://chromium.googlesource.com/external/github.com/WebAssembly/spec/+log/cf67a47..64bf5c7

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/5195651..237fb2a

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/08faab9..93277a7

Rolling v8/third_party/fuchsia-sdk: https://chromium.googlesource.com/chromium/src/third_party/fuchsia-sdk/+log/6f8b55e..bac0433

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: I76b5ec2bbed7d63db1f496229a20567e3740b9eb
Reviewed-on: https://chromium-review.googlesource.com/c/1290115Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#56799}

Instead of putting "Foo" as type into the list macro, and
then extending to "type*" at consumer macros, put "Foo*"
into the macro.
This is in preparation for incremental transition to ObjectPtr,
where some roots will return pointer types and others won't.
When that migration is complete, everything will be uniform
(and without "*") again.

Bug: v8:3770
Change-Id: Ib4a9900b1fc6e59f5fc924b779ed7e94dc136ad0
Reviewed-on: https://chromium-review.googlesource.com/c/1285397
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56798}

This refactors the innards of HandleBase and IdentityMap
to use Address instead of Object*, as part of the quest
to get rid of Object* entirely.

Bug: v8:3770
Change-Id: I82bd9547ef0d208b1e42636792e21c9064af4cea
Reviewed-on: https://chromium-review.googlesource.com/c/1285396
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56797}

This reverts commit 5847574e.

Reason for revert: Break mjsunit tests in Lite mode. You'll have to find a solution for tests using assertOptimized().

Original change's description:
> [Lite] Disable optimization for Lite mode.
> 
> BUG=v8:8293
> 
> Change-Id: I6b2e02420ab69fb1d2e24945d48b08d2bc24b0d0
> Reviewed-on: https://chromium-review.googlesource.com/c/1280526
> Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
> Reviewed-by: Dan Elphick <delphick@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#56795}

TBR=rmcilroy@chromium.org,delphick@chromium.org

Change-Id: I09f6c17cc325f50560329c46f06ad847f0bb021d
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:8293
Reviewed-on: https://chromium-review.googlesource.com/c/1290111Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56796}

BUG=v8:8293

Change-Id: I6b2e02420ab69fb1d2e24945d48b08d2bc24b0d0
Reviewed-on: https://chromium-review.googlesource.com/c/1280526
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56795}

TSAN was flakily detecting a race in the Add/RemoveSampler functions.
It could also be fixed by moving the USE(atomic_->Value()); line below
the do loop in the constructor of AtomicGuard.

Given that base::AtomicValue is deprecated and std::atomic has a
compare_exchange operation with std::memory_order_seq_cst, we can just
use std::atomic_bool to fix the TSAN false-positive.

Bug: v8:7702
Change-Id: Id2038ea1ccced7339f45991263e944394e935454
Reviewed-on: https://chromium-review.googlesource.com/c/1288814Reviewed-by: Alexei Filippov <alph@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56794}

Make heap profiler provide information about each sample currently
alive. That information can be used to build diagrams of memory
allocations over time.

BUG=chromium:889545

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: Ibcbe2f5302263d0b3976ee4cd3601eff11375cae
Reviewed-on: https://chromium-review.googlesource.com/c/1285130
Commit-Queue: Alexei Filippov <alph@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56793}

This is a reland of 30729e82
Also change the intl.js to remove the ", utils"

Original change's description:
> [Intl] Move Intl.getCanonicalLocales to C++
>
> Bug: v8:5751
> Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
> Change-Id: I20dc0e7eda58f2d9211d0e569d553dd6fcc14fd3
> Reviewed-on: https://chromium-review.googlesource.com/c/1275807
> Commit-Queue: Frank Tang <ftang@chromium.org>
> Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#56747}

Bug: v8:5751
Change-Id: I0bbd5392234d23790e8c405a55e97b764d42507e
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/c/1286956
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Frank Tang <ftang@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56792}

This is a reland of a12203c6

Original change's description:
> [wasm] Add a new wasm-js testsuite to run js-api tests
> 
> These changes were necessary to run with the new style of jsapi tests
> introduced in https://github.com/WebAssembly/spec/pull/883.
> 
> Change-Id: I4629dd48d595ed97ed0607dec9e7d9808c706a7e
> Reviewed-on: https://chromium-review.googlesource.com/c/1277724
> Commit-Queue: Ben Smith <binji@chromium.org>
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Reviewed-by: Mathias Bynens <mathias@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#56745}

Change-Id: I25fcd95bfc1aee1d21da390359423e5dfed112a4
Reviewed-on: https://chromium-review.googlesource.com/c/1286952
Commit-Queue: Ben Smith <binji@chromium.org>
Reviewed-by: Ben Smith <binji@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56791}

Bug: v8:5367
Change-Id: I92a73692e9714b929316d8971a2258e3241bc8c6
Reviewed-on: https://chromium-review.googlesource.com/c/1288643
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Daniel Ehrenberg <littledan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56790}

When InferReceiverMaps doesn't provide us with reliable maps for the
resolution, we can still utilize the information if all the maps that
are found are stable - aka leaf - maps. But in that case we need to
make sure that we add proper dependencies on the stability of these
maps.

Bug: v8:7253
Change-Id: I6f5825583acc3f2575e83a244d55609ac64d04d3
Reviewed-on: https://chromium-review.googlesource.com/c/1288633Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56789}

By default zx_vmo_create() creates resizable VMOs, which may be
hazardous in some cases. It's safer to use ZX_VMO_NON_RESIZABLE unless
VMO needs to be resizable. It doesn't make much difference in
OS::Allocate() because it drops the VMO handle immediately after
mapping it, still it's better to use ZX_VMO_NON_RESIZABLE for
consistency.

Change-Id: I688ee44b08042a9df7e3fae0b1b3298271b53b1c
Reviewed-on: https://chromium-review.googlesource.com/c/1277605Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Sergey Ulanov <sergeyu@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56788}

Make sure we wait for the worker thread to finish compilation before removing
aborted jobs.

BUG=v8:8317,v8:8041

Change-Id: I42f30c4d430b7787ea5e724bdfda6460e5461233
Reviewed-on: https://chromium-review.googlesource.com/c/1288812Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56787}

Change-Id: Ibf0ee76cc19799be405f45bcba7a1d3a7c5c4d38
Reviewed-on: https://chromium-review.googlesource.com/c/1288390
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56786}

Since ValidateExpression just throws the only queued (first) expression error,
we can delay throwing it until the latest possible moment. That's right before
the matching expression classifier dies (goes out of scope or accumulates).

Change-Id: I4538de333b789ae786278b94b76b4799ccdf4903
Reviewed-on: https://chromium-review.googlesource.com/c/1286678
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56785}

Async tail might be long. On frontend side we use only top frame so
we can report tail using id.

R=dgozman@chromium.org

Bug: chromium:873865
Cq-Include-Trybots: luci.chromium.try:linux_chromium_headless_rel;master.tryserver.blink:linux_trusty_blink_rel
Change-Id: Ie9e6b5c4c000cc6bedce2d5fec9f3fa22ea21768
Reviewed-on: https://chromium-review.googlesource.com/c/1286959
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56784}

- Use token-range checks
- Delay ValidateExpression until after the loop
- Only queue classifier errors at the beginning
- Only inline Token-range check rather than the entire
  ParseMemberExpressionContinuation to reduce binary size.

Change-Id: Ib81ce071851fe5c13b4bb405cd883df7a82c84c9
Reviewed-on: https://chromium-review.googlesource.com/c/1286677
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56783}

This also changes Consume to bypass the stackoverflow check. Otherwise the
following pattern wouldn't work:

if (peek() == expected) {
  f()
}

f() {
  Consume(expected);
}

since the call to f can cause the overflow.

Change-Id: If2fd3181ecdf1fd681f584b630e83e0af4e4bf9d
Reviewed-on: https://chromium-review.googlesource.com/c/1286684
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56782}

See: https://github.com/nodejs/node-v8/pull/84
Change-Id: Ia1d4b110367c795e952e8e3d0a067f601a306077
Reviewed-on: https://chromium-review.googlesource.com/c/1278014
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56781}

This separates the fast-non-asan path from the asan path so it can be inlined.
Additionally avoid updating allocation_size_ on each Zone::New call.
Inlining Zone::New actually reduces binary size by 50kb...

Change-Id: Ie5d58638284e5a1a5e0198c24080b0f600d79092
Reviewed-on: https://chromium-review.googlesource.com/c/1288641Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56780}

Change-Id: Ib41ddbf15c6f9395b747b78c081e466a9f2e44bd
Reviewed-on: https://chromium-review.googlesource.com/c/1286682
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56779}

Teach TurboFan about the maps produced by JSPerformPromiseThen and
JSCreatePromise, which yields a ~1-2% improvement on the doxbee
promises benchmark by removing the redundant checks from the optimized
code with promise chaining.

Bug: v8:7253
Change-Id: If0edce8ba15917c1b7e76b9d06490cfffe911650
Reviewed-on: https://chromium-review.googlesource.com/c/1288639Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56778}

This will be rewritten soon to not use the sampling processor, we can
reenable it then.

Bug: v8:5193
Change-Id: I1d50cf39048e7b5ddeea8d333dcf808fe5c28396
Reviewed-on: https://chromium-review.googlesource.com/c/1288636
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56777}

Additionally, introduce IntPtrDiv to CodeAssembler.

Change-Id: I9396f77b90a2fadb0179028d44475e616be3d081
Reviewed-on: https://chromium-review.googlesource.com/c/1285400
Commit-Queue: Peter Wong <peter.wm.wong@gmail.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56776}

Addendum to https://chromium-review.googlesource.com/c/1283050.

TBR=sigurds@chromium.org

Bug: v8:6666
Change-Id: I93073e481cbead3c966914a2ee3f7faa1ac5df0f
Reviewed-on: https://chromium-review.googlesource.com/c/1288634Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56775}

This reverts commit fad1c1c9.

Reason for revert: Debug printing not needed anymore.

Original change's description:
> [test] Be more chatty when killing hanging tests
> 
> Bug: v8:8292
> Change-Id: I74fd304692e90adfb694b73ecf5e7858e3b66607
> Reviewed-on: https://chromium-review.googlesource.com/c/1275814
> Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
> Reviewed-by: Maya Lekova <mslekova@chromium.org>
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#56562}

TBR=machenbach@chromium.org,sergiyb@chromium.org,mslekova@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:8292
Change-Id: Ieaba51f866b93d49fe168b6370bd126752993afb
Reviewed-on: https://chromium-review.googlesource.com/c/1288632Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56774}

It seems that the Promise.resolve() lowering in JSCallReducer was no
longer called.

Bug: v8:7253
Change-Id: I3c80aed085d15fb54d88245b9d71b9caed7de075
Reviewed-on: https://chromium-review.googlesource.com/c/1288452Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56773}

If the user's cleanup function didn't iterate all available WeakCells, we need
to schedule the cleanup task again at some point. The previous condition
resulted it never being scheduled.

BUG=v8:8179

Change-Id: I8f5f4c01d1eb6a3cca8bd21bdc52c38663889882
Reviewed-on: https://chromium-review.googlesource.com/c/1286686
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56772}

BUG=v8:8179

Change-Id: I43861e114b9f46847df9b02d0337709a685feb72
Reviewed-on: https://chromium-review.googlesource.com/c/1278810Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56771}