The keyed load/store lowering is too aggressive when it comes to element
vs. property access. If we cannot find a cached name on the IC we
automatically assume that it's an element access, i.e. we assume that
the key that is passed to the keyed access must be a valid array index
then. But this is not true for megamorphic keyed load/store ICs, which
do not have a cached name (because the IC saw different names), and thus
use a different mechanism to indicate that it's a non-element access.

Review-Url: https://codereview.chromium.org/2195583002
Cr-Commit-Position: refs/heads/master@{#38155}

In contrast to the generic stream, this character stream works without
accessing the heap, and can be used on a background thread.

BUG=v8:5215
R=vogelheim@chromium.org,marja@chromium.org

Review-Url: https://codereview.chromium.org/2184393002
Cr-Commit-Position: refs/heads/master@{#38154}

Rolling v8/build to 5240573aa6f46cfee690cdf7c6d9544e1841f502

Rolling v8/tools/mb to f2acac06c11447a7155d476d61f140f18a4a8066

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2196593002
Cr-Commit-Position: refs/heads/master@{#38153}

X87: Revert of [heap] Reland "Remove black pages and use black areas instead." (patchset #4 id:60001 of https://codereview.chromium.org/2185613002/ ).

  port 2c7efba6 (r38129)

  original commit message:
  Reason for revert:
  Still crashing.

  Original issue's description:
  > [heap] Reland "Remove black pages and use black areas instead."
  >
  > BUG=chromium:630969,chromium:630386
  > LOG=n
  >
  > Committed: https://crrev.com/9e37a07c8de0a20ef2681e26824ff4d329102603
  > Cr-Commit-Position: refs/heads/master@{#38057}

BUG=

Review-Url: https://codereview.chromium.org/2192113002
Cr-Commit-Position: refs/heads/master@{#38152}

- Changes register allocation to only use even numbered registers on Arm.
- Turns on float32 testing in test-gap-resolver.cc.

This is effectively a revert of:
https://codereview.chromium.org/2086653003/

LOG=N
BUG=V8:4124, V8:5202

Review-Url: https://codereview.chromium.org/2176173003
Cr-Commit-Position: refs/heads/master@{#38151}

A "--minimal" flag turns off all optimizing compilers and activates the
interpreter. The idea is that with this flag activated, only the
platform-specific stubs and a Turbofan implementation must be complete to start
d8 and run the bulk of the tests. Note that although this flag is constructed as
a runtime flag, it must be set to true when building the snapshot and therefore
creates a compile-time dependency.

BUG=chromium:608675

Review-Url: https://codereview.chromium.org/2189663002
Cr-Commit-Position: refs/heads/master@{#38150}

BUG=chromium:631094
R=hpayer@chromium.org

Review-Url: https://codereview.chromium.org/2190093002
Cr-Commit-Position: refs/heads/master@{#38149}

Port 7f1fa30e

Original commit message:

    In the process also inline the stub into the appropriate interpreter bytecode
    handler and make sure that the context register is preserved in hand-written
    assembly code that calls the stub and expects the context register to be
    preserved.

R=danno@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=608675
LOG=N

Review-Url: https://codereview.chromium.org/2188483008
Cr-Commit-Position: refs/heads/master@{#38148}

R=rmcilroy@chromium.org
BUG=v8:4764

Review-Url: https://codereview.chromium.org/2185293004
Cr-Commit-Position: refs/heads/master@{#38147}

This CL introduces a new fast flat instantiations cache for the first 1024 object templates.
After that we fall back to the existing slower dictionary cache.

Drive-by-fix: de-handlify and clean up some code in api-natives.cc

BUG=chromium:630217

Review-Url: https://codereview.chromium.org/2170743003
Cr-Commit-Position: refs/heads/master@{#38146}

[gdb] Define print functions used by gdb macros in the top level namespace to make them always be available.

This should fix the following errors that sometimes appear when using V8 gdb macros:
  Cannot evaluate function -- may be inlined
or
  No symbol "xxx" in namespace "v8::internal".

Review-Url: https://codereview.chromium.org/2186293002
Cr-Commit-Position: refs/heads/master@{#38145}

R=rmcilroy@chromium.org
TEST=mjsunit/ignition/osr-from-generator
BUG=v8:4764

Review-Url: https://codereview.chromium.org/2185973004
Cr-Commit-Position: refs/heads/master@{#38144}

In native context specialization, we attempt to use map-based feedback to do optimized named and element loads and stores. Tragically, it could happen that any maps we encounter for a load have been deprecated. The right thing to do here is reoptimize later, let the IC subsystem update the map.

BUG=

Review-Url: https://codereview.chromium.org/2187283002
Cr-Commit-Position: refs/heads/master@{#38143}

With black allocation turned on we have no guarantee that the target array is
white and will be visited by the marker. Only execute the fast path when we are
allowed to skip the barrier.

R=hpayer@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2188713004
Cr-Commit-Position: refs/heads/master@{#38142}

BUG=

Review-Url: https://codereview.chromium.org/2173773002
Cr-Commit-Position: refs/heads/master@{#38141}

BUG=chromium:629792
LOG=N

Review-Url: https://codereview.chromium.org/2185123003
Cr-Commit-Position: refs/heads/master@{#38140}

[fullcode][mips][mips64][ppc][s390] Avoid trashing of a home object when doing a count operation with keyed load/store to a super.

BUG=chromium:631917

Review-Url: https://codereview.chromium.org/2191663004
Cr-Commit-Position: refs/heads/master@{#38139}

The timing scopes don't come for free and in the case of wrapper creation only add
overhead. This CL removes the histogram timer for CallAs(Function|Constructor) and
Function::(NewInstance|Call).

BUG=chromium:630217

Review-Url: https://codereview.chromium.org/2188193002
Cr-Commit-Position: refs/heads/master@{#38138}

BUG=chromium:630969,chromium:632334
LOG=n

Review-Url: https://codereview.chromium.org/2189033002
Cr-Commit-Position: refs/heads/master@{#38137}

BUG=

Review-Url: https://codereview.chromium.org/2174723002
Cr-Commit-Position: refs/heads/master@{#38136}

BUG=chromium:580337

Review-Url: https://codereview.chromium.org/2190833004
Cr-Commit-Position: refs/heads/master@{#38135}

Change was meant to be in previous patch but was accidentally reverted.
README.md updated with new filename, also.

BUG=

Review-Url: https://codereview.chromium.org/2184223005
Cr-Commit-Position: refs/heads/master@{#38134}

BUG=630950,631909

Review-Url: https://codereview.chromium.org/2184193004
Cr-Commit-Position: refs/heads/master@{#38133}

In the process also inline the stub into the appropriate interpreter bytecode
handler and make sure that the context register is preserved in hand-written
assembly code that calls the stub and expects the context register to be
preserved.

BUG=608675

Review-Url: https://codereview.chromium.org/2188993003
Cr-Commit-Position: refs/heads/master@{#38132}

BUG=630953
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2191713004
Cr-Commit-Position: refs/heads/master@{#38131}

Splitt of CL:
https://codereview.chromium.org/2188693002/#ps100001

Switching to GN is blocked on test errors. These files are
required for compilation and allow looking into the test
errors locally.

BUG=chromium:474921
NOTRY=true

Review-Url: https://codereview.chromium.org/2190863003
Cr-Commit-Position: refs/heads/master@{#38130}

Revert of [heap] Reland "Remove black pages and use black areas instead." (patchset #4 id:60001 of https://codereview.chromium.org/2185613002/ )

Reason for revert:
Still crashing.

Original issue's description:
> [heap] Reland "Remove black pages and use black areas instead."
>
> BUG=chromium:630969,chromium:630386
> LOG=n
>
> Committed: https://crrev.com/9e37a07c8de0a20ef2681e26824ff4d329102603
> Cr-Commit-Position: refs/heads/master@{#38057}

TBR=ulan@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=chromium:630969,chromium:630386

Review-Url: https://codereview.chromium.org/2183383004
Cr-Commit-Position: refs/heads/master@{#38129}

Breaks chromium win.

This also includes:

Revert "[gn] Add missing deps to inspector_protocol_parser_test"

Revert "Fix gitignores after moving inspector_protocol"

NOTRY=true
BUG=chromium:580337
TBR=yangguo@chromium.org, jochen@chromium.org, pfeldman@chromium.org

Review-Url: https://codereview.chromium.org/2187263002
Cr-Commit-Position: refs/heads/master@{#38128}

Split the monster methods in JSNativeContextSpecialization into smaller
ones, adding appropriate helpers. Improve the condition checking for
strings and numbers using CheckString/CheckNumber when applicable. Also
try to merge compatible PropertyAccessInfos, to avoid running into the
polymorphic case whenever possible.

Drive-by-fix: Don't try to resurrect dead nodes during LoadElimination.
With the improve code generation for monomorphic loads, we seem to
trigger the dead node resurrection.

R=epertoso@chromium.org
BUG=v8:4930,v8:5141

Review-Url: https://codereview.chromium.org/2191823002
Cr-Commit-Position: refs/heads/master@{#38127}

  port 9e37a07c (r38057)

  original commit message:

BUG=

Review-Url: https://codereview.chromium.org/2185363003
Cr-Commit-Position: refs/heads/master@{#38126}

R=neis@chromium.org
TEST=mjsunit/ignition/osr-from-generator
BUG=v8:4764

Review-Url: https://codereview.chromium.org/2188723005
Cr-Commit-Position: refs/heads/master@{#38125}

perf-turbo.py merges a perf data file and a turbofan trace file into a
single json object which can then be piped to a file and uploaded to
turbolizer to display the profiling data in the disassembly. With the
changes, turbolizer now shows the event counts for instruction in
percentage form and with heatmap-stype colouring. Multiple different
events can be recorded at once with a new drop-down menu to select which
event to view the counts of. The documentation has been updated with
instructions. Using the script is optional and turbolizer retains
previous functionality if a trace without profiling data is uploaded.

BUG=None

Review-Url: https://codereview.chromium.org/2174803002
Cr-Commit-Position: refs/heads/master@{#38124}

This reduces the size of GetStrongGcSubrootName() from 77 KB to 10KB.

BUG=5240

Review-Url: https://codereview.chromium.org/2189633003
Cr-Commit-Position: refs/heads/master@{#38123}

X87: Reland of [interpreter] Add explicit OSR polling bytecode. (patchset #1 id:1 of https://codereview.chromium.org/2184553003/ ).

  port e1ad114e (r38056)

  original commit message:
  Reason for revert:
  Fix has been landed.

  Original issue's description:
  > Revert of [interpreter] Add explicit OSR polling bytecode. (patchset #6 id:100001 of https://codereview.chromium.org/2172233002/ )
  >
  > Reason for revert:
  > Bunch of breakages. Maybe bad interaction with https://chromium.googlesource.com/v8/v8/+/e520e5da5550f0d1a975e87d6e66a2edecbb0c8e ?
  >
  > E.g.:
  > https://build.chromium.org/p/client.v8/builders/V8%20Linux64/builds/11607
  >
  > Original issue's description:
  > > [interpreter] Add explicit OSR polling bytecode.
  > >
  > > This adds an explicit {OsrPoll} bytecode into every loop header which
  > > triggers on-stack replacement when armed. Note that each such bytecode
  > > stores the static loop depths as an operand, and hence can be armed for
  > > specific loop depths.
  > >
  > > This also adds builtin code that triggers OSR compilation and switches
  > > execution over to optimized code in case compilation succeeds. In case
  > > compilation fails, the bytecode dispatch just continues unhindered.
  > >
  > > R=rmcilroy@chromium.org
  > > TEST=mjsunit/ignition/osr-from-bytecode
  > > BUG=v8:4764
  > >
  > > Committed: https://crrev.com/a55beb68e0ededb3773affa294a71edc50621458
  > > Cr-Commit-Position: refs/heads/master@{#38043}
  >
  > TBR=rmcilroy@chromium.org,mstarzinger@chromium.org
  > # Skipping CQ checks because original CL landed less than 1 days ago.
  > NOPRESUBMIT=true
  > NOTREECHECKS=true
  > NOTRY=true
  > BUG=v8:4764
  >
  > Committed: https://crrev.com/439aa2c6d708bfd95db725bd6f97c4c49bbc51fc
  > Cr-Commit-Position: refs/heads/master@{#38044}

BUG=

Review-Url: https://codereview.chromium.org/2190903002
Cr-Commit-Position: refs/heads/master@{#38122}

Use it like this:

Program received signal SIGTRAP, Trace/breakpoint trap.
[Switching to Thread 0x7f50d02c4700 (LWP 8152)]
base::debug::(anonymous namespace)::DebugBreak ()
    at ../../base/debug/debugger_posix.cc:230
230     }
(gdb) bt
    at ../../base/debug/debugger_posix.cc:230
...
    args_object=0x7f50d02bfe00, isolate=0x2f001c9e2020)
    at ../../v8/src/builtins/builtins-api.cc:123
...
(gdb) jss
(gdb) bt
    isolate=0x2f001c9e2020, is_construct=false, target=..., receiver=...,
    argc=1, args=0x7f50d02c0518, new_target=...)
    at ../../v8/src/execution.cc:111
    isolate=0x2f001c9e2020, callable=..., receiver=..., argc=1,
    argv=0x7f50d02c0518) at ../../v8/src/execution.cc:168
...

R=yangguo@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2186013002
Cr-Commit-Position: refs/heads/master@{#38121}

BUG=chromium:580337
TBR=yangguo@chromium.org, jochen@chromium.org, pfeldman@chromium.org
NOTRY=true

Review-Url: https://codereview.chromium.org/2192563003
Cr-Commit-Position: refs/heads/master@{#38120}

  port ba092fb0 (r37971)

  original commit message:
  So far we don't have a useful way to inline Math.max or Math.min in
  TurboFan optimized code. This adds new operators NumberMax and NumberMin
  and changes the Float64Max/Float64Min operators to have JavaScript
  semantics instead of the C++ semantics that it had previously.

  This also removes support for recognizing the tenary case in the
  CommonOperatorReducer, since that doesn't seem to have any positive
  impact (and actually doesn't show up in regular JavaScript, where
  people use Math.max/Math.min instead).

BUG=

  Drive-by-fix: Also nuke the unused Float32Max/Float32Min operators.
Review-Url: https://codereview.chromium.org/2187463005

Cr-Commit-Position: refs/heads/master@{#38119}

If the input to a CheckString is already a String, then the check
is redundant.

R=epertoso@chromium.org

Review-Url: https://codereview.chromium.org/2190833002
Cr-Commit-Position: refs/heads/master@{#38118}

This is required for all executables.

BUG=chromium:580337
TBR=yangguo@chromium.org, jochen@chromium.org, pfeldman@chromium.org
NOTRY=true

Review-Url: https://codereview.chromium.org/2183313007
Cr-Commit-Position: refs/heads/master@{#38117}

R=adamk@chromium.org
BUG=v8:5237

Review-Url: https://codereview.chromium.org/2188753002
Cr-Commit-Position: refs/heads/master@{#38116}