We don't need to add stability dependencies on JSObject prototypes when
storing to an element, because we do the map check (and thereby guard
the elements kind) and we also properly deoptimize on holes if the array
protector is not usable.

R=verwaest@chromium.org
BUG=chromium:616709

Review-Url: https://codereview.chromium.org/2198833002
Cr-Commit-Position: refs/heads/master@{#38355}

Rolling v8/build to f0243d787961584ac95a86e7dae897b9b60ea674

Rolling v8/buildtools to 9c6ad6f5cbc2f30989edc3504ec7f9d360542512

Rolling v8/tools/clang to 0b06ba9e49a0cba97f6accd71a974c1623d69e16

Rolling v8/tools/mb to 60b89880ddfbccdc978f3c1562b2431119aea3d4

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2211333002
Cr-Commit-Position: refs/heads/master@{#38354}

The `PerformPromiseThen` spec-internal operation is used by the async functions
proposal, in order to ensure that AwaitExpressions are not observable via
usual mechanisms/hooks, such as Symbol.species.

BUG=v8:5253
R=littledan@chromium.org, adamk@chromium.org, gsathya@chromium.org, yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2209433003
Cr-Commit-Position: refs/heads/master@{#38353}

BUG=

Review-Url: https://codereview.chromium.org/2216813002
Cr-Commit-Position: refs/heads/master@{#38352}

FixedArrays could be shown differently based on their subtypes.

Review-Url: https://codereview.chromium.org/2208753002
Cr-Commit-Position: refs/heads/master@{#38351}

Return -1 instead of out of throwing errors, update tests.

R=titzer@chromium.org, ahaas@chromium.org

Review-Url: https://codereview.chromium.org/2216443002
Cr-Commit-Position: refs/heads/master@{#38350}

Review-Url: https://codereview.chromium.org/2204703002
Cr-Commit-Position: refs/heads/master@{#38349}

When parsing a eagerly-parsed-but-lazily-compiled function, we
used to put some of its AST nodes into a discardable Zone. This
CL puts the function Scope, its inner Scopes and the related AST
nodes (Declarations, VariableProxys) into the temporary Zone
too. This reduces peak memory usage and enables future work to
keep the temporary Zone around for later compilation.

BUG=

Review-Url: https://codereview.chromium.org/2210243002
Cr-Commit-Position: refs/heads/master@{#38348}

Ensure that receiver->elements() == *dictionary after calling an accessor, in
addition to checking the prototype.

BUG=chromium:634273, chromium: 634357, v8:5162
R=cbruni@chromium.org, mstarzinger@chromium.org

Review-Url: https://codereview.chromium.org/2212963002
Cr-Commit-Position: refs/heads/master@{#38347}

Make sure all the scopes used in api-natives.cc have inlineable constructors
and destructors. Additionally directly precheck the instantiations cache before
trying to enter the InvokeScope which sets the save_context.

BUG=chromium:630217

Review-Url: https://codereview.chromium.org/2206773003
Cr-Commit-Position: refs/heads/master@{#38346}

This was dropped accidentally in bb97d27a.

R=verwaest@chromium.org
BUG=chromium:633884

Review-Url: https://codereview.chromium.org/2203213003
Cr-Commit-Position: refs/heads/master@{#38345}

The contract is that the method is only invoked when there are no elements on
the prototype, and this elements type forbids accessor elements. So it is safe
to limit the search to the end of the backing store.

BUG=chromium:634269, v8:5162
R=cbruni@chromium.org, mstarzinger@chromium.org

Review-Url: https://codereview.chromium.org/2209273002
Cr-Commit-Position: refs/heads/master@{#38344}

R=machenbach@chromium.org,thakis@chromium.org
BUG=v8:5258

Review-Url: https://codereview.chromium.org/2206983002
Cr-Commit-Position: refs/heads/master@{#38343}

This adds the possibility to address test cases in the
status file with the variant under which the test is running.
This is only allowed in top-level sections.

Example:
[{
  'test-case': [PASS, SLOW],
}]

['variant == foo', {
  'test-case': [FAIL],
}]

The test case "test-case" is marked as slow in all variants.
Additionally, in variant foo, it'll be expected to fail.

This CL also exemplifies the new feature with test cases
running under the ignition_turbofan variant. The
corresponding legacy flag is deprecated.

BUG=v8:5238

Review-Url: https://codereview.chromium.org/2203013002
Cr-Commit-Position: refs/heads/master@{#38342}

OrComplement and AndComplement has no native support on s390.
So remove them.

R=joransiu@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com, bjaideep@ca.ibm.com
BUG=

Review-Url: https://codereview.chromium.org/2213783002
Cr-Commit-Position: refs/heads/master@{#38341}

There seems to be a fundamental problem with calling runtime functions
from wasm if the runtime function can cause a GC.

NOTRY=true
R=machenbach@chromium.org, titzer@chromium.org

Review-Url: https://codereview.chromium.org/2216433003
Cr-Commit-Position: refs/heads/master@{#38340}

BUG=

Review-Url: https://codereview.chromium.org/2209193002
Cr-Commit-Position: refs/heads/master@{#38339}

Only basic things for now, but enough, for example, to emit

mov rax, [rax+0xc]

instead of

mov rax, 0x3
mov rdx, [rdx+rax*4]

on x64.

BUG=

Review-Url: https://codereview.chromium.org/2211633003
Cr-Commit-Position: refs/heads/master@{#38338}

R=jgruber@chromium.org

Review-Url: https://codereview.chromium.org/2213583003
Cr-Commit-Position: refs/heads/master@{#38337}

This adds the missing lazy bailout point when defining accessor pairs
within object literals via Runtime::kDefineAccessorPropertyUnchecked.
The runtime function in question can indeed trigger a lazy deopt due
to a DependentCode::kPrototypeCheckGroup dependency.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-633585
BUG=chromium:633585

Review-Url: https://codereview.chromium.org/2207413002
Cr-Commit-Position: refs/heads/master@{#38336}

References in code objects to new-space embedded objects have to be
recorded in a remembered set so that they get updated by the garbage
collector.

TEST=cctest/test-serialize/CodeSerializerEmbeddedObject

R=ulan@chromium.org, yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2200333004
Cr-Commit-Position: refs/heads/master@{#38335}

This reverts an unintended change that was part of my recent CL
(https://codereview.chromium.org/2203803002).

BUG=

Review-Url: https://codereview.chromium.org/2208473008
Cr-Commit-Position: refs/heads/master@{#38334}

Compilation breaks when compiling v8 through Chromium using GYP. The isssue
started to appear after https://codereview.chromium.org/2190973003 landed.
It happens because trace_event_common.h header is on different location if we
are compiling v8 through Chromium compared to when we are compiling v8 standalone.

BUG=

Review-Url: https://codereview.chromium.org/2207943002
Cr-Commit-Position: refs/heads/master@{#38333}

This will allow for using DoParseLazy on a background thread, so we can
also parse inner functions on the background thread.

BUG=v8:5215
R=adamk@chromium.org,marja@chromium.org

Review-Url: https://codereview.chromium.org/2201423002
Cr-Commit-Position: refs/heads/master@{#38332}

Usage of hex IO manipulator for async event IDs corrupts future decimal number
outputs.

BUG=v8:5261

Review-Url: https://codereview.chromium.org/2200113003
Cr-Commit-Position: refs/heads/master@{#38331}

BUG=v8:5259
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2213793003
Cr-Commit-Position: refs/heads/master@{#38330}

Add missing support for the STORE_NO_TRANSITION_IGNORE_OUT_OF_BOUNDS
store mode to TurboFan.

R=epertoso@chromium.org
BUG=v8:4470

Review-Url: https://codereview.chromium.org/2210883002
Cr-Commit-Position: refs/heads/master@{#38329}

This reverts commit d2cf6e29.

BUG=chromium:633537

Review-Url: https://codereview.chromium.org/2207383002
Cr-Commit-Position: refs/heads/master@{#38328}

This removes the ability to specify a catch prediction for exception
handler tables that are based on return addresses. The encoding for
handlers still looks the same to keep it in sync with tables based on
ranges, just no payload is stored in the respective bits.

R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2205893002
Cr-Commit-Position: refs/heads/master@{#38327}

R=mlippautz@chromium.org
BUG=chromium:633539
TEST=cctest/test-heap/TestNewSpaceRefsInCopiedCode

Review-Url: https://codereview.chromium.org/2203783002
Cr-Commit-Position: refs/heads/master@{#38326}

An infinite recursion can be triggered when NoSideEffectToString is
called on an error object with its name property set to itself.

BUG=633998

Review-Url: https://codereview.chromium.org/2206313002
Cr-Commit-Position: refs/heads/master@{#38325}

Thrown exceptions must be handled before another exception is thrown.
This fixes all remaining test failures exposed by not clearing pending
exceptions in JSEntryStub.

BUG=v8:5259

Review-Url: https://codereview.chromium.org/2207923002
Cr-Commit-Position: refs/heads/master@{#38324}

These tests all called assertUnreachable within a try/catch block.

BUG=v8:5246

Review-Url: https://codereview.chromium.org/2209663003
Cr-Commit-Position: refs/heads/master@{#38323}

Ignition benchmarks will be switched to --ignition-staging.

TBR=machenbach@chromium.org
NOTRY=true
NOTREECHECKS=true
NOPRESUBMIT=true

Review-Url: https://codereview.chromium.org/2210873002
Cr-Commit-Position: refs/heads/master@{#38322}

Use a single CheckMaps node instead of the sequence of LoadField,
ReferenceEqual and CheckIf. This also makes it easier to eliminate
the COW check if there are multiple of them in a row.

R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2216453002
Cr-Commit-Position: refs/heads/master@{#38321}

  port cdae8654 (r38292)

  original commit message:
  A corresponding flag was added as well to help us find out what breaks when we
  do not clear pending exceptions on each JS entry.

BUG=

Review-Url: https://codereview.chromium.org/2212733002
Cr-Commit-Position: refs/heads/master@{#38320}

Rolling v8/build to c6b327c244be25a972266cad3228279266a03c66

Rolling v8/buildtools to 88c6fc5bde77b9477345f0885cd88d4a57ad1844

Rolling v8/tools/mb to 72a708590a056993adf080a92211ddc8221010e7

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2212753002
Cr-Commit-Position: refs/heads/master@{#38319}

Promise.resolve

Instead of creating resolve and reject closures, directly
call ResolvePromise after creating the promise.

Using the following as a microbenchmark --
```
var b = 0;
var start = performance.now();
for (var i = 0; i < 1000000; i++) {
  Promise.resolve(1).then((val) => {
    b += val;
    if (b == 1000000) print(performance.now() - start)
  });
}
```

I see a 16.01% improvement over 5 runs with this patch.

BUG=v8:5046

Review-Url: https://codereview.chromium.org/2143553002
Cr-Commit-Position: refs/heads/master@{#38318}

R=ahaas@chromium.org,bradnelson@chromium.org
BUG=chromium:628542

Review-Url: https://codereview.chromium.org/2207183002
Cr-Commit-Position: refs/heads/master@{#38317}

BUG=v8:5046

Review-Url: https://codereview.chromium.org/2209773003
Cr-Commit-Position: refs/heads/master@{#38316}