When we merge two NotFound access infos, we currently forgot to include
all the maps into the final PropertyAccessInfo, which results in a deopt
loop.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2625413003
Cr-Commit-Position: refs/heads/master@{#42332}

This puts lowering of {JSCreateClosure} operations behind a flag. For
now the benefit of inline allocating such closures is negligible, it
does increase code size, and breaks in combination with inlining based
on {SharedFunctionInfo}.

R=jarin@chromium.org
BUG=v8:2206

Review-Url: https://codereview.chromium.org/2636493002
Cr-Commit-Position: refs/heads/master@{#42331}

- condense repeated elements
- print map

BUG=

Review-Url: https://codereview.chromium.org/2626023002
Cr-Commit-Position: refs/heads/master@{#42330}

BUG=v8:5495

Review-Url: https://codereview.chromium.org/2633553002
Cr-Commit-Position: refs/heads/master@{#42329}

BUG=v8:5495

Review-Url: https://codereview.chromium.org/2622413004
Cr-Commit-Position: refs/heads/master@{#42328}

R=marja@chromium.org

Review-Url: https://codereview.chromium.org/2628293003
Cr-Commit-Position: refs/heads/master@{#42327}

Revert of [compiler] Support Object.create(null) inlining in TF (patchset #5 id:80001 of https://codereview.chromium.org/2622723003/ )

Reason for revert:
Breaks buildbot: https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20avx2/builds/13399/steps/Benchmarks/logs/stdio

Original issue's description:
> [compiler] Support Object.create(null) inlining in TF
>
> In the ideal case, this will speed up Object.create(null) by ~10x.
>
> Drive-by-fix: Spread usage of new IsSpecialReceiverMap() and
>               IsSpecialReceiverInstanceType(InstanceType) helpers.
>
> BUG=v8:5788
>
> Review-Url: https://codereview.chromium.org/2622723003
> Cr-Commit-Position: refs/heads/master@{#42321}
> Committed: https://chromium.googlesource.com/v8/v8/+/ff7063c7d5d8ad8eafcce3da59e65d7fe2b4f915

TBR=jarin@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5788

Review-Url: https://codereview.chromium.org/2636493003
Cr-Commit-Position: refs/heads/master@{#42326}

TBR=adamk@chromium.org
BUG=v8:1569

Review-Url: https://codereview.chromium.org/2621413009
Cr-Commit-Position: refs/heads/master@{#42325}

This changes the {MessageLocation} structure to no longer contain a
concrete {JSFunction} object but rather a {SharedFunctionInfo}. It is
much easier by now to determine, and also the concrete closure is never
actually being used.

R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2628973005
Cr-Commit-Position: refs/heads/master@{#42324}

Fix a deoptimization loop in TurboFan, where we'd constantly fail the
same map check due to not trying instance migration, when there are
migration targets in the map check list. This deoptimization loop
showed up on the React test in Speedometer.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2621423006
Cr-Commit-Position: refs/heads/master@{#42323}

R=jkummerow@chromium.org

Review-Url: https://codereview.chromium.org/2625053006
Cr-Commit-Position: refs/heads/master@{#42322}

In the ideal case, this will speed up Object.create(null) by ~10x.

Drive-by-fix: Spread usage of new IsSpecialReceiverMap() and
              IsSpecialReceiverInstanceType(InstanceType) helpers.

BUG=v8:5788

Review-Url: https://codereview.chromium.org/2622723003
Cr-Commit-Position: refs/heads/master@{#42321}

The simulator implements these exactly, but on ARM hardware,
the estimates are not exact, so CHECK_EQ will fail. This CL adds
a tolerance to the checks.

LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2628153003
Cr-Commit-Position: refs/heads/master@{#42320}

BUG=v8:5837
NOTRY=true

Review-Url: https://codereview.chromium.org/2636473002
Cr-Commit-Position: refs/heads/master@{#42319}

  The CL #42279 (https://codereview.chromium.org/2619353006 ) caused a gcc error (-Werror=strict-overflow).

  Here is the error message:
  In file included from .././src/globals.h:15:0,
                   from .././src/allocation.h:9,
                   from .././src/profiler/profile-generator.h:9,
                   from ../src/profiler/profile-generator.cc:5:
  .././src/base/logging.h: In member function ‘void v8::internal::ProfileTree::TraverseDepthFirst(Callback*) [with Callback = v8::internal::DeleteNodesCallback]’:
  .././src/base/logging.h:179:70: error: assuming signed overflow does not occur when assuming that (X - c) > X is always false [-Werror=strict-overflow]
                             : MakeCheckOpString<Lhs, Rhs>(lhs, rhs, msg);        \
                                                                            ^
  .././src/base/logging.h:191:1: note: in expansion of macro ‘DEFINE_CHECK_OP_IMPL’
   DEFINE_CHECK_OP_IMPL(GT, > )
   ^
    CXX(target) /home/zxli/work/google-v8/v8/out/x87.optdebug/obj.target/v8_base/src/regexp/regexp-macro-assembler.o
  cc1plus: all warnings being treated as errors

  This CL fix it.

BUG=

Review-Url: https://codereview.chromium.org/2632633002
Cr-Commit-Position: refs/heads/master@{#42318}

Revert of [wasm] Enforce that function bodies end with the \"end\" opcode. (patchset #6 id:100001 of https://codereview.chromium.org/2630553002/ )

Reason for revert:
Still breaks Win64 clang build.

Original issue's description:
> [wasm] Enforce that function bodies end with the \"end\" opcode.
>
> R=rossberg@chromium.org
> BUG=chromium:575167
>
> Review-Url: https://codereview.chromium.org/2630553002
> Cr-Original-Commit-Position: refs/heads/master@{#42286}
> Committed: https://chromium.googlesource.com/v8/v8/+/fcc6e85ec6b01e5367795f98aff104b1ff23f619
> Review-Url: https://codereview.chromium.org/2630553002
> Cr-Commit-Position: refs/heads/master@{#42315}
> Committed: https://chromium.googlesource.com/v8/v8/+/74a2f9b7d3c3d9a9284ab8d5a9d08618b8194966

TBR=mtrofin@chromium.org,rossberg@chromium.org,jbroman@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:575167

Review-Url: https://codereview.chromium.org/2636463002
Cr-Commit-Position: refs/heads/master@{#42317}

Prior to this, traces recorded through chrome://tracing would not
include time spent in RunMicrotasks.

BUG=v8:5382

Review-Url: https://codereview.chromium.org/2592793003
Cr-Commit-Position: refs/heads/master@{#42316}

R=rossberg@chromium.org
BUG=chromium:575167

Review-Url: https://codereview.chromium.org/2630553002
Cr-Original-Commit-Position: refs/heads/master@{#42286}
Committed: https://chromium.googlesource.com/v8/v8/+/fcc6e85ec6b01e5367795f98aff104b1ff23f619
Review-Url: https://codereview.chromium.org/2630553002
Cr-Commit-Position: refs/heads/master@{#42315}

This adapts the aformentioned interface to no longer return a list of
{JSFunction} objects, but {SharedFunctionInfo} objects instead. Since
deoptimization data only contains the latter as literals, this by now
represents the fast path. All call sites requiring the former can use
the slow path via {JavaScriptFrame::Summarize} instead.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2626213002
Cr-Original-Commit-Position: refs/heads/master@{#42311}
Committed: https://chromium.googlesource.com/v8/v8/+/25a9364f25a40986f4d7266b1fe53a5921754f6a
Review-Url: https://codereview.chromium.org/2626213002
Cr-Commit-Position: refs/heads/master@{#42314}

R=titzer@chromium.org
NOTRY=true

Review-Url: https://codereview.chromium.org/2635463002
Cr-Commit-Position: refs/heads/master@{#42313}

Revert of [runtime] Change JavaScriptFrame::GetFunctions interface. (patchset #2 id:20001 of https://codereview.chromium.org/2626213002/ )

Reason for revert:
Breaks compilation.

Original issue's description:
> [runtime] Change JavaScriptFrame::GetFunctions interface.
>
> This adapts the aformentioned interface to no longer return a list of
> {JSFunction} objects, but {SharedFunctionInfo} objects instead. Since
> deoptimization data only contains the latter as literals, this by now
> represents the fast path. All call sites requiring the former can use
> the slow path via {JavaScriptFrame::Summarize} instead.
>
> R=jarin@chromium.org
>
> Review-Url: https://codereview.chromium.org/2626213002
> Cr-Commit-Position: refs/heads/master@{#42311}
> Committed: https://chromium.googlesource.com/v8/v8/+/25a9364f25a40986f4d7266b1fe53a5921754f6a

TBR=jarin@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2629113004
Cr-Commit-Position: refs/heads/master@{#42312}

This adapts the aformentioned interface to no longer return a list of
{JSFunction} objects, but {SharedFunctionInfo} objects instead. Since
deoptimization data only contains the latter as literals, this by now
represents the fast path. All call sites requiring the former can use
the slow path via {JavaScriptFrame::Summarize} instead.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2626213002
Cr-Commit-Position: refs/heads/master@{#42311}

R=machenbach@chromium.org, ahaas@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2632493002
Cr-Commit-Position: refs/heads/master@{#42310}

If a breakpoint is set on a wasm function, compile an interpreter entry
stub for it, and replace all calls to the original function by calls to
this interpreter entry.
Also, instantiate a wasm interpreter object on demand and set the
breakpoint there.

R=titzer@chromium.org
BUG=v8:5822

Review-Url: https://codereview.chromium.org/2625093004
Cr-Commit-Position: refs/heads/master@{#42309}

R=jgruber@chromium.org
BUG=v8::5836

Review-Url: https://codereview.chromium.org/2628963005
Cr-Commit-Position: refs/heads/master@{#42308}

[runtime] Mark maps created as a result of field type or representation generalization as migration targets.

BUG=v8:5444

Review-Url: https://codereview.chromium.org/2379633002
Cr-Commit-Position: refs/heads/master@{#42307}

BUG=chromium:673246
NOTRY=true
TBR=tandrii@chromium.org,mbarbella@chromium.org

Review-Url: https://codereview.chromium.org/2632623002
Cr-Commit-Position: refs/heads/master@{#42306}

The fuzz test cases now print the original test paths during execution.
This exploits this extra information and reports a hash of only one
original source file from the section that caused a difference.

The hash size is now limited to 3 to avoid possible duplicate
explosion, in case this doesn't work out as expected.

This prepares for patch 3 of:
https://chromereviews.googleplex.com/550337016/

BUG=chromium:673246
NOTRY=true
TBR=tandrii@chromium.org,mbarbella@chromium.org

Review-Url: https://codereview.chromium.org/2620343005
Cr-Commit-Position: refs/heads/master@{#42305}

Revert of PPC/s390: Internalize strings in-place (reland) (patchset #1 id:1 of https://codereview.chromium.org/2628643002/ )

Reason for revert:
Original CL https://codereview.chromium.org/2626893005 got reverted.

Original issue's description:
> PPC/s390: Internalize strings in-place (reland)
>
> Port 4c699e34
>
> Original Commit Message:
>
>     using newly introduced ThinStrings, which store a pointer to the actual,
>     internalized string they represent.
>
>     (Previously landed as #42168 / af51befe.
>
> R=jkummerow@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
> BUG=v8:4520
> LOG=N
>
> Review-Url: https://codereview.chromium.org/2628643002
> Cr-Commit-Position: refs/heads/master@{#42202}
> Committed: https://chromium.googlesource.com/v8/v8/+/aa0cb2eaf830e03fced1e00134fb65938df02388

TBR=jkummerow@chromium.org,joransiu@ca.ibm.com,jyan@ca.ibm.com,michael_dawson@ca.ibm.com
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=v8:4520

Review-Url: https://codereview.chromium.org/2628923004
Cr-Commit-Position: refs/heads/master@{#42304}

We allocate console timing messages for now,
as previously skipping this tickled unrelated flake.
Use a fixed message to make them consistent in predictable mode.

BUG=v8:4203
TBR=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2628173003
Cr-Commit-Position: refs/heads/master@{#42303}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/9c22ce7..15635a4

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/ed0540f..fe8a3c8

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/c30c6ff..0147ef9

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2633463005
Cr-Commit-Position: refs/heads/master@{#42302}

We recently started emitting an error because a module's validation
doesn't reach the end (due to lack of exports).
This contained a mistake that prevents many most other types
of errors from actually getting out.

Ensuring export errors (or not reaching then end) doesn't clobber
other errors.

TODO(bradnelson): Figure out a way to structure tests so this gets
caught.

BUG=v8:4203
R=gdeepti@chromium.org

Review-Url: https://codereview.chromium.org/2632593002
Cr-Commit-Position: refs/heads/master@{#42301}

This directs all asm.js traffic via the Wasm backend.
Make asm.js console output less noisy.

R=titzer@chromium.org,aseemgarg@chromium.org
BUG=v8:4203

Review-Url: https://codereview.chromium.org/2624813002
Cr-Original-Original-Commit-Position: refs/heads/master@{#42194}
Committed: https://chromium.googlesource.com/v8/v8/+/946cc371ed4b34d1a9f5cc615b14c41b652562ad
Review-Url: https://codereview.chromium.org/2624813002
Cr-Original-Commit-Position: refs/heads/master@{#42244}
Committed: https://chromium.googlesource.com/v8/v8/+/3169fb94c98953f002908974a606b51a35178046
Review-Url: https://codereview.chromium.org/2624813002
Cr-Commit-Position: refs/heads/master@{#42300}

BUG=None
LOG=None
R=mtrofin@chromium.org

Review-Url: https://codereview.chromium.org/2621373005
Cr-Commit-Position: refs/heads/master@{#42299}

Revert of [wasm] Enforce that function bodies end with the \"end\" opcode. (patchset #1 id:1 of https://codereview.chromium.org/2628203003/ )

Reason for revert:
OK, the failure really does seem to be due to this patch: It triggers Clang to crash

FAILED: obj/test/unittests/unittests/function-body-decoder-unittest.obj
E:\b\build\slave\cache\cipd\goma/gomacc.exe ../../third_party/llvm-build/Release+Asserts/bin/clang-cl.exe /nologo /showIncludes /FC @obj/test/unittests/unittests/function-body-decoder-unittest.obj.rsp /c ../../test/unittests/wasm/function-body-decoder-unittest.cc /Foobj/test/unittests/unittests/function-body-decoder-unittest.obj /Fd"obj/test/unittests/unittests_cc.pdb"
Assertion failed: (NumGaps == 0 || Bias < MaxDefRange) && "large ranges should not have gaps", file E:\b\build\slave\win_upload_clang\build\src\third_party\llvm\lib\MC\MCCodeView.cpp, line 531
Wrote crash dump file "C:\Users\CHROME~2\AppData\Local\Temp\goma_temp.5068\clang-cl.exe-563144.dmp"

Let's leave it out for now.

Original issue's description:
> Reland of [wasm] Enforce that function bodies end with the \"end\" opcode. (patchset #1 id:1 of https://codereview.chromium.org/2628883006/ )
>
> Reason for revert:
> Try a reland; this might not have been the source of tree-closing.
>
> Original issue's description:
> > Revert of [wasm] Enforce that function bodies end with the \"end\" opcode. (patchset #3 id:40001 of https://codereview.chromium.org/2630553002/ )
> >
> > Reason for revert:
> > Caused tree to close by failing compilation:
> >
> > https://build.chromium.org/p/client.v8/builders/V8%20Win64%20-%20clang/builds/4451
> >
> > Original issue's description:
> > > [wasm] Enforce that function bodies end with the \"end\" opcode.
> > >
> > > R=rossberg@chromium.org
> > > BUG=chromium:575167
> > >
> > > Review-Url: https://codereview.chromium.org/2630553002
> > > Cr-Commit-Position: refs/heads/master@{#42286}
> > > Committed: https://chromium.googlesource.com/v8/v8/+/fcc6e85ec6b01e5367795f98aff104b1ff23f619
> >
> > TBR=mtrofin@chromium.org,rossberg@chromium.org,jbroman@chromium.org,titzer@chromium.org
> > # Skipping CQ checks because original CL landed less than 1 days ago.
> > NOPRESUBMIT=true
> > NOTREECHECKS=true
> > NOTRY=true
> > BUG=chromium:575167
> >
> > Review-Url: https://codereview.chromium.org/2628883006
> > Cr-Commit-Position: refs/heads/master@{#42287}
> > Committed: https://chromium.googlesource.com/v8/v8/+/1d32a3989bc474745eeb618ebf094634f4efbb36
>
> TBR=mtrofin@chromium.org,rossberg@chromium.org,jbroman@chromium.org,titzer@chromium.org
> # Skipping CQ checks because original CL landed less than 1 days ago.
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=chromium:575167
>
> Review-Url: https://codereview.chromium.org/2628203003
> Cr-Commit-Position: refs/heads/master@{#42296}
> Committed: https://chromium.googlesource.com/v8/v8/+/e539bd8e0eb6afc8e7c98c38584928d6bc799b5b

TBR=mtrofin@chromium.org,rossberg@chromium.org,jbroman@chromium.org,titzer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:575167

Review-Url: https://codereview.chromium.org/2633583002
Cr-Commit-Position: refs/heads/master@{#42298}

R=joransiu@ca.ibm.com, bjaideep@ca.ibm.com
BUG=

Review-Url: https://codereview.chromium.org/2622073006
Cr-Commit-Position: refs/heads/master@{#42297}

Reland of [wasm] Enforce that function bodies end with the \"end\" opcode. (patchset #1 id:1 of https://codereview.chromium.org/2628883006/ )

Reason for revert:
Try a reland; this might not have been the source of tree-closing.

Original issue's description:
> Revert of [wasm] Enforce that function bodies end with the \"end\" opcode. (patchset #3 id:40001 of https://codereview.chromium.org/2630553002/ )
>
> Reason for revert:
> Caused tree to close by failing compilation:
>
> https://build.chromium.org/p/client.v8/builders/V8%20Win64%20-%20clang/builds/4451
>
> Original issue's description:
> > [wasm] Enforce that function bodies end with the \"end\" opcode.
> >
> > R=rossberg@chromium.org
> > BUG=chromium:575167
> >
> > Review-Url: https://codereview.chromium.org/2630553002
> > Cr-Commit-Position: refs/heads/master@{#42286}
> > Committed: https://chromium.googlesource.com/v8/v8/+/fcc6e85ec6b01e5367795f98aff104b1ff23f619
>
> TBR=mtrofin@chromium.org,rossberg@chromium.org,jbroman@chromium.org,titzer@chromium.org
> # Skipping CQ checks because original CL landed less than 1 days ago.
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=chromium:575167
>
> Review-Url: https://codereview.chromium.org/2628883006
> Cr-Commit-Position: refs/heads/master@{#42287}
> Committed: https://chromium.googlesource.com/v8/v8/+/1d32a3989bc474745eeb618ebf094634f4efbb36

TBR=mtrofin@chromium.org,rossberg@chromium.org,jbroman@chromium.org,titzer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:575167

Review-Url: https://codereview.chromium.org/2628203003
Cr-Commit-Position: refs/heads/master@{#42296}

Before, in `var p1 = p.then(() => {}) we would trigger the
before/after callbacks with p as the associated promise, but we must
call it with p1.

Also removes promise from PromiseReactionJobInfo.

Review-Url: https://codereview.chromium.org/2633443002
Cr-Commit-Position: refs/heads/master@{#42295}

The constant field tracking implies data constants to be stored
in fields instead of descriptor arrays. This CL does necessary
modifications to the JSModuleNamespace map setup.

BUG=v8:1569, v8:5495

Review-Url: https://codereview.chromium.org/2625093005
Cr-Commit-Position: refs/heads/master@{#42294}

enabled TODO-ed compile tests

BUG=v8:5833

Review-Url: https://codereview.chromium.org/2628053004
Cr-Commit-Position: refs/heads/master@{#42293}