A few tests that would be good to have to verify that the known manifestations
of this bug are resolved.

Previously, the async generator and async function tests would crash. The other
ones never did, but still resulted in the register overwite bug.

BUG=v8:6322
R=adamk@chromium.org

Change-Id: Ic2238227629077de5671d67d18b3bfe018dd23f4
Reviewed-on: https://chromium-review.googlesource.com/514230Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Cr-Commit-Position: refs/heads/master@{#45524}

R=joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2905683002
Cr-Commit-Position: refs/heads/master@{#45523}

Rather than trying to pre-calculate the number of contexts required during
scope analysis, instead just allocate context registers in the register
allocator. This reduces frame size a bit due to reusing of registers when
the context isn't pushed.

 BUG=v8:6322, chromium:716265

Change-Id: I145e38fcb3797a3b86c91e90ea9326a6e55b9b89
Reviewed-on: https://chromium-review.googlesource.com/514087Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45522}

Revert of [turbofan] Speculatively optimize string character access. (patchset #1 id:1 of https://codereview.chromium.org/2905623003/ )

Reason for revert:
Changes layout tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/15867

See:
https://github.com/v8/v8/wiki/Blink-layout-tests

Original issue's description:
> [turbofan] Speculatively optimize string character access.
>
> Add a protector cell for string bounds checks that is being used to
> protect speculative bounds for String.prototype.charCodeAt and
> String.prototype.charAt in TurboFan (and Crankshaft). This way we don't
> have the diamond in optimized code, which stands in the way of other
> optimizations for charCodeAt that are currently being worked on by
> petermarshall@.
>
> BUG=v8:6391
> TBR=mlippautz@chromium.org
> R=petermarshall@chromium.org
>
> Review-Url: https://codereview.chromium.org/2905623003
> Cr-Commit-Position: refs/heads/master@{#45514}
> Committed: https://chromium.googlesource.com/v8/v8/+/9d8bd0551657d60c66b2f96544eecedfba1cba8a

TBR=petermarshall@chromium.org,mlippautz@chromium.org,bmeurer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:6391

Review-Url: https://codereview.chromium.org/2900333002
Cr-Commit-Position: refs/heads/master@{#45521}

TBR=machenbach@chromium.org

Bug: 
Change-Id: I916d52297bd81c5015fcd3185105dcb0d0a3d78f
Reviewed-on: https://chromium-review.googlesource.com/513906Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Commit-Queue: Daniel Vogelheim <vogelheim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45520}

This reverts commit ee3729d2.

Reason for revert: The initial commit required https://chromium-review.googlesource.com/c/510021/ also land on the Blink side. I mistakenly thought it did.

Original change's description:
> Revert "[wasm] Remove override-ability from async compile and instantiate."
> 
> This reverts commit 2869dd55.
> 
> Reason for revert: Breaks:
> https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/15850
> 
> See also:
> https://github.com/v8/v8/wiki/Blink-layout-tests
> 
> Original change's description:
> > [wasm] Remove override-ability from async compile and instantiate.
> > 
> > We're now using explicit APIs.
> > 
> > Bug: 
> > Change-Id: I4a4248e44543f6e7dfcbdc66456e610fb98ff5ee
> > Reviewed-on: https://chromium-review.googlesource.com/513406
> > Commit-Queue: Brad Nelson <bradnelson@chromium.org>
> > Reviewed-by: Brad Nelson <bradnelson@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#45500}
> 
> TBR=bradnelson@chromium.org,mtrofin@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> 
> Bug: 
> Change-Id: Ie7c2db40279bd07c535c20afaa1cea51b680fe65
> Reviewed-on: https://chromium-review.googlesource.com/513862
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#45502}

TBR=bradnelson@chromium.org,machenbach@chromium.org,mtrofin@chromium.org,v8-reviews@googlegroups.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Bug: 
Change-Id: Ib826b590b5d362d005460fcebdc6800c8d6c5f63
Reviewed-on: https://chromium-review.googlesource.com/513496Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
Commit-Queue: Mircea Trofin <mtrofin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45519}

Bug: chromium:725201
Change-Id: Ic75f4080b8ef28e64b471887871c526c0bac316b
Reviewed-on: https://chromium-review.googlesource.com/514004Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45518}

Change-Id: I5e725f984178c2c9d48ba48c1270faea1b63ff3e
Reviewed-on: https://chromium-review.googlesource.com/513943Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45517}

Missing parentheses are causing compilation failures, added them.

BUG=

Review-Url: https://codereview.chromium.org/2906433002
Cr-Commit-Position: refs/heads/master@{#45516}

In particular, local variables should be allocated on stack (in bytecode register), and stored/loaded to the generator object on generator suspend/resume.

The CL is based on @adamk's change to scoping/parsers (https://chromium-review.googlesource.com/c/498538/), I only made the debugger cope with this change.

I should note that the CL changes the scope type of suspended generators from ScopeType.Closure to ScopeType.Local. In the future we might want to introduce ScopeType.SuspendedGenerator to make the distinction explicit.

Some of the changes in the tests have been made because the debugger functions do not return scopes of closed generators anymore. Generators should be allowed to throw away their internal state when they finish.

BUG=v8:6368

Review-Url: https://codereview.chromium.org/2898163002
Cr-Commit-Position: refs/heads/master@{#45515}

Add a protector cell for string bounds checks that is being used to
protect speculative bounds for String.prototype.charCodeAt and
String.prototype.charAt in TurboFan (and Crankshaft). This way we don't
have the diamond in optimized code, which stands in the way of other
optimizations for charCodeAt that are currently being worked on by
petermarshall@.

BUG=v8:6391
TBR=mlippautz@chromium.org
R=petermarshall@chromium.org

Review-Url: https://codereview.chromium.org/2905623003
Cr-Commit-Position: refs/heads/master@{#45514}

- Create getters for number of tasks for all parallel stages
- Count slots for the minor MC and limit tasks by the overall number of slots.
- Cleanup existing getters.

Bug: chromium:651354
Change-Id: I9f67cca4474cbe1800faff4a549fbec019b096ce
Reviewed-on: https://chromium-review.googlesource.com/512862
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45513}

Add support for I8x16Add, I8x16AddSaturateS, I8x16Sub, I8x16SubSaturateS,
I8x16Mul, I8x16MaxS, I8x16MinS, I8x16Eq, I8x16Ne, I8x16LtS,
I8x16LeS, I8x16ShrU, I8x16AddSaturateU, I8x16SubSaturateU, I8x16MaxU,
I8x16MinU, I8x16LtU, I8x16LeU, S128And, S128Or, S128Xor, S128Not for
mips32 and mips64 architectures.

BUG=

Review-Url: https://codereview.chromium.org/2798853003
Cr-Commit-Position: refs/heads/master@{#45512}

This removes the need for certain context scopes to skip popping the
context register. For the {incoming_context} the flag was already
obsolete, because its destructor would only run once the basic block
ended with a return. For {local_function_context} the same holds now
by moving handling of implicit returns into the body visitor.

R=rmcilroy@chromium.org

Change-Id: Icceaab1b30d7223b2b2f87a092a6580be7d7d675
Reviewed-on: https://chromium-review.googlesource.com/513963Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45511}

This is safe since we already take the page lock.

Bug: 
Change-Id: Id7797ef66c387be150064cda1213c1f2b75d31d3
Reviewed-on: https://chromium-review.googlesource.com/514003Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45510}

There are two break locations at the same source location by desugaring:
- call iterator.next,
- before variable assignment.

Additionally location for for..of loops is moved from before "of" to before each variable expression.

We should not report first implicit call to avoid user confusion. User still able to go into .next function with both scenarios:
- when this call is reached by stepOver or stepInto from previous line,
- when this call is reached because of breakpoint at current line.

BUG=v8:6425
R=dgozman@chromium.org,jgruber@chromium.org

Review-Url: https://codereview.chromium.org/2893313002
Cr-Commit-Position: refs/heads/master@{#45509}

Add a sequential string type to the compiler, and transform
charCodeAt on SeqString into SeqStringCharCodeAt.

SeqStringCharCodeAt can handle one and two byte strings.

Bug: v8:6391
Change-Id: I2785257522c28f3b268c9833f5313e9630cb982a
Reviewed-on: https://chromium-review.googlesource.com/509573Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45508}

This avoids emitting redundant {PopContext} bytecode instructions when
non-local control-flow leaves the method body. It also folds multiple
such {PopContext} instructions into one, in case several scoping levels
are crossed at one. Only the expected context of the target of a local
control-flow transfer matters.

R=rmcilroy@chromium.org
TEST=debugger/regress/regress-crbug-724858
BUG=chromium:724858

Change-Id: Id4a47ae9fea25e75ae1af13619720b16a3975edf
Reviewed-on: https://chromium-review.googlesource.com/512545Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45507}

This reverts commit 589a4d1d.

Reason for revert: Breaks webkit:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20predictable/builds/11714

Original change's description:
> [test] Don't hide crashes in predictable mode
> 
> Bug: v8:6426
> Change-Id: I278dda0d628732bb9c539c2648d2b27bcbc89bf0
> Reviewed-on: https://chromium-review.googlesource.com/512643
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#45504}

TBR=jkummerow@chromium.org,machenbach@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
Bug: v8:6426

Change-Id: I85c573fa332f436bb57f2747ad98c26e1c1f23bd
Reviewed-on: https://chromium-review.googlesource.com/513866Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45506}

NOTRY=true
TBR=hpayer@chromium.org

Bug: chromium:651354
Change-Id: Ibff438d987b07907b2c4463a42bef685864c1602
Reviewed-on: https://chromium-review.googlesource.com/513903Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45505}

Bug: v8:6426
Change-Id: I278dda0d628732bb9c539c2648d2b27bcbc89bf0
Reviewed-on: https://chromium-review.googlesource.com/512643Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45504}

There are only two users of hidden prototypes left and they both only have 1 level. This slightly simplifies the handcrafted code.

Bug: v8:5561
Change-Id: I674e72f1465ccbe75c0bb63f7eea3525830145cb
Reviewed-on: https://chromium-review.googlesource.com/512745Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45503}

This reverts commit 2869dd55.

Reason for revert: Breaks:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/15850

See also:
https://github.com/v8/v8/wiki/Blink-layout-tests

Original change's description:
> [wasm] Remove override-ability from async compile and instantiate.
> 
> We're now using explicit APIs.
> 
> Bug: 
> Change-Id: I4a4248e44543f6e7dfcbdc66456e610fb98ff5ee
> Reviewed-on: https://chromium-review.googlesource.com/513406
> Commit-Queue: Brad Nelson <bradnelson@chromium.org>
> Reviewed-by: Brad Nelson <bradnelson@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#45500}

TBR=bradnelson@chromium.org,mtrofin@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Bug: 
Change-Id: Ie7c2db40279bd07c535c20afaa1cea51b680fe65
Reviewed-on: https://chromium-review.googlesource.com/513862Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45502}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/b19d8a0..5488ca8

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/08a6e0a..51b3178

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: Ic07c2cd8459688129791ac27e185e2e1308d5a48
Reviewed-on: https://chromium-review.googlesource.com/513445Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45501}

We're now using explicit APIs.

Bug: 
Change-Id: I4a4248e44543f6e7dfcbdc66456e610fb98ff5ee
Reviewed-on: https://chromium-review.googlesource.com/513406
Commit-Queue: Brad Nelson <bradnelson@chromium.org>
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45500}

This doesn't fix the bug, just avoids it.

Bug: v8:6436
Change-Id: I06305a9baf892e4039f2aaf353fa7edf7b7e325d
Reviewed-on: https://chromium-review.googlesource.com/513242Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Commit-Queue: Brad Nelson <bradnelson@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45499}

Drive-by: Add some comments.

R=jarin@chromium.org, mtrofin@chromium.org
BUG=v8:6434

Change-Id: If4ee8dfc68685429a91885a1c831709a4e31619c
Reviewed-on: https://chromium-review.googlesource.com/513202
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45498}

This patch also adds sharing of code target entries, which requires
sharing the RelocInfo for those entries as well. The disassembler
is also modified in order to print comments for the RelocInfo that
is now shared.

This improves the snapshot size for arm by about 4%.

BUG=

Review-Url: https://codereview.chromium.org/2869683004
Cr-Commit-Position: refs/heads/master@{#45497}

Asynchronous context tracking mechanisms in Node.js need to store some
state on all promise objects. This change will allow embedders to
configure the number of internal fields on promises as is already done
for ArrayBuffers.

BUG=v8:6435

Review-Url: https://codereview.chromium.org/2889863002
Cr-Commit-Position: refs/heads/master@{#45496}

Perf Sheriffs: This CL may change performance on various benchmarks.

BUG=chromium:716032

Review-Url: https://codereview.chromium.org/2895473003
Cr-Commit-Position: refs/heads/master@{#45495}

Bug: chromium:651354
Change-Id: If2a67a7166e412affad7e71eb06087cc1478892c
Reviewed-on: https://chromium-review.googlesource.com/512825Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45494}

A number of improvements in mips64 load immediate macro is added per
suggestions from MIPS ART team. Also fix Subu and Dsubu macro, add a
test for Subu and Dsubu and make minor code adjustments.

BUG=
TEST=cctest/test-assembler-mips/li_macro
     cctest/test-assembler-mips/Subu
     cctest/test-assembler-mips/Dsubu

Review-Url: https://codereview.chromium.org/2892163002
Cr-Commit-Position: refs/heads/master@{#45493}

NOTRY=true

Change-Id: Id2085b36ccbf5e039b725fad477c7292735a27b5
Reviewed-on: https://chromium-review.googlesource.com/512543Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45492}

Before emitting the safepoint table, remove consecutive identical
entries (idential except for the pc of course). The lookup then
searches for the last entry whose pc is <= the wanted pc.
The lookup procedure can still be optimized to use binary search
laster.

This change decreases code size for wasm by 27.6% (on the unity
benchmark).

BUG=v8:6434

Change-Id: I03481721fe666cd2c50a383380c74b06edf39106
Reviewed-on: https://chromium-review.googlesource.com/512542
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45491}

PrintAlloctionsHash -> PrintAllocationsHash

R=mlippautz@chromium.org

Change-Id: I3b5067d5ea2ef1f4250e384b233cc4a85d8509c1
Reviewed-on: https://chromium-review.googlesource.com/512723Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45490}

Bug: v8:5717, v8:6354
Change-Id: I4be80eabcb0f98446e695a2ab1ad5804b7181ac7
Reviewed-on: https://chromium-review.googlesource.com/506818
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45489}

Keep the live bytes counter in a local hashmap. Merge back the counts
upon task destruction.

Bug: chromium:651354
Change-Id: Idd30e8fde690739d769a34e4650d8c0179fb5a75
Reviewed-on: https://chromium-review.googlesource.com/512642
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45488}

Change-Id: Ib6ee9d9ce827c2f9f42f09292b0caca922cfde1e
Reviewed-on: https://chromium-review.googlesource.com/512663Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45487}

BUG=v8:5402

Review-Url: https://codereview.chromium.org/2900713004
Cr-Commit-Position: refs/heads/master@{#45486}

Previously the inlining of accessors into try-blocks (i.e. try/catch,
try/finally, for-of, etc.) was disabled in JSNativeContextSpecialization,
which prevented a couple of interesting optimizations, i.e. we end up
with a LOAD_IC in optimized code for this simple example:

  class A { get x() { return 1; } }
  function foo(a) {
    try {
      return a.x;
    } catch (e) {
      return 0;
    }
  }
  foo(new A)

This is now fixed and the accessors are properly rewired into the
handler chain.

BUG=v8:6278,v8:6344,v8:6424
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2902533003
Cr-Commit-Position: refs/heads/master@{#45485}