Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/c7c2db6..d25400d

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/buildtools/+log/7e53759..b3771b1

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/47b9857..4f3d6da

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/9913fb1..37d701b

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: I23061bacabda9ed97edf9d849d6811ed313bac7e
Reviewed-on: https://chromium-review.googlesource.com/447360Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43470}

NOTRY=true
TBR=machenbach@chromium.org

Review-Url: https://codereview.chromium.org/2721663004
Cr-Commit-Position: refs/heads/master@{#43469}

Add tests for local variables in function scopes and async features.

R=jgruber@chromium.org
BUG=v8:5821

Review-Url: https://codereview.chromium.org/2707043003
Cr-Commit-Position: refs/heads/master@{#43468}

Revert "Revert of [Atomics] Implement ldaxr/stlxr instructions in ARM64 simulator (patchset #8 id:140001 of https://codereview.chromium.org/2711473002/ )"

This reverts commit 2362f869.

BUG=v8:4614

Review-Url: https://codereview.chromium.org/2720133004
Cr-Commit-Position: refs/heads/master@{#43467}

This makes it no longer necessary to ensure that V8 and Blink have non-colliding
tags, which makes it easier for them to evolve independently, and also makes
the wire format more suitable for other V8 embedders, who would not
necessarily be surveyed before V8 introduced a new tag that might collide
with theirs.

BUG=chromium:686159

Review-Url: https://codereview.chromium.org/2709023003
Cr-Commit-Position: refs/heads/master@{#43466}

BUG=v8:4124
R=bradnelson@chromium.org,bbudge@chromium.org,gdeepti@chromium.org

Review-Url: https://codereview.chromium.org/2713613005
Cr-Commit-Position: refs/heads/master@{#43465}

R=joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2722603003
Cr-Commit-Position: refs/heads/master@{#43464}

Revert of [Atomics] Implement ldaxr/stlxr instructions in ARM64 simulator (patchset #8 id:140001 of https://codereview.chromium.org/2711473002/ )

Reason for revert:
The tree is closed due to an msan violation (use of uninitialized value) in the arm64 simulator soon after this patch landed; this seems related

https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/builds/13607/steps/Check/logs/simulator_invalidate_..

Original issue's description:
> [Atomics] Implement ldaxr/stlxr instructions in ARM64 simulator
>
> BUG=v8:4614
> R=binji@chromium.org
>
> Review-Url: https://codereview.chromium.org/2711473002
> Cr-Commit-Position: refs/heads/master@{#43461}
> Committed: https://chromium.googlesource.com/v8/v8/+/a2a2c1b9eeccd86e77f2c7e6eda3e1b09bb5306c

TBR=binji@chromium.org,jarin@chromium.org,jacob.bramley@arm.com,aseemgarg@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4614

Review-Url: https://codereview.chromium.org/2720133003
Cr-Commit-Position: refs/heads/master@{#43463}

perf regression. See crbug.com/695653 for more info.

Revert "[SAB] Move Atomics builtins to C++"

This reverts commit 2b9840d8.

Revert "[SAB] Remove unreachable Uint8Clamped atomics paths"

This reverts commit d1160fb1.

Revert "Remove tiny unit test for MinSimple/MaxSimple"

This reverts commit 837760ec.

Revert "Remove infrastructure for experimental JS natives"

This reverts commit 8cfe45b6.

BUG=695653
TBR=hablich@chromium.org

Review-Url: https://codereview.chromium.org/2715223003
Cr-Commit-Position: refs/heads/master@{#43462}

BUG=v8:4614
R=binji@chromium.org

Review-Url: https://codereview.chromium.org/2711473002
Cr-Commit-Position: refs/heads/master@{#43461}

BUG= https://bugs.chromium.org/p/chromium/issues/detail?id=694954

Change-Id: I07d7eeccca716028e1151db3df7ebee81d4a9ef2
Reviewed-on: https://chromium-review.googlesource.com/446707
Commit-Queue: Eric Holk <eholk@chromium.org>
Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43460}

BUG=none
R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2710903003
Cr-Commit-Position: refs/heads/master@{#43459}

This test helps to prevent regressions during work on new break locations.

BUG=none
R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2719763002
Cr-Commit-Position: refs/heads/master@{#43458}

BUG=chromium:695236
R=dgozman@chromium.org,yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2710953004
Cr-Commit-Position: refs/heads/master@{#43457}

BUG=

R=bjaideep@ca.ibm.com, jyan@ca.ibm.com, joransiu@ca.ibm.com

Review-Url: https://codereview.chromium.org/2712193002
Cr-Commit-Position: refs/heads/master@{#43456}

This will randomly break compilation units that don't happen to #define
DCHECK before v8-util.h is included.

BUG=chromium:688155

Change-Id: I7abdaf87c8bb7aca995d9e6e7ef8b4faff0dc50c
Reviewed-on: https://chromium-review.googlesource.com/447002Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Daniel Cheng <dcheng@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43455}

Make MarkerIs[Not]FrameType actually use their argument instead of a
fixed value for the stack frame type.

Review-Url: https://codereview.chromium.org/2709953002
Cr-Commit-Position: refs/heads/master@{#43454}

Inline the Array.isArray builtin during typed lowering, which generates
ideal code for the common case (non-JSProxy arg), and use the existing
%ArrayIsArray runtime function for the JSProxy case just like in baseline.

BUG=v8:5267
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2719023002
Cr-Commit-Position: refs/heads/master@{#43453}

When an instance of a constructor goes dictionary mode, this changes the initial map
of that constructor to also be in dictionary mode. This avoids spurious hidden class
creation, that also results in IC misses.

BUG=

Change-Id: I0e70f822ac345d0224f2092ec473621a603d4cc5
Reviewed-on: https://chromium-review.googlesource.com/446361Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43452}

BUG=chromium:688734

Change-Id: If5dd370971cb02c4463fa20a489d0fa60b0423c4
Reviewed-on: https://chromium-review.googlesource.com/446845Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43451}

R=titzer@chromium.org, ahaas@chromium.org

Review-Url: https://codereview.chromium.org/2714403004
Cr-Commit-Position: refs/heads/master@{#43450}

Skip parallel compilation if less than two functions need to be
compiled, and skip over imported functions instead of adding nullptrs
for them to the compilation_units_ vector.

R=titzer@chromium.org, ahaas@chromium.org

Review-Url: https://codereview.chromium.org/2718053002
Cr-Commit-Position: refs/heads/master@{#43449}

In spec review, the Intl constructor fallback semantics ended
up changing a bit; this patch updates V8 to the newest semantics.

BUG=v8:4360,v8:4870

Review-Url: https://codereview.chromium.org/2618533002
Cr-Commit-Position: refs/heads/master@{#43448}

This extends the existing typer for JS-level comparisons to also be
applied on simplified-level number comparisons. Now that nodes having
such operators are introduced early during graph construction, precise
type information has become more important.

R=jarin@chromium.org
TEST=unittests/TyperTest

Change-Id: Ibcfda36cadf72381b3c63138dd8ad2f6b1f7fbba
Reviewed-on: https://chromium-review.googlesource.com/445879
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43447}

Compare function for std::sort should satisfy strict weak ordering
relation.

BUG=chromium:696251

Change-Id: I1c07e3bb1b012fd203bc059a21a75ae0fc61f5ac
Reviewed-on: https://chromium-review.googlesource.com/447036Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43446}

Nodes having the {Throw} operator are just used as terminators for
control-flow leaving the function body with an exception completion,
they turn into basic-block terminators within the schedule. Actually
raising an exception is done solely via runtime calls. Hence {Throw}
nodes no longer need any value input.

R=bmeurer@chromium.org

Change-Id: Id6d8e46b12c4b84f4e7a8ac96623c8efb1f27b26
Reviewed-on: https://chromium-review.googlesource.com/446501
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43445}

This should have been removed with 9e187e.

BUG=

Review-Url: https://codereview.chromium.org/2719013002
Cr-Commit-Position: refs/heads/master@{#43444}

Don't just blindly bake in CallIC feedback in the JSCallReducer,
but instead try to estimate first whether it makes sense to bake
it in (and risk potential eager deoptimization exits). We already
didn't use the CallIC feedback when the call target is a known
constant, but we should also not use it if the target is a
JSCreateClosure node or a Phi of known constants / JSCreateClosure
nodes.

R=jarin@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2721483003
Cr-Commit-Position: refs/heads/master@{#43443}

Change-Id: I10ca732853729564c59755648d5fb369fb49ce97
Reviewed-on: https://chromium-review.googlesource.com/446364Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43442}

BUG=chromium:693426
NOTRY=true
TBR=mstarzinger@chromium.org,jarin@chromium.org

Change-Id: If9e5611566660455543044ddff60acda1ee153ba
Reviewed-on: https://chromium-review.googlesource.com/446347Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43441}

BUG=chromium:685318
NOTRY=true
TBR=hablich@chromium.org

Change-Id: Ic5a6d721372ff93d1c2254bad0e8c1d9c0b0af94
Reviewed-on: https://chromium-review.googlesource.com/446344Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Aaron Gable <agable@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43440}

Calling AstNode::Print() from within gdb, e.g. during bytecode
generation, sometimes results in a CHECK failure due to handle
dereferencing being disallowed.  This is very frustrating.

Since this function is purely for debugging and not called anywhere in
the code base, I'm now explicitly adding an AllowHandleDereference scope
to it.

R=adamk@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2711003007
Cr-Commit-Position: refs/heads/master@{#43439}

BUG=v8:6005
R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2715793004
Cr-Commit-Position: refs/heads/master@{#43438}

BUG=chromium:662424,chromium:696247
NOTRY=true
TBR=mstarzinger@chromium.org

Change-Id: I8ff62f16267efc20b1f612300498cc0b994c9a58
Reviewed-on: https://chromium-review.googlesource.com/446346Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43437}

BUG=chromium:689877
NOTRY=true
R=yangguo@chromium.org,jgruber@chromium.org

Change-Id: Ic11826510a0c9484832f62aaa8f2078b3088ecc5
Reviewed-on: https://chromium-review.googlesource.com/446395Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43436}

BUG=chromium:695416

Change-Id: Ied3a389d0dfb0132c798bc85e10f7b1fd4432eb4
Reviewed-on: https://chromium-review.googlesource.com/446343Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43435}

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/246a39a..47b9857

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: Ia6870fe800590533b799e96437db0a275284454f
Reviewed-on: https://chromium-review.googlesource.com/446640Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43434}

Currently, ArrayIncludes handles the hypothetical case of an array with
a fast ElementsKind and non-SMI length. This should not happen (and is checked
against in JSArray::JSArrayVerify of objects_debug.cc).

Therefore this CL replaces that handling with a CSA_ASSERT that the length is
indeed SMI.

The CL also simplifies loading of the (SMI) length on 64 bit architectures by
using LoadAndUntagObjectField instead of LoadObjectField+SmiToWord.

BUG=v8:5985

Review-Url: https://codereview.chromium.org/2714193002
Cr-Commit-Position: refs/heads/master@{#43433}

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/buildtools/+log/94cdccb..7e53759

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: I0e85f180a129e1436aaddc1157566e173213f675
Reviewed-on: https://chromium-review.googlesource.com/447016Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43432}

Currently, Generate_ArrayIndexOf handles the hypothetical case of an array with
a fast ElementsKind and non-SMI length. This should not happen (and is checked
against in JSArray::JSArrayVerify of objects_debug.cc).

Therefore this CL replaces that handling with a CSA_ASSERT that the length is
indeed SMI.

The CL also simplifies loading of the (SMI) length on 64 bit architectures by
using LoadAndUntagObjectField instead of LoadObjectField+SmiToWord.

The CL does not add new tests, because test/mjsunit/array-length.js should
cover this already.

BUG=v8:5985

Review-Url: https://codereview.chromium.org/2714173002
Cr-Commit-Position: refs/heads/master@{#43431}