Ignition skipped collecting NumberOrOddball feedback if the right hand
side of a relational comparison is undefined, thus leading to a
deoptimization loop, because it reported Number feedback to TurboFan.

This was caught on 3d-raytrace test of SunSpider.

R=rmcilroy@chromium.org

Review-Url: https://codereview.chromium.org/2513903002
Cr-Commit-Position: refs/heads/master@{#41094}

This fixes the bogus implementation of the function in question and adds
test coverage for the deserialization of the corresponding flags from
the serialized scope info. Note that the tests so far only cover cases
where the module and the function contain context-allocated variables.

R=verwaest@chromium.org
TEST=cctest/test-parsing/AsmFunctionFlag
BUG=v8:5653

Review-Url: https://codereview.chromium.org/2507063004
Cr-Commit-Position: refs/heads/master@{#41093}

This is the TurboFan counterpart of http://crrev.com/2504263004, but it
is a bit more involved, since in TurboFan we always inline the appropriate
call to the @@hasInstance handler, and by that we can optimize a lot more
patterns of instanceof than Crankshaft, and even yield fast instanceof
for custom @@hasInstance handlers (which we can now properly inline as
well).

Also we now properly optimize Function.prototype[@@hasInstance], even if
the right hand side of an instanceof doesn't have the Function.prototype
as its direct prototype.

For the baseline case, we still rely on the global protector cell, but
we can address that in a follow-up as well, and make it more robust in
general.

TEST=mjsunit/compiler/instanceof
BUG=v8:5640
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2511223003
Cr-Commit-Position: refs/heads/master@{#41092}

See https://github.com/mathiasbynens/es-regexp-unicode-property-escapes

Changes:
- only allow General Category, binary properties, Script, and Script_Extensions.
- implement Script_Extensions.

R=littledan@chromium.org
BUG=v8:4743

Review-Url: https://codereview.chromium.org/2502933002
Cr-Commit-Position: refs/heads/master@{#41091}

Reland of Update usage of linux blink try bot to use linux_trusty_blink_rel. (patchset #1 id:1 of https://codereview.chromium.org/2507853002/ )

Reason for revert:
linux_trusty_blink_rel is now working, with more capacity

Original issue's description:
> Revert of Update usage of linux blink try bot to use linux_trusty_blink_rel. (patchset #1 id:1 of https://codereview.chromium.org/2475563002/ )
>
> Reason for revert:
> Submitting this before more capacity was added to linux_trusty_blink_rel caused that builder to get too busy (http://crbug.com/665246); should be able to reland after http://crbug.com/665917 is fixed.
>
> Original issue's description:
> > Update usage of linux blink try bot to use linux_trusty_blink_rel.
> >
> > Reason: We're planning to drop support for Linux Precise for layout tests.
> >
> > BUG=chromium:660580
> > NOTRY=true
>
> TBR=machenbach@chromium.org
> # Not skipping CQ checks because original CL landed more than 1 days ago.
> BUG=chromium:660580
> NOTRY=true

TBR=machenbach@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:660580

Review-Url: https://codereview.chromium.org/2505403002
Cr-Commit-Position: refs/heads/master@{#41090}

With this change, WebAssembly.Memory objects have backing stores allocated as an
8GB region where everything beyond the size of the Wasm heap is inaccessible.

GrowMemory is now implemented by changing the protection on the guard regions to
make the new portions of the heap accessible.

Guard pages are not enabled by default, but this change adds a flag and a test
variant to make sure we get test coverage on them.

BUG= https://bugs.chromium.org/p/v8/issues/detail?id=5277

Review-Url: https://codereview.chromium.org/2396433008
Cr-Commit-Position: refs/heads/master@{#41089}

BUG=

Review-Url: https://codereview.chromium.org/2507293003
Cr-Commit-Position: refs/heads/master@{#41088}

After moving inspector from blink to V8, inspector can use DebugInterface to compile and mark internal scripts.

BUG=v8:5530
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2502173002
Cr-Commit-Position: refs/heads/master@{#41087}

Review-Url: https://codereview.chromium.org/2509293002
Cr-Commit-Position: refs/heads/master@{#41086}

With the new wasm object types, the GetCompiledModule and GetWasmBytes
functions are not needed any more. The same functions are already
public on the wasm objects.
In order to use them properly, I changed a few more locations to make
use of the new types.

R=ahaas@chromium.org, titzer@chromium.org

Review-Url: https://codereview.chromium.org/2503403005
Cr-Commit-Position: refs/heads/master@{#41085}

BUG=chromium:665398

Review-Url: https://codereview.chromium.org/2509753002
Cr-Commit-Position: refs/heads/master@{#41084}

Adds --wasm-no-bounds-checks and --wasm-no-stack-checks which
help in diagnosing potential sources of slowdown in WASM code.

R=ahaas@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2511113002
Cr-Commit-Position: refs/heads/master@{#41083}

R=titzer@chromium.org
NOTRY=true
NOTREECHECKS=true

Review-Url: https://codereview.chromium.org/2511763002
Cr-Commit-Position: refs/heads/master@{#41082}

Collect feedback for oddballs in the interpreter compare operations handlers.
This is important to ensure that we don't consider oddball comparisons as
generic, which prevents optimization.

BUG=chromium:660947

Review-Url: https://codereview.chromium.org/2506283003
Cr-Commit-Position: refs/heads/master@{#41081}

BUG=
TBR=machenbach@chromium.org
NOTRY=true

Review-Url: https://codereview.chromium.org/2515443002
Cr-Commit-Position: refs/heads/master@{#41080}

The ptr_to_* methods do (often unnecessary) type checks, and can
return nullptr. This is problematic since the handlified getter
uses them, and assumes the result to be non-null. So change
them to only to a DCHECK and never return nullptr, and introduce
maybe_ptr_to_* with the old semantics.

R=titzer@chromium.org, ahaas@chromium.org

Review-Url: https://codereview.chromium.org/2509053003
Cr-Commit-Position: refs/heads/master@{#41079}

Collect string feedback for compare operations. Without this,
functions which have a lot of string compare operations end up with
a high generic type percentage, and don't get optimized until very
late.

Currently TurboFan doesn't use this String feedback for compare
operations, but this could be done in future work if it is useful.

BUG=chromium:660947

Review-Url: https://codereview.chromium.org/2506013005
Cr-Commit-Position: refs/heads/master@{#41078}

V8 was applying incorrect optimization to them advancing the start position.

This would cause /foo$/y too match "barfoo", which it should not.

BUG=

Review-Url: https://codereview.chromium.org/2510743003
Cr-Commit-Position: refs/heads/master@{#41077}

Review-Url: https://codereview.chromium.org/2511553002
Cr-Commit-Position: refs/heads/master@{#41076}

R=machenbach@chromium.org
BUG=chromium:664068

Review-Url: https://codereview.chromium.org/2509843005
Cr-Commit-Position: refs/heads/master@{#41075}

BUG=
R=ahaas@chromium.or

Review-Url: https://codereview.chromium.org/2502383003
Cr-Commit-Position: refs/heads/master@{#41074}

Also fixed handling of load non-existent handlers outside typeof.

BUG=v8:5561, chromium:662854

Review-Url: https://codereview.chromium.org/2511603002
Cr-Commit-Position: refs/heads/master@{#41073}

There's no need to return anything.

Also add a DCHECK to make sure that we never mark a variable proxy as assigned
that is already resolved (to avoid potential inconsistency with the variable's
maybe_assigned status).

R=littledan@chromium.org
CC=mstarzinger@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2504613002
Cr-Commit-Position: refs/heads/master@{#41072}

The control edges in a TurboFan graph can form a cycle. To break this cycle in the int64-lowering we add special handling for loop nodes. Similar handling already exists for phi nodes and effectphi nodes, which breaks cycles formed by value edges and effect edges, respectively.

Review-Url: https://codereview.chromium.org/2511503002
Cr-Commit-Position: refs/heads/master@{#41071}

This hopefully avoids multiple error messages appearing on the same
line.

R=titzer@chromium.org, machenbach@chromium.org
BUG=chromium:660016

Review-Url: https://codereview.chromium.org/2503423006
Cr-Commit-Position: refs/heads/master@{#41070}

TBR=ahaas@chromium.org, kozyatinskiy@chromium.org
NOTRY=true
NOTREECHECKS=true

Review-Url: https://codereview.chromium.org/2503213004
Cr-Commit-Position: refs/heads/master@{#41069}

The test just prints the source text of each line on the stack.
Look how beautiful it reads \o/

BUG=chromium:659715
R=yangguo@chromium.org, kozyatinskiy@chromium.org
CC=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2492123003
Cr-Commit-Position: refs/heads/master@{#41068}

Fix c3a6ca68

Fix compilation failure on MIPS and GCC cross compile that started to appear
after the CL c3a6ca68 landed. The compilation
error is due to:

.././src/objects-inl.h:4129:54: error: assuming signed overflow does not occur
when assuming that (X + c) < X is always false [-Werror=strict-overflow]
   DCHECK(index >= 0 && length >= 0 && index + length >= index &&

BUG=

Review-Url: https://codereview.chromium.org/2501963002
Cr-Commit-Position: refs/heads/master@{#41067}

Incremental marking does not use idle tasks anymore.

BUG=

Review-Url: https://codereview.chromium.org/2512643002
Cr-Commit-Position: refs/heads/master@{#41066}

This method is a slight misnomer. What we actually want to know is
whether the function was defined in a user-provided script.

Also remove redundant Script::hide_source flag.

R=bmeurer@chromium.org, ulan@chromium.org

Review-Url: https://codereview.chromium.org/2505853003
Cr-Commit-Position: refs/heads/master@{#41065}

This adds clearAllBreakPoints functionality (which requires tracking set
breakpoints internally), and several script-related functions that rely
on runtime functions.

BUG=v8:5530

Review-Url: https://codereview.chromium.org/2508853003
Cr-Commit-Position: refs/heads/master@{#41064}

BUG=v8:5628
NOTRY=true

Review-Url: https://codereview.chromium.org/2508093002
Cr-Commit-Position: refs/heads/master@{#41063}

This adds access to the LiveEdit API object, frame.restart(), and
various breakpoint setters. The LiveEdit API still depends on the JS
debugging context and blocks its removal; but it should be removed
once LiveEdit is rewritten in the midterm.

BUG=v8:5530

Review-Url: https://codereview.chromium.org/2503293002
Cr-Commit-Position: refs/heads/master@{#41062}

R=ishell@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2505853005
Cr-Commit-Position: refs/heads/master@{#41061}

R=jochen@chromium.org, kozyatinskiy@chromium.org

Review-Url: https://codereview.chromium.org/2510633002
Cr-Commit-Position: refs/heads/master@{#41060}

In Crankshaft we can actually do an abstract interpretation of the
@@hasInstance lookup when optimizing instanceof and then use the
normal machinery to protect the result instead of relying on the
global @@hasInstance protector cell for optimizations.

This recovers the 100x performance drop in Node.js v7 reported in
https://github.com/nodejs/node/issues/9634. This patch should be
easily back-mergable to Node.js v7.

BUG=v8:5640
R=yangguo@chromium.org,franzih@chromium.org

Review-Url: https://codereview.chromium.org/2504263004
Cr-Commit-Position: refs/heads/master@{#41059}

R=jarin@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2507063003
Cr-Commit-Position: refs/heads/master@{#41058}

Add computed property names in object literal micro-benchmarks.

Taken from http://kpdecker.github.io/six-speed/

BUG=v8:5622

Review-Url: https://codereview.chromium.org/2509593004
Cr-Commit-Position: refs/heads/master@{#41057}

Inspector uses this type for all internal scripts, e.g. injected-script-source.js. Scripts with new type are not reported by remote debugging protocol, frames from them are ignored.

CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_precise_blink_rel
BUG=none
R=yangguo@chromium.org,dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2499273003
Cr-Commit-Position: refs/heads/master@{#41056}

This allows to show wasm source (disassembled wasm code) in DevTools.
See design doc for details.

More tests for the disassembly will have to follow. Also, the text
format (generated by V8) will be changed.

BUG=chromium:659715
R=yangguo@chromium.org, kozyatinskiy@chromium.org, titzer@chromium.org, dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2493773003
Cr-Commit-Position: refs/heads/master@{#41055}