R=joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1809643004

Cr-Commit-Position: refs/heads/master@{#34837}

 - New RelocInfo mode WASM_MEMORY_REFERENCE as a marker for wasm code objects that need to be relocated on a heap change
 - RelocInfo mode recorded for immediates that use the memory buffer as base
 - Tests to verify address patching works

BUG=

Committed: https://crrev.com/cc815b69c17da368107ed77306a5bb161170c834
Cr-Commit-Position: refs/heads/master@{#34831}

Review URL: https://codereview.chromium.org/1759873002

Cr-Commit-Position: refs/heads/master@{#34836}

Revert of [crankshaft] Fixing ES6 tail call elimination. (patchset #7 id:200001 of https://codereview.chromium.org/1780043004/ )

Reason for revert:
[Sheriff] Leads to mac gc stress crashes:
https://build.chromium.org/p/client.v8/builders/V8%20Mac%20GC%20Stress/builds/4975

Original issue's description:
> [crankshaft] Fixing ES6 tail call elimination.
>
> In case when F inlined normal call to G which tail calls H we should not write translation for G for the tail call site.
> Otherwise we will see G in a stack trace inside H.
>
> This CL also enables all existing tests related to ES6 tail call elimination.
>
> TBR=bmeurer@chromium.org
> BUG=v8:4698
> LOG=N
>
> Committed: https://crrev.com/689980f7d4dfd4c29492f616d7b616b86ec9af91
> Cr-Commit-Position: refs/heads/master@{#34830}

TBR=mstarzinger@chromium.org,ishell@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4698

Review URL: https://codereview.chromium.org/1814433002

Cr-Commit-Position: refs/heads/master@{#34835}

This will allow to only load json data for the files under
review instead of the whole data set.

This will be called on the infra-side after all coverage
data has been merged.

Also fix a bunch of log lines.

BUG=chromium:568949
LOG=n
NOTRY=true

Review URL: https://codereview.chromium.org/1808663002

Cr-Commit-Position: refs/heads/master@{#34834}

This makes the aforementioned visitation function independent of the
target architecture by leveraging existing abstractions.

R=ishell@chromium.org

Review URL: https://codereview.chromium.org/1807943002

Cr-Commit-Position: refs/heads/master@{#34833}

Revert of Assembler changes for enabling GrowHeap in Wasm (patchset #13 id:260001 of https://codereview.chromium.org/1759873002/ )

Reason for revert:
Breaks compile:
https://build.chromium.org/p/client.v8/builders/V8%20Mac64/builds/7740

Probably had outdated tryjobs

Original issue's description:
> Assembler changes for enabling GrowHeap in Wasm
>  - New RelocInfo mode WASM_MEMORY_REFERENCE as a marker for wasm code objects that need to be relocated on a heap change
>  - RelocInfo mode recorded for immediates that use the memory buffer as base
>  - Tests to verify address patching works
>
> BUG=
>
> Committed: https://crrev.com/cc815b69c17da368107ed77306a5bb161170c834
> Cr-Commit-Position: refs/heads/master@{#34831}

TBR=titzer@chromium.org,yangguo@chromium.org,bradnelson@chromium.org,bradnelson@google.com,marija.antic@imgtec.com,gdeepti@google.com
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1808823002

Cr-Commit-Position: refs/heads/master@{#34832}

 - New RelocInfo mode WASM_MEMORY_REFERENCE as a marker for wasm code objects that need to be relocated on a heap change
 - RelocInfo mode recorded for immediates that use the memory buffer as base
 - Tests to verify address patching works

BUG=

Review URL: https://codereview.chromium.org/1759873002

Cr-Commit-Position: refs/heads/master@{#34831}

In case when F inlined normal call to G which tail calls H we should not write translation for G for the tail call site.
Otherwise we will see G in a stack trace inside H.

This CL also enables all existing tests related to ES6 tail call elimination.

TBR=bmeurer@chromium.org
BUG=v8:4698
LOG=N

Review URL: https://codereview.chromium.org/1780043004

Cr-Commit-Position: refs/heads/master@{#34830}

Various failures for MIPS were introduced by the refactoring of
the way frames are marked https://codereview.chromium.org/1696043002.

Problems were caused during context loading in CheckAccessGlobalProxy
* The value of the register at was unintentionally modified.
* Use of branch instruction instead of branch macro resulted in
  a branch instruction in forbidden slot.

BUG=

Review URL: https://codereview.chromium.org/1812463002

Cr-Commit-Position: refs/heads/master@{#34829}

Function declarations were previously permitted by V8 in many locations
which no ECMAScript specification allowed; the ECMAScript 2015 spec
enumerates a few locations (in blocks, as well as after labels and in
conditionals when in sloppy mode). This patch ships the flag to restrict
the usage of function declarations to those contexts.

R=adamk
LOG=Y
BUG=v8:4824
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1799233003

Cr-Commit-Position: refs/heads/master@{#34828}

This version does not modify arm64.

R=jkummerow@chromium.org, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1806893002

Cr-Commit-Position: refs/heads/master@{#34827}

This prints the mnemonic of the bytecode that a bytecode handler belongs
to, whenever the handler is disassembled (not just during tracing). This
can be helpful when debugging code in GDB or with the snapshot where the
tracing is not available.

R=rmcilroy@chromium.org

Review URL: https://codereview.chromium.org/1806883002

Cr-Commit-Position: refs/heads/master@{#34826}

Review URL: https://codereview.chromium.org/1811563002

Cr-Commit-Position: refs/heads/master@{#34825}

This should recover regression caused by 7f11fba7 (https://codereview.chromium.org/1739233002).

TBR=bmeurer@chromium.org
BUG=chromium:592692, chromium:595265
LOG=N

Review URL: https://codereview.chromium.org/1807913002

Cr-Commit-Position: refs/heads/master@{#34824}

BUG=
NOTRY=true

Review URL: https://codereview.chromium.org/1800693002

Cr-Commit-Position: refs/heads/master@{#34823}

We need to pop the context to correct level on return as well. This was incorrectly
removed in this cl: https://codereview.chromium.org/1768123002/. For example
when we have a try-catch-finally block and catch does a return, the return
does not happen immediately. It should execute finally block before it
returns. Return statement should pop the context to the correct level as
expected by finally block.

BUG=594369,v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1796893002

Cr-Commit-Position: refs/heads/master@{#34822}

Port 33c08596

Original commit message:
    Int64Sub is lowered to a new turbofan operator, Int32SubPair. The new
    operator takes 4 inputs an generates 2 outputs. The inputs are the low
    word of the left input, high word of the left input, the low word of the
    right input, and high word of the right input. The ouputs are the low
    and high word of the result of the subtraction.

    The implementation is very similar to the implementation of Int64Add.

R=ahaas@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1812473002

Cr-Commit-Position: refs/heads/master@{#34821}

Reland of Allow Math.random to be called when creating a custom startup snapshot. (patchset #1 id:1 of https://codereview.chromium.org/1798863003/ )

Reason for revert:
This seems not to change performance.

Original issue's description:
> Revert of Allow Math.random to be called when creating a custom startup snapshot. (patchset #2 id:20001 of https://codereview.chromium.org/1780173002/ )
>
> Reason for revert:
> Regresses performance on base64 benchmark.
>
> Original issue's description:
> > Allow Math.random to be called when creating a custom startup snapshot.
> >
> > R=jkummerow@chromium.org
> > BUG=v8:4810
> > LOG=N
> >
> > Committed: https://crrev.com/6a7ec6a3bf779cdd41c66a768fd7a37195ed7b7f
> > Cr-Commit-Position: refs/heads/master@{#34705}
>
> TBR=jkummerow@chromium.org
> # Not skipping CQ checks because original CL landed more than 1 days ago.
> BUG=v8:4810, chromium:594484
> LOG=N
>
> Committed: https://crrev.com/b7be51cd33bc81d768dbf5632ba0c68843448e37
> Cr-Commit-Position: refs/heads/master@{#34739}

TBR=jkummerow@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=v8:4810, chromium:594484
LOG=N

Review URL: https://codereview.chromium.org/1806713003

Cr-Commit-Position: refs/heads/master@{#34820}

BUG=v8:4682
LOG=N

Review URL: https://codereview.chromium.org/1805503003

Cr-Commit-Position: refs/heads/master@{#34819}

Tenured objects allocated on black pages require write barriers.
BUG=chromium:594958
LOG=n

Review URL: https://codereview.chromium.org/1811473002

Cr-Commit-Position: refs/heads/master@{#34818}

This introduces {optimized_out} as another Oddball kind to be used by
optimizing compilers when values are being optimized away. The aim is
providing visibility when this value leaks into the application domain.
Currently this will lead to {undefined} values appearing which then
silently propagate through the application. The special oddball can be
identified easily as a bug and also the debugger can treat it specially
when needed.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1810483002

Cr-Commit-Position: refs/heads/master@{#34817}

along with "[arm64] Fix i/d cache line size confusion typo"
and "Fix a warning about inline asm source/destination mismatches..."
which were building on it.

This reverts the following commits:
8d7399f9
474e6a3d
c3ff68b6

Reason for revert: We're getting a large number of crash reports from
arm64 devices that are obviously related to cache flushing after code
patching. Bisection results say that the problems started at revision
c3ff68b6. Since I can't find a bug in that CL except for the typo that
I've fixed in 474e6a3d (which made some of the crashes go away but not
all of them), we have no choice but to revert the changes in order to
get stability under control while we investigate.

BUG=chromium:594646
LOG=n

Review URL: https://codereview.chromium.org/1806853002

Cr-Commit-Position: refs/heads/master@{#34816}

TBR=jkummerow@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1807883002

Cr-Commit-Position: refs/heads/master@{#34815}

R=littledan@chromium.org
BUG=v8:3455
LOG=n

Review URL: https://codereview.chromium.org/1772343008

Cr-Commit-Position: refs/heads/master@{#34814}

  The CL #34701 (https://codereview.chromium.org/1779123002/) added the Run_WasmF32SConvertI64/Run_WasmF64SConvertI64 test cases and X87 failed at them.

  The reason is same as the CL #33630 (Issue 1649323002: X87: Change the test case for X87 RunRoundInt32ToFloat32), please refer: https://codereview.chromium.org/1649323002.

  Here is the key comments from CL #33630:
  Some new test cases use CheckFloatEq(...) and CheckDoubleEq(...) function for result check. When GCC compiling the CheckFloatEq() and CheckDoubleEq() function,
  those inlined functions has different behavior comparing with GCC ia32 build and x87 build.
  The major difference is sse float register still has single precision rounding semantic. While X87 register has no such rounding precsion semantic when directly use register value.
  The V8 turbofan JITTed has exactly same result in both X87 and IA32 port.

  For CHECK_EQ(a, b) function, if a and b are double or float, it will has similar behaviors like CheckFloatEq(...) and CheckDoubleEq(...) function when compiled by GCC and causes the test case fail.

  So we add the following sentence to do type case to keep the same precision for Run_WasmF32SConvertI64/Run_WasmF64SConvertI64. Such as: volatile double expect = static_cast<float>(*i).

  ahaas put those codes in CHECK_FLOAT_EQ and CHECK_DOUBLE_EQ macros in CL #34534 (https://codereview.chromium.org/1773513002 ).

  So this CL replaced the CHECK_EQ in Run_WasmF32SConvertI64/Run_WasmF64SConvertI64 to CHECK_FLOAT_EQ/CHECK_DOUBLE_EQ for x87 can pass Run_WasmF32SConvertI64/Run_WasmF64SConvertI64 tests.

BUG=

Review URL: https://codereview.chromium.org/1784813004

Cr-Commit-Position: refs/heads/master@{#34813}

This speeds up element normalization.

BUG=

Review URL: https://codereview.chromium.org/1802733002

Cr-Commit-Position: refs/heads/master@{#34812}

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1806593003

Cr-Commit-Position: refs/heads/master@{#34811}

This fix removes unnecessary nops from function prolog and seems to recover performance regression on some of SunSpider benchmarks.

TBR=bmeurer@chromium.org
BUG=chromium:531369
LOG=N

Review URL: https://codereview.chromium.org/1800233003

Cr-Commit-Position: refs/heads/master@{#34810}

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1810473002

Cr-Commit-Position: refs/heads/master@{#34809}

Int64Sub is lowered to a new turbofan operator, Int32SubPair. The new
operator takes 4 inputs an generates 2 outputs. The inputs are the low
word of the left input, high word of the left input, the low word of the
right input, and high word of the right input. The ouputs are the low
and high word of the result of the subtraction.

The implementation is very similar to the implementation of Int64Add.

@v8-arm-ports: please take a careful look at the implementation of sbc
in the simulator.

R=titzer@chromium.org, v8-arm-ports@googlegroups.com

Review URL: https://codereview.chromium.org/1778893005

Cr-Commit-Position: refs/heads/master@{#34808}

The monomorphic case already carefully ensures that we don't try to use
a regular elements load stub on string wrapper elements. The polymorphic
path must perform an equivalent check.

BUG=chromium:594955
LOG=n
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/1806543002

Cr-Commit-Position: refs/heads/master@{#34807}

Add EqualStub and NotEqualStub, based on the CodeStubAssembler, and hook
them up with TurboFan and Ignition. The stubs are a full implementation
of abstract equality for ES6 plus the current SIMD.js draft, unlike the
generic version of the CompareIC, which only implements a subset with
funky runtime fallbacks.

Drive-by-fix: Introduce some common helper methods.

R=epertoso@chromium.org
BUG=chromium:592690
LOG=n

Review URL: https://codereview.chromium.org/1795793002

Cr-Commit-Position: refs/heads/master@{#34806}

BUG=chromium:595092
LOG=n
R=hablich@chromium.org

Review URL: https://codereview.chromium.org/1803313002 .

Cr-Commit-Position: refs/heads/master@{#34805}

The feature was removed from the bots a while ago. It was
superseeded by the flaky-test detection which reruns tests.

Remaining tests still marked as flaky most certainly pass
since a while.

Referencing all the bugs whose expectations lines get
removed by this.

BUG=v8:3838,v8:3525,v8:3125
LOG=n

Review URL: https://codereview.chromium.org/1802983002

Cr-Commit-Position: refs/heads/master@{#34804}

  port 1b230799 (r34747)

  original commit message:
  Int64Add is lowered to a new turbofan operator, Int32AddPair. The new
  operator takes 4 inputs an generates 2 outputs. The inputs are the low
  word of the left input, high word of the left input, the low word of the
  right input, and high word of the right input. The ouputs are the low
  and high word of the result of the addition.

BUG=

Review URL: https://codereview.chromium.org/1806833002

Cr-Commit-Position: refs/heads/master@{#34803}

This part of Scope has existed since V8's initial check in, but from what
I can tell it's not required to implement "with". The only tests that
depend upon it are tests of the debugger and the Scope mirrors, but the
resulting test behavior after removing the bit still seems perfectly
reasonable to me. In fact, with the included fix for scope name collection,
the scope mirror is actually improved with this change.

As a bi-product, this fixes the attached bug, about the contains_with
bit having inconsistent values in some arrow function compilation
scenarios.

BUG=chromium:592353
LOG=n
CQ_INCLUDE_TRYBOTS=tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1804783002

Cr-Commit-Position: refs/heads/master@{#34802}

src/js/regexp.js was one of the few files that was left in sloppy
mode. The ES2017 draft specification requires that writes to
lastIndex throw when the property is non-writable, and test262
tests enforce this behavior. This patch puts that file in strict
mode.

BUG=v8:4504
R=yangguo@chromium.org
LOG=Y

Review URL: https://codereview.chromium.org/1776883005

Cr-Commit-Position: refs/heads/master@{#34801}

Add support for S390 to GDB-JIT.

R=danno@chromium.org,jkummerow@chromium.org,jochen@chromium.org,jyan@ca.ibm.com,michael_dawson@ca.ibm.com,mbrandy@us.ibm.com

BUG=

Review URL: https://codereview.chromium.org/1804193002

Cr-Commit-Position: refs/heads/master@{#34800}

The current trace scoping failed to accomplish what it intended to do
it failed in 2 aspects:
First, when new trace events were added in
https://codereview.chromium.org/1770353002/ they escaped the scopes.
Secondly, a webgl code interacts with the V8 Objects directly using
the EXECUTION_PRIMITIVE context that does not generate any TRACE_EVENTs
resulting in a lot of empty scopes (breaking analysis on TBM webgl benchmarks)
https://crbug.com/590761.

I am removing the calls for now until figuring out a better approach for both issues.

BUG=590761,v8:4565
LOG=N

Review URL: https://codereview.chromium.org/1807433002

Cr-Commit-Position: refs/heads/master@{#34799}

Array.prototype.concat did not work correct with complex elements on the
receiver or the prototype chain.

BUG=chromium:594574
LOG=y

Review URL: https://codereview.chromium.org/1804963002

Cr-Commit-Position: refs/heads/master@{#34798}