I think the WebAssembly format changed since the last time we updated
the corpus.

R=bradnelson@chromium.org

Change-Id: Ic4e24bade8cffbd43025d0961b805757a5e6f4d6
Reviewed-on: https://chromium-review.googlesource.com/485801Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44832}

For polymorphic loads that refer to the same underlying field, but
differ in either representation or field maps, try harder to merge
them into a simple field load by going to Tagged representation or
throwing away the field maps (this is essentially what Crankshaft
is doing).

R=jarin@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2836893002
Cr-Commit-Position: refs/heads/master@{#44831}

BUG=chromium:714483

Review-Url: https://codereview.chromium.org/2833423004
Cr-Commit-Position: refs/heads/master@{#44830}

R=clemensh@chromium.org

Change-Id: I3aad1b4058eb464dee80c08332a186109efb7208
Reviewed-on: https://chromium-review.googlesource.com/485622
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44829}

Avoid TransitionElementsKind when storing to objects which only differ
in holeyness of their elements kind. Instead go for polymorphic
CheckMaps, which can often by optimized and avoid the mutation of the
array map.

This generalizes the approach https://codereview.chromium.org/2836943003
which covered only element loads.

R=yangguo@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2836913004
Cr-Commit-Position: refs/heads/master@{#44828}

Bug:chromium:617892

Change-Id: I9993191fb632ca49f020e8073e7e409c86932a29
Reviewed-on: https://chromium-review.googlesource.com/485202
Commit-Queue: Hitoshi Yoshida <peria@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44827}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/4636d31..87cefe1

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/4d43438..892a0b6

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: I291fb57adab75a15c8b7c44f672192e543f3f2de
Reviewed-on: https://chromium-review.googlesource.com/486500Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44826}

TBR=machenbach@chromium.org
Bug: v8:5193

Change-Id: Ic24a59895b29ee8a0a97f97e5009be98bd34f10f
Reviewed-on: https://chromium-review.googlesource.com/486266Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44825}

See this v8-dev thread for more background:
https://groups.google.com/d/msg/v8-dev/71PVa9fMzoc/AvBZ9Fw4BQAJ

TBR=hpayer@chromium.org

Change-Id: I49957a72c8faec4cf5032cbf6437a461d7139b83
Reviewed-on: https://chromium-review.googlesource.com/486062Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44824}

Change-Id: I27b1463ba14e34f3302b51c25c6efaf40ca7e3e0
Reviewed-on: https://chromium-review.googlesource.com/486185Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44823}

Bug: v8:5549
Change-Id: I32b9853b6542c6ad04d12a9d54f31be9e3c76da8
Reviewed-on: https://chromium-review.googlesource.com/486245Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44822}

This patch removes JSFunction::SetInstancePrototype() from
JSFunction's public API and makes it an implementation detail
of SetPrototype().

Also clear out constructor field of JSFunction Map when
transitioning from non-instance prototype to instance
prototype.

Change-Id: If51d37bf6047b51b934d1b370fb52bb5cf5ffed4
Reviewed-on: https://chromium-review.googlesource.com/483961Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44821}

The AsyncGeneratorYield builtin just invoked the
AsyncGeneratorResolve() stub anyways, so this removes the middle-man.

Really minor refactoring, but clears out a bit of snapshot size and
another context index.

BUG=v8:5855
R=rmcilroy@chromium.org, bmeurer@chromium.org

Change-Id: I3385a5c5412e8d58493601874c2ad6b60e613012
Reviewed-on: https://chromium-review.googlesource.com/471913
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44820}

BUG=v8:6291, v8:811
R=marja@chromium.org, vogelheim@chromium.org

Change-Id: I978ea446d7b42092592b0a3ae3c99626e36d40fd
Reviewed-on: https://chromium-review.googlesource.com/485099
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44819}

BUG=v8:6291, v8:811
R=marja@chromium.org, vogelheim@chromium.org

Change-Id: Icf18b1cba8562aab87d233d383eb1d73a8e6aa9d
Reviewed-on: https://chromium-review.googlesource.com/485059
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44818}

BUG=

Review-Url: https://codereview.chromium.org/2833373003
Cr-Commit-Position: refs/heads/master@{#44817}

This lived in the JS natives for a long time, but it seems to work
just fine in the bootstrapper, and looks much cleaner there.

Change-Id: I9f5723cd840d83dde536db842b294ff1ccac294b
Reviewed-on: https://chromium-review.googlesource.com/483963Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44816}

This changes behavior of TurboFan to match the behavior of Crankshaft
when it comes to polymorphic loads of similar elements kind (i.e. all
tagged or all double), where we should use the "worst case" code without
a transition. This is often much faster than transitioning the elements
to the worst case first, trading a TransitionElementsKind for a CheckMaps
and avoiding mutation of the array.

This is beneficial for various crypto benchmarks, which don't need to
pay the cost for TransitionElementsKind now.

R=jarin@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2836943003
Cr-Commit-Position: refs/heads/master@{#44815}

VC++ 2017's STL doesn't suppress warnings as aggressively as prior
versions did. This causes warnings on code which mixes signed and
unsigned types. In this case a deque of unsigned integers was being
queried to see how many signed integers it contains. This could be
fixed by passing in unsigned 0, 1, and 2 to std::count but changing
the deque from unsigned to int is simpler.

R=adamk@chromium.org
BUG=chromium:683729

Review-Url: https://codereview.chromium.org/2834293002
Cr-Commit-Position: refs/heads/master@{#44814}

This makes it easier to set the value for embedders where it is
difficult to plumb through to the Isolate constructor.

BUG=chromium:711809
R=jochen@chromium.org

Review-Url: https://codereview.chromium.org/2829223002
Cr-Commit-Position: refs/heads/master@{#44813}

- Adds new F32x4AddHoriz, I32x4AddHoriz, etc. to WASM opcodes.
- Implements them for ARM.

LOG=N
BUG=v8:6020

Review-Url: https://codereview.chromium.org/2804883008
Cr-Commit-Position: refs/heads/master@{#44812}

R=adamk@chromium.org
BUG=v8:1569

Review-Url: https://codereview.chromium.org/2833773002
Cr-Commit-Position: refs/heads/master@{#44811}

- All ARM hardware has 32 single precision float registers; save all
  s-registers regardless of the number of d-registers (16 or 32).

LOG=N
BUG=v8:6077

Review-Url: https://codereview.chromium.org/2821273004
Cr-Commit-Position: refs/heads/master@{#44810}

Bug:

Change-Id: I116591b80af41e8d210445ba4c2bc3b25577b15d
Reviewed-on: https://chromium-review.googlesource.com/480619Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Pavel Feldman <pfeldman@chromium.org>
Commit-Queue: Franziska Hinkelmann <franzih@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44809}

In general, deleting a property from a fast-properties object
requires transitioning the object to dictionary mode. However,
when the most-recently-added property is deleted, we can simply
roll back the last map transition that the object went through.

This is a performance experiment: it should make things faster,
but if it turns out to have more negative than positive impact,
we will have to revert it.

TBR=bmeurer@chromium.org (just adding a comment)

Previously reviewed at https://codereview.chromium.org/2830093002
Previously landed as 98acfb36 / r44799

Review-Url: https://codereview.chromium.org/2840583002
Cr-Commit-Position: refs/heads/master@{#44808}

- Dispatch evacuation of a page to its concrete evacuator.
- Create MC base class to accommodate shared state.

BUG=chromium:651354

Review-Url: https://codereview.chromium.org/2828323004
Cr-Commit-Position: refs/heads/master@{#44807}

Revert of [builtins] DeleteProperty: Handle last-added fast properties (patchset #2 id:20001 of https://codereview.chromium.org/2830093002/ )

Reason for revert:
Breaks:
https://build.chromium.org/p/client.v8/builders/V8%20Mac%20GC%20Stress/builds/12920
and
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20gc%20stress/builds/10281

Original issue's description:
> [builtins] DeleteProperty: Handle last-added fast properties
>
> In general, deleting a property from a fast-properties object
> requires transitioning the object to dictionary mode. However,
> when the most-recently-added property is deleted, we can simply
> roll back the last map transition that the object went through.
>
> This is a performance experiment: it should make things faster,
> but if it turns out to have more negative than positive impact,
> we will have to revert it.
>
> TBR=bmeurer@chromium.org (just adding a comment)
>
> Review-Url: https://codereview.chromium.org/2830093002
> Cr-Commit-Position: refs/heads/master@{#44799}
> Committed: https://chromium.googlesource.com/v8/v8/+/98acfb36e1acf2ab52ab6b6439eb6356c83dcda6

TBR=ishell@chromium.org,jkummerow@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2843473002
Cr-Commit-Position: refs/heads/master@{#44806}

This reverts commit e8f1fc24.

Reason for revert: Node.js doesn't build with this patch anymore. 

out/Release/obj/gen/debug-support.cc:428:55: error: expected initializer before ‘<’ token
 int v8dbg_class_Script__preparsed_scope_data__PodArray<uint32_t> = Script::kPreParsedScopeDataOffset;

Original change's description:
> [parser] Skipping inner funcs: use PodArray for the data.
> 
> The data produced by the preparser scope analysis might be large.
> 
> ByteArrays are already allowed in the large object space.
> 
> This fixes mjsunit/asm/poppler/poppler.js with the flag on.
> 
> BUG=v8:5516
> 
> Change-Id: I951836244776c57efdd2a491c5c78493dc8cca63
> Reviewed-on: https://chromium-review.googlesource.com/484459
> Commit-Queue: Marja Hölttä <marja@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#44795}

TBR=marja@chromium.org,mstarzinger@chromium.org,ulan@chromium.org,vogelheim@chromium.org,hpayer@chromium.org,v8-reviews@googlegroups.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5516

Change-Id: I3012d27b6b65b37d3afc5f3b0921e044bdcc118e
Reviewed-on: https://chromium-review.googlesource.com/485759Reviewed-by: Franziska Hinkelmann <franzih@chromium.org>
Commit-Queue: Franziska Hinkelmann <franzih@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44805}

This patch cleans up the Intl code by switching to using declared
accessors, rather than embedder fields, for holding references to
ICU objects. Additionally:
- Rename classes to be more similar to how other classes are named
- Make some unreachable paths into check-fails, rather than throwing
  JS exceptions
- Move some macros from objects-inl.h into object-macros.h, to allow
  the implementation here to not touch objects.h
- Some setup logic is moved from runtime-i18n.cc to i18n.cc.

This patch leaves type tags as they are; a future patch should move
from a special Intl type tagging system to object types as other system
objects use. Future patches should also move more logic to i18n.cc

BUG=v8:5402,v8:5751,v8:6057
CQ_INCLUDE_TRYBOTS=master.tryserver.v8:v8_linux_noi18n_rel_ng

Change-Id: Ia9cbb25cf8f52662e3deb15e64179d792c10842c
Reviewed-on: https://chromium-review.googlesource.com/479651
Commit-Queue: Daniel Ehrenberg <littledan@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44804}

I have no idea how the empty folder got
in there in the first place ¯\_(ツ)_/¯.

Bug:

Change-Id: I0fd94d1dec76f2444b24f772c1691924f872ec55
Reviewed-on: https://chromium-review.googlesource.com/485621Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Commit-Queue: Franziska Hinkelmann <franzih@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44803}

Also move the responsibility of marking builtins as initialized
to the deserializer.

R=jkummerow@chromium.org

Review-Url: https://codereview.chromium.org/2840493002
Cr-Commit-Position: refs/heads/master@{#44802}

- Split out code for Intl objects into src/objects/
- Rename i18n to intl (except for the name of the build flag)
- Use build system more broadly to turn on/off Intl code
- Delete a little bit of dead code

Bug: v8:5751
Change-Id: I41bf2825a5cb0df20824922b17c24cae637984da
Reviewed-on: https://chromium-review.googlesource.com/481284Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Daniel Ehrenberg <littledan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44801}

This makes sure that typed array constructors (e.g. Int8Array, ...) used
within an asm.js module are considered uses of stdlib values, and hence
are checked during module instantiation.

R=clemensh@chromium.org
TEST=mjsunit/regress/regress-6280
BUG=v8:6280,chromium:714537

Change-Id: Ic5d689f5319c4dac4e9df3dca4a8cf5a4edd890b
Reviewed-on: https://chromium-review.googlesource.com/485521
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44800}

In general, deleting a property from a fast-properties object
requires transitioning the object to dictionary mode. However,
when the most-recently-added property is deleted, we can simply
roll back the last map transition that the object went through.

This is a performance experiment: it should make things faster,
but if it turns out to have more negative than positive impact,
we will have to revert it.

TBR=bmeurer@chromium.org (just adding a comment)

Review-Url: https://codereview.chromium.org/2830093002
Cr-Commit-Position: refs/heads/master@{#44799}

Local refactoring to replace if cascade by switch. For readability and
performance.

R=ahaas@chromium.org

Change-Id: I064d51c7c8232fefcde223b086eb7b9caf44f94c
Reviewed-on: https://chromium-review.googlesource.com/485480
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44798}

for now, it's just the methods
- log
- warn
- debug
- info
- error
- time
- timeEnd

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2840543002
Cr-Commit-Position: refs/heads/master@{#44797}

R=jgruber@chromium.org
BUG=v8:5821

Review-Url: https://codereview.chromium.org/2841513002
Cr-Commit-Position: refs/heads/master@{#44796}

The data produced by the preparser scope analysis might be large.

ByteArrays are already allowed in the large object space.

This fixes mjsunit/asm/poppler/poppler.js with the flag on.

BUG=v8:5516

Change-Id: I951836244776c57efdd2a491c5c78493dc8cca63
Reviewed-on: https://chromium-review.googlesource.com/484459
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44795}

Add missing kEnd opcode after each body. Also, avoid the macro.
This fix is needed for follow-up changes to the control transfer
computation.

R=ahaas@chromium.org
BUG=v8:5822

Change-Id: If2b4dbea831ec40939a2045701f3d13479331773
Reviewed-on: https://chromium-review.googlesource.com/485481Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44794}

BUG=

Review-Url: https://codereview.chromium.org/2775503006
Cr-Commit-Position: refs/heads/master@{#44793}