Capture the place we call the verifier as part of the investigation
into the referenced bug.

Bug: chromium:725559
Change-Id: I08fa91636f73994f8d77ac6ab66aa7165a12ef0b
Reviewed-on: https://chromium-review.googlesource.com/524266
Commit-Queue: Brad Nelson <bradnelson@chromium.org>
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45712}

Instead of going through debugger agent, this patch implements
console.assert pause similar to debugger statement and OOM break.

New test uncovered a bug, where pause on exceptions state mix up
between different context groups. Added a TODO to fix it.

BUG=chromium:590878

Review-Url: https://codereview.chromium.org/2916363002
Cr-Commit-Position: refs/heads/master@{#45711}

Now that the BytecodeGenerator has a dedicated register holding
the generator object, BytecodeGenerator::VisitSuspend can
access the generator directly from that register. This reduces
by one the number of live registers at each suspend point.

Bug: v8:6351, v8:6460
Change-Id: I380a9d2bd8ca7eec6720e5392c1ca07dd0df0e2d
Reviewed-on: https://chromium-review.googlesource.com/522982
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45710}

Bug: v8:6358
Change-Id: Ia7a9de3b60138c489276cd2ed4bd018a8f4ef8f6
Reviewed-on: https://chromium-review.googlesource.com/496126
Commit-Queue: Daniel Ehrenberg <littledan@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45709}

This gives sessions separate remote objects space and also
makes command line api respect the session it was called from.

BUG=chromium:590878

Review-Url: https://codereview.chromium.org/2916803005
Cr-Commit-Position: refs/heads/master@{#45708}

Bug: v8:4280
Change-Id: Iedd3182301ad6cde4e63c65dca6cd280e3f05198
Reviewed-on: https://chromium-review.googlesource.com/524044Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45707}

Fixes a crash in PrintRegisters() with --trace-ignition and the
RestoreGeneratorRegisters bytecode.

BUG=v8:4280, v8:6351
R=rmcilroy@chromium.org, mythria@chromium.org, adamk@chromium.org

Change-Id: I09e86523b71fb9e5763e0373c567925f38227913
Reviewed-on: https://chromium-review.googlesource.com/523843
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45706}

Bug: v8:6351
Change-Id: Iad82fcfb4172d7a9cbadffa1e40fd1cd26866895
Reviewed-on: https://chromium-review.googlesource.com/521107
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45705}

Macro-ization of Turbofan's SIMD Visitor methods in the same way it was
done for ARM and x64 architectures.

BUG=

Review-Url: https://codereview.chromium.org/2910533003
Cr-Commit-Position: refs/heads/master@{#45704}

Reland 84ff6e4c

In Wasm-to-interpeter entry creation, arguments for the interpreter
are stored in an argument buffer. Depending on the order of the
arguments some arguments may be misaligned and this causes crashes
on those architectures that do not support unaligned memory access.

TEST=mjsunit/wasm/interpreter
BUG=

Review-Url: https://codereview.chromium.org/2887053003
Cr-Commit-Position: refs/heads/master@{#45703}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/f6841a1..31e28f7

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/64ea479..6866edf

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: I72c69196f0ab831f949239f4f3f1aba9cdbe760b
Reviewed-on: https://chromium-review.googlesource.com/523603Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45702}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/d1e77ff..f6841a1

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/b0384fe..64ea479

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: Ie2d61593f2f62398b8a8004141fea78efe97b1cb
Reviewed-on: https://chromium-review.googlesource.com/523245Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45701}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/a055d2e..d1e77ff

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/buildtools/+log/1045741..31d4daa

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/b33525e..b0384fe

Rolling v8/third_party/icu: https://chromium.googlesource.com/chromium/deps/icu/+log/ae18d60..dfa798f

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: I95d8046bf6e4d226785271365360f0e224b68d9f
Reviewed-on: https://chromium-review.googlesource.com/523063Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45700}

TBR=ishell@chromium.org

Bug: v8:6457
Change-Id: I09d7d6ff8460688b7ddf25f733aea73a620db953
Reviewed-on: https://chromium-review.googlesource.com/523037Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45699}

The code was already careful to use memcpy() here, but then it
added needless casts to wider types that made the compiler think
that it can do 4-byte-aligned accesses when it couldn't.

(It's also a bug that the snapshot got loaded at an unaligned
address, but we can fix both bugs.)

BUG=chromium:729059

Review-Url: https://codereview.chromium.org/2915323002
Cr-Commit-Position: refs/heads/master@{#45698}

TBR=machenbach@chromium.org

Bug: v8:6457
Change-Id: I75cf773941fc4f3eb6878df14f757ba1d2e23926
Reviewed-on: https://chromium-review.googlesource.com/522647Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45697}

This places in the scaffolding for completely relying on the embedder
for these APIs. Once Chrome uses these instead of the old APIs,
we can cleanup further by removing the old callback insertion points
and not exposing the streaming APIs if callbacks aren't provided.

Bug: 
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I15abd257257be512674b18aa4af2e0a0153612a5
Reviewed-on: https://chromium-review.googlesource.com/520602
Commit-Queue: Brad Nelson <bradnelson@chromium.org>
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45696}

A module context holds the module object in its extension slot, which should not be recursed on (it's not even a JSObject).

(I don't know how this code path can be triggered, though.)

R=adamk@chromium.org
BUG=v8:1569

Review-Url: https://codereview.chromium.org/2919063002
Cr-Commit-Position: refs/heads/master@{#45695}

Review-Url: https://codereview.chromium.org/2916143003
Cr-Commit-Position: refs/heads/master@{#45694}

R=jgruber@chromium.org, kozyatinskiy@chromium.org

Bug: v8:1569
Change-Id: Ief7d96079adc03e62c129ac2bb9d9ccd6db65102
Reviewed-on: https://chromium-review.googlesource.com/522664
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45693}

This CL updates the hook for the WebAssembly spec repository, and it
updates the WebAssembly spec tests. The WebAssembly spec tests have to
be updated manually with the tools/wasm/update-wasm-spec-tests.sh
script. Mircea, I saw that you updated the WebAssembly spec repository
last time. Can you please take a look?

UPDATE: I improved the update script slightly, and there is one
additional JS API test we fail now and have to fix eventually.

R=mtrofin@chromium.org

Change-Id: I3c0df9cee64d444147db47daa0c1936edf116173
Reviewed-on: https://chromium-review.googlesource.com/509257Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45692}

Chromium_BUG=616017
R=machenbach@chromium.org, dpranke@chromium.org, ivica.bogosavljevic@imgtec.com

Review-Url: https://codereview.chromium.org/2913353004
Cr-Commit-Position: refs/heads/master@{#45691}

We need to keep the new space mark bits as they are still required for
pointer updating.

TBR=hpayer@chromium.org
NOTRY=true

Bug: chromium:651354
Change-Id: Idc85f08a3b6525dd1ca932585f5e696a22b12808
Reviewed-on: https://chromium-review.googlesource.com/522609Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45690}

NOTRY=true

Bug: chromium:728867
Change-Id: Ie116021aab9d72d01e1532036cb5de8f4b2bd2ab
Reviewed-on: https://chromium-review.googlesource.com/522663Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45689}

Unify, simplify logic, reduce UTF8 specific handling.

Intend of this is also to have stream views.
Stream views can be used concurrently by multiple threads, but
only one thread may fetch new data from the underlying source.
This together with unified stream view creation is intended to be
used for parse tasks.

BUG=v8:6093

Change-Id: I3bce48185fa2c986d16619a9a8ece3ff4c4f5e60
Reviewed-on: https://chromium-review.googlesource.com/509489Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Wiktor Garbacz <wiktorg@google.com>
Cr-Commit-Position: refs/heads/master@{#45688}

NOTRY=true

Change-Id: I62ae81ef5e7439a19efbffdffd196f44c5c31349
Reviewed-on: https://chromium-review.googlesource.com/521041
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45687}

NOTRY=true

Change-Id: If4dcecf179b955c756a4af468e614b3292f1e5fe
Reviewed-on: https://chromium-review.googlesource.com/522606Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45686}

R=marja@chromium.org

Change-Id: I3efa9e87f985b3ccb63c89881340a0e3ec7875f0
Reviewed-on: https://chromium-review.googlesource.com/522643Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45685}

R=machenbach@chromium.org

Change-Id: If25d0d34179b326f3a7b292f30299fe48a0aa1e2
Reviewed-on: https://chromium-review.googlesource.com/522127Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Jochen Eisinger <jochen@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45684}

During incremental marking we need to clear to old generation
mark bits for promoted pages.

Bug: chromium:651354
Change-Id: I986de08d6a123b2eff3dd7824729cc1cfe29aeba
Reviewed-on: https://chromium-review.googlesource.com/522665Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45683}

Bug: v8:5717
Change-Id: I5e46dbeee9e3383253c2fbebb9623325f5e4e01d
Reviewed-on: https://chromium-review.googlesource.com/520714Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45682}

Execution tests regress-336820 and regress-678917 finished with error
messages "allocation failure GC in old space requested" and "fatal
javascript OOM in CALL_AND_RETRY_LAST". For successful execution,
parameter max_old_space_size must be increased and this is done inside
tests.

TEST=mjsunit/regress/regress-336820,
     mjsunit/regress/regress-678917
BUG=

Review-Url: https://codereview.chromium.org/2907363003
Cr-Original-Commit-Position: refs/heads/master@{#45672}
Committed: https://chromium.googlesource.com/v8/v8/+/1550c869094c5873da9226ae9b4de7084692a857
Review-Url: https://codereview.chromium.org/2907363003
Cr-Commit-Position: refs/heads/master@{#45681}

TBR=tandrii@chromium.org,kjellander@chromium.org
NOTRY=true
NOTREECHECKS=true

Bug: chromium:726584
Change-Id: Ia0b2cbde1949adced9554b0fb1420c21405d24f3
Reviewed-on: https://chromium-review.googlesource.com/522608Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45680}

When the input to Function.prototype.bind is a known function, we can
inline the allocation of the JSBoundFunction into TurboFan, which
provides a 2x speed-up for several hot functions in Node streams (as
discovered by Matteo Collina). One of example of this can be found in
https://github.com/nodejs/node/pull/13322, which can be optimized and
made more readable using bind instead of closures.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2916063002
Cr-Commit-Position: refs/heads/master@{#45679}

Based on past discussions I'm going to try to reland this change. This makes window.document and document behave the same after navigation, which is a change from what the spec says. If this works out though, it would greatly simplify the spec; and fix the fact that currently it's leaking the underlying global object, which we don't want for security and object-identity reasons.

Bug: chromium:713732
Change-Id: I5ce89afb46349ff92b7f5a884a7c388fcff887bf
Reviewed-on: https://chromium-review.googlesource.com/522605Reviewed-by: Kentaro Hara <haraken@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45678}

We want to be stricter about checking in the future, so give embedders a
way to disable checking while they fix their microtasks scopes.

BUG=chromium:728583
R=machenbach@chromium.org

Change-Id: I443575bf6820b432def59cbbd4d048b2007573c8
Reviewed-on: https://chromium-review.googlesource.com/522604
Commit-Queue: Jochen Eisinger <jochen@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45677}

NOTRY=true
NOTREECHECKS=true
TBR=tandrii@chromium.org,kjellander@chromium.org

Bug: chromium:726584
Change-Id: I3bf3587e2d58c34b5697785c6033d28eb584146d
Reviewed-on: https://chromium-review.googlesource.com/522126
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45676}

This is a first step towards reducing the number of stores/loads when suspending/resuming a generator.

Unfortunately, even for an empty generator, we still use 8 register for various things (try-finally, copies of generator object, parser-introduced temporaries). I will try to get rid of these in separate CLs.

Changes:

- SuspendGenerator bytecode now takes register list to save.
- ResumeGenerator was split into two bytecodes:
  * Resume generator reads the state out and marks the generator as
      'executing'.
  * RestoreGeneratorRegisters reloads the registers from
      the generator.
    + this required adding support for output register list.

- Introduced generator_object_ register in the bytecode generator.
  * in subsequent CLs, I will make better use of it, the goal is
      to get rid if the .generator_object local variable.

- Taught register optimizer to flush unassigned registers.

BUG=v8:6379

Review-Url: https://codereview.chromium.org/2894293003
Cr-Commit-Position: refs/heads/master@{#45675}

Bug: v8:5717
Change-Id: I87cfef5d6d69106fd454338e77c2c703fcdba67b
Reviewed-on: https://chromium-review.googlesource.com/520576Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45674}

Revert of [heap] Decrease old space physical memory factor. (patchset #3 id:40001 of https://codereview.chromium.org/2907363003/ )

Reason for revert:
Fails on other bots now:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20debug/builds/16197
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/builds/13170
https://build.chromium.org/p/client.v8.ports/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20gc%20stress/builds/6749

Original issue's description:
> Fix tests regress-336820 and regress-678917.
>
> Execution tests regress-336820 and regress-678917 finished with error
> messages "allocation failure GC in old space requested" and "fatal
> javascript OOM in CALL_AND_RETRY_LAST". For successful execution,
> parameter max_old_space_size must be increased and this is done inside
> tests.
>
> TEST=mjsunit/regress/regress-336820,
>      mjsunit/regress/regress-678917
> BUG=
>
> Review-Url: https://codereview.chromium.org/2907363003
> Cr-Commit-Position: refs/heads/master@{#45672}
> Committed: https://chromium.googlesource.com/v8/v8/+/1550c869094c5873da9226ae9b4de7084692a857

TBR=hpayer@chromium.org,jochen@chromium.org,mlippautz@chromium.org,mstarzinger@chromium.org,ulan@chromium.org,ivica.bogosavljevic@imgtec.com,bmeurer@chromium.org,jarin@chromium.org,ishell@chromium.org,Ilija.Pavlovic@imgtec.com,Ilija.Pavlovic@imgtec.com,Ilija.Pavlovic@imgtec.com,Ilija.Pavlovic@imgtec.com
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review-Url: https://codereview.chromium.org/2917063002
Cr-Commit-Position: refs/heads/master@{#45673}