The class Float32 stores the bit pattern of a float as uint32_t to
guarantee that the exact bit pattern of the contained value is
preserved. This is necessary because the bit pattern of a NaN may
change, e.g. when it is passed as a parameter.

For convenience the Float32 class provides a constructor with a float
parameter. Since this constructor cannot guarantee that the right bit
pattern will be stored for NaNs, this CL adds a DCHECK now to make
sure that the constructor is never used with a NaN.

R=mstarzinger@chromium.org

Change-Id: Iba85a5a1bb2778d5f8bdc1aad97524ef8369b73d
Reviewed-on: https://chromium-review.googlesource.com/579367
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46811}

After moving the shared function info creation to be during unoptmized
compile finalization the --print-bytecode flag caused a crash by trying
to access the shared function info before it was created. This CL fixes it.

BUG=v8:5203

Change-Id: I82c0431bace51aa44154c55ad4bebde897f7a39e
Reviewed-on: https://chromium-review.googlesource.com/579769Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46810}

And alpha-sort some lists.

R=jgruber@chromium.org

Change-Id: I01fcf01cf8e1eb1e6c99202156c1013e92bf4e7e
Reviewed-on: https://chromium-review.googlesource.com/579711
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46809}

Move block coverage slot creation into BreakableControlFlowBuilder for
Switch/Loop/Block constructs.

Bug: v8:6000
Change-Id: I4fa7fdb2ffbb56fd1016c22741458c103b42219c
Reviewed-on: https://chromium-review.googlesource.com/571808
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46808}

Tracing block coverage prints raw generated slots in the format:
{start_source_position,end_source_position}

Slots are printed before being mutated during coverage collection.

Bug: v8:6000
Change-Id: I3423e226a124e00c6b13ccd8dddb13d00e4989c7
Reviewed-on: https://chromium-review.googlesource.com/579374Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46807}

Depending on the visitation order of the graph, we can have a dead
ArrayBufferWasNeutered check in the state table. This can only happen
when ArrayBuffers have been neutered in the isolate and there are loops
involved where the LoadEliminationPhase triggers revisitation in the
GraphReducer framework. With the most recent fix to the revisit queue
the original repro case no longer works, since it requires us to visit
an ArrayBufferWasNeutered node after a dominating one was killed.

Bug: chromium:741022
Change-Id: I3644bcf0ff7795289cc27d177ab5f6af32238a43
Reviewed-on: https://chromium-review.googlesource.com/579974Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46806}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/37f4a78..995d759

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/c7c5420..d8bc21b

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/76b8b39..34762ec

TBR=machenbach@chromium.org,hablich@chromium.org

Change-Id: I40ed94d88702416b98ab4997c48c71ef76f4a3e8
Reviewed-on: https://chromium-review.googlesource.com/579849Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46805}

This reverts commit 4851745f.

Reason for revert: Top crasher on Canary, see https://crbug.com/746935

Original change's description:
> [literals] Introduce CreateEmptyArrayLiteral Bytecode
> 
> Empty Array literals are amongst the most commonly used literal types on our
> top25 page list. Using a custom bytecode we can drop the boilerplate for empty
> Array literals alltogether. However, we still need a proper AllocationSite to
> track ElementsKind transitions.
> 
> Bug: v8:6211
> Change-Id: Id5dbdac0ea8e24dd474e679c902c6e4a2957af1d
> Reviewed-on: https://chromium-review.googlesource.com/567079
> Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46752}

TBR=rmcilroy@chromium.org,mstarzinger@chromium.org,cbruni@chromium.org,ishell@chromium.org,rmcilroy@google.com
Bug: v8:6211, chromium:746935

Change-Id: Ibf19a923688c071d03bad8661a10e08f8414db56
Reviewed-on: https://chromium-review.googlesource.com/580193
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46804}

- Adds opcode for 32/16/8 bit dup instruction.
- Matches shuffles that are equivalent to dup's.

Bug: v8:6020
Change-Id: I8848d974adf30127d1dc31c09a9517f8f9573ce9
Reviewed-on: https://chromium-review.googlesource.com/571448
Commit-Queue: Bill Budge <bbudge@chromium.org>
Reviewed-by: Martyn Capewell <martyn.capewell@arm.com>
Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46803}

Change-Id: I0c46b8b86a6ea33e4f48d498e1521fac54e3305e
Reviewed-on: https://chromium-review.googlesource.com/578728
Commit-Queue: Alexei Filippov <alph@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46802}

Now the OSR phase is only used when OSRing from the ast graph builder.
When OSRing from Turbofan, the implementation is now in the graph
building phase, at the beginning of the VisitBytecode function.
We are no longer generating any OSRLoopEntry or OSRNormalEntry nodes,
nor nodes for the possible code of the OSRed function which is before
the OSRed loops.

The trimming and reducing of the OSR phase is not done either. This
change in the way the way the OSR is done enabled to remove the
workaround to the bug mentioned below.

Bug: v8:6112
Bug: v8:6518
Change-Id: I1c9231810b923486d55ea618d550d981d695d797
Reviewed-on: https://chromium-review.googlesource.com/543042
Commit-Queue: Alexandre Talon <alexandret@google.com>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46801}

All of these were dead; many existed only on some platforms:
SlowTruncateToI
TestDoubleIsInt32
TestDoubleIsMinusZero
TruncateNumberToI
TruncateHeapNumberToI
TruncateDoubleToI
TryInt32Floor

Change-Id: Ic55fdadcfa851f5aa04dce8cacd5658d2d6315e8
Reviewed-on: https://chromium-review.googlesource.com/578674Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46800}

- add some more const to Context getters

Change-Id: Ia7560b33cae71a6015515e4337b464648e03a6f2
Reviewed-on: https://chromium-review.googlesource.com/575993Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46799}

Bug: chromium:738865
Change-Id: Ie18574bb067438816238e2cf930e6d2a7bc5ecef
Reviewed-on: https://chromium-review.googlesource.com/570579
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46798}

This reverts commit ae9a2d38.

Reason for revert: Regresses benchmarks related to maps and sets. 
Regressions here: https://chromeperf.appspot.com/group_report?rev=46756.
In future when we move these builtins to CSA, we may still want to
remove this flag.

Original change's description:
> Remove SetForceInlineFlag from src/js/*
> 
> Remove SetForceInlineFlag from the js builtins. 
> 
> Bug: 
> Change-Id: I962982509c82e4baba8dc32a0f163147c47daf34
> Reviewed-on: https://chromium-review.googlesource.com/571803
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Commit-Queue: Mythri Alle <mythria@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46756}

TBR=rmcilroy@chromium.org,jarin@chromium.org,mythria@chromium.org,bmeurer@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Change-Id: I96651aa9d6e91e593af8da1b531e9f7b0240088f
Reviewed-on: https://chromium-review.googlesource.com/579194
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46797}

marking visitors.

This makes incremental and concurrent visitors of share function infos
side-effect free.

BUG=chromium:694255

Change-Id: I85ee7bac17f17bdbc101ef64ecfb46020b5b3458
Reviewed-on: https://chromium-review.googlesource.com/574851
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46796}

Bug: chromium:722783
Change-Id: Id4612f3d45fb26daca8b4ef2efb0f7bc9ac39ed3
Reviewed-on: https://chromium-review.googlesource.com/579268Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46795}

This is reland of 34ed2470.
Fixed build error:

https: //build.chromium.org/p/client.v8.ports/builders/V8%20Mips%20-%20builder/builds/10881
Bug: 
Change-Id: Ie49ac7097b12780ab1f2f3a8559a4a5f25bc73ab
Reviewed-on: https://chromium-review.googlesource.com/579433Reviewed-by: Miran Karić <Miran.Karic@imgtec.com>
Commit-Queue: Miran Karić <Miran.Karic@imgtec.com>
Cr-Commit-Position: refs/heads/master@{#46794}

This patch implements a recent spec change [1] which increases the
bounds of precision for toFixed, toExponential and toPrecision.
The bounds are a compromise between SpiderMonkey and the other
engines.

[1] https://github.com/tc39/ecma262/pull/857

Bug: v8:6539
Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng
Change-Id: I877aa35e08f3dcda63f5f9181fdecf3c227f2c35
Reviewed-on: https://chromium-review.googlesource.com/553378
Commit-Queue: Daniel Ehrenberg <littledan@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46793}

Bug: chromium:744584
Change-Id: Ie25c2ba63e4764f359de38e53c2f3f3222877e0e
Reviewed-on: https://chromium-review.googlesource.com/577690Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46792}

Apparently the name float.h causes problems on Windows when V8 is
compiled with Visual Studio, see the bug description.

R=clemensh@chromium.org

Bug: v8:6588
Change-Id: Iaa9c1e93e62509a779f1a8ddecbb03a53981cf8a
Reviewed-on: https://chromium-review.googlesource.com/578029Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46791}

TBR=machenbach@chromium.org
NOTRY=true

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Iead81c633b9c0712524a348b106f267ddede24ff
Reviewed-on: https://chromium-review.googlesource.com/579427
Commit-Queue: Michael Hablich <hablich@chromium.org>
Reviewed-by: Michael Hablich <hablich@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46790}

The size of parent function is not considered when taking decisions
on which functions to inline. This cl, includes the size of the
parent function to the cumulative count. 

Bug: 
Change-Id: Ib8f4ec684f8313f7c2e29237580bb3c0403930bd
Reviewed-on: https://chromium-review.googlesource.com/506205
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46789}

... between % and a function name.

Change-Id: I4d06e2623abb6fdd50af748649d0f8e9fae3897d
Reviewed-on: https://chromium-review.googlesource.com/575053Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46788}

The link between the JS weak collection object and its backing store
was missing.

Change-Id: If8293a8d43fb52bc4fc9f156ccda578233a1991c
Reviewed-on: https://chromium-review.googlesource.com/579267Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46787}

CSA::Print() is only used during development and can often be useful
in release builds.

Bug: 
Change-Id: Ib6baf5f5275439a468a0f63a00ed446ae11a8de2
Reviewed-on: https://chromium-review.googlesource.com/579190Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46786}

Unscaled memory operations were missing disassembly output for vector registers,
so add support and rewrite as a macro.

Bug: 
Change-Id: I6f388952dbe5a3b9f8a9b9c46e69ef63dc6655ba
Reviewed-on: https://chromium-review.googlesource.com/576177Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Martyn Capewell <martyn.capewell@arm.com>
Cr-Commit-Position: refs/heads/master@{#46785}

This reverts commit 34ed2470.

Reason for revert: Compile on mips builder:
https://build.chromium.org/p/client.v8.ports/builders/V8%20Mips%20-%20builder/builds/10881

Original change's description:
> MIPS[64]: Implement MSA I10 instructions in simulator
> 
> Bug: 
> Change-Id: Ib252b157977fe97f6f4ceb6e7f696f14ca12680e
> Reviewed-on: https://chromium-review.googlesource.com/574595
> Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@imgtec.com>
> Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@imgtec.com>
> Cr-Commit-Position: refs/heads/master@{#46783}

TBR=ivica.bogosavljevic@imgtec.com,Ilija.Pavlovic@imgtec.com,dusan.simicic@imgtec.com,Miran.Karic@imgtec.com

Change-Id: Ic855904b3f93e5ef941a27bcc67c61c15303422a
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/579048Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46784}

Bug: 
Change-Id: Ib252b157977fe97f6f4ceb6e7f696f14ca12680e
Reviewed-on: https://chromium-review.googlesource.com/574595
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@imgtec.com>
Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@imgtec.com>
Cr-Commit-Position: refs/heads/master@{#46783}

This removes support for dropping arguments adaptor frames as part of
the JSFunction-to-JSFunction tail-call mechanism. The need for having
dedicated {kArchTailCallJSFunctionFromJSFunction} instructions is gone.

R=bmeurer@chromium.org
BUG=v8:4698

Change-Id: Id3d35d06800bee68e06b9554c4315e6ad304de5f
Reviewed-on: https://chromium-review.googlesource.com/575975Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46782}

Scavenger and full MC now rely on the same allocation behavior for their
evacuation.

Bug: 
Change-Id: Iddb0affe171187308e5b77ab0d3cfa75211bd8b8
Reviewed-on: https://chromium-review.googlesource.com/575983Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46781}

This inlines the allocation of regexp literals when a boilerplate exists.

Bug: v8:6605,v8:6556
Change-Id: If0f1b9dedf8a7de1ec51c394fe39cf21d2413ac5
Reviewed-on: https://chromium-review.googlesource.com/575240
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46780}

In contrast to other internal fields (data, source, and flags), last_index is
an in-object property. But we can still use the standard accessor macros to
access it.

Bug: 
Change-Id: If77f2bb01c6ddccebdde09d7a316c2ddaaf9b277
Reviewed-on: https://chromium-review.googlesource.com/577549Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46779}

- Change indentation from 4 to 2 in accordance with Node.js guidelines.
- Fix --no-review option.

R=petermarshall@chromium.org

Change-Id: Ia525297292b0f13776e2264d5cf82dcc7ec449ad
Reviewed-on: https://chromium-review.googlesource.com/574860Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46778}

It used to be that immortal immovable objects have to be on the first page to
not be moved. This is no longer true since we flag pages wrt whether they are
allowed to move.

R=mlippautz@chromium.org

Change-Id: I5c9c88fa358636df119108e16e871815b126ab27
Reviewed-on: https://chromium-review.googlesource.com/575976Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46777}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/543ec6e..37f4a78

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/a4770ef..c7c5420

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/844603c..76b8b39

TBR=machenbach@chromium.org,hablich@chromium.org

Change-Id: I252c26150fe01d55107ac705cbd9d851936b6568
Reviewed-on: https://chromium-review.googlesource.com/577924Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46776}

Check the receiver_map for the dictionary mode bit instead of
comparing the properties map against the HashTableMap.

Bug: 
Change-Id: Iebf3118f00fd0afc8f7f13e88f373282c099f682
Reviewed-on: https://chromium-review.googlesource.com/578324
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46775}

We already have all the functionality available in the
CodeStubAssembler, so this is merely connecting the dots.

Drive-by-fix: Improve code generation for StringCharCodeAt
to properly mark runtime entries as deferred and just use
a single slow-path.

Bug: v8:5049
Change-Id: I76793c823b23f676e65cdb717558473edb6b91cd
Reviewed-on: https://chromium-review.googlesource.com/577533
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46774}

Before the existence of "= delete", we were enforcing that the
DISALLOW_* macros were used in the private: section of classes only.
This is not needed any more, hence remove the comment on the macros.

Also, introduce macros for making types move-only, and use them
instead of our special macro in wasm.

R=bmeurer@chromium.org
CC=titzer@chromium.org

Change-Id: Iceba456fb0a32ae67defe16e35b865db8c8da500
Reviewed-on: https://chromium-review.googlesource.com/577687Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46773}

R=ishell@chromium.org,clemensh@chromium.org
BUG=chromium:742659

Review-Url: https://codereview.chromium.org/2977113002
Cr-Commit-Position: refs/heads/master@{#46772}