Note that the offset can still be out of bounds, even after grow memory. The calculation of the remaining size can overflow.

R=gdeepti@chromium.org
BUG=chromium:644670

Review-Url: https://codereview.chromium.org/2376153003
Cr-Commit-Position: refs/heads/master@{#39886}

R=bradnelson@chromium.org,mtrofin@chromium.org
BUG=chromium:575167

Review-Url: https://codereview.chromium.org/2384513002
Cr-Commit-Position: refs/heads/master@{#39885}

Revert of [WASM] Implements catch for the wasm low level exception mechanism. (patchset #16 id:300001 of https://codereview.chromium.org/2275293002/ )

Reason for revert:
nosse4 errors:
https://build.chromium.org/p/client.v8/builders/V8%20Linux/builds/13524
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20debug/builds/11215

Original issue's description:
> [WASM] Implements catch for the wasm low level exception mechanism.
>
> BUG=
>
> Committed: https://crrev.com/93e5425c46453764779bd557628d61fae670027a
> Cr-Commit-Position: refs/heads/master@{#39881}

TBR=titzer@chromium.org,bradnelson@chromium.org,jpp@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review-Url: https://codereview.chromium.org/2383613002
Cr-Commit-Position: refs/heads/master@{#39884}

Uses the base hashmap to store the ConstantArrayBuilder's constant map,
which slightly improves the performance of ConstantArrayBuilder::Insert.

Includes a small overload of the hashmap LookupOrInsert method, which
allows passing in a value creation function instead of just default
initialising new values.

On Octane's codeload, this gives (on my machine) a 0.27% improvement,
which doesn't sound like a lot but I guess every little helps.

Review-Url: https://codereview.chromium.org/2336553002
Cr-Commit-Position: refs/heads/master@{#39883}

Adds a fast-path test and branch for the turbofan graph generated by
BytecodeGraphBuilder for dynamic global lookups.

BUG=v8:5263

Review-Url: https://codereview.chromium.org/2374983003
Cr-Commit-Position: refs/heads/master@{#39882}

BUG=

Review-Url: https://codereview.chromium.org/2275293002
Cr-Commit-Position: refs/heads/master@{#39881}

The label names were reversed - an external string is a short external
string if (instance_type | kShortExternalStringMask) != 0.

R=ishell@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2380073002
Cr-Commit-Position: refs/heads/master@{#39880}

Migrate newly added C++ String Iterator builtins to TFJ builtins, per
step 4. of the String Iterator Baseline Implementation section of the design doc

BUG=v8:5388
R=bmeurer@chromium.org, mstarzinger@chromium.org, jkummerow@chromium.org

Committed: https://crrev.com/f9a2c8b1112c4e915df8bc5f7ea1fccdf7a33ff8
Cr-Commit-Position: refs/heads/master@{#39765}

patch from issue 2358263002 at patchset 260001 (http://crrev.com/2358263002#ps260001)

Review-Url: https://codereview.chromium.org/2381053002
Cr-Commit-Position: refs/heads/master@{#39879}

Making new nodes inside of exception-handled blocks fiddles around with the
current environment to merge the exception paths. In particular, the current
environment pointer is mutated. This patch ensures that when we merge the fast
and slow paths of the LdaContextLookup, we actually merge the correct
environment and do not accidentally merge the exceptional environment.

BUG=chromium:651394

Review-Url: https://codereview.chromium.org/2379043002
Cr-Commit-Position: refs/heads/master@{#39878}

BUG=chromium:635948
R=dgozman@chromium.org,jochen@chromium.org

Review-Url: https://codereview.chromium.org/2373983003
Cr-Commit-Position: refs/heads/master@{#39877}

Port: 1beb89f2

This patch simplifies code for speeding up marking and
removes write barrier counter.

The step size is now computed based in two parts:
- bytes to mark in order to keep up with allocation,
- bytes to mark in order to make progress.

R=mvstanton@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com, bjaideep@ca.ibm.com
BUG=

Review-Url: https://codereview.chromium.org/2378053003
Cr-Commit-Position: refs/heads/master@{#39876}

Review-Url: https://codereview.chromium.org/2377343002
Cr-Commit-Position: refs/heads/master@{#39875}

The test now checks the case when an observer is added after tracing is started.

BUG=chromium:406277

Review-Url: https://codereview.chromium.org/2376953002
Cr-Commit-Position: refs/heads/master@{#39874}

Revert of [modules] Properly initialize declared variables. (patchset #5 id:80001 of https://codereview.chromium.org/2375793002/ )

Reason for revert:
Suspect for causing win64 debug problems:
https://build.chromium.org/p/client.v8/builders/V8%20Win64%20-%20debug/builds/12646

Original issue's description:
> [modules] Properly initialize declared variables.
>
> Before evaluating a module, all variables declared at the top-level
> in _any_ of the modules in the dependency graph must be initialized.
> This is observable because a module A can access a variable imported
> from module B (e.g. a function) at a point when module B's body hasn't
> been evaluated yet.
>
> We achieve this by implementing modules internally as generators with
> two states (not initialized, initialized).
>
> R=adamk@chromium.org
> BUG=v8:1569
>
> Committed: https://crrev.com/f4dfb6fbe1cdd9a0f287a1a9c496e1f69f6f5d20
> Cr-Commit-Position: refs/heads/master@{#39871}

TBR=adamk@chromium.org,mstarzinger@chromium.org,neis@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:1569

Review-Url: https://codereview.chromium.org/2379063002
Cr-Commit-Position: refs/heads/master@{#39873}

R=bmeurer@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2380973002
Cr-Commit-Position: refs/heads/master@{#39872}

Before evaluating a module, all variables declared at the top-level
in _any_ of the modules in the dependency graph must be initialized.
This is observable because a module A can access a variable imported
from module B (e.g. a function) at a point when module B's body hasn't
been evaluated yet.

We achieve this by implementing modules internally as generators with
two states (not initialized, initialized).

R=adamk@chromium.org
BUG=v8:1569

Review-Url: https://codereview.chromium.org/2375793002
Cr-Commit-Position: refs/heads/master@{#39871}

Revert of [builtins] migrate C++ String Iterator builtins to baseline TurboFan (patchset #13 id:260001 of https://codereview.chromium.org/2358263002/ )

Reason for revert:
Introduces an infinite loop (see comment).

Original issue's description:
> [builtins] migrate C++ String Iterator builtins to baseline TurboFan
>
> Migrate newly added C++ String Iterator builtins to TFJ builtins, per
> step 4. of the String Iterator Baseline Implementation section of the design doc
>
> BUG=v8:5388
> R=bmeurer@chromium.org, mstarzinger@chromium.org
>
> Committed: https://crrev.com/f9a2c8b1112c4e915df8bc5f7ea1fccdf7a33ff8
> Cr-Commit-Position: refs/heads/master@{#39765}

TBR=bmeurer@chromium.org,mstarzinger@chromium.org,caitp@igalia.com
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=v8:5388

Review-Url: https://codereview.chromium.org/2374123005
Cr-Commit-Position: refs/heads/master@{#39870}

This is useful for my upcoming work on OSR typing, which needs
to create checkpoints (which in turn require environments).

Review-Url: https://codereview.chromium.org/2379643003
Cr-Commit-Position: refs/heads/master@{#39869}

Make MatchFun a template parameter in TemplateHashMapImpl, moving the
PointersMatch function down to an implementation which extends
TemplateHashMapImpl to void* key and value (i.e. the same as the current
HashMap and ZoneHashMap typedefs).

This will allow other instantiations of TemplateHashMapImpl, with
different MatchFun values, e.g. std::equal_to, to have their key
equality test inlined, rather than calling a function pointer,

Review-Url: https://codereview.chromium.org/2354593002
Cr-Commit-Position: refs/heads/master@{#39868}

BUG=

Review-Url: https://codereview.chromium.org/2380523005
Cr-Commit-Position: refs/heads/master@{#39867}

- added a inspector folder,
- added related GN and gyp files,
- added task handling infrastructure for test runner.

BUG=chromium:635948
R=dgozman@chromium.org,alph@chromium.org

Review-Url: https://codereview.chromium.org/2361623006
Cr-Commit-Position: refs/heads/master@{#39866}

BUG=
NOTRY=true

Review-Url: https://codereview.chromium.org/2376103003
Cr-Commit-Position: refs/heads/master@{#39865}

BUG=chromium:651327

Review-Url: https://codereview.chromium.org/2380993003
Cr-Commit-Position: refs/heads/master@{#39864}

Add simplified operator reduction rule that reduces

  CheckedTaggedSignedToInt32(ConvertTaggedHoleToUndefined(x))

to

  CheckedTaggedSignedToInt32(x)

which avoids the unnecessary hole to undefined conversion, as the check
operation will fail equally on either hole or undefined.

BUG=v8:5267
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2384453002
Cr-Commit-Position: refs/heads/master@{#39863}

This is useful for correctness fuzzing where different compilers might
overflow the stack in different points.

Review-Url: https://codereview.chromium.org/2381773003
Cr-Commit-Position: refs/heads/master@{#39862}

R=bradnelson@chromium.org,mtrofin@chromium.org,mstarzinger@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2383463002
Cr-Commit-Position: refs/heads/master@{#39861}

BUG=

Review-Url: https://codereview.chromium.org/2375673002
Cr-Commit-Position: refs/heads/master@{#39860}

BUG=chromium:651354

Review-Url: https://codereview.chromium.org/2377273002
Cr-Commit-Position: refs/heads/master@{#39859}

This flag was disabled by default, and has been broken for a long time.

BUG=

Review-Url: https://codereview.chromium.org/2374063004
Cr-Commit-Position: refs/heads/master@{#39858}

bytes_processed should be used instead of bytes_to_process when
updating bytes_allocated_. Also updated the type of bytes_processed
since min() takes in 2 variables of the same type.
The code was added as part of:
https://codereview.chromium.org/2359903002

R=hpayer@chromium.org,ulan@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2380853002
Cr-Commit-Position: refs/heads/master@{#39857}

Strings takes a considerate amount of time and times out on
many platforms. Generally the iterations need to be reduced
to free resources.

NOTRY=true
TBR=hablich@chromium.org

Review-Url: https://codereview.chromium.org/2374393002
Cr-Commit-Position: refs/heads/master@{#39856}

Tracing CPU profiler allows V8 to automatically collect CPU profile when tracing
is started with category v8.cpu_profile2 enabled.

BUG=chromium:406277

Review-Url: https://codereview.chromium.org/2378143003
Cr-Commit-Position: refs/heads/master@{#39855}

Reason for revert:
No real improvement as we still lack the ability to promote from
scavenges/young gen GCs.

Let's keep this in mind for later.

Original issue's description:
> [heap] Remove border page
>
> A page now belongs either the nursery *or* the intermediate gen. The page that
> contained objects of both spaces is removed in this change.
>
> BUG=chromium:636331
>
> Committed: https://crrev.com/42ece47446f0dbd3779d6e0e00dce97a1931a9f9
> Cr-Commit-Position: refs/heads/master@{#39778}

TBR=ulan@chromium.org,hpayer@chromium.org
BUG=chromium:636331

Review-Url: https://codereview.chromium.org/2383443002
Cr-Commit-Position: refs/heads/master@{#39854}

BUG=406277

Review-Url: https://codereview.chromium.org/2321073004
Cr-Commit-Position: refs/heads/master@{#39853}

BUG=v8:5415

Committed: https://crrev.com/cc37dff7ba21345b3a867a86127a208e34a3f707
Review-Url: https://codereview.chromium.org/2358133004
Cr-Original-Commit-Position: refs/heads/master@{#39717}
Cr-Commit-Position: refs/heads/master@{#39852}

This ports the platform-specific SubStringStub to TurboFan.

It also contains a minor bug-fix for the case when the requested substring
length equals the subject string length, but the start index is not equal to 0.
The old stub implementation returned the subject string, while the new
implementation calls into runtime, which finally results in a thrown exception.

BUG=v8:5415

Committed: https://crrev.com/49be31921536716706a6790fbbf9c346b975af16
Review-Url: https://codereview.chromium.org/2355793003
Cr-Original-Commit-Position: refs/heads/master@{#39653}
Cr-Commit-Position: refs/heads/master@{#39851}

Change include statement, otherwise embedders have problems compiling.

BUG=

Review-Url: https://codereview.chromium.org/2378773004
Cr-Commit-Position: refs/heads/master@{#39850}

When lowering a JSLoadNamed with an immutable own property of a
known constant JSObject, we can just constant fold the load during
native context specialization, similar to what Crankshaft does in
HOptimizedGraphBuilder::BuildLoadNamedField. This way we can also
constant-fold stuff like Math.LN2 and friends.

R=jarin@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2376033002
Cr-Commit-Position: refs/heads/master@{#39849}

BUG=chromium:651070

Review-Url: https://codereview.chromium.org/2371403003
Cr-Commit-Position: refs/heads/master@{#39848}

Rolling v8/base/trace_event/common to 08b7b94e88aecc99d435af7f29fda86bd695c4bd

Rolling v8/build to d3f34f8dfaecc23202a6ef66957e83462d6c826d

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2380463004
Cr-Commit-Position: refs/heads/master@{#39847}