Port 0b8200c7

R=petermarshall@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:5659
LOG=N

Review-Url: https://codereview.chromium.org/2645683002
Cr-Commit-Position: refs/heads/master@{#42482}

This CL implements ldrex, ldrexb, ldrexh, strex, strexb, and strexh in the
Simulator. These instructions provide "exclusive" access, which provides mutual
exclusion for concurrent threads of execution.

The ARM specification gives some leeway to implementors, but essentially
describes each processor as having Local Monitor and Global Monitor. The Local
Monitor is used to check the exclusivity state without having to synchronize
with other processors. The Global Monitor is shared between processors. We
model both to make it easier to match behavior with the spec.

When running with multiple OS threads, each thread has its own isolate, and
each isolate has its own Simulator. The Local Monitor is stored directly on the
Simulator, and the Global Monitor is stored as a lazy singleton. The Global
Monitor maintains a linked-list of all Simulators.

All loads/stores (even non-exclusive) are guarded by the Global Monitor's mutex.

BUG=v8:4614

Review-Url: https://codereview.chromium.org/2006183004
Cr-Commit-Position: refs/heads/master@{#42481}

Currently V8 context just crashes on OOM, with this CL backend will send paused notification with OOM reason before OOM and will increase heap limits to allow further debugging on pause.

BUG=chromium:675911

Review-Url: https://codereview.chromium.org/2624543004
Cr-Commit-Position: refs/heads/master@{#42480}

BUG=v8:4203
R=hablich@chromium.org

Review-Url: https://codereview.chromium.org/2641983002
Cr-Commit-Position: refs/heads/master@{#42479}

So far we only recognized

  typeof x == 'type'
  typeof x != 'type'
  typeof x === 'type'
  typeof x !== 'type'

but some people seem to prefer it the other way around, i.e.

  'type' == typeof x
  'type' != typeof x
  'type' === typeof x
  'type' !== typeof x

as spotted in some Ember.js code, so we should obviously handle that as
well and reduce it to a quick check on x instead of calling the TypeOf
builtin and comparing the resulting string.

R=ishell@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2642743003
Cr-Commit-Position: refs/heads/master@{#42478}

Listener is called instead of event listener for v8::AfterCompile and v8::CompileError events if installed.
- removed v8::debug::Script::Wrap.

BUG=v8:5510
R=yangguo@chromium.org,jgruber@chromium.org,dgozman@chromium.org,clemensh@chromium.org, alph@chromium.org,

Review-Url: https://codereview.chromium.org/2626283002
Cr-Commit-Position: refs/heads/master@{#42477}

This reverts commits
* 45c11887 "[fullcodegen] Remove dead hole check logic"
* 2aaf217b "[crankshaft] Remove dead Variable hole-checking code"
* f40a3817 "[crankshaft] Fix mips/mips64 build: remove unused variable"

BUG=
R=adamk@chromium.org,bmeurer@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2640793004
Cr-Commit-Position: refs/heads/master@{#42476}

FFI Compiler outline based on code stub assembler. We are looking to land this frame to allow specific type translation implementations to proceed in parallel.

BUG=v8:4456

Review-Url: https://codereview.chromium.org/2607993003
Cr-Commit-Position: refs/heads/master@{#42475}

When attempting to allocate a blocked register, in the absence of
aliasing, it was possible to assume that a register that was
blocked - by either belonging to an active fixed register, or to
an active unspillable range - could not have possibly be allocated
to another active range (because there'd be an interference otherwise).

With aliasing, that changes. The range we're trying to allocate
may be a double, while the 2 or more active ranges in the paragraph
above may be singles aliasing to the same double slot.

Opportunistically refactored for readability an optimization, and
added some comments.

BUG=681529

Review-Url: https://codereview.chromium.org/2632373004
Cr-Commit-Position: refs/heads/master@{#42474}

R=rossberg@chromium.org,clemensh@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2640013003
Cr-Commit-Position: refs/heads/master@{#42473}

R=adamk@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2645503002
Cr-Commit-Position: refs/heads/master@{#42472}

This brings VerifyPointersVisitor into line with Object::VerifyPointer.

R=hpayer@chromium.org
BUG=v8:5854

Review-Url: https://codereview.chromium.org/2640623002
Cr-Commit-Position: refs/heads/master@{#42471}

Revert of [Ignition/turbo] Add a CallWithSpread bytecode. (patchset #10 id:170001 of https://codereview.chromium.org/2629363002/ )

Reason for revert:
Causes a few bugs caught by clusterfuzz.

Original issue's description:
> [Ignition/turbo] Add a CallWithSpread bytecode.
>
> Also, emit a NewWithSpread bytecode for CallNew AST nodes where possible, rather than desugaring in the parser.
>
> BUG=v8:5511
>
> Review-Url: https://codereview.chromium.org/2629363002
> Cr-Commit-Position: refs/heads/master@{#42455}
> Committed: https://chromium.googlesource.com/v8/v8/+/4bae43471d5685e34d8bd74458889b83e60235a0

TBR=bmeurer@chromium.org,rmcilroy@chromium.org,verwaest@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5511

Review-Url: https://codereview.chromium.org/2642843002
Cr-Commit-Position: refs/heads/master@{#42470}

V8InspectorSession::schedulePauseOnNextStatement and V8InspectorSession::cancelPauseOnNextStatement are now exposed in inspector tests. These methods are required at least for better blackboxing tests.

BUG=v8:5842
R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2636613002
Cr-Commit-Position: refs/heads/master@{#42469}

R=joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2639853002
Cr-Commit-Position: refs/heads/master@{#42468}

The results are too noisy ATM. This switches off validate-asm for
default comparisons. We can add back dedicated jobs later that switch
it on.

BUG=chromium:663714
NOTRY=true
TBR=bradnelson@chromium.org,titzer@chromium.org

Review-Url: https://codereview.chromium.org/2640743004
Cr-Commit-Position: refs/heads/master@{#42467}

First step in splitting apart https://codereview.chromium.org/2622833002/ to
land piece by piece.

Porting src/js/async-await.js to TF builtins using this boilerplate is
now very straightforward.

BUG=v8:4483, v8:5855
R=jgruber@chromium.org, gsathya@chromium.org

Review-Url: https://codereview.chromium.org/2635353002
Cr-Commit-Position: refs/heads/master@{#42466}

R=titzer@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2643783002
Cr-Commit-Position: refs/heads/master@{#42465}

The new ignition config will be used as baseline comparison in new
jobs, e.g. against ignition_turbo. We'll keep --validate-asm off
in ignition_turbo for now as it is very chatty.

BUG=chromium:673246
NOTRY=true

Review-Url: https://codereview.chromium.org/2640043002
Cr-Commit-Position: refs/heads/master@{#42464}

- Refactors many FP, integer, and signed integer instructions where
possible.

LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2639443002
Cr-Commit-Position: refs/heads/master@{#42463}

BUG=chromium:681806
NOTRY=true
TBR=bradnelson@chromium.org

Review-Url: https://codereview.chromium.org/2644573002
Cr-Commit-Position: refs/heads/master@{#42462}

CodeAssemblerLabel's destructor was not calling RawMachineLabel's destructor, because label_ is zone-allocated. RawMachineLabel's destructor contains a DCHECK that would make debugging easier. If the DCHECK is not triggered, things will go awry in the register allocation phase, making it harder to debug the issue.

BUG=

Review-Url: https://codereview.chromium.org/2641863002
Cr-Commit-Position: refs/heads/master@{#42461}

R=titzer@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2640823002
Cr-Commit-Position: refs/heads/master@{#42460}

A future linear version of the hash table will only need the element count and
deleted element count. Hence moving them to the beginning of the underlying
fixed array makes the transition easier.

BUG=v8:5717

Review-Url: https://codereview.chromium.org/2630373002
Cr-Commit-Position: refs/heads/master@{#42459}

Power9 support was originally added in CL
https://codereview.chromium.org/2625013002

R=jochen@chromium.org
BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2637213002
Cr-Commit-Position: refs/heads/master@{#42458}

R=machenbach@chromium.org,eholk@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2641873002
Cr-Commit-Position: refs/heads/master@{#42457}

Due to outstanding performance issues, it's safer to revert these
changes.

Revert "PPC/s390: [TypeFeedbackVector] DeclareGlobals needs a literals array"
Revert "[TypeFeedbackVector] DeclareGlobals needs a literals array"
Revert "PPC/s390: [builtins] CompileLazy bailed out to the runtime entirely too often."
Revert "[builtins] CompileLazy bailed out to the runtime entirely too often."

Another CL is to follow that removes the main part of this work
(after that revert, performance regressions should disappear.

TBR=mstarzinger@chromium.org, leszeks@chromium.org, bmeurer@chromium.org
BUG=680637

Review-Url: https://codereview.chromium.org/2645543002
Cr-Commit-Position: refs/heads/master@{#42456}

Also, emit a NewWithSpread bytecode for CallNew AST nodes where possible, rather than desugaring in the parser.

BUG=v8:5511

Review-Url: https://codereview.chromium.org/2629363002
Cr-Commit-Position: refs/heads/master@{#42455}

This CL fixes the check for empty elements in keys.cc. Previously we would
accidentally bail out of the fast path because the check would always fail.
As a consequence for-in loops that would initialize the enum-cache of an object
with own-only fast properties would never be optimized properly.

Review-Url: https://codereview.chromium.org/2638323002
Cr-Commit-Position: refs/heads/master@{#42454}

Lower JSLoadMessage and JSStoreMessage in JSTypedLowering to allow for
optimizations across try-catch, try-finally, for-of, destructuring,
etc.

BUG=v8:5448
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2641843002
Cr-Commit-Position: refs/heads/master@{#42453}

Makes us pass the spec's memory.wast test.

R=titzer@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2640453003
Cr-Commit-Position: refs/heads/master@{#42452}

Breakpoints are always re-set by the embedder after compilation, so we
don't want to store the corresponding breakpoint objects.
Also don't serialize WASM_INTERPRETER_ENTRY stubs as they are replaced
by ordinary WASM_FUNCTION code at instantiation anyway, and skip
WASM_TO_JS wrappers which are recompiled on each instantiation.
Instead, we serialize the Illegal builtin, and also use that one
instead of the placeholder when compiling the wasm code initially.

R=titzer@chromium.org, yangguo@chromium.org
BUG=v8:5822

Review-Url: https://codereview.chromium.org/2629853004
Cr-Commit-Position: refs/heads/master@{#42451}

As no one will ever try to allocate a Thread directly, we can just make
Thread a proxy of ThreadImpl by reinterpret_casting between both types.
This allows to not mention ThreadImpl in the header at all, and to
define it in an anonymous namespace in the implementation, allowing for
more optimizations.
It also saves runtime, as no memory load is needed to forward from
Thread to ThreadImpl, and we do not need to allocate ThreadImpl objects
on the heap.

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2643443002
Cr-Commit-Position: refs/heads/master@{#42450}

When inlining allocations for Array and String iterators, make sure the
allocations have proper types on it (rather than just Type::Any). This
allows us to escape analyze the iterators in a couple of more cases,
i.e. in this very simple case:

  function f(a) {
    const it = a[Symbol.iterator]();
    return it.next().value;
  }

R=jarin@chromium.org
BUG=v8:4586,v8:5448

Review-Url: https://codereview.chromium.org/2640743003
Cr-Commit-Position: refs/heads/master@{#42449}

TBR=titzer@chromium.org
NOTRY=true

Review-Url: https://codereview.chromium.org/2639903003
Cr-Commit-Position: refs/heads/master@{#42448}

This also introduces exhaustive switch-cases for instance types.

BUG=chromium:681383

Review-Url: https://codereview.chromium.org/2646433002
Cr-Commit-Position: refs/heads/master@{#42447}

BUG=chromium:681241
NOTRY=true
TBR=bradnelson@chromium.org,titzer@chromium.org

Review-Url: https://codereview.chromium.org/2644503002
Cr-Commit-Position: refs/heads/master@{#42446}

This fast path check compared a tagged smi and an untagged one, meaning that the slow path was always taken.

Review-Url: https://codereview.chromium.org/2641823002
Cr-Commit-Position: refs/heads/master@{#42445}

BUG=v8:5659

Review-Url: https://codereview.chromium.org/2571563004
Cr-Commit-Position: refs/heads/master@{#42444}

Store breakpoint positions in the WasmSharedModuleData in order to set
them on new instantiations. Also redirect them to all live instances at
the time the breakpoint is set.

Inside the WasmDebugInfo, we store the BreakPointInfo objects to find
hit breakpoints.

R=titzer@chromium.org, yangguo@chromium.org
BUG=v8:5822

Review-Url: https://codereview.chromium.org/2626253002
Cr-Commit-Position: refs/heads/master@{#42443}