250K was probably still too generous and 80K leads to improvements
locally.

BUG=v8:6348

Review-Url: https://codereview.chromium.org/2876413002
Cr-Commit-Position: refs/heads/master@{#45288}

Smis can easily be handled outside the stub call without adding much to code
size.

The ToString inlining adds overhead of repeated instance type loads and checks,
but under the assumption that it is called with mostly string values it should
speed things up (a local RegExp.p[@@replace] microbenchmark shows consistent
1.6% improvements).

Drive-by-fix: Remove duplication in ToString implementations.

BUG=

Review-Url: https://codereview.chromium.org/2874423003
Cr-Commit-Position: refs/heads/master@{#45287}

With this CL SloppyArguments immediately go to dictionary elements on
deletion, keeping the arguments backing store packed.

Bug: v8:6251
Change-Id: I90d1972179447bf6810e7fe2b8e0bc8703b38d9d
Reviewed-on: https://chromium-review.googlesource.com/486921Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45286}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/cb040e9..63fb52b

Rolling v8/third_party/icu: https://chromium.googlesource.com/chromium/deps/icu/+log/4b06aad..87232d8

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: Ie82d5813078e93ce03eb5161199971efef264b7e
Reviewed-on: https://chromium-review.googlesource.com/505712Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45285}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/3639cca..cb040e9

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/ff3b45d..37015fb

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: I8fa21ea36bec3f6f235b6c0a82eef358abceeb82
Reviewed-on: https://chromium-review.googlesource.com/505868Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45284}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/00764a8..3639cca

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/1ff6ffc..ff3b45d

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/4dfb853..162cac4

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: Ia06ca0b5c6f911d86fc6e6fdae197a79a84675a3
Reviewed-on: https://chromium-review.googlesource.com/505707Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45283}

This is almost identical to V8's default array buffer allocator.  The only
difference is that 0 byte allocations are changed into 1 byte allocations.  We
do not seem to need this behavior, so it does not seem worth maintaining yet
another allocator.

Bug: 
Change-Id: I94f45f1276958791be9a6f2405fcfba8fa6eaa38
Reviewed-on: https://chromium-review.googlesource.com/505199Reviewed-by: Ben Smith <binji@chromium.org>
Commit-Queue: Eric Holk <eholk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45282}

This lets us avoid allocating the "this" variable for every
generator, since the BytecodeGenerator can directly read
the receiver via BytecodeArrayBuilder::Receive() when passing
it into %_CreateJSGeneratorObject.

Bug: v8:6351
Change-Id: Ib5e1f3303b6b5d5fc051ce76ea62129fd6afac65
Reviewed-on: https://chromium-review.googlesource.com/500507
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Caitlin Potter <caitp@igalia.com>
Cr-Commit-Position: refs/heads/master@{#45281}

Remove FinalizePageSequentially as it had only a single use case that
was tied to the full collector.

Bug: chromium:651354
Change-Id: I03299ddbd439ea273e02dd33f12c005371694130
Reviewed-on: https://chromium-review.googlesource.com/504508Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45280}

TEST=wasm-spec-tests/tests/set_local,wasm-spec-tests/tests/imports
BUG=

Review-Url: https://codereview.chromium.org/2859223004
Cr-Commit-Position: refs/heads/master@{#45279}

We make assumptions that baseline code exists if we run the optimized code
(e.g., to deopt to the baseline code). If the baseline code has been
cleared by code flushing (only full-codegen) then it might not exist
but there is still optimized code in the map.

BUG=v8:6389

Change-Id: Id4db664afee96c2da3a36a177f425293aae9a0a3
Reviewed-on: https://chromium-review.googlesource.com/503010Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45278}

This makes sure that the order of exports as they appear in asm.js
modules is maintained globally (not just per function) while being
translated to a WASM module.

R=clemensh@chromium.org
TEST=mjsunit/asm/asm-validation
BUG=chromium:720586

Change-Id: I8b26d717ae2f88467d41670bced901f196c7b3fc
Reviewed-on: https://chromium-review.googlesource.com/503708
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45277}

No need to call through ConstructJS -> ArrayCode -> ArrayConstructorStub
-> AllocateJSArray if we can call AllocateJSArray directly.

This also moves ArraySpeciesCreate to builtins-array-gen to free
up space in the binary.

BUG=v8:6354

Review-Url: https://codereview.chromium.org/2874833004
Cr-Commit-Position: refs/heads/master@{#45276}

BUG=v8:6370

Review-Url: https://codereview.chromium.org/2870013004
Cr-Commit-Position: refs/heads/master@{#45275}

I just tried a local mac build, and the assert seems to be okay.
Let's see what the waterfall thinks.

R=mlippautz@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2875273002
Cr-Commit-Position: refs/heads/master@{#45274}

Add Miran Karic and Dusan Simicic
Remove Paul Lind, Gergely Kis, Akos Palfi, Balasz Kilvady
and Dusan Milosavljevic

NOTRY=true

Review-Url: https://codereview.chromium.org/2881493003
Cr-Commit-Position: refs/heads/master@{#45273}

Compilers don't flatten os << const char* for you. Save a bit binary size.

Bug:NO

Change-Id: Iabe0de83fdf6394f223d0423e63bd5aadf1453b3
Reviewed-on: https://chromium-review.googlesource.com/503829Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Loo Rong Jie <loorongjie@gmail.com>
Cr-Commit-Position: refs/heads/master@{#45272}

The current implementation failed when comparing an integral type to a
reference to an integral type of different signedness (see updated
unittest).
This CL fixes the checks to actually test the std::decay<T>::type,
i.e. with all references, const or volatile modifiers stripped.

R=jochen@chromium.org, ishell@chromium.org
TEST=unittests/LoggingTest.CompareWithReferenceType

Change-Id: Ib0ac077a91e0409ada7a80b68150cb98cbdd32f1
Reviewed-on: https://chromium-review.googlesource.com/502814Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45271}

Bug: 
Change-Id: Ic5b96bfb6b8b468434c06aed5e12b4ddb278dd08
Reviewed-on: https://chromium-review.googlesource.com/503440
Commit-Queue: Mircea Trofin <mtrofin@chromium.org>
Commit-Queue: Brad Nelson <bradnelson@chromium.org>
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45270}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/2e68430..00764a8

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/27f7008..1ff6ffc

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/ae881aa..4dfb853

Rolling v8/tools/swarming_client: https://chromium.googlesource.com/external/swarming.client/+log/e6fc938..a941a08

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: I5a68e9bc325e394b618e0f5605b3c4b13a80f263
Reviewed-on: https://chromium-review.googlesource.com/503869Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45269}

Also add support for host_byteorder logic which is introduced in - https://codereview.chromium.org/2815453004/

Chromium_BUG=706728
R=machenbach@chromium.org, dpranke@chromium.org, adamk@chromium.org

Review-Url: https://codereview.chromium.org/2809963004
Cr-Commit-Position: refs/heads/master@{#45268}

Conf. c++ coding guide (https://chromium.googlesource.com/chromium/src/+/master/styleguide/c++/c++.md#Types),
we may use size_t for vector indices, etc.

Bug: 
Change-Id: I578fb4199c061b006d03e1cc68e745868b40c227
Reviewed-on: https://chromium-review.googlesource.com/503590
Commit-Queue: Mircea Trofin <mtrofin@chromium.org>
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45267}

Creation stack trace points to the place where callback was actually chained, scheduled points where parent promise was resolved.
For async tasks without creation stack (e.g. setTimeout) we continue to use scheduled as creation since usually they are the same.

BUG=v8:6189
R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2868493002
Cr-Original-Commit-Position: refs/heads/master@{#45198}
Committed: https://chromium.googlesource.com/v8/v8/+/e118462f18a862df81a04486e13dd62997cbfc5a
Review-Url: https://codereview.chromium.org/2868493002
Cr-Commit-Position: refs/heads/master@{#45266}

This prepares for:
https://chromium-review.googlesource.com/c/503210

TBR=jkummerow@chromium.org

Bug: 720606
Change-Id: If291077e1647c7116101b9e1ee685ccbc67619a0
Reviewed-on: https://chromium-review.googlesource.com/503368Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45265}

The error_pc was only used to calculated the relative error offset.
Switching to an error_offset directly will allow us later to give the
decoder a base offset. Thereby we can get correct error
positions even when the decoder is executed on multiple memory chunks,
which will happen with streaming compilation. With this change I also
had to provide "kind of" reasonable error position in the
StreamingDecoder.

R=clemensh@chromium.org

Change-Id: I736fa082c51c64334d23771061acf97e2c47778e
Reviewed-on: https://chromium-review.googlesource.com/502909
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45264}

Bug: chromium:651354
Change-Id: I356d551f249c9c9c785bb082412ff872639f692f
Reviewed-on: https://chromium-review.googlesource.com/502813Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45263}

This is a part of synchronization protocol with the concurrent marking.

BUG=chromium:694255

Review-Url: https://codereview.chromium.org/2872323002
Cr-Commit-Position: refs/heads/master@{#45262}

This reverts commit 682d5369.

Reason for revert: Didn't see that this was the Reland... now we should be in good state.

Original change's description:
> Revert "Revert "Revert "[global-handles] Remove dead code"""
> 
> This reverts commit c836a95e.
> 
> Reason for revert: I don't think this was related.
> 
> Original change's description:
> > Revert "Revert "[global-handles] Remove dead code""
> > 
> > This reverts commit 58020872.
> > 
> > Reason for revert: Turned out to be a bot issue, reverting the revert. 
> > 
> > Original change's description:
> > > Revert "[global-handles] Remove dead code"
> > > 
> > > This reverts commit e2890c19.
> > > 
> > > Reason for revert: Looks like this CL causes slowdown on multiple builders, Check tests timeout and raise exceptions on the bot. Possible it is a bot issue as well, see tracking bug - https://bugs.chromium.org/p/chromium/issues/detail?id=720606
> > > 
> > > Original change's description:
> > > > [global-handles] Remove dead code
> > > > 
> > > > Bug: chromium:720477
> > > > Change-Id: I090168c575c41b7038af5dfba6cd8973d1154c51
> > > > Reviewed-on: https://chromium-review.googlesource.com/501790
> > > > Reviewed-by: Hannes Payer <hpayer@chromium.org>
> > > > Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> > > > Cr-Commit-Position: refs/heads/master@{#45241}
> > > 
> > > TBR=hpayer@chromium.org,mlippautz@chromium.org,jochen@chromium.org
> > > NOPRESUBMIT=true
> > > NOTREECHECKS=true
> > > NOTRY=true
> > > Bug: chromium:720477
> > > 
> > > Change-Id: I92f40d8c4dbfdb5208b3068648612e8c5b97fb20
> > > Reviewed-on: https://chromium-review.googlesource.com/502029
> > > Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
> > > Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
> > > Cr-Commit-Position: refs/heads/master@{#45243}
> > 
> > TBR=hpayer@chromium.org,gdeepti@chromium.org,mlippautz@chromium.org,jochen@chromium.org,v8-reviews@googlegroups.com
> > NOPRESUBMIT=true
> > NOTREECHECKS=true
> > NOTRY=true
> > Bug: chromium:720477
> > 
> > Change-Id: I70e190e0c27074228a8128aa849e5a419af915e8
> > Reviewed-on: https://chromium-review.googlesource.com/502030
> > Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
> > Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#45244}
> 
> TBR=hpayer@chromium.org,gdeepti@chromium.org,mlippautz@chromium.org,jochen@chromium.org,v8-reviews@googlegroups.com
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> Bug: chromium:720477
> 
> Change-Id: If3e4abea51d87546e25076b906a4c91e5ccf947b
> Reviewed-on: https://chromium-review.googlesource.com/503007
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#45246}

TBR=hpayer@chromium.org,gdeepti@chromium.org,mlippautz@chromium.org,jochen@chromium.org,v8-reviews@googlegroups.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
Bug: chromium:720477

Change-Id: Id7dc886cc20b3b36ca5bb643686fe4fe2e98a3a7
Reviewed-on: https://chromium-review.googlesource.com/503008Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45261}

std::vector can never store const types, as the stored type has to be
either copy-constructable or move-constructable.
std::vector<const X> does not compile and makes no sense if you think
about it.
Thus remove the TODO to use such a vector.

R=ahaas@chromium.org

Change-Id: Ieb00a31872f04c720d2ef90b70452c18e79f0a5d
Reviewed-on: https://chromium-review.googlesource.com/503148
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45260}

BUG=v8:6261, v8:6278, v8:6344

Review-Url: https://codereview.chromium.org/2868343002
Cr-Original-Commit-Position: refs/heads/master@{#45236}
Committed: https://chromium.googlesource.com/v8/v8/+/55a610ba24c819ef24d0efbcc4d2e4a4f6a24baa
Review-Url: https://codereview.chromium.org/2868343002
Cr-Commit-Position: refs/heads/master@{#45259}

Bug: chromium:651354
Change-Id: I797a0eee698c9c5a6bf191fb041111c9ff5440cf
Reviewed-on: https://chromium-review.googlesource.com/503227Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45258}

This patch fixes regresion introduced in CL:
https://chromium-review.googlesource.com/c/489525/

ldr instruction is unaligned load on MIPS and it is not available in
MIPS64r6 architecture.

BUG=

Review-Url: https://codereview.chromium.org/2873873005
Cr-Commit-Position: refs/heads/master@{#45257}

This makes sure that function variables as well as function table
variables are properly typed as immutable, hence assignments to them
should cause validation failures.

R=clemensh@chromium.org
TEST=mjsunit/asm/immutable
BUG=chromium:721271

Change-Id: Ia3f65fd0782ca571ffcf99520fdbd8fc5a359d16
Reviewed-on: https://chromium-review.googlesource.com/503209Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45256}

This removes logic tracking whether a number literal in the source
contained a "dot" character or not. The tracking was only needed for
validation of asm.js modules on the AST, it is obsolete now.

R=marja@chromium.org

Change-Id: Ib474e2281db80fe56d43e1af52221a7c66261e01
Reviewed-on: https://chromium-review.googlesource.com/503228Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45255}

The mutator can convert a pointer slot of a JSObject to an unboxed
double slot. To make it we safe for the concurrent marker, we require
synchronization using the object markbits.

The concurrent marker visits the JSObject as follows:
- save snapshot of object slot addresses and values.
- visit the snapshot only after successful transition of the object
  from grey to black.

Before an unsafe layout change the mutator colors the object black
and visits it using the bailout marking deque.

BUG=chromium:694255

Review-Url: https://codereview.chromium.org/2876553002
Cr-Commit-Position: refs/heads/master@{#45254}

R=clemensh@chromium.org

Change-Id: I5c37cdf4f11ff7062e6af8c7af5b6eabf1baedad
Reviewed-on: https://chromium-review.googlesource.com/503207Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45253}

BUG=chromium:720606

Review-Url: https://codereview.chromium.org/2871173006
Cr-Commit-Position: refs/heads/master@{#45252}

Bug: v8:6355
NOTRY=true
TBR=sergiyb@chromium.org

Change-Id: Ib0b6d32cf330d03d1898f55f7fc21092ce816beb
Reviewed-on: https://chromium-review.googlesource.com/503269Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45251}

This CL implements a streaming decoder which takes the bytes
of a wasm module as an input, potentially split into multiple
chunks, and decodes them into segments. Each segment either
contains the payload of a whole section, or the code of a
single function. The goal is that the streaming decoder is
used for streaming compilation. That's where the interface
comes from, see
(https://cs.chromium.org/chromium/src/v8/include/v8.h?q=OnBytesReceived&sq=package:chromium&l=4060)

Error positions are not reported correctly at the moment. I
plan to do this in a separate CL.

Change-Id: I6e3df6a91945c7baec2dc4f5de2e5f47636083df
Reviewed-on: https://chromium-review.googlesource.com/471350
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45250}

Port https://chromium-review.googlesource.com/c/501849/

NOTRY=true
TBR=tandrii@chromium.org
Bug: chromium:717504

Change-Id: Ia37759c615cc3ad4d2978a4589ca687a750afc46
Reviewed-on: https://chromium-review.googlesource.com/503028
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45249}