BUG=chromium:651354

Change-Id: I8d74133ca9b21ce9e0612efc1e5ace41d1002dae
Reviewed-on: https://chromium-review.googlesource.com/440304Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43064}

These intrinsics are heavily used in typedarray.js and are part of the
reason why the typed array constructors are more than twice as slow in
TurboFan compared to Crankshaft.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2684193003
Cr-Commit-Position: refs/heads/master@{#43063}

Updated according to the recent spec change at
https://github.com/tc39/ecma262/pull/798.

BUG=v8:5949

Review-Url: https://codereview.chromium.org/2681323002
Cr-Commit-Position: refs/heads/master@{#43062}

R=jgruber@chromium.org
BUG=v8:5821

Review-Url: https://codereview.chromium.org/2680163005
Cr-Commit-Position: refs/heads/master@{#43061}

Revert of [debugger] expose side-effect free evaluate to inspector. (patchset #3 id:40001 of https://codereview.chromium.org/2685483002/ )

Reason for revert:
Speculative revert. Seems to block the roll:
https://codereview.chromium.org/2685933005/

Original issue's description:
> [debugger] expose side-effect free evaluate to inspector.
>
> R=jgruber@chromium.org, kozyatinskiy@chromium.org
> BUG=v8:5821
>
> Review-Url: https://codereview.chromium.org/2685483002
> Cr-Commit-Position: refs/heads/master@{#43049}
> Committed: https://chromium.googlesource.com/v8/v8/+/1a989bdeefdc679745215ae547007773edb3d29e

TBR=jgruber@chromium.org,kozyatinskiy@chromium.org,pfeldman@chromium.org,yangguo@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5821

Review-Url: https://codereview.chromium.org/2687013003
Cr-Commit-Position: refs/heads/master@{#43060}

R=jgruber@chromium.org
BUG=v8:5530

Review-Url: https://codereview.chromium.org/2682593003
Cr-Commit-Position: refs/heads/master@{#43059}

BUG=v8:5943

Review-Url: https://codereview.chromium.org/2681123002
Cr-Commit-Position: refs/heads/master@{#43058}

On bots we don't sort due to not being able to store the duration DB. But we should still run the tests marked as slow first.

BUG=v8:5861

Change-Id: Ifa812b3eef15f48e3d3c752c14c3f546b5dd87d1
Reviewed-on: https://chromium-review.googlesource.com/439284Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43057}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/7968040..e62b61f

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/df67b47..5c71aac

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/426ef62..404d542

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: I59c076ae3fa6b6d495011268d6d791173a1ffa8e
Reviewed-on: https://chromium-review.googlesource.com/439745Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43056}

LoadGlobalIC will be inlined into ignition's LdaGlobal family of bytecode
handlers.  This CL splits up LoadGlobalIC into three distinct cases (property
cell, handler, and miss) and introduces the ExitPoint abstraction in order
to make inlining easier.

BUG=v8:5917

Review-Url: https://codereview.chromium.org/2688503002
Cr-Commit-Position: refs/heads/master@{#43055}

arguments.h is one of the headers including objects-inl.h. Files needing
objects-inl.h used to innocently pull in debug.h, so that needs to be fixed now
too.

BUG=v8:5294
R=mstarzinger@chromium.org

Change-Id: I8ce671c533ed757103ef9a3b0bf0a0509230fdd8
Reviewed-on: https://chromium-review.googlesource.com/439287Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43054}

BUG=chromium:688159
NOTRY=true
TBR=bmeurer@chromium.org,mstarzinger@chromium.org

Change-Id: I9b5c0c531af31534a0dd33e078a148b822834448
Reviewed-on: https://chromium-review.googlesource.com/439184Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43053}

BUG=chromium:688856,chromium:664068
NOTRY=true

Change-Id: Icf0e7a51693b6d399c8395eb0bbed9a3c373eb0a
Reviewed-on: https://chromium-review.googlesource.com/439164Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43052}

BUG=v8:5830
R=yangguo@chromium.org

Change-Id: Ic4f41e0afa32de17615f9f1e9c9b9f05f265b7fe
Reviewed-on: https://chromium-review.googlesource.com/439151
Commit-Queue: Jochen Eisinger <jochen@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43051}

Since the empty string is canonical HeapObject now, we can use
this fact to optimize

  - strict equality comparisons with the empty string to a
    simple ReferenceEqual operation, and
  - optimize ToBoolean to avoid instance type checks completely.

Drive-by-fix: Allow InternalizedString for Type::HeapConstant
in the type system. This is safe, since InternalizedStrings
can be compared to other heap constants by reference (except
for non-InternalizedStrings, which are excluded from the
HeapConstant type).

BUG=v8:5267
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2681273002
Cr-Commit-Position: refs/heads/master@{#43050}

R=jgruber@chromium.org, kozyatinskiy@chromium.org
BUG=v8:5821

Review-Url: https://codereview.chromium.org/2685483002
Cr-Commit-Position: refs/heads/master@{#43049}

R=rossberg@chromium.org,bradnelson@chromium.org
BUG=chromium:575167, chromium:690281

Review-Url: https://codereview.chromium.org/2681993003
Cr-Commit-Position: refs/heads/master@{#43048}

Review-Url: https://codereview.chromium.org/2683903002
Cr-Commit-Position: refs/heads/master@{#43047}

Tests are queued retaining the order of testing variants and test suites. This reorders the variants and suites to make sure the slowest run first.

Currently the debugger suite contains the slowest tests.

BUG=v8:5861
TBR=jochen@chromium.org,yangguo@chromium.org,jkummerow@chromium.org

Change-Id: Idae349b5e6db2540c6181f9b5e2ffb689733846e
Reviewed-on: https://chromium-review.googlesource.com/439311Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43046}

Previously the runtime stats tool would only show entries which were in
the baseline version. This change adds any entries which exist in any
version to the comparison table, which would otherwise not appear anywhere
unless that version was selected as the baseline version.

NOTRY=true

Review-Url: https://codereview.chromium.org/2683863004
Cr-Commit-Position: refs/heads/master@{#43045}

E.g.,
{ function lazy_inner(b = somevar) { let somevar; } }

If we don't produce the same scopes, PreParser thinks that the unresolved
variable inside the default parameter resolves into the variable declared inside
the function. Thus, it's not correctly recorded as a free variable.

One part is already done by https://codereview.chromium.org/2638333002 . But at
the laziness boundary, we still produced different scopes.

Unlike previously thought, this is also needed for lazy inner function
correctness, not only for "preparser scope analysis" (ie., skipping inner
functions).

BUG=v8:5938

Change-Id: I047cd43ef16478bb0f18d1f114845e7d1ab8c5f2
Reviewed-on: https://chromium-review.googlesource.com/439345
Commit-Queue: Marja Hölttä <marja@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43044}

Without doing this, a JSMessageObject can be kept alive by the isolate, which
in turn keeps the context alive, until the message is cleared.

BUG=v8:5941

Review-Url: https://codereview.chromium.org/2675203005
Cr-Commit-Position: refs/heads/master@{#43043}

BUG=

R=jyan@ca.ibm.com, joransiu@ca.ibm.com, bjaideep@ca.ibm.com

Review-Url: https://codereview.chromium.org/2685733002
Cr-Commit-Position: refs/heads/master@{#43042}

R=cbruni@chromium.org

Review-Url: https://codereview.chromium.org/2684823003
Cr-Commit-Position: refs/heads/master@{#43041}

Review-Url: https://codereview.chromium.org/2684043002
Cr-Commit-Position: refs/heads/master@{#43040}

Where the arguments have already been inlined, we can replace these
calls with a direct call. We have to make sure that the iteration over
the arguments is not observable.

Also factor out the large chunk of logic shared with
ReduceJSConstructWithSpread.

BUG=v8:5932

Change-Id: I6c4fac670028fbd8ca82c4474d4392231573bc49
Reviewed-on: https://chromium-review.googlesource.com/439329Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43039}

It used to require >1GB of memory which leads to flaky test failures on
machines with less memory when executing multiple variants in parallel

R=cbruni@chromium.org,ulan@chromium.org
BUG=v8:5706

Change-Id: Id8c6f49cbfa51f2d443991c1493f225810efb18f
Reviewed-on: https://chromium-review.googlesource.com/439310
Commit-Queue: Camillo Bruni <cbruni@google.com>
Commit-Queue: Jochen Eisinger <jochen@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43038}

TBR=yangguo@chromium.org
NOTRY=true

Change-Id: I2138299e93f5790118d1b28ddf7f4c8219f5831d
Reviewed-on: https://chromium-review.googlesource.com/439564Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43037}

Arm64 compiles "x +_64 (y >> shift)" into a single instruction if
"shift" is a constant. The code generator expects that "shift" is a
32 bit constant. however, TurboFan can also pass in a 64 bit constant,
which caused a crash in the code generator.

With this CL we cast the constant of TurboFan to an int in the
instruction selector and thereby satisfy the assumption of the code
generator. This should be correct since the code generator anyways cast
the "shift" to an int5 or int6 eventually.

R=v8-arm-ports@googlegroups.com
BUG=v8:5923

Review-Url: https://codereview.chromium.org/2669203005
Cr-Commit-Position: refs/heads/master@{#43036}

Installing a feedback vector in a closure is a multi-step process.
The closure actually points to a Cell that points to a feedback
vector or undefined if we haven't created one yet.
This happens because we often create closures before we've compiled
the code.

JSFunction::EnsureLiterals is the bottleneck in our system that
creates a feedback vector if necessary. The predicates it used to
determine what to do were arcane. This CL allows it to think it
terms of state, and clarifies the reading of that useful
bottleneck.

I also did a few renamings in parts of the code that referred
to a "literals array," which we don't have any more.

BUG=

Review-Url: https://codereview.chromium.org/2681773004
Cr-Commit-Position: refs/heads/master@{#43035}

Do not preinitialize the feedback vector slot if
the lookup iterator is an interceptor, because it is not
guaranteed that the iterator has a PropertyCell.

If the HandlerConfiguration has a non-masking
intercepting setter,
the iterator does not have a valid PropertyCell.

BUG=chromium:656648

Review-Url: https://codereview.chromium.org/2674103002
Cr-Commit-Position: refs/heads/master@{#43034}

TBR=mvstanton@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Change-Id: Ie7e75861347a1c2e65205f2c9f3c4c62204fd6a8
Reviewed-on: https://chromium-review.googlesource.com/439247
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43033}

BUG=v8:5917

Change-Id: I9611ace4ba73f18cb90f95f9c81eeb19c74e06f4
Reviewed-on: https://chromium-review.googlesource.com/439327Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43032}

(Minimal change to support easy backmerging.)

BUG=v8:5938

Change-Id: Icad35c90d9c2451cd63a4ab7e495d9b5252da693
Reviewed-on: https://chromium-review.googlesource.com/439170Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43031}

The testb instruction requires the REX prefix when either of its
operands uses a register with the high bit set. The existing code only
considered the register operand. In the test case the REX prefix was not
emitted because the testb instruction had the register operand RAX which
does not have the high bit set. The REX prefix was necessary though
because the memory operand used R8, which has the high bit set.

R=bmeurer@chromium.org
BUG=chromium:688876

Change-Id: Ib214bebbe75965664f2aea530e29afa95a54f44f
Reviewed-on: https://chromium-review.googlesource.com/439145
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43030}

BUG=v8:5917

Change-Id: I2f78355ae344624906e40504fba168b3189a18bb
Reviewed-on: https://chromium-review.googlesource.com/439447
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43029}

Now we can inline vector-based IC dispatchers to bytecode handlers.

BUG=v8:5917

Change-Id: Ie81750f252a730240097e514e69b348f410a48b7
Reviewed-on: https://chromium-review.googlesource.com/439265Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43028}

R=marja@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2682033002
Cr-Commit-Position: refs/heads/master@{#43027}

Previously, both type feedback vector and the shared function info
of a function points to the matching type feedback metadata. This
makes finding the shared function info of a type feedback vector
difficult.

Instead, we now point the type feeback vector to the shared function
info, and find the metadata through the shared function info.

Also remove the obsolete empty type feedback vector.

R=hpayer@chromium.org, mvstanton@chromium.org
BUG=v8:5808

Review-Url: https://codereview.chromium.org/2672363002
Cr-Commit-Position: refs/heads/master@{#43026}

BUG=chromium:689877
NOTRY=true
TBR=yangguo@chromium.org,jgruber@chromium.org

Change-Id: I53112d487545acc4086cb48a153a96f0f1aabb21
Reviewed-on: https://chromium-review.googlesource.com/439286Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43025}