R=joransiu@ca.ibm.com, bjaideep@ca.ibm.com
BUG=

Review-Url: https://codereview.chromium.org/2842833002
Cr-Commit-Position: refs/heads/master@{#44895}

- Use Assembler in a few places that unneccessarily used MacroAssembler before.
- Fix some comments.

R=jarin@chromium.org
BUG=v8:6048

Review-Url: https://codereview.chromium.org/2843933002
Cr-Commit-Position: refs/heads/master@{#44894}

Revert of [turbofan] Set proper representation for initial arguments length. (patchset #1 id:1 of https://codereview.chromium.org/2810333004/ )

Reason for revert:
Field representation is not preserved

Original issue's description:
> [turbofan] Set proper representation for initial arguments length.
>
> The JSArgumentsObject::length representation is initially Smi, so we can
> record that on the initial map and use it to optimize the accesses in
> TurboFan based on that. Similar for JSSloppyArgumentsObject::caller.
>
> BUG=v8:6262
> R=yangguo@chromium.org
>
> Review-Url: https://codereview.chromium.org/2810333004
> Cr-Commit-Position: refs/heads/master@{#44644}
> Committed: https://chromium.googlesource.com/v8/v8/+/5eec7df9b319e5b7a8158d82825d61e90a7cfe33

TBR=yangguo@chromium.org,bmeurer@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=v8:6262

Review-Url: https://codereview.chromium.org/2825323002
Cr-Commit-Position: refs/heads/master@{#44893}

R=clemensh@chromium.org
TEST=mjsunit/asm/int32-mul
BUG=chromium:715482

Change-Id: I525e901fd6ade101999694a53d5147b6e4ccc2e5
Reviewed-on: https://chromium-review.googlesource.com/488024Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44892}

This makes sure that the observable property order of the module export
maintains insertion order. Now that properties are configurable, we no
longer need to reverse the export processing.

R=clemensh@chromium.org
TEST=mjsunit/asm/asm-validation
BUG=chromium:715420

Change-Id: Ib2024254c07bdad7fee1cf2fa0bd3e847721f5b5
Reviewed-on: https://chromium-review.googlesource.com/488022Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44891}

This fixes the bounds checking of "unsigned" numeric literals (those
that do not contains dots) by the parser. In particular this fixes a
bogus truncation to 32-bit in the scanner. It also makes the scanner
more robust by limiting the range of those numeric literals, hence
completely avoiding rounding loss or truncation errors.

R=clemensh@chromium.org
TEST=unittests/AsmJsScannerTest.UnsignedNumbers
BUG=v8:6298

Change-Id: Id31ab3c652e99fa8d3d6663315768e1bfaf3b773
Reviewed-on: https://chromium-review.googlesource.com/486881Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44890}

Add PropertyDetails::AttributesField + PropertyDetails::LocationField.

Review-Url: https://codereview.chromium.org/2842843004
Cr-Commit-Position: refs/heads/master@{#44889}

Instead of calculating the OSR entry point both in the bytecode analysis
and in the bytecode graph builder, calculate it once in the analysis and
use that calculation in the graph builder.

Old TODO from https://codereview.chromium.org/2558093005.

Change-Id: I071bc622beb55dc5eddaee25ef28e21fc4b477f0
Reviewed-on: https://chromium-review.googlesource.com/485899
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44888}

This makes e.g., load(file) work within Realm.eval(realm, "load(file)") to load files into that realm.

Bug:

Change-Id: I85738f0dfab621f2a8c9e2703f4ce4b39dd882bf
Reviewed-on: https://chromium-review.googlesource.com/484379Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44887}

Only create a singleton array for Array(len) if Type(len) cannot be
Number, otherwise we might need to throw an exception instead.

BUG=chromium:715404
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2838123004
Cr-Commit-Position: refs/heads/master@{#44886}

The only users of the LoadStoreOpcodeOf function were a number of
macros in wasm-macro-gen.h, and three test functions using it directly.
This CL refactors those functions to also use the macros.
In one case, this requires storing the value in a local variable first.

R=ahaas@chromium.org

Change-Id: Ia2fbf67a3831fafc9345e155eb240cf1bf6feb5d
Reviewed-on: https://chromium-review.googlesource.com/486842Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44885}

Also move the responsibility of marking builtins as initialized
to the deserializer.

R=jkummerow@chromium.org

Review-Url: https://codereview.chromium.org/2840493002
Cr-Original-Commit-Position: refs/heads/master@{#44802}
Committed: https://chromium.googlesource.com/v8/v8/+/a2b3a2fbc562584ec298dfe674c97662a125a59e
Review-Url: https://codereview.chromium.org/2840493002
Cr-Commit-Position: refs/heads/master@{#44884}

BUG=chromium:715204

Review-Url: https://codereview.chromium.org/2836203004
Cr-Commit-Position: refs/heads/master@{#44883}

v8-info.sh relies on svn and doesn't work
anymore.

Bug:

Change-Id: Ib4bc996897111bf12d08f3cf0b83154c9d7965a4
Reviewed-on: https://chromium-review.googlesource.com/485639Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Franziska Hinkelmann <franzih@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44882}

BUG=chromium:715151
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2839873004
Cr-Commit-Position: refs/heads/master@{#44881}

R=jarin@chromium.org
BUG=chromium:714696

Review-Url: https://codereview.chromium.org/2838143002
Cr-Original-Commit-Position: refs/heads/master@{#44854}
Committed: https://chromium.googlesource.com/v8/v8/+/87b5b53f6f3321ad33b15e686590da7b57df2ff9
Review-Url: https://codereview.chromium.org/2838143002
Cr-Commit-Position: refs/heads/master@{#44880}

Update the json file in js-perf-test with compare bytecode handler tests.
This cl (https://chromium-review.googlesource.com/c/485522/) adds new
tests but not all of them are updated in the json file.

Bug:v8:4280

Change-Id: Ifd1f479b770a4277fbba1de51ca2f7cbc26003cb
Reviewed-on: https://chromium-review.googlesource.com/487961Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44879}

- Throw TypeError in ValidateTypedArray, matching JSC, SpiderMonkey
  and ChakraCore.
- Validate typed arrays at start of each typed array prototype
  methods in src/js/typedarrays.js
- Add tests to check detached buffers
- Remove an unnecessary parameter of TypedArraySpeciesCreate
  in src/js/typedarrays.js
- Standardize TypedArray.prototype.subarray
- Update test262.status to pass detached buffer tests

Reland of https://codereview.chromium.org/2778623003

BUG=v8:4648, v8:4665, v8:4953
CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_trusty_blink_rel

Review-Url: https://codereview.chromium.org/2827443002
Cr-Commit-Position: refs/heads/master@{#44878}

Previously API function calls would only be optimized in TurboFan when
the receiver was a (compile-time) known constant, which was probably
only true for certain cases where functions where called on the global
proxy (the window object).

BUG=v8:5267,v8:6304
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2839953002
Cr-Commit-Position: refs/heads/master@{#44877}

Although we currently only support up to 1GB memory, we want to raise
this issue in the future. This test illustrates several issues we need
to be sure to fix first.

Bug: v8:6306
Change-Id: I362b7a9e51e8eb33a50e3b172a6f01d41995c3cb
Reviewed-on: https://chromium-review.googlesource.com/487047
Commit-Queue: Brad Nelson <bradnelson@chromium.org>
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44876}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/87cefe1..95c219b

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/892a0b6..380124f

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/5d201de..dc087f5

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: I2e0f396b5c52ab4d40318b2856852a4f4a0f2942
Reviewed-on: https://chromium-review.googlesource.com/487561Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44875}

We should be ready for gone agent.

BUG=chromium:714819
R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2842903002
Cr-Commit-Position: refs/heads/master@{#44874}

BUG=chromium:714486
R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2834363003
Cr-Commit-Position: refs/heads/master@{#44873}

Port 46d0e481

Original Commit Message:

    The CallApiCallbackStub can avoid loading undefined in case the
    call_data is already undefined, which doubles the number of versions of
    the stub and adds unnecessary complexity (at the benefit of saving one
    stupid load). The idea is to turn the CallApiCallbackStub into a single
    builtin instead, which does the right thing, so this is the first step
    towards that goal.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:6304
LOG=N

Review-Url: https://codereview.chromium.org/2837283004
Cr-Commit-Position: refs/heads/master@{#44872}

- introduced pausedContextGroupId,
- added targetContextGroupId param for V8Debugger::continueProgram method.

BUG=chromium:714955
R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2842733002
Cr-Commit-Position: refs/heads/master@{#44871}

Revert of [snapshot] full setup delegate should also be able to deserialize. (patchset #2 id:20001 of https://codereview.chromium.org/2840493002/ )

Reason for revert:
prime suspect for https://bugs.chromium.org/p/chromium/issues/detail?id=714976

Original issue's description:
> [snapshot] full setup delegate should also be able to deserialize.
>
> Also move the responsibility of marking builtins as initialized
> to the deserializer.
>
> R=jkummerow@chromium.org
>
> Review-Url: https://codereview.chromium.org/2840493002
> Cr-Commit-Position: refs/heads/master@{#44802}
> Committed: https://chromium.googlesource.com/v8/v8/+/a2b3a2fbc562584ec298dfe674c97662a125a59e

TBR=jkummerow@chromium.org,yangguo@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.

BUG=chromium:714976

Review-Url: https://codereview.chromium.org/2841993002
Cr-Commit-Position: refs/heads/master@{#44870}

The CallApiCallbackStub can avoid loading undefined in case the
call_data is already undefined, which doubles the number of versions of
the stub and adds unnecessary complexity (at the benefit of saving one
stupid load). The idea is to turn the CallApiCallbackStub into a single
builtin instead, which does the right thing, so this is the first step
towards that goal.

R=yangguo@chromium.org
BUG=v8:6304

Review-Url: https://codereview.chromium.org/2838143003
Cr-Commit-Position: refs/heads/master@{#44869}

Revert of [inspector] always include user scripts in the snapshot. (patchset #3 id:40001 of https://codereview.chromium.org/2836623002/ )

Reason for revert:
So that https://codereview.chromium.org/2841993002/ can be reverted.

Original issue's description:
> [inspector] always include user scripts in the snapshot.
>
> V8 can bundle user scripts in the start up snapshot. These are
> shared across contexts, and do not work well context groups.
>
> R=kozyatinskiy@chromium.org
> BUG=v8:6274
>
> Review-Url: https://codereview.chromium.org/2836623002
> Cr-Commit-Position: refs/heads/master@{#44847}
> Committed: https://chromium.googlesource.com/v8/v8/+/9685cfd310a51b2b32f97223069abaaca77405a8

TBR=kozyatinskiy@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:6274

Review-Url: https://codereview.chromium.org/2840923002
Cr-Commit-Position: refs/heads/master@{#44868}

In preparation for adding another verifier that only considers a subset
of the graph.

BUG=chromium:651354

Review-Url: https://codereview.chromium.org/2844473002
Cr-Commit-Position: refs/heads/master@{#44867}

BUG=chromium:651354

Review-Url: https://codereview.chromium.org/2842803002
Cr-Commit-Position: refs/heads/master@{#44866}

Also add more local variables to regress-v8-6077 to force
register spill on platform with 32 float registers.

BUG=

Review-Url: https://codereview.chromium.org/2822073003
Cr-Commit-Position: refs/heads/master@{#44865}

Evacuators shoud know their associated collector and thus figure out the
marking state themselves.

BUG=chromium:651354

Review-Url: https://codereview.chromium.org/2840863002
Cr-Commit-Position: refs/heads/master@{#44864}

This reverts commit 28930128.

Reason for revert: GC stress failures:
https://build.chromium.org/p/client.v8/builders/V8%20Mac%20GC%20Stress/builds/12958

Original change's description:
> [runtime] Keep FAST_SLOPPY_ARGUMENTS packed
> 
> With this CL SloppyArguments immediately go to dictionary elements on 
> deletion, keeping the arguments backing store packed.
> 
> Bug: v8:6251
> Change-Id: I2afa4fb5f0af9942eee0a1606942f5f289539330
> Reviewed-on: https://chromium-review.googlesource.com/480379
> Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#44857}

TBR=jkummerow@chromium.org,cbruni@chromium.org,v8-reviews@googlegroups.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Change-Id: I9482bf693a745d1301d068869ddae39f11143827
Reviewed-on: https://chromium-review.googlesource.com/486885Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44863}

Bug: chromium:713367
Change-Id: I3f5960f5b2da22c6468ca5a5ea9dc847b30c7fc7
Reviewed-on: https://chromium-review.googlesource.com/486360
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44862}

R=clemensh@chromium.org
TEST=mjsunit/asm/asm-validation
BUG=chromium:715068,v8:5877

Change-Id: I26e0b84c94e5f036336f39e9d764f0588ff3ec0d
Reviewed-on: https://chromium-review.googlesource.com/486882Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44861}

This makes an ObjectVisitor as powerful as a StaticVisitor and allows
slots recording in ObjectVisitor.

This patch also renames VisitCell method of ObjectVisitor to
VisitCellPointer, so that VisitCell is free to be used for actually
visiting a cell.

BUG=chromium:709075

Review-Url: https://codereview.chromium.org/2810653002
Cr-Commit-Position: refs/heads/master@{#44860}

This reverts commit 56a6fda3.

Reason for revert: Makes tsan flaky:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20TSAN/builds/15038

Original change's description:
> [parser] Inital parallel parse tasks implementation.
> 
> While parsing top-level code eager functions are skipped just like lazy
> ones, but also a parse task is created for each.
> 
> The parse tasks are run by the compiler dispatcher and can be executed
> either on background thread or in idle time.
> After parsing of top-level code finishes it waits for all unfinished
> parser tasks - possibly picking up and executing them on current thread.
> Afterwards parse task results are stitched together with top-level AST,
> in case of failures eager functions are treated just like lazy -
> parsing/compilation is retriggered for them in the runtime and proper
> errors are generated (performance is not optimized for error case at
> all).
> 
> BUG=v8:6093
> 
> Change-Id: I718dd2acc8a70ae1b09c2dea2616716605d7b05d
> Reviewed-on: https://chromium-review.googlesource.com/483439
> Commit-Queue: Wiktor Garbacz <wiktorg@google.com>
> Reviewed-by: Marja Hölttä <marja@chromium.org>
> Reviewed-by: Jochen Eisinger <jochen@chromium.org>
> Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#44849}

TBR=marja@chromium.org,vogelheim@chromium.org,jochen@chromium.org,wiktorg@google.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:6093

Change-Id: I17e689efee7d216d28a94a5c8147022ae7e830dd
Reviewed-on: https://chromium-review.googlesource.com/486883Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44859}

Port 3337cccc

Original Commit Message:

    Consistently support calls to host-C-linkage functions with up to 9 arguments
    from the simulator, and check that these limits aren't exceeded accidentally.

R=jgruber@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:6281
LOG=N

Review-Url: https://codereview.chromium.org/2841693003
Cr-Commit-Position: refs/heads/master@{#44858}

With this CL SloppyArguments immediately go to dictionary elements on 
deletion, keeping the arguments backing store packed.

Bug: v8:6251
Change-Id: I2afa4fb5f0af9942eee0a1606942f5f289539330
Reviewed-on: https://chromium-review.googlesource.com/480379
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44857}

Revert of [d8] console methods must not throw. (patchset #1 id:1 of https://codereview.chromium.org/2838143002/ )

Reason for revert:
Breaks no-intl builds.

Original issue's description:
> [d8] console methods must not throw.
>
> R=jarin@chromium.org
> BUG=chromium:714696
>
> Review-Url: https://codereview.chromium.org/2838143002
> Cr-Commit-Position: refs/heads/master@{#44854}
> Committed: https://chromium.googlesource.com/v8/v8/+/87b5b53f6f3321ad33b15e686590da7b57df2ff9

TBR=jarin@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:714696

Review-Url: https://codereview.chromium.org/2840853002
Cr-Commit-Position: refs/heads/master@{#44856}