Now that all accesses to the last match info are in C++ and TF code, we can
finally turn the last match info into a FixedArray. Similar to the ArrayList,
it uses its first field to store its length and grows dynamically in amortized
O(1) time.

Unlike previously, this means that the last match info pointer stored on the
context can actually change (in case the FixedArray needs to grow).

BUG=v8:5339

Review-Url: https://codereview.chromium.org/2415103002
Cr-Commit-Position: refs/heads/master@{#40308}

Introduce CSA_ASSERT macro that outputs a message, file name and line number to
console before calling DebugBreak.

Review-Url: https://codereview.chromium.org/2419433008
Cr-Commit-Position: refs/heads/master@{#40307}

These accessors also always call into C++ anyways, so there's no point
in having the JavaScript wrappers.

R=yangguo@chromium.org
BUG=v8:5049, chromium:655963

Committed: https://crrev.com/ede69cfabd790fe9f171b5d1f426ea0fc55e3c98
Review-Url: https://codereview.chromium.org/2417183002
Cr-Original-Commit-Position: refs/heads/master@{#40298}
Cr-Commit-Position: refs/heads/master@{#40306}

BUG=chromium:654343

Review-Url: https://codereview.chromium.org/2419783004
Cr-Commit-Position: refs/heads/master@{#40305}

This differentiates sancov files from several runs of the
same test. This situation happens when a test fails and is
rerun for flake checking.

BUG=v8:5502

Review-Url: https://codereview.chromium.org/2414093003
Cr-Commit-Position: refs/heads/master@{#40304}

Revert of [builtins] Also port the Object.prototype.__proto__ accessors to C++. (patchset #1 id:1 of https://codereview.chromium.org/2417183002/ )

Reason for revert:
[Sheriff] Speculative revert for webkit tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/10656

Was broken before, but this one test failure started with this CL:
inspector/console/console-dir.htm

All other errors stopped after another revert.

See also:
https://github.com/v8/v8/wiki/Blink-layout-tests

Original issue's description:
> [builtins] Also port the Object.prototype.__proto__ accessors to C++.
>
> These accessors also always call into C++ anyways, so there's no point
> in having the JavaScript wrappers.
>
> R=yangguo@chromium.org
> BUG=v8:5049
>
> Committed: https://crrev.com/ede69cfabd790fe9f171b5d1f426ea0fc55e3c98
> Cr-Commit-Position: refs/heads/master@{#40298}

TBR=yangguo@chromium.org,bmeurer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5049

Review-Url: https://codereview.chromium.org/2415173003
Cr-Commit-Position: refs/heads/master@{#40303}

'RETURN_RESULT(isolate, call, type)' is equivalent to 'return call' in
all current use cases.

BUG=

Review-Url: https://codereview.chromium.org/2415993003
Cr-Commit-Position: refs/heads/master@{#40302}

It's always JSFunction.

R=bmeurer@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2422573002
Cr-Commit-Position: refs/heads/master@{#40301}

R=machenbach@chromium.org,jgruber@chromium.org,mythria@chromium.org
CQ_INCLUDE_TRYBOTS=master.tryserver.v8:v8_win_dbg,v8_mac_dbg;master.tryserver.chromium.android:android_arm64_dbg_recipe

Review-Url: https://codereview.chromium.org/2410353005
Cr-Commit-Position: refs/heads/master@{#40300}

Revert of [inspector] Record EvaluateScript trace event upon console evaluation (patchset #2 id:20001 of https://codereview.chromium.org/2413943002/ )

Reason for revert:
Breaks layout tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/10647

See also:
https://github.com/v8/v8/wiki/Blink-layout-tests

Original issue's description:
> [inspector] Record EvaluateScript trace event upon console evaluation
>
> It will allow timeline to show JS profile on code evaluated from console.
>
> BUG=chromium:655430
>
> Committed: https://crrev.com/6882c91ecd222f3ee2feb42ad73fbc796d5c8172
> Cr-Commit-Position: refs/heads/master@{#40289}

TBR=caseq@chromium.org,paulirish@chromium.org,dgozman@chromium.org,alph@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:655430

Review-Url: https://codereview.chromium.org/2416213002
Cr-Commit-Position: refs/heads/master@{#40299}

These accessors also always call into C++ anyways, so there's no point
in having the JavaScript wrappers.

R=yangguo@chromium.org
BUG=v8:5049

Review-Url: https://codereview.chromium.org/2417183002
Cr-Commit-Position: refs/heads/master@{#40298}

R=machenbach@chromium.org,jgruber@chromium.org
CQ_INCLUDE_TRYBOTS=master.tryserver.v8:v8_win_dbg,v8_mac_dbg;master.tryserver.chromium.android:android_arm64_dbg_recipe

Review-Url: https://codereview.chromium.org/2417703003
Cr-Commit-Position: refs/heads/master@{#40297}

BUG=

Review-Url: https://codereview.chromium.org/2421493002
Cr-Commit-Position: refs/heads/master@{#40296}

R=ulan@chromium.org,cbruni@chromium.org,rmcilroy@chromium.org
BUG=v8:5215

Review-Url: https://codereview.chromium.org/2413243002
Cr-Commit-Position: refs/heads/master@{#40295}

This is done to introduce the correct bitcasts operator on the right nodes.

R=bmeurer@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2415133002
Cr-Commit-Position: refs/heads/master@{#40294}

This calls into C++ anyways, so no need to add the JavaScript wrapper
around it.

R=yangguo@chromium.org
BUG=v8:5049

Review-Url: https://codereview.chromium.org/2421803002
Cr-Commit-Position: refs/heads/master@{#40293}

Revert of [heap] Move slot filtering logic into sweeper. (patchset #4 id:60001 of https://codereview.chromium.org/2418773002/ )

Reason for revert:
[Sheriff] Speculative revert for heap corruption on all platforms, e.g.:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20debug/builds/12377
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20debug/builds/12379
https://build.chromium.org/p/client.v8/builders/V8%20Win32/builds/4819
https://build.chromium.org/p/client.v8/builders/V8%20Win32%20-%20nosnap%20-%20shared/builds/16783
https://build.chromium.org/p/client.v8/builders/V8%20Mac64%20-%20debug/builds/10007

Original issue's description:
> [heap] Move slot filtering logic into sweeper.
>
> BUG=chromium:648568
>
> Committed: https://crrev.com/18db69c38c93450c1ae957999fc48c465f111f00
> Cr-Commit-Position: refs/heads/master@{#40267}

TBR=ulan@chromium.org,mlippautz@chromium.org,hpayer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:648568

Review-Url: https://codereview.chromium.org/2418053002
Cr-Commit-Position: refs/heads/master@{#40292}

Rolling v8/base/trace_event/common: https://chromium.googlesource.com/chromium/src/base/trace_event/common/+log/98499f3..06294c8

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/f9e6643..ee1c1b5

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapul/+log/5b5774b..c73d4a1

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clan/+log/6551b7f..6ba3d23

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2418033002
Cr-Commit-Position: refs/heads/master@{#40291}

Inspected context is created in V8InspectorImpl::contextCreated method and destroyed in V8InspectorImpl::contextDestroyed.
Both methods takes valid v8::Local<v8::Context> handle to the same context, it means that context is created before InspectedContext constructor and is always destroyed after InspectedContext destructor therefore context weak callback in inspected context should be never called.
It's possible only if inspector client doesn't call contextDestroyed which is considered an error.

Therefore CHECK(false) is added into context weak callback to be sure that v8::Context always survives inspected context.

BUG=chromium:652548
R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2413583002
Cr-Commit-Position: refs/heads/master@{#40290}

It will allow timeline to show JS profile on code evaluated from console.

BUG=chromium:655430

Review-Url: https://codereview.chromium.org/2413943002
Cr-Commit-Position: refs/heads/master@{#40289}

If current locale has "," as decimal separator then message for consoleAPICalled will be corrupted.

BUG=chromium:653424
R=dgozman@chromium.org

Committed: https://crrev.com/dde5ef75cbac1eb7e2dae59b246e4a0d0ba6a0f4
Review-Url: https://codereview.chromium.org/2410933002
Cr-Original-Commit-Position: refs/heads/master@{#40190}
Cr-Commit-Position: refs/heads/master@{#40288}

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2411793006
Cr-Commit-Position: refs/heads/master@{#40287}

Review-Url: https://codereview.chromium.org/2412393003
Cr-Commit-Position: refs/heads/master@{#40286}

Revert of [turbofan] Enable super constructor inlining. (patchset #1 id:1 of https://codereview.chromium.org/2409423006/ )

Reason for revert:
As adamk@ pointed out, this is not correct. Some more changes required instead

Original issue's description:
> [turbofan] Enable super constructor inlining.
>
> When we inlined a [[Construct]] call to a subclass constructor, we can
> also inline the super constructor call (either explicit or implicit),
> since we have a concrete JSFunction constant for the subclass and we
> can thus constant-fold the %_GetSuperConstructor intrinsic. We don't
> need any guards here since the prototype of subclass constructors is
> non-writable, non-configurable in ES6.
>
> BUG=v8:5517
> R=jarin@chromium.org
>
> Committed: https://crrev.com/74158b00b3f6a1fc8676dd1f7af4d96131eb5ebe
> Cr-Commit-Position: refs/heads/master@{#40261}

TBR=jarin@chromium.org,adamk@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5517

Review-Url: https://codereview.chromium.org/2413883003
Cr-Commit-Position: refs/heads/master@{#40285}

R=ulan@chromium.org
BUG=chromium:468240

Review-Url: https://codereview.chromium.org/2418803003
Cr-Commit-Position: refs/heads/master@{#40284}

R=machenbach@chromium.org
BUG=v8:5513

Review-Url: https://codereview.chromium.org/2416433005
Cr-Commit-Position: refs/heads/master@{#40283}

BUG=

Review-Url: https://codereview.chromium.org/2417773004
Cr-Commit-Position: refs/heads/master@{#40282}

This CL also adds separate runtime call stats buckets for data handlers.

BUG=

Review-Url: https://codereview.chromium.org/2419513002
Cr-Commit-Position: refs/heads/master@{#40281}

R=ahaas@chromium.org, titzer@chromium.org
BUG=v8:5507

Review-Url: https://codereview.chromium.org/2421453002
Cr-Commit-Position: refs/heads/master@{#40280}

Revert of [heap] Cancel tasks before tearing down the heap. (patchset #2 id:20001 of https://codereview.chromium.org/2413203004/ )

Reason for revert:
Timeout on gc stress bot.

Original issue's description:
> [heap] Cancel tasks before tearing down the heap.
>
> BUG=chromium:654343
>
> Committed: https://crrev.com/9365463d6f1fc11b2369fff63ca0ac825c61eae4
> Cr-Commit-Position: refs/heads/master@{#40272}

TBR=mlippautz@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:654343

Review-Url: https://codereview.chromium.org/2414073002
Cr-Commit-Position: refs/heads/master@{#40279}

When the test is executed in user mode qemu for mips64, it fails because
the buffer is too small. Increasing the buffer fixes the problem.

BUG=
TEST=cctest/test-mark-compact/RegressJoinThreadsOnIsolateDeinit

Review-Url: https://codereview.chromium.org/2416573002
Cr-Commit-Position: refs/heads/master@{#40278}

This ports RegExpInitialize, IsRegExp, InternalMatch and InternalReplace to C++
/ TurboFan. InternalMatch is in TurboFan because it calls RegExpExecStub and
needs to construct a RegExpResult (which are, respectively, a PlatformStub and
a CodeStubAssembler function).

Except for LastMatchInfo (and GetSubstitution, which could be moved to string.js
anytime), regexp.js is now completely empty.

BUG=v8:5339

Review-Url: https://codereview.chromium.org/2409513003
Cr-Commit-Position: refs/heads/master@{#40277}

GCC on S390 31-bit treats size_t as 'long unsigned int', which
is incompatible with %d format specifier that expects an 'int'.
Using the appropriate macro (PRIuS) instead.

R=mlippautz@chromium.org, ulan@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2412563003
Cr-Commit-Position: refs/heads/master@{#40276}

This is automatically taken into account in the Parser constructor already

BUG=v8:5501

Review-Url: https://codereview.chromium.org/2409103005
Cr-Commit-Position: refs/heads/master@{#40275}

With --trace-ic flag, the function names and the source positions are
not shown for interpreted functions. Interpreted functions have an extra
frame built by bytecode handlers which has to be skipped to get the
interpreted function's frame. Also the code offsets are computed differently
for interpreted functions.

BUG=v8:4280

Review-Url: https://codereview.chromium.org/2405173007
Cr-Commit-Position: refs/heads/master@{#40274}

R=ahaas@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2411963003
Cr-Commit-Position: refs/heads/master@{#40273}

BUG=chromium:654343

Review-Url: https://codereview.chromium.org/2413203004
Cr-Commit-Position: refs/heads/master@{#40272}

A decoder error sets builder_ to null, which causes builder_->StackCheck
to segfault.

R=titzer@chromium.org

TEST=mjsunit/regress/wasm/loop-stack-check

Review-Url: https://codereview.chromium.org/2416873002
Cr-Commit-Position: refs/heads/master@{#40271}

R=ishell@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2410353004
Cr-Commit-Position: refs/heads/master@{#40270}

BUG=v8:5501

Review-Url: https://codereview.chromium.org/2417643004
Cr-Commit-Position: refs/heads/master@{#40269}