And then lower it afterwards. This is more future-proof for
multi-return values.

R=titzer@chromium.org
CC=​rossberg@chromium.org

Bug: v8:6672
Change-Id: I6505b049275360c32530992c1db8765254b405c1
Reviewed-on: https://chromium-review.googlesource.com/602036
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47166}

Bug: v8:6563
Change-Id: Id4578b90133ef4a6797233ff0e859ddc3dfbb54f
Reviewed-on: https://chromium-review.googlesource.com/599848
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47165}

This is a modified reland of 062bb7d4

There's an inherent trade-off when deciding between ATOM and IRREGEXP
regexps: IRREGEXP is faster at runtime for all but trivial short
patterns, while ATOM regexps have a lower memory overhead.

This CL is intended to help investigate impact on benchmarks and real-world
code - if something tanks, it's easy to revert, otherwise it can be a first
step towards a possible removal of ATOM regexps.

Bug: v8:6633
Change-Id: I8d946a7cbb398d4987b47ecba24c9faa88788d0d
Reviewed-on: https://chromium-review.googlesource.com/599910Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47164}

This bug was introduced by the CL
https://chromium-review.googlesource.com/c/586707

With these changes we make sure that the object being deoptimized 
does not point to code objects that have been already collected. 
The CL https://chromium-review.googlesource.com/c/596027 did not
fix this problem because we were only invalidating embedded objects
reachable from the stack, however it is possible that there are some 
dangling references in objects not on the stack. Thus we consider 
all the optimized code objects that are marked for deoptimization.

Bug: v8:751825
Change-Id: I3a6410c2bf556fa254c54a25e1f49d7356b9e51d
Reviewed-on: https://chromium-review.googlesource.com/601967
Commit-Queue: Juliana Patricia Vicente Franco <jupvfranco@google.com>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47163}

The signature is already set on the {WasmGraphBuilder}, so we don't
need to pass it again to the {Build*} functions.

R=titzer@chromium.org

Change-Id: I21e93f78211e84a9960b3fd5dffc1c94778b85e5
Reviewed-on: https://chromium-review.googlesource.com/602034Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47162}

This reverts commit 40a9eabc.

Reason for revert: https://bugs.chromium.org/p/chromium/issues/detail?id=752438

Original change's description:
> Reland "[turbofan] enable new implementation of escape analysis"
> 
> This is a reland of a6c3f143
> Original change's description:
> > [turbofan] enable new implementation of escape analysis
> > 
> > Bug: 
> > Change-Id: I0218ab67bf391deb8f1b1b78811643eb84745b7c
> > Reviewed-on: https://chromium-review.googlesource.com/595508
> > Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#47032}
> 
> Change-Id: Ide3d11f4b25eae2bbcaca9fc3cdb983d73ba846c
> Reviewed-on: https://chromium-review.googlesource.com/599827
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#47121}

TBR=jarin@chromium.org,tebbi@chromium.org

Change-Id: I3b700fb92265c7e27c009a5371038bc25619d37f
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/602067Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47161}

Moves the construction of CompilationInfo for unoptimized code into
GenerateUnoptimizedCode in preparation for making it owned by the
unoptimized compilation jobs (to be done in a followup CL).

This CL also adds a new constructor for creation of unoptimized
CompilationInfos with fields correctly initialized and updates the existing
constructor to he exclusively for optimized compilation. Finally, also moves
the call to RecordFunctionCompilation with LAZY_COMPILE_TAG recording into
FinalizeUnoptimizedCompilationJob where it is called for other unoptimized
compiles.

BUG=v8:5203,v8:6659

Change-Id: Icfd7f56588073f2fc547e002db9fa99843ed2e8b
Reviewed-on: https://chromium-review.googlesource.com/598908
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47160}

This reland is after fix in [heap] Delete wrong DCHECK.
It includes moving ProxyGetProperty to its own stub to reduce
binary size.

This is a reland of 47a97aa5
Original change's description:
> [builtins] Port getting property from Proxy to CSA
> 
> Bug: v8:6559, v8:6557
> Change-Id: If6c51f5483adb73ddd2495cede5d85e887a3c298
> Reviewed-on: https://chromium-review.googlesource.com/589212
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Maya Lekova <mslekova@google.com>
> Cr-Commit-Position: refs/heads/master@{#47113}

Bug: v8:6559, v8:6557
Change-Id: I76acd97ba1acb62b7e7983db1741441d997050f0
Reviewed-on: https://chromium-review.googlesource.com/600215
Commit-Queue: Maya Lekova <mslekova@google.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Franziska Hinkelmann <franzih@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47159}

Calling the Array constructor is an edge case, and we don't seem to
benefit from doing the AllocationSite tracking there as well. In fact
it's a lot of complexity and somewhat blocking the more important 
optimization of the subclass constructors.

This is an attempt to nuke the CallIC support for AllocationSites. If
it regresses something important, we'll have to find another way.

Bug: v8:6399
Change-Id: I56f6da29679c516f0a5c3161c2696fc2b8762176
Reviewed-on: https://chromium-review.googlesource.com/600968Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47158}

In order to limit the overall length of error message, limit the output
of string provided by the user. This is implemented by a helper class
which takes the maximum length as template argument and has simple
accessors for the start address and the length of the truncated string.

This is the compromise CL after
https://chromium-review.googlesource.com/c/566815 and
https://chromium-review.googlesource.com/c/594288.

R=titzer@chromium.org

Bug: chromium:740023, chromium:749041, v8:6634
Change-Id: I7c154eb18b3a6befd5ecabbd2f435b015ad71542
Reviewed-on: https://chromium-review.googlesource.com/600547Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47157}

This fixes a missing fast-path check in the code-stub implementation of
the {Array.prototype.filter} method. Appending to the target JSArray is
only correct if the underlying length did not change.

R=jgruber@chromium.org
TEST=mjsunit/regress/regress-6657
BUG=v8:6657

Change-Id: Ida8d3511485b649b70d9a4b161742d494ebe4dac
Reviewed-on: https://chromium-review.googlesource.com/600467Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47156}

Bug: chromium:694255
Change-Id: Id1ae4eb069a4ba79a35f1bb6b2bc2b1c445edb96
Reviewed-on: https://chromium-review.googlesource.com/600969Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47155}

Remove the include of frames.h in isolate.h and the include of
frames-inl.h from various places, e.g. architecture-specific builtin
files.

R=yangguo@chromium.org

Bug: 
Change-Id: If8d13188474702fd0b0c298f8e45ef393184b877
Reviewed-on: https://chromium-review.googlesource.com/600212Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47154}

concurrent marker.

Bug: chromium:694255
Change-Id: I973ba8df7a4afc5f58ede02f3f6d043cf7038784
Reviewed-on: https://chromium-review.googlesource.com/600970Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47153}

R=petermarshall@chromium.org

Change-Id: Ie62129f39e1085a94737406dc07b07e359294c4e
Reviewed-on: https://chromium-review.googlesource.com/599813Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47152}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/6a89d4e..4736539

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/c8c5d6b..a62e07f

TBR=machenbach@chromium.org,hablich@chromium.org

Change-Id: I9b54d11ef4f0d14b098f47d6257403d976faa419
Reviewed-on: https://chromium-review.googlesource.com/601551Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47151}

extending existing transition target storage (so both inline storage
on the map, and the "target" slots in TransitionArrays are supported).

Change-Id: Ib360b9755b8ca5f08bc3a25dd27833f348badaf4
Reviewed-on: https://chromium-review.googlesource.com/584192
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47150}

Bug: 
Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng
Change-Id: I2e1b36303f8b9ad4a3dc4e488123e6e4ce8b02ec
Reviewed-on: https://chromium-review.googlesource.com/533033
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47149}

R=mtrofin@chromium.org

Change-Id: I665065b7e1161bcef6315a03083437410c574755
Reviewed-on: https://chromium-review.googlesource.com/601174
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47148}

This fixes the collection of function sizes (see comment #1 of
v8:6361).  This was done by adding a wrapper function around
VerifyWasmCode() that updates UMA stats for function size (as well as
decode time when validating).

Bug: v8:6361
Change-Id: Ia2597db22cbed5b0429d9c8514e96cdea5d7323a
Reviewed-on: https://chromium-review.googlesource.com/600530
Commit-Queue: Karl Schimpf <kschimpf@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47147}

Collect compile time separately for asm.js and Wasm functions.

Note: Dependent on CL https://chromium-review.googlesource.com/c/598542

Bug: v8:6361
Change-Id: I77c43b663cb66261f17bca73db03ab1a4af5e11d
Reviewed-on: https://chromium-review.googlesource.com/598930
Commit-Queue: Karl Schimpf <kschimpf@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47146}

Port 4b0099a4

R=mstarzinger@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, bjaideep@ca.ibm.com
BUG=
LOG=N

Change-Id: I4be5357b265ca970a8d1a0db41ddc73ff47bffdc
Reviewed-on: https://chromium-review.googlesource.com/600512Reviewed-by: Jaideep Bajwa <bjaideep@ca.ibm.com>
Commit-Queue: Jaideep Bajwa <bjaideep@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#47145}

This patch removes tracking of
- V8.GCIdleTimeAllottedInMS
- V8.GCIdleTimeLimit.Overshot
- V8.GCIdleTimeLimit.Undershot

BUG=chromium:751045

Change-Id: Iccaa0fff609d3caa4cf38ebcc8aca7cdca33c442
Reviewed-on: https://chromium-review.googlesource.com/595588
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47144}

Change-Id: Ic9da54513d92736899ce8ad67a5e588011314640
Reviewed-on: https://chromium-review.googlesource.com/600988Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47143}

On advancing the iterator we need to reset the current object,
so that it can be lazily reloaded later on.

TBR=mlippautz@chromium.org

Bug: chromium:694255
Change-Id: If7ddd8670df9d11837f491503312919b55b451fe
Reviewed-on: https://chromium-review.googlesource.com/600687
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47142}

Make sure to fail PrepareTransfer when the transferables array contains
a non-ArrayBuffer, otherwise the function leaks a scheduled_exception.

Bug: chromium:736565
Change-Id: I64c2e09eb92720519c7bda2dca41749ff5ac9c8d
Reviewed-on: https://chromium-review.googlesource.com/599357
Commit-Queue: Ben Smith <binji@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47141}

R=titzer@chromium.org

Bug: 
Change-Id: I2710aa5605bf2a26b6f86db98338dd54b6b87d2a
Reviewed-on: https://chromium-review.googlesource.com/600235
Commit-Queue: Andreas Rossberg <rossberg@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47140}

R=titzer@chromium.org

Bug: 
Change-Id: Ib1a13b5131ec1b5a155c893de3c5ceb376bd33a3
Reviewed-on: https://chromium-review.googlesource.com/600227
Commit-Queue: Andreas Rossberg <rossberg@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47139}

We need to modify that module, e.g. to add signatures to the signature
maps. Hence it cannot be const.

R=titzer@chromium.org
CC=mtrofin@chromium.org

Change-Id: I261af5b4233a0b2ec8031a9cbe0cf9f826316ae0
Reviewed-on: https://chromium-review.googlesource.com/600428Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47138}

Change-Id: I42f51fd00b1a21a1ff7ef2379fbf81a42266a737
Reviewed-on: https://chromium-review.googlesource.com/599111Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47137}

This fixes collection of function decoding time (See comment #20 of
v8:6361). Updated other path for decoding to also update UMA stat.

Bug: v8:6361
Change-Id: I8e6cb398aebd7847e064d3b9a979586ded118513
Reviewed-on: https://chromium-review.googlesource.com/598458
Commit-Queue: Karl Schimpf <kschimpf@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47136}

R=mstarzinger@chromium.org

Bug: 
Change-Id: Ia416acd8c12a3c8e3fdfabc56a4cd31cb946c88c
Reviewed-on: https://chromium-review.googlesource.com/599949
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47135}

An optimization in li checks if a value has all their "n" LSBs set to
one, and their "64-n" MSBs set to zero. This is done by checking
base::bits::IsPowerOfTwo(value + 1), but this doesn't cover the case
when only MSB is zero, and other bits are one. Added another check that
covers the missing case, this also fixes Dsubu test.

BUG=
TEST=cctest/test-assembler-mips/Dsubu

Change-Id: I97b8fb4984af3b7f974ba901e3a1a9c89e925805
Reviewed-on: https://chromium-review.googlesource.com/598228Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@imgtec.com>
Commit-Queue: Miran Karić <Miran.Karic@imgtec.com>
Cr-Commit-Position: refs/heads/master@{#47134}

R=titzer@chromium.org

Bug: v8:5815
Change-Id: Ied267a431ed294f022628169e811069f2a4851b1
Reviewed-on: https://chromium-review.googlesource.com/599875
Commit-Queue: Andreas Rossberg <rossberg@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47133}

This reverts commit b9acf4ed.

Bug: chromium:694255
Change-Id: I62766e8b32cfa16af39a28ad07fecd72441ad8cd
Reviewed-on: https://chromium-review.googlesource.com/598468Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47132}

This is a reland of 35c923cc
Original change's description:
> [heap] Add support for atomic access to page flags.
> 
> This patch renames AsAtomicWord to AsAtomicPointer and
> adds new AsAtomicWord that works with intptr_t.
> 
> Slot recording uses atomic page flag accessors.
> 
> BUG=chromium:694255
> 
> Change-Id: I1c692813244b41320182e9eea50462d1802fcd98
> Reviewed-on: https://chromium-review.googlesource.com/597688
> Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#47086}

Bug: chromium:694255
Change-Id: I36780ff4001e068815d4be1e16cd06f1a4f98d13
Reviewed-on: https://chromium-review.googlesource.com/599909Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47131}

This DCHECK is incorrect in no-snapshot builds because we can run 
garbage collection while deserializing the snapshot.

Bug: v8:6559, v8:6557
Change-Id: I0b8456ee19443f796889656952b236ff40b1e2fb
Reviewed-on: https://chromium-review.googlesource.com/600367Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Maya Lekova <mslekova@google.com>
Cr-Commit-Position: refs/heads/master@{#47130}

BUG=v8:5203

Change-Id: I2c4854096bda35fbfb50820e9fb2ece2cb029e55
Reviewed-on: https://chromium-review.googlesource.com/597927Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47129}

R=titzer@chromium.org

Bug: v8:6647
Change-Id: I73f19111b5c40988d57e9086852da902ba36acb2
Reviewed-on: https://chromium-review.googlesource.com/599872Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Andreas Rossberg <rossberg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47128}

R=rossberg@chromium.org

Bug: 
Change-Id: I2401709b42106c7e325144b53be3c3b3d1ed16c7
Reviewed-on: https://chromium-review.googlesource.com/599874Reviewed-by: Andreas Rossberg <rossberg@chromium.org>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47127}