R=marja@chromium.org

Change-Id: I3efa9e87f985b3ccb63c89881340a0e3ec7875f0
Reviewed-on: https://chromium-review.googlesource.com/522643Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45685}

R=machenbach@chromium.org

Change-Id: If25d0d34179b326f3a7b292f30299fe48a0aa1e2
Reviewed-on: https://chromium-review.googlesource.com/522127Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Jochen Eisinger <jochen@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45684}

During incremental marking we need to clear to old generation
mark bits for promoted pages.

Bug: chromium:651354
Change-Id: I986de08d6a123b2eff3dd7824729cc1cfe29aeba
Reviewed-on: https://chromium-review.googlesource.com/522665Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45683}

Bug: v8:5717
Change-Id: I5e46dbeee9e3383253c2fbebb9623325f5e4e01d
Reviewed-on: https://chromium-review.googlesource.com/520714Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45682}

Execution tests regress-336820 and regress-678917 finished with error
messages "allocation failure GC in old space requested" and "fatal
javascript OOM in CALL_AND_RETRY_LAST". For successful execution,
parameter max_old_space_size must be increased and this is done inside
tests.

TEST=mjsunit/regress/regress-336820,
     mjsunit/regress/regress-678917
BUG=

Review-Url: https://codereview.chromium.org/2907363003
Cr-Original-Commit-Position: refs/heads/master@{#45672}
Committed: https://chromium.googlesource.com/v8/v8/+/1550c869094c5873da9226ae9b4de7084692a857
Review-Url: https://codereview.chromium.org/2907363003
Cr-Commit-Position: refs/heads/master@{#45681}

TBR=tandrii@chromium.org,kjellander@chromium.org
NOTRY=true
NOTREECHECKS=true

Bug: chromium:726584
Change-Id: Ia0b2cbde1949adced9554b0fb1420c21405d24f3
Reviewed-on: https://chromium-review.googlesource.com/522608Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45680}

When the input to Function.prototype.bind is a known function, we can
inline the allocation of the JSBoundFunction into TurboFan, which
provides a 2x speed-up for several hot functions in Node streams (as
discovered by Matteo Collina). One of example of this can be found in
https://github.com/nodejs/node/pull/13322, which can be optimized and
made more readable using bind instead of closures.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2916063002
Cr-Commit-Position: refs/heads/master@{#45679}

Based on past discussions I'm going to try to reland this change. This makes window.document and document behave the same after navigation, which is a change from what the spec says. If this works out though, it would greatly simplify the spec; and fix the fact that currently it's leaking the underlying global object, which we don't want for security and object-identity reasons.

Bug: chromium:713732
Change-Id: I5ce89afb46349ff92b7f5a884a7c388fcff887bf
Reviewed-on: https://chromium-review.googlesource.com/522605Reviewed-by: Kentaro Hara <haraken@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45678}

We want to be stricter about checking in the future, so give embedders a
way to disable checking while they fix their microtasks scopes.

BUG=chromium:728583
R=machenbach@chromium.org

Change-Id: I443575bf6820b432def59cbbd4d048b2007573c8
Reviewed-on: https://chromium-review.googlesource.com/522604
Commit-Queue: Jochen Eisinger <jochen@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45677}

NOTRY=true
NOTREECHECKS=true
TBR=tandrii@chromium.org,kjellander@chromium.org

Bug: chromium:726584
Change-Id: I3bf3587e2d58c34b5697785c6033d28eb584146d
Reviewed-on: https://chromium-review.googlesource.com/522126
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45676}

This is a first step towards reducing the number of stores/loads when suspending/resuming a generator.

Unfortunately, even for an empty generator, we still use 8 register for various things (try-finally, copies of generator object, parser-introduced temporaries). I will try to get rid of these in separate CLs.

Changes:

- SuspendGenerator bytecode now takes register list to save.
- ResumeGenerator was split into two bytecodes:
  * Resume generator reads the state out and marks the generator as
      'executing'.
  * RestoreGeneratorRegisters reloads the registers from
      the generator.
    + this required adding support for output register list.

- Introduced generator_object_ register in the bytecode generator.
  * in subsequent CLs, I will make better use of it, the goal is
      to get rid if the .generator_object local variable.

- Taught register optimizer to flush unassigned registers.

BUG=v8:6379

Review-Url: https://codereview.chromium.org/2894293003
Cr-Commit-Position: refs/heads/master@{#45675}

Bug: v8:5717
Change-Id: I87cfef5d6d69106fd454338e77c2c703fcdba67b
Reviewed-on: https://chromium-review.googlesource.com/520576Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45674}

Revert of [heap] Decrease old space physical memory factor. (patchset #3 id:40001 of https://codereview.chromium.org/2907363003/ )

Reason for revert:
Fails on other bots now:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20debug/builds/16197
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/builds/13170
https://build.chromium.org/p/client.v8.ports/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20gc%20stress/builds/6749

Original issue's description:
> Fix tests regress-336820 and regress-678917.
>
> Execution tests regress-336820 and regress-678917 finished with error
> messages "allocation failure GC in old space requested" and "fatal
> javascript OOM in CALL_AND_RETRY_LAST". For successful execution,
> parameter max_old_space_size must be increased and this is done inside
> tests.
>
> TEST=mjsunit/regress/regress-336820,
>      mjsunit/regress/regress-678917
> BUG=
>
> Review-Url: https://codereview.chromium.org/2907363003
> Cr-Commit-Position: refs/heads/master@{#45672}
> Committed: https://chromium.googlesource.com/v8/v8/+/1550c869094c5873da9226ae9b4de7084692a857

TBR=hpayer@chromium.org,jochen@chromium.org,mlippautz@chromium.org,mstarzinger@chromium.org,ulan@chromium.org,ivica.bogosavljevic@imgtec.com,bmeurer@chromium.org,jarin@chromium.org,ishell@chromium.org,Ilija.Pavlovic@imgtec.com,Ilija.Pavlovic@imgtec.com,Ilija.Pavlovic@imgtec.com,Ilija.Pavlovic@imgtec.com
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review-Url: https://codereview.chromium.org/2917063002
Cr-Commit-Position: refs/heads/master@{#45673}

Execution tests regress-336820 and regress-678917 finished with error
messages "allocation failure GC in old space requested" and "fatal
javascript OOM in CALL_AND_RETRY_LAST". For successful execution,
parameter max_old_space_size must be increased and this is done inside
tests.

TEST=mjsunit/regress/regress-336820,
     mjsunit/regress/regress-678917
BUG=

Review-Url: https://codereview.chromium.org/2907363003
Cr-Commit-Position: refs/heads/master@{#45672}

BUG=chromium:728228,chromium:626082
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_chromium_rel_ng

Review-Url: https://codereview.chromium.org/2917853004
Cr-Commit-Position: refs/heads/master@{#45671}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/54fde1e..a055d2e

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/e6ad063..b33525e

Rolling v8/third_party/icu: https://chromium.googlesource.com/chromium/deps/icu/+log/c844075..ae18d60

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: I5da56e51e4c890df61ef9b55f2a4d271d55ec922
Reviewed-on: https://chromium-review.googlesource.com/522165Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45670}

This is just a cleanup patch.

BUG=none

Review-Url: https://codereview.chromium.org/2921623006
Cr-Commit-Position: refs/heads/master@{#45669}

This is in an effort to narrow down the root cause of the
referenced, very flaky, bug.

Bug: chromium:725559
Change-Id: I8235983fea6f579d228e81177fdcac9ef6115d1f
Reviewed-on: https://chromium-review.googlesource.com/521923Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Mircea Trofin <mtrofin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45668}

This patch adds ability to connect multiple sessions to a single context group. This is an experimental feature, which is already supported in test harness.

So far covered runtime domain with tests (and found a bug thanks to the test). More tests to follow in next patches, probably with code adjustments as well.

BUG=chromium:590878

Review-Url: https://codereview.chromium.org/2906153002
Cr-Commit-Position: refs/heads/master@{#45667}

Similar to marking, seed the pointers updating with items.

Bug: chromium:726040
Change-Id: Iaa480d153de96d744c425c478c68e7629550c85a
Reviewed-on: https://chromium-review.googlesource.com/521145Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45666}

BUG=chromium:724972

R=clemensh@chromium.org, rossberg@chromium.org

Review-Url: https://codereview.chromium.org/2917603002
Cr-Commit-Position: refs/heads/master@{#45665}

Bug: v8:5717, v8:6354, v8:6410
Change-Id: Ie652f4358f2a68c7ea76d546e26a6b4fb815df4a
Reviewed-on: https://chromium-review.googlesource.com/518923
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45664}

Currently x instanceof Map/Set checks cannot take the fast path, since
the Map/Set constructor has dictionary properties. To avoid that, just
forcibly migrate the Map/Set constructor to fast properties again once
it's fully setup in the bootstrapper.

Bug: v8:5717, v8:5902
Change-Id: I23dfd00456c9206a0ca5af71dfbc9236982936fc
Reviewed-on: https://chromium-review.googlesource.com/520578
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45663}

Add support for S1x4And, S1x4Or, S1x4Xor, S1x4Not, S1x4AnyTrue,
S1x4AllTrue, S1x8And, S1x8Or, S1x8Xor, S1x8Not, S1x8AnyTrue,
S1x8AllTrue, S1x16And, S1x16Or, S1x16Xor, S1x16Not, S1x16AnyTrue,
S1x16AllTrue, SimdLoad, SimdStore operations for mips32 and mips64
architectures.

BUG=

Review-Url: https://codereview.chromium.org/2801683003
Cr-Commit-Position: refs/heads/master@{#45662}

This fixes an issue with ful-codegen where code target entries for the OSR
check were being incorrectly shared. We now explicitly disable sharing of code
target constant pool entries for full-codegen and for calls to builtins from
WASM code, using a scope.

BUG=chromium:725743

Review-Url: https://codereview.chromium.org/2922433002
Cr-Commit-Position: refs/heads/master@{#45661}

R=clemensh@chromium.org
TEST=mjsunit/asm/regress-719866
BUG=chromium:719866

Change-Id: I6cc9f222769aa036275654286c9c6271ef2d1334
Reviewed-on: https://chromium-review.googlesource.com/520945Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45660}

Revert "Reland "[runtime] Pass global proxy as receiver to native accessors in case of contextual access""

This reverts commit ba8a7539.

Reason for revert: A layout test is unhappy:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/16010

Original change's description:
> Reland "[runtime] Pass global proxy as receiver to native accessors in case of contextual access"
> 
> Based on past discussions I'm going to try to reland this change. This makes window.document and document behave the same after navigation, which is a change from what the spec says. If this works out though, it would greatly simplify the spec; and fix the fact that currently it's leaking the underlying global object, which we don't want for security and object-identity reasons.
> 
> Bug: chromium:713732
> Change-Id: I835ef510fc78f04c602434a7cec6420e027c4012
> Reviewed-on: https://chromium-review.googlesource.com/520764
> Commit-Queue: Toon Verwaest <verwaest@chromium.org>
> Reviewed-by: Kentaro Hara <haraken@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#45654}

TBR=haraken@chromium.org,verwaest@chromium.org
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:713732

Change-Id: Iecde1cd855c21efa73939bbfbff0c26540ee2d98
Reviewed-on: https://chromium-review.googlesource.com/521045Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45659}

SRWLOCK is a faster and lightweight alternative of CRITICAL_SECTION for
non-recursive use case.

Bug: chromium:592752
Change-Id: Ie97cd9cee2d50a95f316b41c30e953f586b06c99
Reviewed-on: https://chromium-review.googlesource.com/520828Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Commit-Queue: Loo Rong Jie <loorongjie@gmail.com>
Cr-Commit-Position: refs/heads/master@{#45658}

Furthermore avoid lock-step between pointer updating phases as they
should execute in parallel without synchronization restrictions.

This reverts commit bc6adb86.

Bug: chromium:726040
Change-Id: I1713d4333f0ce1604ff51c02461f3ef91e4bdaed
Reviewed-on: https://chromium-review.googlesource.com/521062Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45657}

On left trimming the main thread ensures that the array
is black before changing its map and length.

The concurrent marker snapshots the length of the array
and then tries to change its color to black. If the change
is successful, then the array is iterated using the saved
length.


BUG=chromium:694255

Change-Id: Ib06c1c9c3240ace56c1897e5a73462aa447d41f5
Reviewed-on: https://chromium-review.googlesource.com/519323Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45656}

Embedders should use Module::InstantiateModule

R=neis@chromium.org

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Iebd5beeeeb9ea7025c61b97b666827e0a6ec89ad
Reviewed-on: https://chromium-review.googlesource.com/519162Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Jochen Eisinger <jochen@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45655}

Based on past discussions I'm going to try to reland this change. This makes window.document and document behave the same after navigation, which is a change from what the spec says. If this works out though, it would greatly simplify the spec; and fix the fact that currently it's leaking the underlying global object, which we don't want for security and object-identity reasons.

Bug: chromium:713732
Change-Id: I835ef510fc78f04c602434a7cec6420e027c4012
Reviewed-on: https://chromium-review.googlesource.com/520764
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45654}

On ia32, AssembleMove used to emit different code depending on whether
the to-be-moved heap object is in new space or not. This may have been
necessary in the past but is no longer. Moreoever, it's incompatible
with running off-thread. With this CL, we don't do the new-space check
and just emit a mov.

R=mstarzinger@chromium.org

Bug: v8:6048
Change-Id: I93abd61a5f290311a431edee3d4fa0a240d52085
Reviewed-on: https://chromium-review.googlesource.com/519248Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45653}

Use relaxed reads to allow changing the pointer concurrently in the 
GC. The layout descriptor will either be fast and there's nothing
to be done, or it will be slow, and we will use the forwarding
pointer to determine the proper version to use.

Bug: chromium:726040
Change-Id: I0a376752c3a99abf0874070387fcaeb3cee0dcb2
Reviewed-on: https://chromium-review.googlesource.com/519346
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45652}

Switch to use Win32 CONDITION_VARIABLE like Chromium.

This greatly simplifies the implementation of ConditionVariable
class for Windows with better performance.

Bug:NO

Change-Id: Iea5e5cb80520a966aeb687bebb4b5256396cb13b
Reviewed-on: https://chromium-review.googlesource.com/519542Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Commit-Queue: Loo Rong Jie <loorongjie@gmail.com>
Cr-Commit-Position: refs/heads/master@{#45651}

Visitor id for JSObjects does not depend on the instance size.

BUG=chromium:694255

Change-Id: I6b4b559207609f4a4c19373572be6692a55c5187
Reviewed-on: https://chromium-review.googlesource.com/520763Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45650}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/0312f98..54fde1e

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/32a3f0b..e6ad063

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: I2c9f167618d17546e4df4abbed2da0d428226868
Reviewed-on: https://chromium-review.googlesource.com/520922Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45649}

Port 510ebfc3
Port 8f61fbc6

R=neis@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2920523002
Cr-Commit-Position: refs/heads/master@{#45648}

This fixes the counter inconsistencies while leaving the memory in an
inaccessible state.

Bug: chromium:724947
Change-Id: I431eb6fda84922a52dfb9380c6b482ada55bccee
Reviewed-on: https://chromium-review.googlesource.com/519164
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45647}

Bug: 
Change-Id: If4a5408f8ff63a8a2b189f60fda37896a9403d3d
Reviewed-on: https://chromium-review.googlesource.com/519386Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45646}