port b8294aaa (r42264)

  original commit message:
  Literal arrays and feedback vectors for a function can be garbage
  collected if we don't have a rooted closure for the function, which
  happens often. It's expensive to come back from this (recreating
  boilerplates and gathering feedback again), and the cost is
  disproportionate if the function was inlined into optimized code.

  To guard against losing these arrays when we need them, we'll now
  create literal arrays when creating the feedback vector for the outer
  closure, and root them strongly in that vector.

BUG=

Review-Url: https://codereview.chromium.org/2627973007
Cr-Commit-Position: refs/heads/master@{#42351}

R=rossberg@chromium.org
BUG=chromium:575167

Review-Url: https://codereview.chromium.org/2630553002
Cr-Original-Original-Commit-Position: refs/heads/master@{#42286}
Committed: https://chromium.googlesource.com/v8/v8/+/fcc6e85ec6b01e5367795f98aff104b1ff23f619
Review-Url: https://codereview.chromium.org/2630553002
Cr-Original-Commit-Position: refs/heads/master@{#42315}
Committed: https://chromium.googlesource.com/v8/v8/+/74a2f9b7d3c3d9a9284ab8d5a9d08618b8194966
Review-Url: https://codereview.chromium.org/2630553002
Cr-Commit-Position: refs/heads/master@{#42350}

 - Table.Grow updates function, signature table sizes
 - Updates generated code with new base addresses for function, signature tables
 - Relocates size references for correct bounds check

R=bradnelson@chromium.org, titzer@chromium.org

Review-Url: https://codereview.chromium.org/2637643002
Cr-Commit-Position: refs/heads/master@{#42349}

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/buildtools/+log/7e08d33..9a94713

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/1bcf49e..95b3e83

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2638583002
Cr-Commit-Position: refs/heads/master@{#42348}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/15635a4..9a3fba5

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/fe8a3c8..1bcf49e

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/0147ef9..f7ce1a5

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2628273005
Cr-Commit-Position: refs/heads/master@{#42347}

This issue was exposed with snapshot=off

R=joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=n

Review-Url: https://codereview.chromium.org/2638473003
Cr-Commit-Position: refs/heads/master@{#42346}

Revert of Temporarily skip debugger/debug/es8/async-function-debug-scopes test. (patchset #1 id:1 of https://codereview.chromium.org/2636473002/ )

Reason for revert:
Inspector doesn't call any JS on async event any more.

https://codereview.chromium.org/2623313005/

Original issue's description:
> Temporarily skip debugger/debug/es8/async-function-debug-scopes test.
>
> BUG=v8:5837
> NOTRY=true
>
> Review-Url: https://codereview.chromium.org/2636473002
> Cr-Commit-Position: refs/heads/master@{#42319}
> Committed: https://chromium.googlesource.com/v8/v8/+/93aca16937b131dd735ed0b087fd4d17d0004adb

TBR=machenbach@chromium.org,ishell@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5837

Review-Url: https://codereview.chromium.org/2637533002
Cr-Commit-Position: refs/heads/master@{#42345}

Recognize and emit in-memory comparisons of 8-bit and 16-bit values with
immediate values that fit.

LOG=N
R=epertoso@chromium.org

Review-Url: https://codereview.chromium.org/2605863002
Cr-Commit-Position: refs/heads/master@{#42344}

1.
DCHECK in runtime-i18n.cc for case mapping was wrong to
assume that the longest primary language tag is 3 characters.
BCP 47 actually allows up to 8 characters.

2. GetFlatContent() was called to a string without flattening it first.

BUG=680314,680464
TEST=intl/general/case-mapping (see also the bugs)

Review-Url: https://codereview.chromium.org/2629763003
Cr-Commit-Position: refs/heads/master@{#42343}

We weren't throwing LinkError where appropriate

progress

BUG=v8:5835

Review-Url: https://codereview.chromium.org/2629523007
Cr-Commit-Position: refs/heads/master@{#42342}

Enabled support for Power9 hardware and implemented P9 modulo
instruction.

R=joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, jochen@chromium.org
BUG=
LOG=n

Review-Url: https://codereview.chromium.org/2625013002
Cr-Commit-Position: refs/heads/master@{#42341}

If installed, this listener is called instead of general DebugEventListener.

BUG=v8:5510
R=yangguo@chromium.org,	jgruber@chromium.org, dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2623313005
Cr-Commit-Position: refs/heads/master@{#42340}

Inspector uses event name only for enqueue* events and doesn't really need name for other events.

BUG=v8:5738
R=jgruber@chromium.org,gsathya@chromium.org
TBR=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2628173005
Cr-Commit-Position: refs/heads/master@{#42339}

New options: v8_enable_trace_maps, v8_enable_v8_checks.
Renamed options for consistency: v8_object_print to v8_enable_object_print.
Fixed options: v8_enable_verify_heap, v8_enable_object_print.

BUG=

Review-Url: https://codereview.chromium.org/2625393003
Cr-Commit-Position: refs/heads/master@{#42338}

Followup to https://codereview.chromium.org/2621983002/ so that
v8-version-string.h is includeable with varying include search paths.
This seems to match the pattern of other #includes in the include/
directory.

R=machenbach@chromium.org
BUG=chromium:581766

Review-Url: https://codereview.chromium.org/2634443002
Cr-Commit-Position: refs/heads/master@{#42337}

In the ideal case, this will speed up Object.create(null) by ~10x.

Drive-by-fix: Spread usage of new IsSpecialReceiverMap() and
              IsSpecialReceiverInstanceType(InstanceType) helpers.

BUG=v8:5788

Review-Url: https://codereview.chromium.org/2622723003
Cr-Commit-Position: refs/heads/master@{#42336}

Now that validate asm is on by default, the comparison fullcode with
ignition_staging does nothing in regards to validate_asm.

BUG=chromium:673246
NOTRY=true
TBR=bradnelson@chromium.org, titzer@chromium.org

Review-Url: https://codereview.chromium.org/2634573002
Cr-Commit-Position: refs/heads/master@{#42335}

With this CL, context loads and stores are "strengthened" by reducing
the incoming context chain and decreasing the depth accordingly,
whenever possible.  This enables more opportunities for specialization
and will let us easily add module context specialization later.

BUG=

Review-Url: https://codereview.chromium.org/2559173003
Cr-Commit-Position: refs/heads/master@{#42334}

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2627723007
Cr-Commit-Position: refs/heads/master@{#42333}

When we merge two NotFound access infos, we currently forgot to include
all the maps into the final PropertyAccessInfo, which results in a deopt
loop.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2625413003
Cr-Commit-Position: refs/heads/master@{#42332}

This puts lowering of {JSCreateClosure} operations behind a flag. For
now the benefit of inline allocating such closures is negligible, it
does increase code size, and breaks in combination with inlining based
on {SharedFunctionInfo}.

R=jarin@chromium.org
BUG=v8:2206

Review-Url: https://codereview.chromium.org/2636493002
Cr-Commit-Position: refs/heads/master@{#42331}

- condense repeated elements
- print map

BUG=

Review-Url: https://codereview.chromium.org/2626023002
Cr-Commit-Position: refs/heads/master@{#42330}

BUG=v8:5495

Review-Url: https://codereview.chromium.org/2633553002
Cr-Commit-Position: refs/heads/master@{#42329}

BUG=v8:5495

Review-Url: https://codereview.chromium.org/2622413004
Cr-Commit-Position: refs/heads/master@{#42328}

R=marja@chromium.org

Review-Url: https://codereview.chromium.org/2628293003
Cr-Commit-Position: refs/heads/master@{#42327}

Revert of [compiler] Support Object.create(null) inlining in TF (patchset #5 id:80001 of https://codereview.chromium.org/2622723003/ )

Reason for revert:
Breaks buildbot: https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20avx2/builds/13399/steps/Benchmarks/logs/stdio

Original issue's description:
> [compiler] Support Object.create(null) inlining in TF
>
> In the ideal case, this will speed up Object.create(null) by ~10x.
>
> Drive-by-fix: Spread usage of new IsSpecialReceiverMap() and
>               IsSpecialReceiverInstanceType(InstanceType) helpers.
>
> BUG=v8:5788
>
> Review-Url: https://codereview.chromium.org/2622723003
> Cr-Commit-Position: refs/heads/master@{#42321}
> Committed: https://chromium.googlesource.com/v8/v8/+/ff7063c7d5d8ad8eafcce3da59e65d7fe2b4f915

TBR=jarin@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5788

Review-Url: https://codereview.chromium.org/2636493003
Cr-Commit-Position: refs/heads/master@{#42326}

TBR=adamk@chromium.org
BUG=v8:1569

Review-Url: https://codereview.chromium.org/2621413009
Cr-Commit-Position: refs/heads/master@{#42325}

This changes the {MessageLocation} structure to no longer contain a
concrete {JSFunction} object but rather a {SharedFunctionInfo}. It is
much easier by now to determine, and also the concrete closure is never
actually being used.

R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2628973005
Cr-Commit-Position: refs/heads/master@{#42324}

Fix a deoptimization loop in TurboFan, where we'd constantly fail the
same map check due to not trying instance migration, when there are
migration targets in the map check list. This deoptimization loop
showed up on the React test in Speedometer.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2621423006
Cr-Commit-Position: refs/heads/master@{#42323}

R=jkummerow@chromium.org

Review-Url: https://codereview.chromium.org/2625053006
Cr-Commit-Position: refs/heads/master@{#42322}

In the ideal case, this will speed up Object.create(null) by ~10x.

Drive-by-fix: Spread usage of new IsSpecialReceiverMap() and
              IsSpecialReceiverInstanceType(InstanceType) helpers.

BUG=v8:5788

Review-Url: https://codereview.chromium.org/2622723003
Cr-Commit-Position: refs/heads/master@{#42321}

The simulator implements these exactly, but on ARM hardware,
the estimates are not exact, so CHECK_EQ will fail. This CL adds
a tolerance to the checks.

LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2628153003
Cr-Commit-Position: refs/heads/master@{#42320}

BUG=v8:5837
NOTRY=true

Review-Url: https://codereview.chromium.org/2636473002
Cr-Commit-Position: refs/heads/master@{#42319}

  The CL #42279 (https://codereview.chromium.org/2619353006 ) caused a gcc error (-Werror=strict-overflow).

  Here is the error message:
  In file included from .././src/globals.h:15:0,
                   from .././src/allocation.h:9,
                   from .././src/profiler/profile-generator.h:9,
                   from ../src/profiler/profile-generator.cc:5:
  .././src/base/logging.h: In member function ‘void v8::internal::ProfileTree::TraverseDepthFirst(Callback*) [with Callback = v8::internal::DeleteNodesCallback]’:
  .././src/base/logging.h:179:70: error: assuming signed overflow does not occur when assuming that (X - c) > X is always false [-Werror=strict-overflow]
                             : MakeCheckOpString<Lhs, Rhs>(lhs, rhs, msg);        \
                                                                            ^
  .././src/base/logging.h:191:1: note: in expansion of macro ‘DEFINE_CHECK_OP_IMPL’
   DEFINE_CHECK_OP_IMPL(GT, > )
   ^
    CXX(target) /home/zxli/work/google-v8/v8/out/x87.optdebug/obj.target/v8_base/src/regexp/regexp-macro-assembler.o
  cc1plus: all warnings being treated as errors

  This CL fix it.

BUG=

Review-Url: https://codereview.chromium.org/2632633002
Cr-Commit-Position: refs/heads/master@{#42318}

Revert of [wasm] Enforce that function bodies end with the \"end\" opcode. (patchset #6 id:100001 of https://codereview.chromium.org/2630553002/ )

Reason for revert:
Still breaks Win64 clang build.

Original issue's description:
> [wasm] Enforce that function bodies end with the \"end\" opcode.
>
> R=rossberg@chromium.org
> BUG=chromium:575167
>
> Review-Url: https://codereview.chromium.org/2630553002
> Cr-Original-Commit-Position: refs/heads/master@{#42286}
> Committed: https://chromium.googlesource.com/v8/v8/+/fcc6e85ec6b01e5367795f98aff104b1ff23f619
> Review-Url: https://codereview.chromium.org/2630553002
> Cr-Commit-Position: refs/heads/master@{#42315}
> Committed: https://chromium.googlesource.com/v8/v8/+/74a2f9b7d3c3d9a9284ab8d5a9d08618b8194966

TBR=mtrofin@chromium.org,rossberg@chromium.org,jbroman@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:575167

Review-Url: https://codereview.chromium.org/2636463002
Cr-Commit-Position: refs/heads/master@{#42317}

Prior to this, traces recorded through chrome://tracing would not
include time spent in RunMicrotasks.

BUG=v8:5382

Review-Url: https://codereview.chromium.org/2592793003
Cr-Commit-Position: refs/heads/master@{#42316}

R=rossberg@chromium.org
BUG=chromium:575167

Review-Url: https://codereview.chromium.org/2630553002
Cr-Original-Commit-Position: refs/heads/master@{#42286}
Committed: https://chromium.googlesource.com/v8/v8/+/fcc6e85ec6b01e5367795f98aff104b1ff23f619
Review-Url: https://codereview.chromium.org/2630553002
Cr-Commit-Position: refs/heads/master@{#42315}

This adapts the aformentioned interface to no longer return a list of
{JSFunction} objects, but {SharedFunctionInfo} objects instead. Since
deoptimization data only contains the latter as literals, this by now
represents the fast path. All call sites requiring the former can use
the slow path via {JavaScriptFrame::Summarize} instead.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2626213002
Cr-Original-Commit-Position: refs/heads/master@{#42311}
Committed: https://chromium.googlesource.com/v8/v8/+/25a9364f25a40986f4d7266b1fe53a5921754f6a
Review-Url: https://codereview.chromium.org/2626213002
Cr-Commit-Position: refs/heads/master@{#42314}

R=titzer@chromium.org
NOTRY=true

Review-Url: https://codereview.chromium.org/2635463002
Cr-Commit-Position: refs/heads/master@{#42313}

Revert of [runtime] Change JavaScriptFrame::GetFunctions interface. (patchset #2 id:20001 of https://codereview.chromium.org/2626213002/ )

Reason for revert:
Breaks compilation.

Original issue's description:
> [runtime] Change JavaScriptFrame::GetFunctions interface.
>
> This adapts the aformentioned interface to no longer return a list of
> {JSFunction} objects, but {SharedFunctionInfo} objects instead. Since
> deoptimization data only contains the latter as literals, this by now
> represents the fast path. All call sites requiring the former can use
> the slow path via {JavaScriptFrame::Summarize} instead.
>
> R=jarin@chromium.org
>
> Review-Url: https://codereview.chromium.org/2626213002
> Cr-Commit-Position: refs/heads/master@{#42311}
> Committed: https://chromium.googlesource.com/v8/v8/+/25a9364f25a40986f4d7266b1fe53a5921754f6a

TBR=jarin@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2629113004
Cr-Commit-Position: refs/heads/master@{#42312}