There is no good reason to have the meat of most objects' initialization
logic in heap.cc, all wrapped by the CALL_HEAP_FUNCTION macro. Instead,
this CL changes the protocol between Heap and Factory to be AllocateRaw,
and all object initialization work after (possibly retried) successful
raw allocation happens in the Factory.

This saves about 20KB of binary size on x64.

Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: Icbfdc4266d7be8b48d2fe085f03411743dc6a0ca
Reviewed-on: https://chromium-review.googlesource.com/959533
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52416}

This is another small step towards detaching the JSFunction from Contexts.
In order to not break the debugger protocol we need the inferred name on the
ScopeInfo chain. This CL might increase memory usage slightly, given that the
inferred name field is duplicated on the ScopeInfo.

Bug: v8:7066, chromium:818642
Change-Id: I0dd9f18ae69791f774cf835669afa50491f7433b
Reviewed-on: https://chromium-review.googlesource.com/995792
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52415}

Bug: chromium:814144
Change-Id: Idd729757608a714921254874af98a4a201340870
Reviewed-on: https://chromium-review.googlesource.com/981146Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52414}

R=joransiu@ca.ibm.com

Change-Id: I28c7f3d018a03adb843b0426510c2ba669324b76
Reviewed-on: https://chromium-review.googlesource.com/996593Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#52413}

This change makes full 8 GiB guard regions always enabled on 64-bit
platforms.

Additionally, since all Wasm memory allocation paths have some form of
guard regions, this removes and simplifies most of the logic around
whether to enable guard regions.

This is a reland of https://crrev.com/c/985142.

Bug: v8:7619
Change-Id: I8bf1f86d6f89fd0bb2144431c7628f15a6b00ba0
Reviewed-on: https://chromium-review.googlesource.com/996466Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Commit-Queue: Eric Holk <eholk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52412}

Port 71018812

Original Commit Message:

    This is a reland of 7a2c3713

    Original change's description:
    > [debug] introduced runtime side effect check
    >
    > This CL demonstrates minimum valuable addition to existing debug evaluate
    > without side effects mechanism.
    > With this CL user can evaluate expressions like:
    > [a,b] // create any kind of temporary array literals
    > [a,b].reduce((x,y) => x + y, 0); // use reduce method
    > [1,2,3].fill(2); // change temporary arrays
    >
    > The core idea: any change of the object created during evaluation without
    > side effects is side effect free. As soon as we try to store this temporary
    > object to object existed before evaluation we will terminate execution.
    >
    > Implementation:
    > - track all objects allocated during evaluation and mark them as temporary,
    > - patch all bytecodes which change objects.
    >
    > A little more details (including performance analysis): [1].
    >
    > [1] https://docs.google.com/document/d/10qqAtZADspPnpYa6SEdYRxrddfKIZJIzbLtGpsZQkRo/edit#
    >
    > Bug: v8:7588
    > Change-Id: I69f7b96e1ebd7ad0022219e8213211c7be72a111
    > Reviewed-on: https://chromium-review.googlesource.com/972615
    > Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
    > Reviewed-by: Yang Guo <yangguo@chromium.org>
    > Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
    > Cr-Commit-Position: refs/heads/master@{#52370}

R=kozyatinskiy@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I8706efa53d0bbf7d12e48f4f0c4ac387b5faa97b
Reviewed-on: https://chromium-review.googlesource.com/998180Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#52411}

Use 64-bit addition if the pointer size is 8, use 32-bit addition
otherwise.

R=titzer@chromium.org
CC=​sreten.kovacevic@mips.com

Change-Id: I129cc29454726b7be45ecea13484212cc4f72eea
Reviewed-on: https://chromium-review.googlesource.com/998552Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52410}

The bug was fixed in https://crrev.com/c/995796, but this CL adds a
regression test to make sure it stays fixed.

Bug: chromium:827806
Change-Id: I9f4aed364bbd310af4253da457887a8b8015533a
Reviewed-on: https://chromium-review.googlesource.com/993237Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Eric Holk <eholk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52409}

The v8_base project can't be loaded in Visual Studio 2017 because
"src/zone/zone-allocator.h" is listed twice.

R=jgruber@chromium.org, yangguo@chromium.org

Change-Id: Ide2f27a7f8ffd3c57deb7f9ae16c55122d999d06
Reviewed-on: https://chromium-review.googlesource.com/998346Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52408}

|is_posix| will be switched to false for Fuchsia, this is a preliminary change.

Bug: chromium:812974
Change-Id: I2ae8e5ef4270cd0acbc7c69bb46d1be9ed4a5c5e
Reviewed-on: https://chromium-review.googlesource.com/988253Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Fabrice de Gans-Riberi <fdegans@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52407}

The AssembleMove and AssembleSwap tests would only perform moves on stack
parameters. This limits us to testing with slots that are likely to be in range
of loads and stores. As well as only testing memory accesses with positive
offsets relative to the frame pointer.

This patch addresses these limitations by moving half of the stack parameters
into spill slots, to then perform moves on them. Additionally, to increase
ranges, we create articial space between each spilled slot.

As a drive-by, allow giving custom names to code objects created with the
CodeAssemblerTester. It helps a lot inspecting disassembly.

And finally, this CL uncovered a bug where I had forgotten to initialize
FixedArrays, which would make the incremental marker crash.

Bug: v8:6848
Change-Id: Ic1954c1896130f6c55e09a3068bf341cc4c68670
Reviewed-on: https://chromium-review.googlesource.com/980613
Commit-Queue: Pierre Langlois <pierre.langlois@arm.com>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52406}

Bug: chromium:828293
Change-Id: I37002c308738eef1366d82a90b7b29d6e44d6c48
Reviewed-on: https://chromium-review.googlesource.com/996585
Commit-Queue: Eric Holk <eholk@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52405}

Previous: https://chromium-review.googlesource.com/972962

BUG=v8:7308

Change-Id: I6882e36ad9f9360d006937a2f41b07839a73a768
Reviewed-on: https://chromium-review.googlesource.com/995014Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52404}

Proposal repo: https://github.com/tc39/proposal-string-matchall

- Add new builtins StringPrototypeMatchAll and RegExpPrototypeMatchAll
- Add new object RegExpStringIterator

Bug: v8:6890
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: I9fad71900cf30e8632258c309df1c7a638ea4600
Reviewed-on: https://chromium-review.googlesource.com/981893
Commit-Queue: Peter Wong <peter.wm.wong@gmail.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52403}

R=clemensh@chromium.org

Change-Id: I510c8e771ab1c84d094205e247054d8057d2dc85
Reviewed-on: https://chromium-review.googlesource.com/997845Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52402}

This CL further lowers the kMaxEmptyFactor constant to more aggressively shrink
the StringTable when it's empty.

Bug: v8:5443, chromium:818642
Change-Id: I1c263a0afd7e6bed8a8bb857db032bf126c3ef4b
Reviewed-on: https://chromium-review.googlesource.com/995473Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52401}

This is a small step towards making node build on Windows.

Bug: v8:6105

R=machenbach@chromium.org

Change-Id: I8d3a9b1830bb012d846a791fddc8d1d8d830515e
Reviewed-on: https://chromium-review.googlesource.com/980950
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52400}

R=clemensh@chromium.org

Change-Id: Iac827a4fc82f9b810af9d67c4aa5757925edc3c5
Reviewed-on: https://chromium-review.googlesource.com/997742Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52399}

R=yangguo@chromium.org

Bug: v8:7588
Change-Id: If78f6dd460c7423923800a98d44520c1bf71663c
Reviewed-on: https://chromium-review.googlesource.com/996236
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52398}

R=clemensh@chromium.org

Change-Id: Ibe6c203aa3ebdbbd8d3ca1f9f0ddfa7f89d79c71
Reviewed-on: https://chromium-review.googlesource.com/997835
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52397}

This adds support for i64.and, i64.or and i64.xor.

R=titzer@chromium.org

Bug: v8:6600
Change-Id: Ie64e1874f87cd250f3e0641e021f584ecd0aaff9
Reviewed-on: https://chromium-review.googlesource.com/995444Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52396}

The amortized cost of a single invocation is actually O(1), not O(n).
But this whole comment is needless anyway, so just remove it.

R=ahaas@chromium.org
NOTRY=true

Change-Id: Icffaedcd784584b1676cd7ed323555177a62d63e
Reviewed-on: https://chromium-review.googlesource.com/997812Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52395}

R=titzer@chromium.org

Change-Id: I2de3bef1753669c7a9f653ece14f168930392180
Reviewed-on: https://chromium-review.googlesource.com/997692Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52394}

Bug: v8:7466
Change-Id: Icb47184e3f6e86bf69157fffd2b29a25ad916500
Reviewed-on: https://chromium-review.googlesource.com/997813Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52393}

It looks like the normal ways of creating lookup iterators work better.

Bug: v8:5988, chromium:828282
Change-Id: Ifd623b2e93708ff8684d056d9292b7779f611a3c
Reviewed-on: https://chromium-review.googlesource.com/997474Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52392}

Add support for decoding anyref globals, and some drive-by cleanups.

R=titzer@chromium.org

Bug: v8:7581
Change-Id: I3527f996a3fa1a890918a5924e951fbafa394cf2
Reviewed-on: https://chromium-review.googlesource.com/997655Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52391}

This implements f64 comparisons analogue to f32 comparisons (f64.eq,
f64.ne, f64.lt, f64.gt, f64.le, f64.ge).

R=titzer@chromium.org

Bug: v8:6600
Change-Id: I382d575e4f2c585c2de1313f2c2fd2c8cda54a9d
Reviewed-on: https://chromium-review.googlesource.com/995773
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52390}

This is a reland of 63ecddc8

Original change's description:
> [runtime] Remove the construct_stub field of the SFI
>
> Don't dispatch based on the construct_stub field anymore. Rather than
> read it out and jump to the construct stub, we can switch on the
> builtin_id.
>
> Builtins will always have builtin_id as a Smi, so this signals we need
> to jump to JSBuiltinsConstructStub. The only exception is for uncompiled
> functions, which will have kCompileLazy as the builtin_id, but need to
> jump to the generic stub instead.
>
> API function calls will have a FunctionTemplateInfo in the SFI
> function_data field, and need to go to the builtins stub as well.
>
> The final case is everything else, which should go to the generic stub.
>
> Bug: v8:7503
> Change-Id: I14790a5f9784dc0d940bf10a05f5310026e1d482
> Reviewed-on: https://chromium-review.googlesource.com/980941
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Commit-Queue: Peter Marshall <petermarshall@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52345}

TBR=bmeurer@chromium.org

Bug: v8:7503
Change-Id: Ie46bfb0af173ad7ac8cbdfeed1865e60f3f413f7
Reviewed-on: https://chromium-review.googlesource.com/997712Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52389}

Fixes a crash that happens when calling postMessage on an empty typed
array.

GetBuffer should only call MaterializeArrayBuffer for on-heap buffers,
but the on-heap check is slightly wrong. This CL moves the on-heap check
logic to the JSTypedArray class so that other parts of the codebase
don't need to worry about how that is determined.

Also add some dchecks to materialize itself. It should only receive
on-heap buffers and should always transform them to off-heap buffers.
There is also no reason for it to be static, so change that here too.

Bug: chromium:797588
Change-Id: Icd88a5b68e424d82c9f1f7889ca42a40a72a1bdc
Reviewed-on: https://chromium-review.googlesource.com/995898
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52388}

In order to clarify the difference between, e.g., InstructionStart and
instruction_start, rename as follows:

Code::instruction_start -> raw_instruction_start
Code::instruction_end   -> raw_instruction_end
Code::instruction_size  -> raw_instruction_size

The difference between the camel-case and raw_* function families is
in how they handle off-heap-trampoline Code objects. For example, when
called on an off-heap-trampoline: raw_instruction_start returns the
trampoline's entry point, while InstructionStart returns the off-heap
code's entry point (located in the .text section of the binary).

Some callsites were updated to call the camel-case function family as
appropriate.

Bug: v8:6666
Change-Id: I4a572f47c2d161a853599d7c17879e263b0d1a87
Reviewed-on: https://chromium-review.googlesource.com/997532
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52387}

This pattern seems to reoccur in the code:

Handle<TransitionArray> array = TransitionArray::Allocate(...);
<something that causes allocation>
// Fill up the array
array->set(...);

If the allocation causes GC, we try to iterate the TransitionArrray
in MarkCompactCollector::ClearFullMapTransitions, and that crashes because it
expects the TransitionArray to contain handlers (not undefined).

This bug is present e.g., in TransitionAccessor::EnsureHasFullTransition.

BUG=v8:7308

Change-Id: I306204fc27d62041801427c466c82d1d9df1bf0c
Reviewed-on: https://chromium-review.googlesource.com/997493
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52386}

NOTRY=true

Bug: chromium:828745
Change-Id: I051f57893937796e01f0b823f1050dd36e0fbfd9
Reviewed-on: https://chromium-review.googlesource.com/997556Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52385}

In addition, remove the default branch from the swtich in HeapObjectPrint, so
that it's no longer possible to leave out printing functionality by accident.

BUG=v8:7308

Change-Id: I2db67549e328aea6228d3a370f9ebb7494ab3730
Reviewed-on: https://chromium-review.googlesource.com/997492
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52384}

Removing these tests from skip list because corresponding wasm simd
opcodes lowering has been implemented.

Change-Id: I77bbbee573ba65cf27dc9ee39f4d352bafb5849f
Reviewed-on: https://chromium-review.googlesource.com/988032Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#52383}

This is a reland of 5ae8420c

Original change's description:
> [Liftoff] Implement float rounding
> 
> This adds support for the four rounding operations on f32 and f64:
> f32.ceil, f32.floor, f32.trunc, f32.nearest_int, f64.ceil, f64.floor,
> f64.trunc, and f64.nearest_int.
> 
> R=titzer@chromium.org
> 
> Bug: v8:6600
> Change-Id: I16ea91e26c3233af7a33bbb794cd4182f9d7cdb0
> Reviewed-on: https://chromium-review.googlesource.com/995894
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Reviewed-by: Ben Titzer <titzer@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52377}

Bug: v8:6600
Change-Id: I9e69309b71041e411bda9ce1375d2451197a111b
Reviewed-on: https://chromium-review.googlesource.com/997393
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52382}

Change-Id: Id661452207cd65445e7390d86f5379b1cc4f1495
Reviewed-on: https://chromium-review.googlesource.com/988012Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#52381}

mjsunit/harmony/bigint/typedarray test failure on mips32 big endian
pointed there was a problem.

Change-Id: I016a31d7758e7bd4019210e23c147dc0f8ea893f
Reviewed-on: https://chromium-review.googlesource.com/995455
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52380}

This moves ArrayView.isArray and some TypedArray accessors to
the JSCallReducer.

Bug: v8:7340, v8:7250
Change-Id: Ia6ed9dc5eb8f0c84c286c58d757cbc149d811cf7
Reviewed-on: https://chromium-review.googlesource.com/995454Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52379}

This reverts commit 5ae8420c.

Reason for revert: Fails on non-sse machine: https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20debug/builds/21480

Original change's description:
> [Liftoff] Implement float rounding
> 
> This adds support for the four rounding operations on f32 and f64:
> f32.ceil, f32.floor, f32.trunc, f32.nearest_int, f64.ceil, f64.floor,
> f64.trunc, and f64.nearest_int.
> 
> R=​titzer@chromium.org
> 
> Bug: v8:6600
> Change-Id: I16ea91e26c3233af7a33bbb794cd4182f9d7cdb0
> Reviewed-on: https://chromium-review.googlesource.com/995894
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Reviewed-by: Ben Titzer <titzer@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52377}

TBR=titzer@chromium.org,clemensh@chromium.org

Change-Id: Iefdeb088b84384f7bc5dc5de6917bc60e9b8292c
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6600
Reviewed-on: https://chromium-review.googlesource.com/997392Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52378}

This adds support for the four rounding operations on f32 and f64:
f32.ceil, f32.floor, f32.trunc, f32.nearest_int, f64.ceil, f64.floor,
f64.trunc, and f64.nearest_int.

R=titzer@chromium.org

Bug: v8:6600
Change-Id: I16ea91e26c3233af7a33bbb794cd4182f9d7cdb0
Reviewed-on: https://chromium-review.googlesource.com/995894
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52377}