Bug: chromium:820312
Change-Id: Ie9237a5c53ac7121e469af460a2f0ad5016d9d03
Reviewed-on: https://chromium-review.googlesource.com/957090
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51844}

This patch removes the TypedArrayConstructor_ConstructStub builtin,
merging its functionality into the refactored TypedArrayConstructor
TurboFan builtin.

This brings us closer to our goal of deprecating the `construct_stub`
field in `SharedFunctionInfo`.

Bug: v8:7503, v8:7518
Change-Id: I264aa0933b3c80814e021b05033636196dc289da
Reviewed-on: https://chromium-review.googlesource.com/956044
Commit-Queue: Mathias Bynens <mathias@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51843}

Previously we used a FixedArray for the FeedbackMetadata, packing bits
of information into Smi fields. On 64-bit platforms, we waste at least
half of the available memory by using the Smi representation.

Given that this is just raw data (no pointers), we can just use a new
type that uses the existing packing scheme to store the data in int32
format instead.

This CL changes FeedbackMetadata to a new subclass of HeapObject. This
is to reduce the API surface exposed, in comparison to extending/using
a more general purpose data structure like ByteArray, which is also just
raw data.

FeedbackMetadata only exposes general purpose methods for accessing
slots, but hides the implementation detail of packing bits into int32
fields.

This CL also introduces a sentinal EmptyFeedbackMetadata, because there
are ~750 empty FeedbackMetadata objects when running an empty program in
V8. These are probably for builtins.

Bug: v8:7500
Change-Id: Ic85563153abbd71a22854cee8519260c32b1e9ab
Reviewed-on: https://chromium-review.googlesource.com/945730
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51842}

This adds support for f32.convert_{s,u}/i{32,64}.
On 32-bit platforms, i64 conversions are implemented by a call to a c
function. Since the signature of this c function is very different to
the currently used functions in Liftoff (in particular they contain an
out parameter), this CL requires a major refactoring of how Liftoff
generates c-calls.

R=titzer@chromium.org

Bug: v8:6600
Change-Id: Iffb4d0263ca1ca3eb9c6216344220322cda16062
Reviewed-on: https://chromium-review.googlesource.com/952122
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51841}

This reverts commit e816d2ba.

Reason for revert: <INSERT REASONING HERE>

Original change's description:
> [heap] Turn on --write-protect-code-memory.
> 
> Bug: chromium:774108
> Change-Id: Ifcf9939f29c9a3dc14ed686dc14608860ff32678
> Reviewed-on: https://chromium-review.googlesource.com/950902
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Reviewed-by: Michael Hablich <hablich@chromium.org>
> Commit-Queue: Hannes Payer <hpayer@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#51766}

TBR=mstarzinger@chromium.org,hpayer@chromium.org,hablich@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: chromium:774108
Change-Id: Icf6da14ec795cf89d2c4085ff7f9afb892184c12
Reviewed-on: https://chromium-review.googlesource.com/955692Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51840}

This benchmark checks comparison with StringAt functions against
each other and and constants. The benchmarks will serve to measure
the effect of an optimization that will omit the implicit
String.fromCharCode in such cases.

Bug: v8:7531
Change-Id: I171df92301516c96beb6a4ed86f1dec8d10e34f5
Reviewed-on: https://chromium-review.googlesource.com/957086Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51839}

This is a move-only CL (except includes cleanup).

Bug: v8:6666
Change-Id: I28422b4a21074e642e8d5c9b3a563ecafdafbda7
Reviewed-on: https://chromium-review.googlesource.com/957087Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51838}

It turns out that with the help of Code::Instruction{Start,End,Size}
helpers, we don't need custom profiler methods.

InstructionStream is now all-static.

Bug: v8:6666
Change-Id: I59e1d2d2cb72c128725a1ed03f11506d40e76224
Reviewed-on: https://chromium-review.googlesource.com/947973
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51837}

Bug: chromium:798964
Change-Id: I1ef202296744a39054366f2bc424d6952c3bbe9d
Reviewed-on: https://chromium-review.googlesource.com/955588Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51836}

This is a reland of 6afd25ff

Original change's description:
> [builtins] Execute binary-embedded builtin code
>
> This CL creates trampolines into binary-embedded builtins on
> isolate-creation, if --stress-off-heap-code is passed.
>
> Note that this still overwrites existing code objects with the
> off-heap trampoline, and that off-heap builtins still exist both in
> the snapshot and the binary. Addressing these points are the next
> steps.
>
> Drive-by-change: More efficient off-heap code lookups now that the
> off-heap memory area has a contiguous and static layout.
>
> Cq-Include-Trybots: luci.v8.try:v8_linux64_fyi_rel_ng
> Bug: v8:6666
> Change-Id: I7e7ef0aa2cd7b8184ae3a13fa02bdcbb4f2c9f86
> Reviewed-on: https://chromium-review.googlesource.com/947969
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#51809}

TBR=mstarzinger@chromium.org

Bug: v8:6666
Change-Id: I4e0684de90733e5f18f6f0ea4832e327d03dfbf7
Cq-Include-Trybots: luci.v8.try:v8_linux64_fyi_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/955595Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51835}

Some compilers complain that ConvertReturn is private in SimulatorBase,
but used in the arm64 Simulator. This CL fixes this by making
ConvertReturn protected.

R=ulan@chromium.org

Bug: v8:7541
Change-Id: I9326b2c746829e9c37c58c14561811b32929c615
Reviewed-on: https://chromium-review.googlesource.com/955689Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51834}

BUG=v8:7490

Change-Id: I07905a57c47ad6663d2d7f6bf539858bed1041f1
Reviewed-on: https://chromium-review.googlesource.com/939164Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51833}

This is a reland of 491d5a81

Original change's description:
> [builtins] Embed builtins into the binary
>
> This embeds code for off-heap-safe builtins into the binary. Actual
> execution of embedded code is not implemented yet.
>
> The embedded file has the following format:
>
> namespace v8 {
> namespace internal {
>
> namespace {
>
> V8_EMBEDDED_TEXT_HEADER(v8_embedded_blob_)
> __asm__( /* builtin offsets and lengths */ );
> __asm__(V8_ASM_LABEL("Builtins_RecordWrite"));
> __asm__( /* binary instruction stream */ );
> /* Repeat for other builtins. */
>
> extern "C" const uint8_t v8_embedded_blob_[];
> static const uint32_t v8_embedded_blob_size_ = /* size in bytes */;
>
> }  // namespace
>
> const uint8_t* DefaultEmbeddedBlob() { return v8_embedded_blob_; }
> uint32_t DefaultEmbeddedBlobSize() { return v8_embedded_blob_size_; }
>
> }  // namespace internal
> }  // namespace v8
>
> Bug: v8:6666
> Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;luci.v8.try:v8_linux64_fyi_rel_ng
> Change-Id: Ic989f01da69ebe2863f31d934bfbe2c5d6e80864
> Reviewed-on: https://chromium-review.googlesource.com/946011
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#51759}

TBR=yangguo@chromium.org

Bug: v8:6666
Change-Id: I89b0498f22b4ce573723748d55d86a82ba285a88
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;luci.v8.try:v8_linux64_fyi_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/957024Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51832}

This reverts a previous accidential edit.

Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel
Change-Id: Ib6a2e31f600de242e960171dd921387e897e3bc9
Reviewed-on: https://chromium-review.googlesource.com/951305Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Commit-Queue: Stephan Herhut <herhut@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51831}

R=jgruber@chromium.org

Bug: v8:178
Change-Id: I1cabed9aa2a04f86e582ba09742b2e2857a40f27
Reviewed-on: https://chromium-review.googlesource.com/956045Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51830}

This reverts commit daa224d4.

Reason for revert: https://bugs.chromium.org/p/chromium/issues/detail?id=819873

Original change's description:
> [builtins] Remove CheckOptimizationMarker builtin
> 
> This was a shim for the non-I+TF codepath, which is now the only
> codepath (that still uses this tier-up mechanism anyway). There were a
> couple of places we were accidentally using it due to CompileLazy or
> deopts, so this also fixes those.
> 
> Change-Id: I00a7fdf9fb5cf74844138dac62d01ceaaf192e17
> Reviewed-on: https://chromium-review.googlesource.com/951490
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#51786}

TBR=rmcilroy@chromium.org,machenbach@chromium.org,leszeks@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Change-Id: I80765eb18aaf5086e6db5d5df96f608a317c999f
Reviewed-on: https://chromium-review.googlesource.com/957022Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51829}

This reverts commit 36b32aa2.

Reason for revert: https://build.chromium.org/p/client.v8.fyi/builders/Win%20V8%20FYI%20Release%20%28NVIDIA%29/builds/208

Original change's description:
> Reland "[builtins] Embed builtins into the binary"
> 
> This is a reland of 491d5a81
> 
> Original change's description:
> > [builtins] Embed builtins into the binary
> >
> > This embeds code for off-heap-safe builtins into the binary. Actual
> > execution of embedded code is not implemented yet.
> >
> > The embedded file has the following format:
> >
> > namespace v8 {
> > namespace internal {
> >
> > namespace {
> >
> > V8_EMBEDDED_TEXT_HEADER(v8_embedded_blob_)
> > __asm__( /* builtin offsets and lengths */ );
> > __asm__(V8_ASM_LABEL("Builtins_RecordWrite"));
> > __asm__( /* binary instruction stream */ );
> > /* Repeat for other builtins. */
> >
> > extern "C" const uint8_t v8_embedded_blob_[];
> > static const uint32_t v8_embedded_blob_size_ = /* size in bytes */;
> >
> > }  // namespace
> >
> > const uint8_t* DefaultEmbeddedBlob() { return v8_embedded_blob_; }
> > uint32_t DefaultEmbeddedBlobSize() { return v8_embedded_blob_size_; }
> >
> > }  // namespace internal
> > }  // namespace v8
> >
> > Bug: v8:6666
> > Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;luci.v8.try:v8_linux64_fyi_rel_ng
> > Change-Id: Ic989f01da69ebe2863f31d934bfbe2c5d6e80864
> > Reviewed-on: https://chromium-review.googlesource.com/946011
> > Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> > Reviewed-by: Yang Guo <yangguo@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#51759}
> 
> TBR=yangguo@chromium.org
> 
> Bug: v8:6666
> Change-Id: I741554cb080b6811dfbcb0913c6e1594e74c0432
> Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;luci.v8.try:v8_linux64_fyi_rel_ng
> Reviewed-on: https://chromium-review.googlesource.com/955084
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#51804}

TBR=yangguo@chromium.org,jgruber@chromium.org

Change-Id: I0e21f958f18b0e4d7edebece5e4a2a3ea094cdd3
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6666
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;luci.v8.try:v8_linux64_fyi_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/956185Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51828}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/ca739dc..d8b353b

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/406b235..df668c3

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: I3712e0f496692dc50d2ee4e8374cc025a54658cd
Reviewed-on: https://chromium-review.googlesource.com/955914
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51827}

This test depends on lack of randomness in the allocation path so it is
not compatible with stress_incremental_marking. Extract it into a
standalone tests which runs with the stress flag disabled.

Revert "[cctests] Disable flaky cctest test-heap-profiler/SamplingHeapProfiler"

This reverts commit 3ea2d6b0.

Bug: v8:7444
Change-Id: Id246bca4699a61e6b9ff4b5b5d2ff1ce4ebbd0da
Reviewed-on: https://chromium-review.googlesource.com/953865Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ali Ijaz Sheikh <ofrobots@google.com>
Cr-Commit-Position: refs/heads/master@{#51826}

This reverts commit b342e611.

Reason for revert: x64 msvc failure

Original change's description:
> Attempt to fix MSVC failure in test-debug/BreakPointJSBuiltin
> 
> TBR=bmeurer@chromium.org
> 
> Bug: v8:178
> Change-Id: Idfa86749f3ee49c9f3b2a7fc7c0d7d3285e45c20
> Reviewed-on: https://chromium-review.googlesource.com/956066
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Commit-Queue: Yang Guo <yangguo@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#51824}

TBR=yangguo@chromium.org,clemensh@chromium.org,bmeurer@chromium.org

Change-Id: I76c4df67416b982b3215df7dce23eb1e7d42ec4c
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:178
Reviewed-on: https://chromium-review.googlesource.com/955572Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51825}

TBR=bmeurer@chromium.org

Bug: v8:178
Change-Id: Idfa86749f3ee49c9f3b2a7fc7c0d7d3285e45c20
Reviewed-on: https://chromium-review.googlesource.com/956066Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51824}

This updates the scanner to use the correct error message when it
encounters an octal escape sequence in a template literal. Previously,
the error message referred to strict mode, even when the template
literal was not in strict mode code.

Bug: v8:7502
Change-Id: I37bb1338cf796c471108bc10f35f824cdf3ce0b7
Reviewed-on: https://chromium-review.googlesource.com/945411Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51823}

The number of embedder fields grows dynamically, but reading these
fields do not perform bounds checks. The naming is taken from a similar
method on v8::Isolate.

Also changed the growing strategy for the backing store to not
over-allocate.

R=adamk@chromium.org, bmeurer@chromium.org

Bug: v8:7533
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I70beab124a32296c940ffabd897a7790bc8ff47a
Reviewed-on: https://chromium-review.googlesource.com/952923Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51822}

TBR=bmeurer@chromium.org
NOTRY=true

Bug: v8:178
Change-Id: I5f8b128d9f0e5ae0ad9c44da0b6cd599c47fdf6b
Reviewed-on: https://chromium-review.googlesource.com/956064Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51821}

Stack slots store the type of the respective value, so we can always
get the reg class from that type.

R=titzer@chromium.org

Bug: v8:6600
Change-Id: I60ca21daa4cc1505562c344367c7586bcd272c9b
Reviewed-on: https://chromium-review.googlesource.com/950948Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51820}

This is a reland of 609aaa55

Originally reviewed at: https://chromium-review.googlesource.com/952626

Tbr: adamk@chromium.org
Bug: v8:6791
Change-Id: If0699fbfb280192bed61538ccc67c7c95893e691
Reviewed-on: https://chromium-review.googlesource.com/954665Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51819}

This is to better pinpoint win64 failures.

TBR=bmeurer@chromium.org

Bug: v8:178
Change-Id: If778352cad1f209927067a12d5684e62c4ead8d2
Reviewed-on: https://chromium-review.googlesource.com/955687Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51818}

On 32-bit systems, the computation {count + type_list->size()} can
overflow, leading to memory corruption later on.

R=titzer@chromium.org

Bug: chromium:819869
Change-Id: Ic81d201e58211e3989b4e945cd52e98dc951fbda
Reviewed-on: https://chromium-review.googlesource.com/955025
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51817}

This reverts commit 6afd25ff.

Reason for revert: https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20debug%20-%20fyi/builds/1437

Original change's description:
> [builtins] Execute binary-embedded builtin code
> 
> This CL creates trampolines into binary-embedded builtins on
> isolate-creation, if --stress-off-heap-code is passed.
> 
> Note that this still overwrites existing code objects with the
> off-heap trampoline, and that off-heap builtins still exist both in
> the snapshot and the binary. Addressing these points are the next
> steps.
> 
> Drive-by-change: More efficient off-heap code lookups now that the
> off-heap memory area has a contiguous and static layout.
> 
> Cq-Include-Trybots: luci.v8.try:v8_linux64_fyi_rel_ng
> Bug: v8:6666
> Change-Id: I7e7ef0aa2cd7b8184ae3a13fa02bdcbb4f2c9f86
> Reviewed-on: https://chromium-review.googlesource.com/947969
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#51809}

TBR=mstarzinger@chromium.org,jgruber@chromium.org

Change-Id: I18276541b468b9d2b2a1366ccd287822e96b6df7
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6666
Cq-Include-Trybots: luci.v8.try:v8_linux64_fyi_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/956042Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51816}

TBR=sergiyb@chromium.org

Bug: chromium:776035
Change-Id: I6a9f2cb62ec275af49ec629d6a4d41d61c0a9dfe
Reviewed-on: https://chromium-review.googlesource.com/955322
Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org>
Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51815}

TBR=bmeurer@chromium.org
NOTRY=true

Bug: v8:178
Change-Id: I25438302be07f51eb9f540ada2ec28e4d06a5198
Reviewed-on: https://chromium-review.googlesource.com/955626Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51814}

Bug: chromium:798964
Change-Id: Ia359f68e30e87e2cbee5b8322b4ac54c335ef474
Reviewed-on: https://chromium-review.googlesource.com/955425Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51813}

Bug: chr:81499
Change-Id: I5a18b9ec061d426e21c08747a8c18a36bf5ca194
Reviewed-on: https://chromium-review.googlesource.com/950724
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51812}

R=bmeurer@chromium.org, leszeks@chromium.org

Bug: v8:178
Change-Id: I00411ddfee458a71464dcba7f1b504b46c70ef06
Reviewed-on: https://chromium-review.googlesource.com/953002Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51811}

This adds a global protector to guard the lookup of "resolve" on the
%Promise% intrinsic object (the initial Promise constructor), making
sure that Promise.resolve yields the initial builtin method. We use
this protector to avoid the lookup of "resolve" all the time inside
of Promise.all and Promise.race, when called with constructor being
the %Promise% intrinsic object.

This improves the performance on the parallel-async-es2017-native
benchmark by roughly 2-3%.

Bug: v8:7253
Change-Id: Ida93b88afbaeae61f17be4cd30ea6a78b4267cea
Reviewed-on: https://chromium-review.googlesource.com/955564Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51810}

This CL creates trampolines into binary-embedded builtins on
isolate-creation, if --stress-off-heap-code is passed.

Note that this still overwrites existing code objects with the
off-heap trampoline, and that off-heap builtins still exist both in
the snapshot and the binary. Addressing these points are the next
steps.

Drive-by-change: More efficient off-heap code lookups now that the
off-heap memory area has a contiguous and static layout.

Cq-Include-Trybots: luci.v8.try:v8_linux64_fyi_rel_ng
Bug: v8:6666
Change-Id: I7e7ef0aa2cd7b8184ae3a13fa02bdcbb4f2c9f86
Reviewed-on: https://chromium-review.googlesource.com/947969
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51809}

JSCallReducer runs at the same time as DeadCodeElimination and hence can observe an incompletely propagated DeadValue in place of a StateValue node holding the arguments to materialize for JSCreateArguments.
This CL fixes this by aborting the lowring of JSCreateArguments in this case.

Bug: chromium:819311 v8:7536
Change-Id: I42c4a1923e3dbe470db1a16c5069aaa7c38659ac
Reviewed-on: https://chromium-review.googlesource.com/955306Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51808}

The PromiseResolve builtin was missing it's fast-path for when we can
skip the "constructor" lookup due to a typo.

Bug: v8:7253
Change-Id: Icca033af5d4f7fe8b43ebf49c9315b4c80d52cbc
Reviewed-on: https://chromium-review.googlesource.com/955483Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51807}

Test started failing after commit `[Liftoff] Remove Get{Unary,Binary}OpTargetRegister`.
Optimization shouldn't be done if dst == rhs in i32_set_cond instruction.
This CL fixes the issue.

Change-Id: I67cd1ca4692fcf69202ef25f7aa58756a5ddddca
Reviewed-on: https://chromium-review.googlesource.com/952963Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#51806}

When optimizing SpeculativeToNumber we need to pay attention to the
hint, otherwise we optimize away a Signed32 conversion, based on the
fact that the input is a Number.

Bug: chromium:819298
Change-Id: I2ac7b0dac708fee9083eca2880bd5674a82daaa3
Reviewed-on: https://chromium-review.googlesource.com/955423Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51805}