This CL prepares support for memory operations, where we will need to
call runtime functions for trapping, and hence need safepoint
information for iterating the frames correctly.

R=titzer@chromium.org

Bug: v8:6600
Change-Id: I8c65d80cd69747d13d9084e7427253413fb4b808
Reviewed-on: https://chromium-review.googlesource.com/810784
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49952}

This upgrades binutils from 2.26 to 2.28.

BUG=chromium:761307

Change-Id: If556ca5912b4c06fdeb3f52b43a2530dfcabb624
Reviewed-on: https://chromium-review.googlesource.com/816017
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49951}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/b70ba2b..404c19d

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/82cfea0..16753e0

Rolling v8/third_party/icu: https://chromium.googlesource.com/chromium/deps/icu/+log/741688e..26f7d8a

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: I866cbe195397f99ab5a9668bf36d6f2310da8a02
Reviewed-on: https://chromium-review.googlesource.com/816537Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49950}

Includes:
- Better windows support in json generator.
- Add PDL2JSON, don't paste descriptions as comments into generated code.
- [inspector_protocol] generated only used types

R=pfeldman@chromium.org

Bug: none
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel
Change-Id: I3c634359b3ac4b00293ac7c5ee224dab53aae7ca
Reviewed-on: https://chromium-review.googlesource.com/810204
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Reviewed-by: Pavel Feldman <pfeldman@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49949}

Bug: v8:6876
Change-Id: I9de5218e4f44f3d593b93772283b2c1df0b07660
Reviewed-on: https://chromium-review.googlesource.com/809265Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Mircea Trofin <mtrofin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49948}

- in certain cases, we need both modification scopes because we may
mutate JS functions, even in the jit-to-native case - e.g. JS-to-wasm
wrappers
- added handling for wasm-to-wasm wrappers in the context of lazy
compilation.

Bug: v8:7105
Change-Id: I085c14e03ef0b08d040998f2207abf7bc3fff01c
Reviewed-on: https://chromium-review.googlesource.com/811285
Commit-Queue: Mircea Trofin <mtrofin@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49947}

This reverts commit d59063b5.

Reason for revert: worked around android toolchain issue. 
chromium:771171 is expected to address android toolchain issue

Original change's description:
> Revert "[wasm] Fix wasm-to-wasm handling in 'native heap' lazy compile"
> 
> This reverts commit 59f22174.
> 
> Reason for revert: android build issue (https://build.chromium.org/p/client.v8.fyi/builders/Android%20Release%20%28Nexus%205X%29/builds/3583)
> 
> Original change's description:
> > [wasm] Fix wasm-to-wasm handling in 'native heap' lazy compile
> > 
> > Wasm-to-wasm uses a tail call mechanism to reach the target
> > function. This means there is no frame for it. This CL ports
> > the fix for that for the WasmCodeManager case, akin the current
> > fix for the GC case.
> > 
> > Bug: v8:7140
> > Change-Id: I04c8a8da1de9cb837a0423493216d2226c53e756
> > Reviewed-on: https://chromium-review.googlesource.com/814498
> > Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
> > Reviewed-by: Ben Titzer <titzer@chromium.org>
> > Commit-Queue: Mircea Trofin <mtrofin@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#49942}
> 
> TBR=bradnelson@chromium.org,titzer@chromium.org,mtrofin@chromium.org,clemensh@chromium.org
> 
> Change-Id: Iae0e43b386f08d2d56aeef70e9fa0af141232023
> No-Presubmit: true
> No-Tree-Checks: true
> No-Try: true
> Bug: v8:7140
> Reviewed-on: https://chromium-review.googlesource.com/815180
> Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
> Commit-Queue: Mircea Trofin <mtrofin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#49943}

TBR=bradnelson@chromium.org,titzer@chromium.org,mtrofin@chromium.org,clemensh@chromium.org

Change-Id: If613a6c986ac4cf0534aecd8ea9bf74ecac21292
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7140
Reviewed-on: https://chromium-review.googlesource.com/815956
Commit-Queue: Mircea Trofin <mtrofin@chromium.org>
Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49946}

This is a reland of 0c2faa06
Original change's description:
> [D8] Clean up ArrayBuffer Allocators in shell.
>
> - Reworks the class hierarchy in d8.cc to conform to the allocator API.
>   In particular, allocators should malloc/free or equivalent unless
>   v8::ArrayBuffer::Allocator::Reserve is called.
> - Modifies ExternalizedContents to remember the allocation mode.
> - ArrayAllocatorBase now tracks its allocations to make sure it doesn't
>   call Free on externalized array buffers it didn't allocate.
>
> Bug: chromium:756050
> Change-Id: Ic2d07d36358f1b4fa542bea27f93d1d51a1757e1
> Reviewed-on: https://chromium-review.googlesource.com/807355
> Commit-Queue: Bill Budge <bbudge@chromium.org>
> Reviewed-by: Ben Titzer <titzer@chromium.org>
> Reviewed-by: Eric Holk <eholk@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#49893}

Bug: chromium:756050,v8:7146
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I8fe3a9d9af43196e16d02342a47347a76c0a1341
Reviewed-on: https://chromium-review.googlesource.com/811724Reviewed-by: Eric Holk <eholk@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49945}

Bring the two functions closer together in implementation. Avoid
unnecessary assignment to top_on_previous_step_.

Bug: 
Change-Id: I0b6881b02ab08a48bc2051e6786e22a7b25a4948
Reviewed-on: https://chromium-review.googlesource.com/815196Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ali Ijaz Sheikh <ofrobots@google.com>
Cr-Commit-Position: refs/heads/master@{#49944}

This reverts commit 59f22174.

Reason for revert: android build issue (https://build.chromium.org/p/client.v8.fyi/builders/Android%20Release%20%28Nexus%205X%29/builds/3583)

Original change's description:
> [wasm] Fix wasm-to-wasm handling in 'native heap' lazy compile
> 
> Wasm-to-wasm uses a tail call mechanism to reach the target
> function. This means there is no frame for it. This CL ports
> the fix for that for the WasmCodeManager case, akin the current
> fix for the GC case.
> 
> Bug: v8:7140
> Change-Id: I04c8a8da1de9cb837a0423493216d2226c53e756
> Reviewed-on: https://chromium-review.googlesource.com/814498
> Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
> Reviewed-by: Ben Titzer <titzer@chromium.org>
> Commit-Queue: Mircea Trofin <mtrofin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#49942}

TBR=bradnelson@chromium.org,titzer@chromium.org,mtrofin@chromium.org,clemensh@chromium.org

Change-Id: Iae0e43b386f08d2d56aeef70e9fa0af141232023
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7140
Reviewed-on: https://chromium-review.googlesource.com/815180Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
Commit-Queue: Mircea Trofin <mtrofin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49943}

Wasm-to-wasm uses a tail call mechanism to reach the target
function. This means there is no frame for it. This CL ports
the fix for that for the WasmCodeManager case, akin the current
fix for the GC case.

Bug: v8:7140
Change-Id: I04c8a8da1de9cb837a0423493216d2226c53e756
Reviewed-on: https://chromium-review.googlesource.com/814498Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Mircea Trofin <mtrofin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49942}

TBR=sergiyb@chromium.org

Bug: chromium:791583
Change-Id: I34ca6f966276277a69194c52fabb475826a034ae
Reviewed-on: https://chromium-review.googlesource.com/813854
Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org>
Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49941}

We might run into the situation that all fp registers are already in
use for holding parameters. Thus, use the {GetUnusedRegister()} method
which might spill to free one of the registers.

R=ahaas@chromium.org

Bug: v8:6600, chromium:792037
Change-Id: I44b279922e31ac4acaa07b6a36ba2e394100fde0
Reviewed-on: https://chromium-review.googlesource.com/813834Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49940}

This reverts commit 72e7b60b.

Reason for revert: whitespace CL is not landed by CQ

Original change's description:
> [tools] Migrate v8_linux64_asan_rel_ng and v8_linux64_asan_rel_ng_triggered to LUCI
> 
> No-Try: true
> Bug: chromium:748008, chromium:748000
> Change-Id: I487b7e85ade29b9aeaa9aeb4c90fd220581899a0
> Reviewed-on: https://chromium-review.googlesource.com/806171
> Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org>
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#49938}

TBR=machenbach@chromium.org,sergiyb@chromium.org

Change-Id: I171e71d34b6a4365b097e4fc951aa7ff7d619edd
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:748008, chromium:748000
Reviewed-on: https://chromium-review.googlesource.com/814714Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49939}

No-Try: true
Bug: chromium:748008, chromium:748000
Change-Id: I487b7e85ade29b9aeaa9aeb4c90fd220581899a0
Reviewed-on: https://chromium-review.googlesource.com/806171
Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49938}

While the affect values must be valid addresses & thus will not overflow
the IntPtr type, they need to be interpreted as unsigned in comparisons.

Bug: chromium:792549, v8:7123, v8:3590
Change-Id: I864b50c8dbdc297d70bf83c74a83cc466c5f3eb0
Reviewed-on: https://chromium-review.googlesource.com/814395
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49937}

Bug: v8:7176
Change-Id: I83d68a7e792b656d9f40a142b5403ac98c4f44c4
Reviewed-on: https://chromium-review.googlesource.com/814116Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49936}

This change got lost on a rebase of https://crrev.com/c/796854.

R=ahaas@chromium.org

Bug: v8:6600
Change-Id: I99e0b7f51f0b3ca1135c8d98fcc7b4c2c13193a3
Reviewed-on: https://chromium-review.googlesource.com/813923Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49935}

The tests illustrate the use of v8::EmbedderHeapTracer.

Bug: v8:7176
Change-Id: Ic383c968691fddb0ec96d66cb33ee42b9c304a75
Reviewed-on: https://chromium-review.googlesource.com/811924
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49934}

R=jgruber@chromium.org

Bug: chromium:791045, v8:1956, v8:7165
Change-Id: I58ba09248824f0309a3d37afa3e59bdea7c5f1f1
Reviewed-on: https://chromium-review.googlesource.com/813914Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49933}

When enabling any coverage mode (other than best-effort), we trigger
deoptimization of all functions on the heap.

Prior to the recent removal of the weak list of optimized functions [0],
we'd unlink optimized code from all relevant JSFunctions during the call
to DeoptimizeAll.

After the weak-list-removal, this was no longer the case, hence this [1]
change which attempts to reset the code object from the
SharedFunctionInfo for all found JSFunction objects.

But this can create a situation in which JSFunctions are set up
incorrectly s.t. they have unoptimized code but no feedback vector.

This CL fixes that by leaving JSFunction objects untouched and relying
on self-healing mechanisms (CompileLazyDeoptimizedCode) to fix up
JSFunction::code.

[0] https://crrev.com/f0acede9bb05155c25ee87e81b4b587e8a76f690
[1] https://crrev.com/c/647596/5/src/debug/debug-coverage.cc

Bug: chromium:786784, chromium:791940, v8:6637
Change-Id: I13191f4c8800a0d72894b959105189dc09ca693e
Reviewed-on: https://chromium-review.googlesource.com/813615
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49932}

R=machenbach@chromium.org

Bug: chromium:747960
Change-Id: Id4e3b976e2600b075a3ef5b719490a9d749b3760
Reviewed-on: https://chromium-review.googlesource.com/813837
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49931}

Bug: v8:7109
Change-Id: I20b7eba388415c0dd3bfe64130e6c9a7eaa3a5c8
Reviewed-on: https://chromium-review.googlesource.com/803436Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49930}

R=clemensh@chromium.org
BUG=v8:6792

Change-Id: Ia2567112ab86f42729337e539f9aaa1719d9a39f
Reviewed-on: https://chromium-review.googlesource.com/811305Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49929}

This is a preparation for a larger CL that needs VectorSlotPair
throughtout the compilation chain (including deoptimizer.cc).

Bug: v8:7127
Change-Id: Ia746805ca3fa294eedba19d23656f858840cd501
Reviewed-on: https://chromium-review.googlesource.com/813934Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49928}

Introduce new flag for starting young generation collection early
based on the current new space size.

Bug: v8:6972
Change-Id: I73dd28b8ac7df873b5c3e6ca4b3e55bdec5295a1
Reviewed-on: https://chromium-review.googlesource.com/811304
Commit-Queue: Michał Majewski <majeski@google.com>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49927}

This is a reland of 8dd405e3. The MSAN
failures were unrelated and should be fixed by 75c1c6c6.

Original change's description:
> [heap] introduce SpaceWithLinearArea class
>
> NewSpace and OldSpace have linear allocation areas, but presently the
> implementation doesn't share any code and there are subtle differences.
> This CL introduces a superclass 'SpaceWithLinearArea' that will be used
> to refactor and share code.
>
> Change-Id: I741e6a6ebb9e75c111287214fd1f555fba62c452
> Reviewed-on: https://chromium-review.googlesource.com/809504
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Commit-Queue: Ali Ijaz Sheikh <ofrobots@google.com>
> Cr-Commit-Position: refs/heads/master@{#49890}

Change-Id: I275bdc881b1b81f3ae3c7d36e919981ac4331315
Reviewed-on: https://chromium-review.googlesource.com/812324Reviewed-by: Ali Ijaz Sheikh <ofrobots@google.com>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49926}

Bug: v8:7109
Change-Id: I9766d28998fca49b0d3e6dc9aca3cc19f0b42124
Reviewed-on: https://chromium-review.googlesource.com/809244Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49925}

Ensure that the type is always stored correctly.

R=titzer@chromium.org

Bug: v8:6600, chromium:791810
Change-Id: Id3a3c20b14f8730b9550c548dec49ac47121e691
Reviewed-on: https://chromium-review.googlesource.com/811188Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49924}

Observers may start incremental marking and thus black allocation. Since
the object was allocated before invocing the observer the invariant
might not hold anymore.

Bug: v8:7174
Change-Id: I74fe1816303bedb28b69ec5ac83fd19e588acace
Reviewed-on: https://chromium-review.googlesource.com/813714Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49923}

This add scope for
- concurrent array buffer free task,
- concurrent store buffer processing task,
- concurrent unmapper task

Bug: chromium:758183
Change-Id: I1be3185a9ec44033982f6a0bb05d2e9b02074f85
Reviewed-on: https://chromium-review.googlesource.com/811646Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49922}

TBR=santa

Change-Id: Ied0791d1bf111c3f4729168432042e0fd13ac81e
Reviewed-on: https://chromium-review.googlesource.com/813694Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49921}

TBR=santa

Change-Id: I17260357602130ff210f3468bef6e55cf85edb65
Reviewed-on: https://chromium-review.googlesource.com/813634
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49920}

This saves ~80KB code size for each Deoptimizer.

Bug: 
Change-Id: I9fc6744e6acebad1d6012017caf2b29832364530
Reviewed-on: https://chromium-review.googlesource.com/809820Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49919}

TBR=mlippautz@chromium.org
NOTRY=true

Change-Id: I01fc2f77bb7df0b9ef7355c9910ca6d7423e46ca
Reviewed-on: https://chromium-review.googlesource.com/813614Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49918}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/3320fde..b70ba2b

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/3337fb6..82cfea0

Rolling v8/tools/swarming_client: https://chromium.googlesource.com/infra/luci/client-py/+log/6fd3c7b..4bd9152

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: I92348a6af3c322b1dd77c884290490612195743d
Reviewed-on: https://chromium-review.googlesource.com/812526Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49917}

Bug: 
Change-Id: I68e3f62612d9e6e7c915931c1c6f810d59df31eb
Reviewed-on: https://chromium-review.googlesource.com/810524Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Jing Bao <jing.bao@intel.com>
Cr-Commit-Position: refs/heads/master@{#49916}

The previous code assumed that trap handling was a global concept, defined
by function trap_handler::UseTrapHandler(). This CL does the first step
in changing the decision to be specifiable at a module level.

Therefore trap_handler::UseTrapHandler() is replaced by
trap_handler::IsTrapHandlerEnabled(), and communicates if compilation
supports the use of trap handlers (but still allowing the use of
bounds checking on memory accesses).

It then refactors the classes ModuleEnv and WasmCompiledModule to have
a field "use_trap_handler" that specifies if traps should be used for
the memory accesses in the module being compiled.

Bug: v8:7143
Change-Id: I9844842d5721c86c2dd55e911b42bf8b9922cf63
Reviewed-on: https://chromium-review.googlesource.com/802322
Commit-Queue: Eric Holk <eholk@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
Reviewed-by: Eric Holk <eholk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49915}

Performed manual testing as well by making 20 CPU profile recordings of
loading http://meduza.io page. Without the patch the page renderer memory size
grows beyond 300MB. With the patch it remains below 200MB.

BUG=v8:6623

Change-Id: Ifce541b84bb2aaaa5175520f8dd49dbc0cb5dd20
Reviewed-on: https://chromium-review.googlesource.com/798020
Commit-Queue: Alexei Filippov <alph@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49914}

It will help us to preserve some scripts for user.

R=alph@chromium.org
TBR=jgruber@chromium.org

Bug: chromium:655701
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I6d42434148c2d9eb41c3a2af906e8c14ccf8d9a9
Reviewed-on: https://chromium-review.googlesource.com/806741
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Reviewed-by: Alexei Filippov <alph@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49913}