It is preparation step for step-into-worker. There are few changes:
- added breakOnAsyncCall flag for Debugger.stepInto. When flag is set
  and async task is scheduled before step-into finished, we pause
  execution with additional Debugger.paused event. This event contains
  additional scheduledAsyncTaskId field.
- added Debugger.pauseOnAsyncTask. This method will pause execution as
  soon as given async task is started.

This mechanism is replacement for Debugger.scheduleStepIntoAsync which
can not be used between multiple targets.

As result we can split async task scheduling in one target and
requesting break for this async task running in another target.

R=pfeldman@chromium.org

Bug: chromium:778796
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel
Change-Id: I77be0c880d91253d333c54a23a4c084e7b8549e9
Reviewed-on: https://chromium-review.googlesource.com/750071Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Pavel Feldman <pfeldman@chromium.org>
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49127}

Implement I32Atomic BinOps, and enable tests to run in the interpreter.

Bug=v8:6532

Change-Id: Ida78d2911cb6973fe053283a9937e7af04e6df01
Reviewed-on: https://chromium-review.googlesource.com/724928
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49126}

Change-Id: I80378f4ea38e1251715614158716a2b1f7bc91b5
Reviewed-on: https://chromium-review.googlesource.com/753594Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49125}

The condition for bounds check generation was not in sync with the
condition that was used for the actual access, which lead to invalid
memory accesses when the array protector was invalid.

Tbr: tebbi@chromium.org
Bug: chromium:781506, chromium:781494, chromium:781457, chromium:781285, chromium:781381, chromium:781380, v8:6936, v8:7014, v8:7027
Change-Id: Ia5b2ad02940292572ed9b37abd3f9ffaa6d7a26b
Reviewed-on: https://chromium-review.googlesource.com/753590Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49124}

This reverts commit 7d231e57.

Reason for revert: Breaks revert for win-clang:
https://build.chromium.org/p/tryserver.chromium.win/builders/win_clang/builds/342755

Original change's description:
> [bits] Consolidate Count{Leading,Trailing}Zeros
> 
> Instead of having one method for 32 bit integers and one for 64 bit,
> plus a templatized version to choose from those two, just implement one
> version which handles unsigned integers of any size. Also, make them
> constexpr.
> The Count{Leading,Trailing}Zeros{32,64} methods are kept for now in
> order to keep the amount of code changes small. Also, sometimes it
> improves readability by stating exactly the size of the argument,
> especially for leading zeros (where zero-extending would add more
> leading zeros).
> 
> CountLeadingZeros now uses a binary search inspired implementation
> as proposed in Hacker's Delight. It's more than 20% faster on x64 if
> the builtins are disabled.
> CountTrailingZeros falls back to CountPopulation instead of counting in
> a naive loop. This is ~50% faster.
> 
> R=​mstarzinger@chromium.org
> 
> Change-Id: I1d8bf1d7295b930724163248150444bd17fbb34e
> Reviewed-on: https://chromium-review.googlesource.com/741231
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#49106}

TBR=mstarzinger@chromium.org,clemensh@chromium.org

Change-Id: Iceeb35bf9c7539a1013c9bdbc47118008611bef2
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/753463Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49123}

DebugBreak bytecode fetches current return value from debugger prior
dispatching original handler. So we can change its value on break.

R=leszeks@chromium.org,rmcilroy@chromium.org

Bug: chromium:656150
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I82d0bc82ff49923a748c0084d252d0fd214a2db8
Reviewed-on: https://chromium-review.googlesource.com/731679Reviewed-by: Pavel Feldman <pfeldman@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49122}

I believe the paths to the V8 include headers are incorrect. The paths
to other sources seem to be relative to the parent directory.

When building Node.js I get the following warning on Windows:
Warning: Missing input files:
deps\v8\src\..\..\include\v8-inspector-protocol.h
deps\v8\src\..\..\include\v8-inspector.h

This commit updates the two include paths.

Bug: 
Change-Id: I51a057abba61e294e7811ba69db03e283b0bdc3f
Reviewed-on: https://chromium-review.googlesource.com/743981Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49121}

This reverts commit c60934e9.

Reason for revert: breaks nosnap build


Original change's description:
> [Ast] Teach Ast Printer to print raw literal values.
> 
> Converts the ast prettyprinter to printing literals from the raw values
> rather than internalized on-heap strings. This enables ast printing before
> internalizing, and means we can avoid use of the isolate in the interpreter's
> off-thread phase.
> 
> Also removes --print-builtin-ast and relies on just --print-ast to print
> everything.
> 
> Finally, converts FunctionLiteral's debug_name function to return a
> char[] which is created from the raw name literal where it exists, rather
> than relying on the value having been internalized.
> 
> BUG=v8:5203
> 
> Change-Id: I0e358d6acc9ae4516ed49e7a763e208fea5fcf66
> Reviewed-on: https://chromium-review.googlesource.com/749261
> Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
> Reviewed-by: Adam Klein <adamk@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#49119}

TBR=rmcilroy@chromium.org,adamk@chromium.org

Change-Id: Ic9d511f5107666a2f6a2bf59d8e93643c32d4d2b
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:5203
Reviewed-on: https://chromium-review.googlesource.com/753627Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49120}

Converts the ast prettyprinter to printing literals from the raw values
rather than internalized on-heap strings. This enables ast printing before
internalizing, and means we can avoid use of the isolate in the interpreter's
off-thread phase.

Also removes --print-builtin-ast and relies on just --print-ast to print
everything.

Finally, converts FunctionLiteral's debug_name function to return a
char[] which is created from the raw name literal where it exists, rather
than relying on the value having been internalized.

BUG=v8:5203

Change-Id: I0e358d6acc9ae4516ed49e7a763e208fea5fcf66
Reviewed-on: https://chromium-review.googlesource.com/749261
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49119}

Bug: 
Change-Id: I9648c10c81a976b179fb58e8192366ee49f57db4
Reviewed-on: https://chromium-review.googlesource.com/741720Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49118}

The code was updating the UMA stats for V8.WasmFunctionSizeBytes when
the WASM function was decoded. Unfortunately, decoding of functions is
no longer done as a separate step. Rather, it is done as part of the
compilation step.

This CL moves the UMA updates to the compilation step.

Bug: v8:7032
Change-Id: I4679036035540fabd43855c1ba5ba66ffee6762a
Reviewed-on: https://chromium-review.googlesource.com/754023
Commit-Queue: Karl Schimpf <kschimpf@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49117}

This reverts commit fd5b067f.

Reason for revert: Tanks Babylon by around 40%

Original change's description:
> Disable --string-slices.
> 
> This is an experiment to quantify the impact of SlicedStrings on both
> performance and memory usage. The intention is to get Canary coverage
> for the experiment and then decide how to proceed.
> 
> Bug: v8:7025
> Change-Id: Ied548cd9e2fab127c1ad2aea3e60b2615d3de663
> Reviewed-on: https://chromium-review.googlesource.com/750082
> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#49070}

TBR=yangguo@chromium.org,bmeurer@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:7025
Change-Id: I95dc36e632ecb5ddcddda8f6f58528439d5c102b
Reviewed-on: https://chromium-review.googlesource.com/753621Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49116}

This patch evaluates computed properties in the order of declaration
during class definition time.

This patch creates a synthetic variable to store the result of
evaluating a computed property and then looks this up in the
initializer function.

Bug: v8:5367
Change-Id: I4182c6a01196d2538991818142890f6afb0e532b
Reviewed-on: https://chromium-review.googlesource.com/752567Reviewed-by: Mythri Alle <mythria@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49115}

- Sanitize Windows page size / alignment code.
- Reorder some methods to match header file.
- Rename AllocateAlignment to AllocatePageSize to be consistent
  with CommitPageSize.
- Eliminate OS::Allocate overload with is_executable argument.
- Eliminate base::OS::AllocateGuarded - it's not implemented.

Bug: chromium:756050
Change-Id: I046bb019cddde0c0063d617adc2c94a23989d9d1
Reviewed-on: https://chromium-review.googlesource.com/742684
Commit-Queue: Bill Budge <bbudge@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49114}

V8 provides non-standard Error API through:

Error.captureStackTrace
Error.prepareStackTrace
Error.stackTraceLimit

Let's add use counters to gauge how wide-spread these are used.

This is the V8 side of required changes.
The Chromium-side CL: https://crrev.com/c/753446

Bug: v8:6975
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I917cd6344a01670799f6cbf88a4bfff8e8d0d6ad
Reviewed-on: https://chromium-review.googlesource.com/753443Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49113}

This reverts commit c61f9171.

Reason for revert: (Speculative)
Seems to block the roll:
https://chromium-review.googlesource.com/c/chromium/src/+/753602

Also failures on webkit win unittests and gpu tests:
https://build.chromium.org/p/client.v8.fyi/builders/Win%20Release%20%28NVIDIA%29/builds/3382
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Win/builds/11512

Original change's description:
> [compiler] Add background compilation mode.
> 
> Adds support for compiling top-level code on a background thread behind a flag.
> When the flag is enabled, any background-parsing-task will perform compilation
> as well as parsing.
> 
> BUG=v8:5203
> 
> Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
> Change-Id: I88ab05c97cd6aea8d6be26e27d8da327f2c9c3a8
> Reviewed-on: https://chromium-review.googlesource.com/741716
> Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Reviewed-by: Marja Hölttä <marja@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#49103}

TBR=rmcilroy@chromium.org,marja@chromium.org,mstarzinger@chromium.org

Change-Id: I49b0b0ee61fb79766a9a928b43d51d0eeb793d39
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:5203
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/753302Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49112}

more.

Bug: v8:6333, v8:6921
Change-Id: I442190988f2c853560b28efa54e04ff73f9d94ca
Reviewed-on: https://chromium-review.googlesource.com/718343
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49111}

Change-Id: I456b3456351860e3e5e7e9dcb800d42d543a7c47
Reviewed-on: https://chromium-review.googlesource.com/753681
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49110}

The {NUMBER} regexp only allowed one, leading to occasional test
failures such as:
https://build.chromium.org/p/client.v8/builders/V8%20Mac%20-%20debug/builds/17156

Bug: 
Change-Id: I25a08b80640d9af19ba70c61c846163685f1cb82
Reviewed-on: https://chromium-review.googlesource.com/753322Reviewed-by: Franziska Hinkelmann <franzih@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49109}

Bug: 
Change-Id: If922715b071276613fd27b6cc7f5326fdc9a37db
Reviewed-on: https://chromium-review.googlesource.com/753091
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@imgtec.com>
Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@imgtec.com>
Cr-Commit-Position: refs/heads/master@{#49108}

Port c1925690

Original Commit Message:

    We expect no GC between the call to UnwindAndFindHandler and
    the call to that handler. We can precalculate the handler entrypoint
    and then let the CEntryStub just load and call that address.

    The main motivation for this change is the wasm on the native heap
    work, and making the CEntryStub able to work with non- Code* values.

R=mtrofin@chromium.org, mstarzinger@chromium.org, bradnelson@chromium.org, titzer@chromium.org, joransiu@ca.ibm.com, bjaideep@ca.ibm.com, michael_dawson@ca.ibm.com

Change-Id: I139fddabef9f601b46dac9011db3ab8e01e3346d
Reviewed-on: https://chromium-review.googlesource.com/752483Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#49107}

Instead of having one method for 32 bit integers and one for 64 bit,
plus a templatized version to choose from those two, just implement one
version which handles unsigned integers of any size. Also, make them
constexpr.
The Count{Leading,Trailing}Zeros{32,64} methods are kept for now in
order to keep the amount of code changes small. Also, sometimes it
improves readability by stating exactly the size of the argument,
especially for leading zeros (where zero-extending would add more
leading zeros).

CountLeadingZeros now uses a binary search inspired implementation
as proposed in Hacker's Delight. It's more than 20% faster on x64 if
the builtins are disabled.
CountTrailingZeros falls back to CountPopulation instead of counting in
a naive loop. This is ~50% faster.

R=mstarzinger@chromium.org

Change-Id: I1d8bf1d7295b930724163248150444bd17fbb34e
Reviewed-on: https://chromium-review.googlesource.com/741231Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49106}

Drive-by-fix: increase coverage in object literals test.

Change-Id: Iccfdf35b29229f63b3e8c1d961bee56ee03da688
Reviewed-on: https://chromium-review.googlesource.com/751661Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49105}

If an error is thrown in a setTimeout callback, exit d8 with an error
code.
This will allow us to test asynchronous failures better, see linked bug.

R=yangguo@chromium.org
CC=mathias@chromium.org

Bug: v8:6981
Change-Id: Ifad152e6039f12dc4ceaac0bdc4b87f709898087
Reviewed-on: https://chromium-review.googlesource.com/738372Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49104}

Adds support for compiling top-level code on a background thread behind a flag.
When the flag is enabled, any background-parsing-task will perform compilation
as well as parsing.

BUG=v8:5203

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I88ab05c97cd6aea8d6be26e27d8da327f2c9c3a8
Reviewed-on: https://chromium-review.googlesource.com/741716
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49103}

R=machenbach@chromium.org

Bug: chromium:777893
Change-Id: I2816934494309da458589b7d9b0c46fba9beaf38
Reviewed-on: https://chromium-review.googlesource.com/741221
Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49102}

We don't use ICs for the Array.prototype and the Object.prototype
because the runtime has to be able to intercept them properly (for the
global protectors). So we better make sure that TurboFan doesn't
outsmart the system by storing to elements of either prototype directly.

Bug: chromium:781116
Change-Id: I0f521601ef02c1b21018abd1bf1028fd8a811e84
Reviewed-on: https://chromium-review.googlesource.com/753089
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49101}

Bug: 
Change-Id: I5be4eabfc61f885f380fbec27dc537ed5d031493
Reviewed-on: https://chromium-review.googlesource.com/753084Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Franziska Hinkelmann <franzih@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49100}

This reverts commit 68212c80.

Reason for revert: https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20noi18n%20-%20debug/builds/17200

Original change's description:
> RegExp: Add the ability to switch flags on and off within the regexp
> 
> R=​yangguo@chromium.org
> 
> This is a reupload of https://chromium-review.googlesource.com/c/v8/v8/+/571746
> with a different user, since the other one was not allowed to commit to V8 any
> more.
> 
> Bug: 
> Change-Id: I6171afd44e514f6c934390faab6f9bee3953ac77
> Reviewed-on: https://chromium-review.googlesource.com/752522
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#49098}

TBR=erik.corry@gmail.com,yangguo@chromium.org,erikcorry@chromium.org,jgruber@chromium.org

Change-Id: I651c5618f09f43104af50cb1319ab7b49011573e
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/752802Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49099}

R=yangguo@chromium.org

This is a reupload of https://chromium-review.googlesource.com/c/v8/v8/+/571746
with a different user, since the other one was not allowed to commit to V8 any
more.

Bug: 
Change-Id: I6171afd44e514f6c934390faab6f9bee3953ac77
Reviewed-on: https://chromium-review.googlesource.com/752522
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49098}

Internalizing a key in the KeyedStoreICGeneric avoids an expensive SetProperty runtime call. 
This improves the prepack benchmark by ~5%. 
In the micro-benchmark copy-object.js attached to the bug, it surfaces as a ~2.5x improvement.
The performance improvement currently relies on the stub cache, since we don't search for 
transitions from within the CSA. As this CL puts additional stress on the stub cache, 
performance regressions wouldn't be too surprising.

Bug: v8:6936, v8:6997
Change-Id: Id1469499a3ae5450519ff40d3c5a0915c6de0d45
Reviewed-on: https://chromium-review.googlesource.com/749951Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49097}

Bug: 
Change-Id: I341ab2833896afcb1f97a6d4c3af3afb12a26b8a
Reviewed-on: https://chromium-review.googlesource.com/753083Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Franziska Hinkelmann <franzih@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49096}

This extends the support in TurboFan and the ICs for OOB loads to also
apply to typed arrays and receivers whose prototype chain is protected
by the "no elements" protector (aka the Array protector). TurboFan will
generate code to materialize undefined instead when it sees a load that
has the OOB bit set and add an appropriate code dependency on the global
protector. For typed arrays it doesn't even need to check the global
protector since elements are never looked up in the prototype chain
for typed arrays.

In the simple micro-benchmark from the bug we go from

  testInBounds: 103 ms.
  testOutOfBounds: 289 ms.

to

  testInBounds: 103 ms.
  testOutOfBounds: 102 ms.

which fixes the 3x slowdown and thus addresses the performance cliff. In
general it's still beneficial to make sure that you don't access out of
bounds, especially once we introduce a bounds check elimination pass to
TurboFan.

This also seems to improve the jQuery benchmark on the Speedometer test
suite by like 1-2% on average. And the SixSpeed rest benchmarks go from

  rest-es5: 25 ms.
  rest-es6: 23 ms.

to

  rest-es5: 6 ms.
  rest-es6: 4 ms.

so a solid 5.7x improvement there.

Bug: v8:6936, v8:7014, v8:7027
Change-Id: Ie99699c69cc40057512e72fd40ae28107216c423
Reviewed-on: https://chromium-review.googlesource.com/750089
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49095}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/ec29950..53fa255

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/buildtools/+log/3275a09..df36429

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/1471560..7208715

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/4ea1d22..9f0284f

Rolling v8/tools/swarming_client: https://chromium.googlesource.com/infra/luci/client-py/+log/fe94e72..5da404c

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: I837c1aa249d66b24733fbfbef597df6fd5480e6e
Reviewed-on: https://chromium-review.googlesource.com/752881Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49094}

This turns on the existing --internalize_on_the_fly flag for the
MEGAMORPHIC KeyedLoadIC to properly internalize strings before
looking up the property. This avoids the otherwise taken runtime
call to %KeyedGetProperty, which is definitely slower.

Initially the --internalize_on_the_fly flag was turned off because
internalizing strings on the fly causes too much traffic on the
megamorphic stub cache. We avoid this problem here by not probing
the stub cache in that case, which still gives the benefit of not
having to go to the runtime.

This improves the babylon test on the web-tooling-benchmark by around
2-3% and will probably also help with several tests (like React or
Ember) on the Speedometer benchmark.

If this CL causes trouble (i.e. tanks something important), we can
just turn off the --internalize_on_the_fly flag again.

Bug: v8:6936, v8:7026
Change-Id: If295ed3fd013f8b0ff031f9979e7df21dab817b6
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/751464Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49093}

Sweeping a page while currently scavenging it is broken as the scavenger
might override the slot it is currently processing.

Bug: chromium:779503
Change-Id: I224a144b84e97a956bf10ba018132c2713e8f78d
Reviewed-on: https://chromium-review.googlesource.com/752081
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49092}

No more crashes are seen in the RuntimeCallStats::Leave function. So
we can remove the debug info.

BUG=chromium:760649

Change-Id: If0a5f4ebf9ae359e3b8180ef2f8d37cab8659b06
Reviewed-on: https://chromium-review.googlesource.com/747483Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Alexei Filippov <alph@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49091}

This is a reland of a9a50dc9

Buildbot crashes are fixed by a274fc65.

Original change's description:
> [heap] Temporarily disable concurrent marking.
> 
> The 6.3 branch has a data race that is fixed in 6.4 but the fix is too
> large for back merging.
> 
> This CL will be back-merged to 6.3 after getting Canary coverage.
> 
> Concurrent marking will be re-enabled afterwards.
> 
> Bug: chromium:774644
> Change-Id: I4112da0e133a637cc4fb52dee2e4c165cdc74f1f
> Reviewed-on: https://chromium-review.googlesource.com/749811
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#49080}

Bug: chromium:774644
Change-Id: Idf5d179eca25a1481c70c6ca3bccde4869deb544
Reviewed-on: https://chromium-review.googlesource.com/751271Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49090}

Bug: v8:6917
Change-Id: Ia80de1d0430efb0c5f41a79267ba9146c5be42ce
Reviewed-on: https://chromium-review.googlesource.com/751462
Commit-Queue: Michał Majewski <majeski@google.com>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49089}

Reduce code duplication, which breaks jumbo builds. Put the StrictEqual
typing rule into the OperationTyper and share the JSType function,
which is also used by SameValue.

Bug: chromium:779531
Change-Id: If292f319217286fd1c676be04f9de3925ed56965
Reviewed-on: https://chromium-review.googlesource.com/751665Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49088}