This is a reland of 72e7b60b
Original change's description:
> [tools] Migrate v8_linux64_asan_rel_ng and v8_linux64_asan_rel_ng_triggered to LUCI
>
> No-Try: true
> Bug: chromium:748008, chromium:748000
> Change-Id: I487b7e85ade29b9aeaa9aeb4c90fd220581899a0
> Reviewed-on: https://chromium-review.googlesource.com/806171
> Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org>
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#49938}

No-Try: true
Bug: chromium:748008, chromium:748000
Change-Id: I406543c15285db81adcd0979fc25397229ddff64
Reviewed-on: https://chromium-review.googlesource.com/814715
Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49971}

If the fixed array is being concurrently left-trimmed then checked
getter can assert because the length is not necessarily a Smi.

This patch uses unchecked length getter to cache the length as Object*.
Only if the marker manages to color the array black, we are guaranteed
that the cached length is a Smi.

This patch also uses unchecked cast for FixedArray in HeapVisitor
for concurrent marker.

Note that this patch only affects debug mode.

Bug: chromium:694255
Change-Id: I5016a2234a9f5fb98b498e06f5d1428b3f1cc3c6
Reviewed-on: https://chromium-review.googlesource.com/817554
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49970}

- Introduce explicit CallXXX helpers in PropertyCallbackArguments for
  all Callback functions exposed in the api.
- Add bit on the Interceptors for checking whether they for names or
  indices.


Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Id862e4e39ba75b4610156adfe83f3eecfb2c048f
Reviewed-on: https://chromium-review.googlesource.com/799910
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49969}

I also adjusted the update script because the output directory of the
run.py script we call has changed.

R=clemensh#chromium.org

Change-Id: I432c81f1a2ffd3c96a294f771064672f7edad250
Reviewed-on: https://chromium-review.googlesource.com/817275Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49968}

Bug: v8:7127
Change-Id: Ibdbf6c5627f3fe8a29ae44cc0c284896c344a0ae
Reviewed-on: https://chromium-review.googlesource.com/817295
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49967}

This is a prepratory change to allow more refactoring of code between
New and PagedSpace.

Bug: 
Change-Id: Iabda8365cae0de2278d772e56728e900e688c9aa
Reviewed-on: https://chromium-review.googlesource.com/815904Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ali Ijaz Sheikh <ofrobots@google.com>
Cr-Commit-Position: refs/heads/master@{#49966}

This patch adds a field for the speculation mode to Call
nodes, and passes the speculation mode from the CallIC
to the Call node in the byte code graph builder.

Bug: v8:7127
Change-Id: I89fa10643b46143b36776de1d5ba6ebe3fa2c878
Reviewed-on: https://chromium-review.googlesource.com/814537
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49965}

This moves the verify-predictable logic from the test runner into
a python wrapper script.

This revealed two more tests that don't print allocations, which are
now skipped.

Bug: v8:7166, v8:7177
Change-Id: Ie4a541cb2a20900414ffe1caf4b3fccc4a5edb52
Reviewed-on: https://chromium-review.googlesource.com/808971
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49964}

This reverts commit 10817205.

While increasing the number of IRREGEXP regexp instances (vs. ATOM)
gives us a 3% perf improvement, it also results in higher memory
overhead. This CL is the suspected culprit for the recent 5x increase
in OOM crashes from within regexp codegen.

Bug: v8:6633, chromium:790833
Change-Id: Icca70b31fbda8cfb7a63dc895f6665dfe534359d
Reviewed-on: https://chromium-review.googlesource.com/817294Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49963}

Some buildbots were not compiling due to error `chosen constructor
is explicit in copy-initialization`

Bug: 
Change-Id: I24b8f1c4467e05e2832d8252a4cfe7352e1e91da
Reviewed-on: https://chromium-review.googlesource.com/813758
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49962}

Port 2cbfa244

Original Commit Message:

  [Memory] Use madvise on POSIX to allow OS to reclaim memory.

  - Use madvise when setting no permissions on memory.
  - Move platform specific mmap flag calculations to a helper fn.

  Bug: chromium:756050,chromium:788341
  Change-Id: I7d420a0abee9656a57fb0317301322da2fd7d7b5
  Reviewed-on: https://chromium-review.googlesource.com/790932


Change-Id: I5f7957066d0be96bd429b3d55c9293ffb996750c
Reviewed-on: https://chromium-review.googlesource.com/804554Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49961}

Bug: 
Change-Id: I4e105a3a09fe3b58255189bb89fa38224078ae5c
Reviewed-on: https://chromium-review.googlesource.com/817196Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49960}

This CL uses bits of the call count as flags according
to CallCountField and SpeculationModeField defined in
CallICNexus.

Bug: v8:7127
Change-Id: I3f64c1807d61410f9029b46b9a59a1fcaa5a0a3b
Reviewed-on: https://chromium-review.googlesource.com/808926
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49959}

Change-Id: I8485e7f11a1e105da79ea9bc99392c77666249ce
Reviewed-on: https://chromium-review.googlesource.com/816894Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49958}

Bug: v8:7180
Change-Id: If246db425a493e52092cba0fc28b1f02bd8d5db8
Reviewed-on: https://chromium-review.googlesource.com/816835Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49957}

This separates common logic that applies to both coverage/type profiling
(i.e. collecting feedback vectors into the list) from work that's only
required by coverage (resetting SFI::has_reported_binary_coverage and
FeedbackVector::invocation_count).

Bug: v8:6000
Change-Id: Icb36a8a6af34b3a425814d69653e331ca8f76cd5
Reviewed-on: https://chromium-review.googlesource.com/813922
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Franziska Hinkelmann <franzih@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49956}

Bug: 
Change-Id: I9003407826865f1befb0ea7de60aa9fce2766da7
Reviewed-on: https://chromium-review.googlesource.com/814675Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49955}

Add an element of padding to the frame constructed by the deoptimiser
when entering JSConstructStub, and update the non-arm64 backends such
that the frames agree for normal and deopt entry.

Bug: v8:6644
Change-Id: I99625e75760f0695b2389446c2ac3cac97c220f4
Reviewed-on: https://chromium-review.googlesource.com/814397Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Martyn Capewell <martyn.capewell@arm.com>
Cr-Commit-Position: refs/heads/master@{#49954}

Bug: chromium:780819
Change-Id: I07c5ff3cf955edb087a175ea2d71a35e0f520ec3
Reviewed-on: https://chromium-review.googlesource.com/813839
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49953}

This CL prepares support for memory operations, where we will need to
call runtime functions for trapping, and hence need safepoint
information for iterating the frames correctly.

R=titzer@chromium.org

Bug: v8:6600
Change-Id: I8c65d80cd69747d13d9084e7427253413fb4b808
Reviewed-on: https://chromium-review.googlesource.com/810784
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49952}

This upgrades binutils from 2.26 to 2.28.

BUG=chromium:761307

Change-Id: If556ca5912b4c06fdeb3f52b43a2530dfcabb624
Reviewed-on: https://chromium-review.googlesource.com/816017
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49951}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/b70ba2b..404c19d

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/82cfea0..16753e0

Rolling v8/third_party/icu: https://chromium.googlesource.com/chromium/deps/icu/+log/741688e..26f7d8a

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: I866cbe195397f99ab5a9668bf36d6f2310da8a02
Reviewed-on: https://chromium-review.googlesource.com/816537Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49950}

Includes:
- Better windows support in json generator.
- Add PDL2JSON, don't paste descriptions as comments into generated code.
- [inspector_protocol] generated only used types

R=pfeldman@chromium.org

Bug: none
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel
Change-Id: I3c634359b3ac4b00293ac7c5ee224dab53aae7ca
Reviewed-on: https://chromium-review.googlesource.com/810204
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Reviewed-by: Pavel Feldman <pfeldman@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49949}

Bug: v8:6876
Change-Id: I9de5218e4f44f3d593b93772283b2c1df0b07660
Reviewed-on: https://chromium-review.googlesource.com/809265Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Mircea Trofin <mtrofin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49948}

- in certain cases, we need both modification scopes because we may
mutate JS functions, even in the jit-to-native case - e.g. JS-to-wasm
wrappers
- added handling for wasm-to-wasm wrappers in the context of lazy
compilation.

Bug: v8:7105
Change-Id: I085c14e03ef0b08d040998f2207abf7bc3fff01c
Reviewed-on: https://chromium-review.googlesource.com/811285
Commit-Queue: Mircea Trofin <mtrofin@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49947}

This reverts commit d59063b5.

Reason for revert: worked around android toolchain issue. 
chromium:771171 is expected to address android toolchain issue

Original change's description:
> Revert "[wasm] Fix wasm-to-wasm handling in 'native heap' lazy compile"
> 
> This reverts commit 59f22174.
> 
> Reason for revert: android build issue (https://build.chromium.org/p/client.v8.fyi/builders/Android%20Release%20%28Nexus%205X%29/builds/3583)
> 
> Original change's description:
> > [wasm] Fix wasm-to-wasm handling in 'native heap' lazy compile
> > 
> > Wasm-to-wasm uses a tail call mechanism to reach the target
> > function. This means there is no frame for it. This CL ports
> > the fix for that for the WasmCodeManager case, akin the current
> > fix for the GC case.
> > 
> > Bug: v8:7140
> > Change-Id: I04c8a8da1de9cb837a0423493216d2226c53e756
> > Reviewed-on: https://chromium-review.googlesource.com/814498
> > Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
> > Reviewed-by: Ben Titzer <titzer@chromium.org>
> > Commit-Queue: Mircea Trofin <mtrofin@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#49942}
> 
> TBR=bradnelson@chromium.org,titzer@chromium.org,mtrofin@chromium.org,clemensh@chromium.org
> 
> Change-Id: Iae0e43b386f08d2d56aeef70e9fa0af141232023
> No-Presubmit: true
> No-Tree-Checks: true
> No-Try: true
> Bug: v8:7140
> Reviewed-on: https://chromium-review.googlesource.com/815180
> Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
> Commit-Queue: Mircea Trofin <mtrofin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#49943}

TBR=bradnelson@chromium.org,titzer@chromium.org,mtrofin@chromium.org,clemensh@chromium.org

Change-Id: If613a6c986ac4cf0534aecd8ea9bf74ecac21292
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7140
Reviewed-on: https://chromium-review.googlesource.com/815956
Commit-Queue: Mircea Trofin <mtrofin@chromium.org>
Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49946}

This is a reland of 0c2faa06
Original change's description:
> [D8] Clean up ArrayBuffer Allocators in shell.
>
> - Reworks the class hierarchy in d8.cc to conform to the allocator API.
>   In particular, allocators should malloc/free or equivalent unless
>   v8::ArrayBuffer::Allocator::Reserve is called.
> - Modifies ExternalizedContents to remember the allocation mode.
> - ArrayAllocatorBase now tracks its allocations to make sure it doesn't
>   call Free on externalized array buffers it didn't allocate.
>
> Bug: chromium:756050
> Change-Id: Ic2d07d36358f1b4fa542bea27f93d1d51a1757e1
> Reviewed-on: https://chromium-review.googlesource.com/807355
> Commit-Queue: Bill Budge <bbudge@chromium.org>
> Reviewed-by: Ben Titzer <titzer@chromium.org>
> Reviewed-by: Eric Holk <eholk@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#49893}

Bug: chromium:756050,v8:7146
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I8fe3a9d9af43196e16d02342a47347a76c0a1341
Reviewed-on: https://chromium-review.googlesource.com/811724Reviewed-by: Eric Holk <eholk@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49945}

Bring the two functions closer together in implementation. Avoid
unnecessary assignment to top_on_previous_step_.

Bug: 
Change-Id: I0b6881b02ab08a48bc2051e6786e22a7b25a4948
Reviewed-on: https://chromium-review.googlesource.com/815196Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ali Ijaz Sheikh <ofrobots@google.com>
Cr-Commit-Position: refs/heads/master@{#49944}

This reverts commit 59f22174.

Reason for revert: android build issue (https://build.chromium.org/p/client.v8.fyi/builders/Android%20Release%20%28Nexus%205X%29/builds/3583)

Original change's description:
> [wasm] Fix wasm-to-wasm handling in 'native heap' lazy compile
> 
> Wasm-to-wasm uses a tail call mechanism to reach the target
> function. This means there is no frame for it. This CL ports
> the fix for that for the WasmCodeManager case, akin the current
> fix for the GC case.
> 
> Bug: v8:7140
> Change-Id: I04c8a8da1de9cb837a0423493216d2226c53e756
> Reviewed-on: https://chromium-review.googlesource.com/814498
> Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
> Reviewed-by: Ben Titzer <titzer@chromium.org>
> Commit-Queue: Mircea Trofin <mtrofin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#49942}

TBR=bradnelson@chromium.org,titzer@chromium.org,mtrofin@chromium.org,clemensh@chromium.org

Change-Id: Iae0e43b386f08d2d56aeef70e9fa0af141232023
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7140
Reviewed-on: https://chromium-review.googlesource.com/815180Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
Commit-Queue: Mircea Trofin <mtrofin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49943}

Wasm-to-wasm uses a tail call mechanism to reach the target
function. This means there is no frame for it. This CL ports
the fix for that for the WasmCodeManager case, akin the current
fix for the GC case.

Bug: v8:7140
Change-Id: I04c8a8da1de9cb837a0423493216d2226c53e756
Reviewed-on: https://chromium-review.googlesource.com/814498Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Mircea Trofin <mtrofin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49942}

TBR=sergiyb@chromium.org

Bug: chromium:791583
Change-Id: I34ca6f966276277a69194c52fabb475826a034ae
Reviewed-on: https://chromium-review.googlesource.com/813854
Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org>
Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49941}

We might run into the situation that all fp registers are already in
use for holding parameters. Thus, use the {GetUnusedRegister()} method
which might spill to free one of the registers.

R=ahaas@chromium.org

Bug: v8:6600, chromium:792037
Change-Id: I44b279922e31ac4acaa07b6a36ba2e394100fde0
Reviewed-on: https://chromium-review.googlesource.com/813834Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49940}

This reverts commit 72e7b60b.

Reason for revert: whitespace CL is not landed by CQ

Original change's description:
> [tools] Migrate v8_linux64_asan_rel_ng and v8_linux64_asan_rel_ng_triggered to LUCI
> 
> No-Try: true
> Bug: chromium:748008, chromium:748000
> Change-Id: I487b7e85ade29b9aeaa9aeb4c90fd220581899a0
> Reviewed-on: https://chromium-review.googlesource.com/806171
> Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org>
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#49938}

TBR=machenbach@chromium.org,sergiyb@chromium.org

Change-Id: I171e71d34b6a4365b097e4fc951aa7ff7d619edd
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:748008, chromium:748000
Reviewed-on: https://chromium-review.googlesource.com/814714Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49939}

No-Try: true
Bug: chromium:748008, chromium:748000
Change-Id: I487b7e85ade29b9aeaa9aeb4c90fd220581899a0
Reviewed-on: https://chromium-review.googlesource.com/806171
Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49938}

While the affect values must be valid addresses & thus will not overflow
the IntPtr type, they need to be interpreted as unsigned in comparisons.

Bug: chromium:792549, v8:7123, v8:3590
Change-Id: I864b50c8dbdc297d70bf83c74a83cc466c5f3eb0
Reviewed-on: https://chromium-review.googlesource.com/814395
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49937}

Bug: v8:7176
Change-Id: I83d68a7e792b656d9f40a142b5403ac98c4f44c4
Reviewed-on: https://chromium-review.googlesource.com/814116Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49936}

This change got lost on a rebase of https://crrev.com/c/796854.

R=ahaas@chromium.org

Bug: v8:6600
Change-Id: I99e0b7f51f0b3ca1135c8d98fcc7b4c2c13193a3
Reviewed-on: https://chromium-review.googlesource.com/813923Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49935}

The tests illustrate the use of v8::EmbedderHeapTracer.

Bug: v8:7176
Change-Id: Ic383c968691fddb0ec96d66cb33ee42b9c304a75
Reviewed-on: https://chromium-review.googlesource.com/811924
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49934}

R=jgruber@chromium.org

Bug: chromium:791045, v8:1956, v8:7165
Change-Id: I58ba09248824f0309a3d37afa3e59bdea7c5f1f1
Reviewed-on: https://chromium-review.googlesource.com/813914Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49933}

When enabling any coverage mode (other than best-effort), we trigger
deoptimization of all functions on the heap.

Prior to the recent removal of the weak list of optimized functions [0],
we'd unlink optimized code from all relevant JSFunctions during the call
to DeoptimizeAll.

After the weak-list-removal, this was no longer the case, hence this [1]
change which attempts to reset the code object from the
SharedFunctionInfo for all found JSFunction objects.

But this can create a situation in which JSFunctions are set up
incorrectly s.t. they have unoptimized code but no feedback vector.

This CL fixes that by leaving JSFunction objects untouched and relying
on self-healing mechanisms (CompileLazyDeoptimizedCode) to fix up
JSFunction::code.

[0] https://crrev.com/f0acede9bb05155c25ee87e81b4b587e8a76f690
[1] https://crrev.com/c/647596/5/src/debug/debug-coverage.cc

Bug: chromium:786784, chromium:791940, v8:6637
Change-Id: I13191f4c8800a0d72894b959105189dc09ca693e
Reviewed-on: https://chromium-review.googlesource.com/813615
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49932}