It's expensive to walk all shared function infos during the gc atomic pause. Instead, use WeakCells to implement this structure without manual clearing.

BUG=

Review URL: https://codereview.chromium.org/1478943003

Cr-Commit-Position: refs/heads/master@{#32567}

Inline allocations performed during mark compact aren't real allocations. They
should not trigger inline-allocation-observer notifications.

R=hpayer@chromium.org, ulan@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1465223009

Cr-Commit-Position: refs/heads/master@{#32566}

Revert of [debugger] do not predict step in target for liveedit. (patchset #1 id:1 of https://codereview.chromium.org/1491743005/ )

Reason for revert:
[Sheriff] Layout test crashes:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/3220

Original issue's description:
> [debugger] do not predict step in target for liveedit.
>
> R=verwaest@chromium.org
>
> Committed: https://crrev.com/8f87ff5d62e996b07ffbde7e735daa603c1d7290
> Cr-Commit-Position: refs/heads/master@{#32553}

TBR=verwaest@chromium.org,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1494143002

Cr-Commit-Position: refs/heads/master@{#32565}

R=bmeurer@chromium.org,jarin@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1498833002

Cr-Commit-Position: refs/heads/master@{#32564}

This moves the proper handling for the end node withing the constructed
graph into the RawMachineAssembler. This simplifies all assemblers and
makes the handling of {Start} and {End} symmetrical.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1493963003

Cr-Commit-Position: refs/heads/master@{#32563}

Adds implementation and tests for Inc and Dec to bytecode graph builder.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1499593002

Cr-Commit-Position: refs/heads/master@{#32562}

Reland of Introduce instance type for transition arrays. (patchset #1 id:1 of https://codereview.chromium.org/1483003002/ )

Reason for revert:
Suspect for crashing found, relanding for canary coverage.

Original issue's description:
> Revert of Introduce instance type for transition arrays. (patchset #6 id:100001 of https://codereview.chromium.org/1480873003/ )
>
> Reason for revert:
> Broken canary. Trying to find out root cause.
>
> Original issue's description:
> > Introduce instance type for transition arrays.
> >
> > The motivation is to allow specialized marking visitor for transition arrays and collect all transition array in a list for post-processing in ClearNonLiveReferences.
> >
> > BUG=chromium:554488
> > LOG=NO
> >
> > Committed: https://crrev.com/026095a3c7932573e1810b8064ec3008ed696601
> > Cr-Commit-Position: refs/heads/master@{#32396}
>
> TBR=mlippautz@chromium.org,jkummerow@chromium.org,ulan@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=chromium:554488
>
> Committed: https://crrev.com/38bf70b9cd2a07b99ac0c0b7eda111849e79c146
> Cr-Commit-Position: refs/heads/master@{#32404}

TBR=mlippautz@chromium.org,jkummerow@chromium.org,ulan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:554488

Review URL: https://codereview.chromium.org/1500623002

Cr-Commit-Position: refs/heads/master@{#32561}

Reland of Tenure transition array. (patchset #1 id:1 of https://codereview.chromium.org/1485613003/ )

Reason for revert:
Suspect for crashing found, relanding for canary coverage.

Original issue's description:
> Revert of Tenure transition array. (patchset #1 id:1 of https://codereview.chromium.org/1472363007/ )
>
> Reason for revert:
> Broken canary. Trying to find out root cause.
>
> Original issue's description:
> > Tenure transition array.
> >
> > BUG=
> >
> > Committed: https://crrev.com/c88d7cd1e09d921e8a9a2930cfe6f2dfbea3dc90
> > Cr-Commit-Position: refs/heads/master@{#32378}
>
> TBR=ulan@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=chromium:563378
>
> Committed: https://crrev.com/cdb4b8fba1774f7617e51228c89286bcbd0425f0
> Cr-Commit-Position: refs/heads/master@{#32405}

TBR=ulan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:563378

Review URL: https://codereview.chromium.org/1492223003

Cr-Commit-Position: refs/heads/master@{#32560}

Reason for revert:

Should be fixed after
https://chromereviews.googleplex.com/318207014/

TBR=sergiyb@chromium.org,tandrii@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:561530

Review URL: https://codereview.chromium.org/1494893003

Cr-Commit-Position: refs/heads/master@{#32559}

An array is either a JSArray or a proxy whose target is an array.

R=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1497483004

Cr-Commit-Position: refs/heads/master@{#32558}

LOG=n
BUG=v8:1543

Review URL: https://codereview.chromium.org/1500553002

Cr-Commit-Position: refs/heads/master@{#32557}

For non-prototype objects constructed using base==new.target, use the cached constructor to render the name.

BUG=chromium:563791
LOG=y

Review URL: https://codereview.chromium.org/1494673004

Cr-Commit-Position: refs/heads/master@{#32556}

Reland of Do not remove write barriers for stores of old space references in most recent old space allocation. (patchset #1 id:1 of https://codereview.chromium.org/1482973003/ )

Reason for revert:
Suspect for crashing found, relanding for canary coverage.

Original issue's description:
> Revert of Do not remove write barriers for stores of old space references in most recent old space allocation. (patchset #1 id:1 of https://codereview.chromium.org/1478113002/ )
>
> Reason for revert:
> Broken canary. Trying to find out root cause.
>
> Original issue's description:
> > Do not remove write barriers for stores of old space references in most recent old space allocation.
> >
> > BUG=chromium:561449
> > LOG=n
> >
> > Committed: https://crrev.com/369778ec55a63ebe51e8fa8497edb5b681069b9b
> > Cr-Commit-Position: refs/heads/master@{#32368}
>
> TBR=ulan@chromium.org,bmeurer@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=chromium:561449
>
> Committed: https://crrev.com/da56525478f1820e3da629576ab61acc5f84daac
> Cr-Commit-Position: refs/heads/master@{#32406}

TBR=ulan@chromium.org,bmeurer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:561449

Review URL: https://codereview.chromium.org/1493313002

Cr-Commit-Position: refs/heads/master@{#32555}

Reland of [heap] Remove eager shortcut in JSFunction visitor. (patchset #1 id:1 of https://codereview.chromium.org/1488063002/ )

Reason for revert:
Suspect for crashing found, relanding for canary coverage.

Original issue's description:
> Revert of [heap] Remove eager shortcut in JSFunction visitor. (patchset #1 id:1 of https://codereview.chromium.org/1476223002/ )
>
> Reason for revert:
> Still investigating bad canary.
>
> Original issue's description:
> > [heap] Remove eager shortcut in JSFunction visitor.
> >
> > This removes an optimization in the static JSFunction visitor that
> > eagerly marked through to the SharedFunctionInfo for code flushing
> > candidates. This causes all processing in VisitJSFunction to be
> > side-stepped and hence might cause leaks.
> >
> > R=hpayer@chromium.org
> >
> > Committed: https://crrev.com/a29f0576c32e8fda90bf7ab19c6d170568150a7f
> > Cr-Commit-Position: refs/heads/master@{#32332}
>
> TBR=mstarzinger@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
>
> Committed: https://crrev.com/672b49119b857c4f96234b03e48b4b60de256969
> Cr-Commit-Position: refs/heads/master@{#32463}

TBR=mstarzinger@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1486413006

Cr-Commit-Position: refs/heads/master@{#32554}

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/1491743005

Cr-Commit-Position: refs/heads/master@{#32553}

Between requesting finalization of incremental marking and the time where we handle the request in the stack guard, the current full GC may have finished. In that case the stack guard triggers to late and tries to finalize marking in a state where marking is not going on.

Note that a cleaner fix would be to express the finalization phase in a special marking phase. I will do that in a follow-up CL.

BUG=

Review URL: https://codereview.chromium.org/1493133003

Cr-Commit-Position: refs/heads/master@{#32552}

BUG=none
R=neis@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/1493053004

Cr-Commit-Position: refs/heads/master@{#32551}

This drops the specific slot containing the new.target value from our
construct stub frames. This side-channel has been deprecated and will
no longer be accessed by any consumers.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/1489353004

Cr-Commit-Position: refs/heads/master@{#32550}

Whenever the InstanceOfStub finds a proxy (either passed as object or
somewhere on the prototype chain), it should bailout to the
%HasInPrototypeChain runtime function, which will do the right thing
(soonish).

R=yangguo@chromium.org
BUG=v8:1543
LOG=n

Review URL: https://codereview.chromium.org/1492243003

Cr-Commit-Position: refs/heads/master@{#32549}

This passes the new.target value in a register instead of through a
side-channel via the construct stub. Note that this marks the last
consumer of said side-channel and the special slot in the construct
stub frame can be removed as a follow-up.

R=bmeurer@chromium.org,yangguo@chromium.org
TEST=mjsunit/es6/regress/regress-new-target-context

Review URL: https://codereview.chromium.org/1492793002

Cr-Commit-Position: refs/heads/master@{#32548}

It didn't support subclassing case at all and in non-subclassing case the runtime
allocation didn't do the slack tracking step.

BUG=chromium:563339
LOG=Y

Review URL: https://codereview.chromium.org/1488023002

Cr-Commit-Position: refs/heads/master@{#32547}

Revert of [CQ] Update proto format to fix triggered builders. (patchset #1 id:1 of https://codereview.chromium.org/1494103002/ )

Reason for revert:
Still not working...

Original issue's description:
> Reland of [CQ] Update proto format to fix triggered builders.
>
> Reason for revert:
>
> Should be fixed after
> https://chromereviews.googleplex.com/317197013/
> https://codereview.chromium.org/1487413002/
> https://codereview.chromium.org/1489293003/
>
> TBR=sergiyb@chromium.org,tandrii@chromium.org
> NOPRESUBMIT=true
> NOTRY=true
> BUG=chromium:561530
>
> Committed: https://crrev.com/224c7fa72b8002348bb876ab7a4d4fabbf9438a4
> Cr-Commit-Position: refs/heads/master@{#32544}

TBR=sergiyb@chromium.org,tandrii@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:561530

Review URL: https://codereview.chromium.org/1497583003

Cr-Commit-Position: refs/heads/master@{#32546}

NOTRY=true
R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1493633005

Cr-Commit-Position: refs/heads/master@{#32545}

Reason for revert:

Should be fixed after
https://chromereviews.googleplex.com/317197013/
https://codereview.chromium.org/1487413002/
https://codereview.chromium.org/1489293003/

TBR=sergiyb@chromium.org,tandrii@chromium.org
NOPRESUBMIT=true
NOTRY=true
BUG=chromium:561530

Review URL: https://codereview.chromium.org/1494103002

Cr-Commit-Position: refs/heads/master@{#32544}

  port 411c5b7f (r32524)

  original commit message:
  Also remove the ResultMode from ToBooleanStub and always return true or
  false and use the same mechanism in fullcodegen.  This is in preparation
  for adding ToBoolean hints to TurboFan.

  Drive-by-fix: We can use the power of the ToBooleanIC in TurboFan now
  that the ResultMode is gone (and the runtime always returns true or
  false from the miss handler).

BUG=

Review URL: https://codereview.chromium.org/1500483002

Cr-Commit-Position: refs/heads/master@{#32543}

Rolling v8/tools/clang to b2ed9e4af62108938543234380912eeb9d5a58e6

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1491363003

Cr-Commit-Position: refs/heads/master@{#32542}

BUG=v8:4588
LOG=n
TBR=yangguo@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1496863002

Cr-Commit-Position: refs/heads/master@{#32541}

  port 531dde9f (r32516)

  original commit message:
  The new step-in implementation no longer tries to predict the step-in
  target, so we don't need the arguments count nor call type anymore.

BUG=

Review URL: https://codereview.chromium.org/1493993002

Cr-Commit-Position: refs/heads/master@{#32540}

The optimized code generated by Crankshaft cannot properly deal
with proxies (in the prototype chain), and there's probably no
point in trying to make that work^Wfast with Crankshaft at all.
TurboFan will handle that properly; Crankshaft just bails out
to fullcodegen, which then goes to the runtime, which should do
the right thing soon.

BUG=v8:1543
LOG=n

Review URL: https://codereview.chromium.org/1492983002

Cr-Commit-Position: refs/heads/master@{#32539}

  port 3e7e3ed7 (r32508)

  original commit message:
  * Add a sibling interface to InterpreterAssembler called
    CodeStubAssembler which provides a wrapper around the
    RawMachineAssembler and is intented to make it easy to build
    efficient cross-platform code stubs. Much of the implementation
    of CodeStubAssembler is shamelessly stolen from the
    InterpreterAssembler, and the idea is to eventually merge the
    two interfaces somehow, probably moving the
    InterpreterAssembler interface over to use the
    CodeStubAssembler. Short-term, however, the two interfaces
    shall remain decoupled to increase our velocity developing the
    two systems in parallel.
  * Implement the StringLength stub in TurboFan with the new
    CodeStubAssembler. Replace and remove the old Hydrogen-stub
    version.
  * Remove a whole slew of machinery to support JavaScript-style
    code stub generation, since it ultimately proved unwieldy,
    brittle and baroque. This cleanup includes removing the shared
    code stub context, several example stubs and a tangle of build
    file changes.

BUG=

Review URL: https://codereview.chromium.org/1492213002

Cr-Commit-Position: refs/heads/master@{#32538}

  port 19741ac9 (r32301)

  original commit message:
  The Float32RoundTruncate operator rounds float32 numbers towards zero.
  The operator is currently implemented on x64, ia32, arm, and arm64.

  Additionally I added support for the float32 vrintz, vrintn, and vrinta
  instructions to the arm simulator.

BUG=

Review URL: https://codereview.chromium.org/1493213002

Cr-Commit-Position: refs/heads/master@{#32537}

Both the is_const and declaration_scope fields can be reliably derived
from the mode field. needs_init cannot be, unfortunately, due to the
special case of CONST in for loops.

Also inline the sole remaining non-trivial caller of
Parser::DeclarationScope(VariableMode).

Review URL: https://codereview.chromium.org/1487603003

Cr-Commit-Position: refs/heads/master@{#32536}

Review URL: https://codereview.chromium.org/1485823003

Cr-Commit-Position: refs/heads/master@{#32535}

These bits were relevant back when we had nested lexical modules, but
I don't think they'll be of any use for ES2015 modules.

Review URL: https://codereview.chromium.org/1485053002

Cr-Commit-Position: refs/heads/master@{#32534}

Port 531dde9f

Original commit message:
    The new step-in implementation no longer tries to predict the step-in
    target, so we don't need the arguments count nor call type anymore.

R=yangguo@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1490413002

Cr-Commit-Position: refs/heads/master@{#32533}

Port 3e7e3ed7

Original commit message:
    * Add a sibling interface to InterpreterAssembler called
      CodeStubAssembler which provides a wrapper around the
      RawMachineAssembler and is intented to make it easy to build
      efficient cross-platform code stubs. Much of the implementation
      of CodeStubAssembler is shamelessly stolen from the
      InterpreterAssembler, and the idea is to eventually merge the
      two interfaces somehow, probably moving the
      InterpreterAssembler interface over to use the
      CodeStubAssembler. Short-term, however, the two interfaces
      shall remain decoupled to increase our velocity developing the
      two systems in parallel.
    * Implement the StringLength stub in TurboFan with the new
      CodeStubAssembler. Replace and remove the old Hydrogen-stub
      version.
    * Remove a whole slew of machinery to support JavaScript-style
      code stub generation, since it ultimately proved unwieldy,
      brittle and baroque. This cleanup includes removing the shared
      code stub context, several example stubs and a tangle of build
      file changes.

R=danno@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:4587
LOG=n

Review URL: https://codereview.chromium.org/1492633006

Cr-Commit-Position: refs/heads/master@{#32532}

Port 411c5b7f

Original commit message:
    Also remove the ResultMode from ToBooleanStub and always return true or
    false and use the same mechanism in fullcodegen.  This is in preparation
    for adding ToBoolean hints to TurboFan.

    Drive-by-fix: We can use the power of the ToBooleanIC in TurboFan now
    that the ResultMode is gone (and the runtime always returns true or
    false from the miss handler).

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:4583
LOG=n

Review URL: https://codereview.chromium.org/1490363003

Cr-Commit-Position: refs/heads/master@{#32531}

Revert of Disable non-standard Promise functions in staging (patchset #1 id:1 of https://codereview.chromium.org/1478533002/ )

Reason for revert:
Will test better; there seems to be a bug related to this.

Original issue's description:
> Reland of Disable non-standard Promise functions in staging (patchset #1 id:1 of https://codereview.chromium.org/1473603002/ )
>
> Reason for revert:
> Breakage in Ignition seems unrelated; relanding.
>
> Original issue's description:
> > Revert of Disable non-standard Promise functions in staging (patchset #5 id:80001 of https://codereview.chromium.org/1469543003/ )
> >
> > Reason for revert:
> > [Sheriff] This breaks ignition on arm sim debug:
> > https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm%20-%20sim%20-%20debug/builds/5317
> >
> > Seems to not be caught by the cq bot that builds release with dchecks.
> >
> > Original issue's description:
> > > Disable non-standard Promise functions in staging
> > >
> > > This patch removes Promise functions and methods which are absent
> > > from the ES2015 specification when the --es-staging flag is on.
> > >
> > > BUG=v8:3237
> > > R=rossberg
> > > LOG=Y
> > >
> > > Committed: https://crrev.com/941251af7e04d50ac2243da2870249a42111221a
> > > Cr-Commit-Position: refs/heads/master@{#32194}
> >
> > TBR=rossberg@chromium.org,littledan@chromium.org
> > NOPRESUBMIT=true
> > NOTREECHECKS=true
> > NOTRY=true
> > BUG=v8:3237
> >
> > Committed: https://crrev.com/86bd2b3c23b562213d5af158849dcd65f347a827
> > Cr-Commit-Position: refs/heads/master@{#32199}
>
> TBR=rossberg@chromium.org,rmcilroy@chromium.org,machenbach@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=v8:3237
>
> Committed: https://crrev.com/9278b7b05a45c2089007e8b61822af96b5d0c8df
> Cr-Commit-Position: refs/heads/master@{#32235}

TBR=rossberg@chromium.org,rmcilroy@chromium.org,machenbach@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3237

Review URL: https://codereview.chromium.org/1493713004

Cr-Commit-Position: refs/heads/master@{#32530}

update.sh is gone in chromium, and using update.py will do the right
thing both before and after the deletion in chromium (previously,
update.py used to call update.sh internally on non-win).

This also has the benefit of working on Windows.

No intended behavior change.

BUG=chromium:494442
LOG=n

Review URL: https://codereview.chromium.org/1495653002

Cr-Commit-Position: refs/heads/master@{#32529}

LOG=Y
BUG=chromium:558998
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1495633002

Cr-Commit-Position: refs/heads/master@{#32528}