Adds a stress-background-compile mode which runs compilation on a background
thread at the same time as compiling on the main thread to flush out races.
This is added as one of the variants, removing stress_asm_validation since this
is no longer a useful variant.

BUG=v8:5203

Change-Id: I73dd9f21d9b6da4a4cb39c05061aa24116e6c5ad
Reviewed-on: https://chromium-review.googlesource.com/741746
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49376}

They can no longer return nan. They basically intersect their argument
type with Type::OrderedNumber before analysing it. Never call them on
Type::NaN.

Bug: 
Change-Id: I7e7b46aa9fcde4f2644b81b3a34e76b092f633a4
Reviewed-on: https://chromium-review.googlesource.com/763410
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49375}

Add padding above arguments, as part of JSSP removal.

Bug: v8:6644
Change-Id: Iee03c3c8cd6da3d62b0b4c86a12400a5fdfe99de
Reviewed-on: https://chromium-review.googlesource.com/757136Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Georgia Kouveli <georgia.kouveli@arm.com>
Cr-Commit-Position: refs/heads/master@{#49374}

This introduces two dedicated API methods to invalidate references from
a given {Code} object. They are needed to reduce lifetime of objects
referenced from deoptimized code. The new methods are aim at embedded
objects and deoptimization data, called {InvalidateCodeEmbeddedObjects}
and {InvalidateCodeDeoptimizationData} respectively.

R=jarin@chromium.org
BUG=v8:6792

Change-Id: I6bf8806c8b00c6e0ec8f0551e9066729a86845b1
Reviewed-on: https://chromium-review.googlesource.com/757010Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49373}

R=mlippautz@chromium.org

Change-Id: Ie5ff0347d7c849e1941f8c8237a0bd56fdb68a4e
Reviewed-on: https://chromium-review.googlesource.com/768672Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49372}

The CodeStubAssembler's BitwiseOp method used by the interpreter and Number
related builtins would unconditionnaly mask the shift amount operand with
0x1f. However some targets' shift implementation may already do it.

This removes 24 `and` instructions from the snapshot on Arm64.

Bug: 
Change-Id: If0a720c7ea69fea46c9b31dd55903603f058d481
Reviewed-on: https://chromium-review.googlesource.com/765971Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Pierre Langlois <pierre.langlois@arm.com>
Cr-Commit-Position: refs/heads/master@{#49371}

Despite the V8_INLINE annotation, it was never actually inlined until
18cac20c removed the NonPatternRewriter,
causing all calls to Parser::RewriteNonPattern() to inline RewriteSpreads.

This patch should recover the binary bloat in the attached bug while
retaining the inlining of the rest of RewriteNonPattern, which in
the common case does very little work (and doesn't call out to RewriteSpreads).

Bug: chromium:784924
Change-Id: I1c2062b41ceb51a9522d49bdb9353e1840393ca1
Reviewed-on: https://chromium-review.googlesource.com/769442Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49370}

Otherwise we can end up with performance regression with a lot of
frames in cache. Map requires log(N) for lookup, unordered map for
frames ids requires - ~O(1).

R=dgozman@chromium.org

Bug: v8:7078
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel
Change-Id: Iac1ff7e35daede8c5ebd424f686a8ef8dbae9061
Reviewed-on: https://chromium-review.googlesource.com/767035
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Reviewed-by: Alexei Filippov <alph@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49369}

Previously, the Parser stored a Scope alongside a RewritableExpression
for each potential destructuring assignment. This Scope was later used
during rewriting to set the correct context for the rewriting. But this
approach failed if a new Scope was inserted into the Scope chain between
the time the assignment was parsed and when it was rewritten.

By storing the Scope directly in RewritableExpression,
ReparentExpressionScopes() is able to appropriately re-scope such
expressions prior to their rewriting.

Bug: chromium:779457
Change-Id: Ieb429a3da841f76d5798610af59da4fccb000652
Reviewed-on: https://chromium-review.googlesource.com/767666
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49368}

Add enum values to the "no cache reason" API which reflect new types of
no-cache reason we will want to distinguish.

Also, renames one of the enum values (BecauseExtension ->
BecauseV8Extension) because it was confusing. It's a V8-only type of no
cache reason, so it shouldn't affect embedders.

Bug: chromium:769203
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I41d4ecfb35b2e91b71562b4f23b15d20f16a943c
Reviewed-on: https://chromium-review.googlesource.com/769010Reviewed-by: Mythri Alle <mythria@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49367}

At the moment, task runners are returned as unique_ptr. This is
inconvenient, however. In all implementations I did, the platform holds
a shared pointer of the task runner and wraps it in a wrapper class just
to return it as a unique_ptr. With this CL the platform API is changed
to return a shared_ptr directly.

R=rmcilroy@chromium.org

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Ide278db855199ea239ad0ae14d97fd17349dac8c
Reviewed-on: https://chromium-review.googlesource.com/768867
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49366}

Prior langing massive async instrumentation refactoring let's add a perf
test to track our progress.

R=dgozman@chromium.org

Bug: v8:7078
Change-Id: I11e1ec962a9f384c2c778061c48935ac410fbe53
Reviewed-on: https://chromium-review.googlesource.com/766647Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49365}

Adds support for compiling top-level code on a background thread behind a flag.
When the flag is enabled, any background-parsing-task will perform compilation
as well as parsing.

BUG=v8:5203
TBR=marja@chromium.org,mstarzinger@chromium.org

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Icf90ac7211298d3555515dafc7c3245618ec1304
Reviewed-on: https://chromium-review.googlesource.com/764048
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49364}

This is a reland of 4899bcb6
This is a reland of b73ee334

Original change's description:
> [Memory] Use OS::Allocate for all OS memory allocations.
>
> - Eliminates OS::ReserveRegion and OS::ReserveAlignedRegion.
> - Changes OS::Allocate to take alignment parameter, reorders parameters
>   to match page_allocator.
> - Since the size of memory allocation can be deduced, don't return the
>   amount of memory allocated.
> - Changes reservation of aligned address space. Before we would reserve
>   (size + alignment) rounded up to page size. This is too much, because
>   maximum misalignment is (alignment - page_size).
> - On Windows and Cygwin, we release an oversize allocation and
>   immediately retry at the aligned address in the allocation. If we
>   lose the address due to a race, we just retry.
> - Clean up all the calls to OS::Allocate in codegen and tests by adding
>   helper AllocateSystemPage function (allocation.h) and
>   AllocateAssemblerBuffer (cctest.h).
> - Changes 'assm' to 'masm' in some targets for consistency when using
>   a macro-assembler.
>
> - Eliminates OS::ReleaseRegion, replacing with calls to OS::Free.
> - Adds bool return value to OS::Free.
> - Cleans up types of flags, protection on Windows and Cygwin.

> Bug: chromium:756050
> Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
> Change-Id: I306dbe042cc867670fdc935abca29db074b0da71

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Iad3c025334e8f8d7d647be99a36a11ee449c9087
Reviewed-on: https://chromium-review.googlesource.com/767014
Commit-Queue: Bill Budge <bbudge@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49363}

This reverts commit 9e4543a2.

Reason for revert: Culprit CL was found, let's reland this.

Original change's description:
> Revert lazy bytecode handler support
>
> Speculative revert due to canary crashes. I'll begin relanding these
> one-by-one next week.
>
> This bundles two reverts:
>
> Revert "[snapshot] Lazy-deserialize bytecode handlers"
> This reverts commit b4587369.
>
> Revert "[interpreter] Remove mechanism for bytecode handler reuse"
> This reverts commit 07fc87a2.
>
> TBR: rmcilroy@chromium.org,mlippautz@chromium.org,yangguo@chromium.org
> Bug: chromium:783708
> Change-Id: I6f8314b9eeafd9412a1c69843bc242e7da240eee
> Reviewed-on: https://chromium-review.googlesource.com/763428
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#49294}

TBR=rmcilroy@chromium.org,mlippautz@chromium.org,yangguo@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: chromium:783708
Change-Id: I6c9274ddf0d0832ecce32baacc4f6a1388f56ac4
Reviewed-on: https://chromium-review.googlesource.com/768749
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49362}

Bug: v8:5799
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I2c412f40aba6135dd0dafc7daa57420071ffee1c
Reviewed-on: https://chromium-review.googlesource.com/768414
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49361}

R=jarin@chromium.org

Bug: v8:6791
Change-Id: I29249640c4612421cd3bf938c465fc823aaa916d
Reviewed-on: https://chromium-review.googlesource.com/765967Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49360}

R=jarin@chromium.org

Bug: 
Change-Id: Ia674f7745ea08b31f3e3098c2d09bd05afc59ea7
Reviewed-on: https://chromium-review.googlesource.com/768410Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49359}

Unaligned access is still unused, but will be necessary to load String-length
once we store it as an int32 next to the hash-field.

Bug: v8:7065
Change-Id: I7fa9364e062774c0a6b32e7f961031dcd30c564c
Reviewed-on: https://chromium-review.googlesource.com/763349
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49358}

This reverts commit 8de2e6db.

Reason for revert: Suspect for:
https://build.chromium.org/p/client.v8/builders/V8%20Win32%20-%20nosnap%20-%20shared/builds/24237
https://build.chromium.org/p/client.v8/builders/V8%20Win64/builds/20896

Original change's description:
> [platform] Implement TaskRunners in the DefaultPlatform
> 
> This CL implements the TaskRunners in the DefaultPlatform which has been
> added recently to the platform API. In addition I changed how task
> posting works on the DefaultPlatform.
> 
> With this implementation the DefaultPlatform keeps one
> DefaultForegroundTaskRunner per isolate, plus one
> DefaultBackgroundTaskRunner. The DefaultPlatform owns these TaskRunners
> with a shared_ptr, which is also shared with any caller of
> GetForegroundTaskRunner or GetBackgroundTaskrunner.
> 
> This CL moves the task management from the DefaultPlatform to the
> TaskRunners.  The DefaultForegroundTaskRunner owns and manages the the
> task queue, the delayed task  queue, and the idle task queue. The
> DefaultBackgroundTaskRunner owns the WorkerThread pool and the
> background task queue.
> 
> In addition changed many Task* to std::unique_ptr<Task> to document task
> ownership.
> 
> R=​rmcilroy@chromium.org
> 
> Change-Id: Ib9a01f1f45e5b48844a37d801f884210ec3f6c27
> Reviewed-on: https://chromium-review.googlesource.com/753583
> Commit-Queue: Andreas Haas <ahaas@chromium.org>
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#49354}

TBR=rmcilroy@chromium.org,ahaas@chromium.org

Change-Id: I6c381915a2cae8ea1a0d21d6cfa6e797ccd2d947
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/768748Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49357}

Change-Id: Ie35e9f07b3936e975f5072c0508889c4a6a622da
Reviewed-on: https://chromium-review.googlesource.com/768812Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49356}

Bytecode compilation is not affected by whether it needs to
be serialized. Only TF-generated code objects included in the
snapshot are part of the startup snapshot. We therefore do
not need to pass the flag through the compilation info.

R=mstarzinger@chromium.org, verwaest@chromium.org

Change-Id: I761971febc5b6c27602c21cd5b0b2bffdd80bd5b
Reviewed-on: https://chromium-review.googlesource.com/758413Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49355}

This CL implements the TaskRunners in the DefaultPlatform which has been
added recently to the platform API. In addition I changed how task
posting works on the DefaultPlatform.

With this implementation the DefaultPlatform keeps one
DefaultForegroundTaskRunner per isolate, plus one
DefaultBackgroundTaskRunner. The DefaultPlatform owns these TaskRunners
with a shared_ptr, which is also shared with any caller of
GetForegroundTaskRunner or GetBackgroundTaskrunner.

This CL moves the task management from the DefaultPlatform to the
TaskRunners.  The DefaultForegroundTaskRunner owns and manages the the
task queue, the delayed task  queue, and the idle task queue. The
DefaultBackgroundTaskRunner owns the WorkerThread pool and the
background task queue.

In addition changed many Task* to std::unique_ptr<Task> to document task
ownership.

R=rmcilroy@chromium.org

Change-Id: Ib9a01f1f45e5b48844a37d801f884210ec3f6c27
Reviewed-on: https://chromium-review.googlesource.com/753583
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49354}

Bug: v8:6917
Change-Id: I4fb315ddf9999a3e7e2306201e5ace69b4e0be4b
Reviewed-on: https://chromium-review.googlesource.com/768713
Commit-Queue: Michał Majewski <majeski@google.com>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49353}

[snapshot] Use ThinStrings instead of custom forwarding using the hashfield to deserialize internalized strings

This is necessary to be able to store the string length next to the hash field in the same 64bit word on 64bit architectures. Otherwise the forwarding pointer will overwrite the length breaking heap guarantees. ThinStrings already just do the right thing, so just use that instead.

Bug: v8:7065
Change-Id: I4922365e72421995cd11437cb91572ff56f8a9e8
Reviewed-on: https://chromium-review.googlesource.com/763231Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49352}

.. by using macros for defining field offsets.

Bug: v8:5799
Change-Id: Id76e81bedb8f348b2efaa1d553bebac0ff90b474
Reviewed-on: https://chromium-review.googlesource.com/768382Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49351}

This partially retires --trace-parse and --trace-preparse which will be fully removed in
a later CL.

Drive-by-fix: make the Parser constructor arguments order more
consistent.

Bug: chromium:757467
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I80a688ce553adfa65ad346718604bd53a9e606a9
Reviewed-on: https://chromium-review.googlesource.com/744046
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49350}

With this CL, {CreateDefaultPlatform} returns a unique_ptr to indicate
that the caller owns the returned memory. We had several memory leaks
where the memory of the DefaultPlatform did not get deallocated.

In addition, the {TracingController} of the {DefaultPlatform} also gets
received as a unique_ptr. Thereby we document that the {DefaultPlatform}
takes ownership of the {TracingController}. Note that the memory of the
{TracingController} was already owned by the {DefaultPlatform}, but it
was not documented in the interface, and it was used incorrectly in
tests.

This CL fixes the asan issues in 
https://chromium-review.googlesource.com/c/v8/v8/+/753583	
([platform] Implement TaskRunners in the DefaultPlatform)

R=rmcilroy@chromium.org

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I0d1a6d3b22bb8289dc050b1977e4f58381cec675
Reviewed-on: https://chromium-review.googlesource.com/755033Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49349}

This CL adds a very crude unittest to check that RuntimeCallStats work
correctly with api callbacks present. This currently doesn't check that
all parent timers (namely FunctionCallback) are handled properly.

Drive-by-Fix:
- Use Microseconds for all RCS timer tests
- Add TestWithContext::SetGlobalProperty helper
- Use explicit v8:: prefix in test-utils.{h,cc}

Change-Id: I054e78abca0b87a3b9e07d3b06cccdad15403bae
Reviewed-on: https://chromium-review.googlesource.com/766429
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49348}

This reverts commit f010b28f.

Reason for revert: Introduces a clusterfuzz issue and CAnary crash

Original change's description:
> [TurboFan] Diagnostic code to track down bug in representation selection
> 
> We need to characterize the types of dead (IrOpcode::kDead) nodes
> introduced in compilation phases prior to representation selection.
> Normally, a dead node isn't expected at the start of this phase. The
> question is, which phase introduced the dead node and failed to
> deal with it properly?
> 
> Bug: chromium:780658
> Change-Id: Ief5b45480bb7d704a2d09dafd60b5d389e0fd42e
> Reviewed-on: https://chromium-review.googlesource.com/765968
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Commit-Queue: Michael Stanton <mvstanton@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#49328}

TBR=mvstanton@chromium.org,mstarzinger@chromium.org

Change-Id: I5d628eb1de630ce4a353b6ef0f80fd74ad740f17
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:780658
Reviewed-on: https://chromium-review.googlesource.com/768747Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49347}

Bug: v8:7016
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I5a509fb91a337eec4a58ab4a13d7104e8ba3ff23
Reviewed-on: https://chromium-review.googlesource.com/760677
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49346}

Make sure we have at least two elements in the Map, otherwise we don't
perform a proper dictionary lookup.

Bug: chromium:781218
Change-Id: I471e3822b95c15e3a5b2ac54c8ad1f030bd54d40
Reviewed-on: https://chromium-review.googlesource.com/768708Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49345}

Temporary fix for isolate archiver behaving weirdly when the command is
missing.

NOTRY=true
TBR=sergiyb@chromium.org

Bug: v8:7012
Change-Id: I1ccee6be16605426e74b6c4a0379fa502106e5a9
Reviewed-on: https://chromium-review.googlesource.com/768727Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49344}

- Remove weak-collection.js
- Adds TFJ builtins for WeakSet and WeakMap constructors
- Unified helpers and constructor behavior into a BaseCollectionsAssembler
- Fast paths for...
  - unmodified constructor function
  - argument is a fast JS array
  - entries are fast JS arrays, for Map/WeakMap
  - no arguments passed

Quick benchmarks shows significant improvements (1.12x - 5.7x!) for ALL collection constructors (weak and non-weak):
https://github.com/peterwmwong/v8-perf/blob/master/weakcollection-constructor/README.md

More could be done for performance.  Currently we always call out to JS to add entries, if we knew the prototype was unmodified, we could call the builtins directly.

Bug: v8:5049, v8:6604
Change-Id: Id7912c1eed5bcf512df7fd6238f04166a8a5937e
Reviewed-on: https://chromium-review.googlesource.com/760385Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49343}

R=jarin@chromium.org

Bug: v8:6791
Change-Id: I8519d0a9afdb457398ff428d0d3ec0734306052b
Reviewed-on: https://chromium-review.googlesource.com/765947Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49342}

Bug: v8:6917
Change-Id: I41324b8bf1827c43a652fa5f6b83731eaa17776d
Reviewed-on: https://chromium-review.googlesource.com/766887Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michał Majewski <majeski@google.com>
Cr-Commit-Position: refs/heads/master@{#49341}

R=ulan@chromium.org

This is in response to

https: //github.com/nodejs/node/issues/16901
Change-Id: I78fd5ea5b1d5602c4e48b985189e1b4114ff6443
Reviewed-on: https://chromium-review.googlesource.com/758680Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49340}

The lookbehind tests weren’t being skipped in the “without
lookbehind” case, resulting in a redundant test.

Bug: v8:4545
Change-Id: Ia004508373ba6ec49fd9de690909467eb0a15361
Reviewed-on: https://chromium-review.googlesource.com/765468Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Mathias Bynens <mathias@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49339}

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/aee17a9..755a485

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: I501229bc239cb2f9a26996249daa998f6a0c1e32
Reviewed-on: https://chromium-review.googlesource.com/768447Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49338}

Since each Array literal containing a spread is individually queued for
rewriting, there's no need for an AstVisitor here: a simple linear
pass through the queue is sufficient.

This patch deletes AstExpressionRewriter and all the machinery supporting
it in the AST. This code was built with the idea of using it as
a general expression rewriting mechanism in the parser, but those use
cases never materialized, and Array spread remains the only thing
that used this code.

Bug: v8:6092
Change-Id: I754c4883099e840881b005f20216f86e57721d5a
Reviewed-on: https://chromium-review.googlesource.com/765051Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49337}