This will give us some clusterfuzz coverage.

Bug: v8:7871
Change-Id: I670572454e196b7617a446769216722302f697a9
Reviewed-on: https://chromium-review.googlesource.com/c/1306973Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57250}

Bug: v8:7834
Change-Id: Ib53448757bbaf785ff39ba0da6f54c91e449035b
Reviewed-on: https://chromium-review.googlesource.com/c/1314113Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57249}

CanUseSameAccessor<ElementsAccessor: type> is array-sort.tq is super
performance-critical. Reverting the type-safe cleanup made in this
function while landing Array.prototype.slice.

Bug=chromium:852764

Change-Id: I1252d2ff8e431581f916794807e59abb39248abb
Reviewed-on: https://chromium-review.googlesource.com/c/1317815Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Daniel Clifford <danno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57248}

The maps in question are already processed in
NativeContextData::Serialize.

R=jarin@chromium.org

Bug: v8:7790
Change-Id: Ifbbff64e10458605b09c74fe09e574b2f2659839
Reviewed-on: https://chromium-review.googlesource.com/c/1317809
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57247}

In particular FunctionLiteral body. Now clients cannot use
function_literal->body() == nullptr anymore to figure out whether it was
preparsed; but have to check the eager compile hint.

Change-Id: Ia0d3a6b51c6fb7e803157e98a9d224224e03c8a7
Reviewed-on: https://chromium-review.googlesource.com/c/1317811Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57246}

Use early returns instead. The general scheme is to return early in the
abnormal case (e.g. error) and fall through to the end of the method in
the normal case.

R=ahaas@chromium.org

Bug: v8:8238
Change-Id: I281d35f5aad1f51b6d476fdc685565d9819397bb
Reviewed-on: https://chromium-review.googlesource.com/c/1317812
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57245}

A Property access is only a valid reference expression if the accessed object
is a valid expression.

Bug: v8:8409
Change-Id: I9bc9ac60ca3bf4e261d10af97aba18e9db2085ea
Reviewed-on: https://chromium-review.googlesource.com/c/1317816Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57244}

R=herhut@chromium.org

Change-Id: Ice45defac8f065b6b1c848fd42ead6ab46da89ab
Reviewed-on: https://chromium-review.googlesource.com/c/1317573Reviewed-by: Stephan Herhut <herhut@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57243}

- Add the WeakRef class and its deref() function.

- Add WeakFactory.prototype.makeRef

- Implement the "keep during job" behavior for WeakRef constructor and deref().

- Here we keep the targets alive longer than until the end of the job
  (microtask), contradicting the spec. However, this is probably the indended
  behavior, see https://github.com/tc39/proposal-weakrefs/issues/39 .

BUG=v8:8179

Change-Id: I41990d41ac1799e34f675d8431b9a7aa7ed3d48d
Reviewed-on: https://chromium-review.googlesource.com/c/1306435
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57242}

This is resurrecting an optimization from the pre-torque version.
Avoid allocating another sequential string for the result when there's only one
element, just return the ToString-ed element.  This not only saves time writing
to this destination string, but also reduce GC pressure.

The System Health Memory Benchmark (load:media:google_images) exposed this missing
optimization with a 15% regression in memory usage.  Very large external strings
were being copied into V8's heap as sequential string.

Bug: chromium:896612
Change-Id: Ieb61906f64100cdc15bf96f3ebcccb1207f75356
Reviewed-on: https://chromium-review.googlesource.com/c/1316620Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Peter Wong <peter.wm.wong@gmail.com>
Cr-Commit-Position: refs/heads/master@{#57241}

This is a reland of 7bd9eb7e. No changes
to that patch other than adding a test case. The bug that lead to the
revert has been fixed in 9bf8f72c.

Original change's description:
> Add fast paths to Array.from.
>
> This reuses the fast path from IterableToList for Array.from. The fast
> paths are taken when .from is called with the receiver Array and the only
> argument is the iterable (no mapping function or thisArg).
>
> Bug: v8:7980
> Change-Id: I975b0c5e3f838262d7b71ad4dec5111fb031d746
> Reviewed-on: https://chromium-review.googlesource.com/c/1297322
> Commit-Queue: Hai Dang <dhai@google.com>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#56993}

Bug: v8:7980
Change-Id: Id081837946c0989ec2b31ce991f48d09e0219b09
Reviewed-on: https://chromium-review.googlesource.com/c/1317586Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57240}

The relocation mode in question was by now only used in tests to model a
wrapper call from wrapper code (on the GC'ed heap) to a non-movable wasm
code object. Instead of using a special relocation mode, we switch to
using the existing {EXTERNAL_REFERENCE} mode similar to other static C++
functions called from generated code.

R=sigurds@chromium.org
BUG=v8:8238

Change-Id: I30af98b92aed207c52ccccaf018a455ecac39c2b
Reviewed-on: https://chromium-review.googlesource.com/c/1309821Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57239}

This introduces a new syntax for identifiers and calls: modulename::foo.
Such a name is resolved by trying to find a module modulename in one of
the parent scopes and looking for foo there. So this roughly corresponds
to C++ qualified namespace lookup.

Bug: v8:7793
Change-Id: Iedc43e6ebe125cd74575cbbcbf990bbcc0155a1f
Reviewed-on: https://chromium-review.googlesource.com/c/1309818
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Daniel Clifford <danno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57238}

R=ahaas@chromium.org

Bug: v8:8238, v8:7490
Change-Id: I27a57a43ad767d77e64764eda1d9017db87bdfcb
Reviewed-on: https://chromium-review.googlesource.com/c/1317588Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57237}

There's only one allocator kind left post-builtin-snapshot-removal,
so the 'Default' prefix can be removed.

Bug: v8:6666, v8:7990
Change-Id: Ib3c3eeb121792708591ca7be1e30adef77d3c111
Reviewed-on: https://chromium-review.googlesource.com/c/1309638
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57236}

No longer use inheritance to associate Torque-generated assemblers
with corresponding CSA subclasses. Instead, all references to CSA
and CSA-derived assemblers are now explicitly qualified, by generating
a short-lived assembler instance in-place. As a consequence, Torque
files have to mention the assembler external macros live in.
The CodeStubAssembler is the default for this and can be omitted.
As a drive-by cleanup, also distinguish between names that are emitted
in C++ and names that are intended to be read in error messages. This
is relevant for generic instantiations, where the generated names are
rather unreadably mangled.

As a follow-up, it will be easy to allow for qualified access to
different modules, thus implementing full namespace semantics for
modules.

Bug: v8:7793
Change-Id: Ie6f1b6b549b510fb49be2442393d898d5f130950
Reviewed-on: https://chromium-review.googlesource.com/c/1309636
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Daniel Clifford <danno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57235}

Ignore invalid input for all arguments of OptimizeFunctionOnNextCall
potentially produced by fuzzers.

Bug: chromium:901645
Change-Id: Ic185812c228a92f8dbb48212c45685bd14892947
Reviewed-on: https://chromium-review.googlesource.com/c/1317567Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57234}

R=clemensh@chromium.org

Change-Id: Icba445650131dcd54495f40f194ffe64cce24f94
Reviewed-on: https://chromium-review.googlesource.com/c/1317587Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57233}

The fast paths for sets and maps did not support allocation in
large object space, yet they were taken in these cases. This CL
adds support, simply by passing the kAllowLargeObjectAllocation
argument to AllocateJSArray.

It also changes the fast path for strings to use this argument
rather than take the slow path.

Bug: v8:7980, v8:8410
Change-Id: I18e88cb4ceb7ebeca250edd8b8b0eb401fdbd6e4
Reviewed-on: https://chromium-review.googlesource.com/c/1317507
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57232}

- Name lookup in module scopes has namespace semantics now: All
  overloads from all parent modules are combined before overload
  resolution.
- Allow overloads of different callables: runtime-functions,
  macros, builtins, and generics.
- The duplication between the DeclarationVisitor and the
  ImplementationVisitor is removed: The DeclarationVisitor creates
  declarables for everything except for implicit generic specializations.
  The ImplementationVisitor iterates over declarables.
  The DeclarationVisitor only looks at the header of declarations, not
  at the body.
- Modules become Declarable's, which will enable them to be nested.
- Modules replace the existing Scope chain mechanism, which will make it
  easier to inline macros.
- The DeclarationVisitor and Declarations become stateless. All state is
  moved to contextual variables and the GlobalContext.
- Implicit specializations are created directly from the
  ImplementationVisitor. This will enable template parameter inference.
- As a consequence, the list of all builtins is only available after the
  ImplementationVisitor has run. Thus GenerateBuiltinDefinitions has to
  move to the ImplementationVisitor. Also, this makes it necessary to
  resolve the link from function pointer types to example builtins only
  at this point.


Bug: v8:7793
Change-Id: I61cef2fd3e954ab148c252974344a6e38ee2d01d
Reviewed-on: https://chromium-review.googlesource.com/c/1304294
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Daniel Clifford <danno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57231}

BUG=chromium:901040

Change-Id: I0c28a2bd9a43d107e8afe8a8c0d53d1d3278121a
Reviewed-on: https://chromium-review.googlesource.com/c/1317506
Commit-Queue: Daniel Clifford <danno@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57230}

I will enable /Zc:DllexportInlines- flags for faster build time on windows.
But the flag makes clang's -Wundefined-inline check more strict as a secondary effect.

Actually, having inline function specifier for the function not defined in header file seems bit strange.
Let me remove inline specifier from such functions.

Bug: chromium:857548, chromium:901709
Change-Id: Ic06d10e2445cfedc7af67b72154f93a51ac26853
Reviewed-on: https://chromium-review.googlesource.com/c/1186017
Commit-Queue: Takuto Ikuta <tikuta@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57229}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/5fafa7f..cd2c8fe

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: I841cf4971c83f84dbe02d1ca771f503ca4856f82
Reviewed-on: https://chromium-review.googlesource.com/c/1316621
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#57228}

ICU 63.1 fixed it and v8's ICU was rolled to ICU 63.1

TBR=sigurds@chromium.org

Bug: v8:8110
Change-Id: Ic44c8f4293d6d39b597a90318f0acbf5aea6eccf
Reviewed-on: https://chromium-review.googlesource.com/c/1316615Reviewed-by: Jungshik Shin <jshin@chromium.org>
Commit-Queue: Jungshik Shin <jshin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57227}

CopyWords, as the name implies, copies raw words anyway, so there
is no need for type specialization.
MoveWords was dead code.

Bug: v8:8238
Change-Id: Ib497cfbabdcf8bac672ac74ef69f679b50ddfd6e
Reviewed-on: https://chromium-review.googlesource.com/c/1316609Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57226}

as part of the ongoing quest to get rid of Object*/Object** entirely.

Bug: v8:3770
Change-Id: Id3c6112a48a7a7ddb5441c72d81f4e4be61e3eae
Reviewed-on: https://chromium-review.googlesource.com/c/1316610Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57225}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/cf39c38..5fafa7f

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/c02ed04..8c035b3

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/a98da07..7e0b0c4

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: I42ab117eb558e08ba1b5b9e56c288e6a5d3be66a
Reviewed-on: https://chromium-review.googlesource.com/c/1316613
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#57224}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/6231c05..cf39c38

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/971689c..c02ed04

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/fec80c4..a98da07

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/36daae0..b2235ed

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: I27fbc4176c251e107b3793ebbb26cc5d298829b9
Reviewed-on: https://chromium-review.googlesource.com/c/1316611Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#57223}

TBR=sergiyb@chromium.org

No-Try: true
Bug: chromium:616879
Change-Id: Ic04e8a4dc58e34aada90e9d2801f88df5bcf8fd8
Reviewed-on: https://chromium-review.googlesource.com/c/1297962
Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org>
Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57222}

This reverts commit 7bd9eb7e.

Reason for revert: crashes on canary, see https://crbug.com/901010

Original change's description:
> Add fast paths to Array.from.
>
> This reuses the fast path from IterableToList for Array.from. The fast
> paths are taken when .from is called with the receiver Array and the only
> argument is the iterable (no mapping function or thisArg).
>
> Bug: v8:7980
> Change-Id: I975b0c5e3f838262d7b71ad4dec5111fb031d746
> Reviewed-on: https://chromium-review.googlesource.com/c/1297322
> Commit-Queue: Hai Dang <dhai@google.com>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#56993}

TBR=neis@chromium.org,dhai@google.com
Bug: v8:7980, chromium:901010, v8:8410

Change-Id: I5e73267f0b3a905582c57a6fad1459c031600a73
Reviewed-on: https://chromium-review.googlesource.com/c/1315935
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57221}

This is a reland of 9d34fa0c

TBR=ishell@chromium.org

Original change's description:
> [parser] Optimize directive parsing especially for preparser
>
> - Avoid allocating AstRawString in the preparser
> - Use fast LiteralEquals to compare the directive.
>
> Bug: chromium:901250
> Change-Id: I178aca812f6c0ffa28d7f48b707316a5a99a2ac0
> Reviewed-on: https://chromium-review.googlesource.com/c/1314570
> Commit-Queue: Toon Verwaest <verwaest@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#57217}

Bug: chromium:901250
Change-Id: I01dfd882923d3f37a08ca0be193474d38e273927
Reviewed-on: https://chromium-review.googlesource.com/c/1314578Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57220}

This is a reland of 7350e7b2

Disabled LayoutTest that was causing issues and will rebaseline once this has rolled.

Original change's description:
> Get BytecodeArray via current frame where possible.
>
> With BytecodeArray flushing the SFI->BytecodeArray pointer will become pseudo weak.
> Instead of getting the bytecode array from the SFI, get it from the frame instead
> (which is a strong pointer). Note: This won't actually change behaviour since the
> fact that the bytecode array was on the frame will retain it strongly, however it
> makes the contract that the BytecodeArray must exist at these points more explicit.
>
> Updates code in runtime-profiler.cc, frames.cc and runtime-test.cc to do this.
>
> BUG=v8:8395
>
> Cq-Include-Trybots: luci.chromium.try:linux_chromium_headless_rel;master.tryserver.blink:linux_trusty_blink_rel
> Change-Id: Id7a3e6857abd0e89bf238e9b0b01de4461df54e1
> Reviewed-on: https://chromium-review.googlesource.com/c/1310193
> Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
> Reviewed-by: Mythri Alle <mythria@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#57198}

TBR=mythria@chromium.org

Bug: v8:8395
Change-Id: I63044138f876a1cdfb8bb71499732a257f30d29a
Cq-Include-Trybots: luci.chromium.try:linux_chromium_headless_rel;master.tryserver.blink:linux_trusty_blink_rel
Reviewed-on: https://chromium-review.googlesource.com/c/1314336Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57219}

This reverts commit 9d34fa0c.

Reason for revert: Breaking test-parsing tests, see
https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Linux%20gcc%204.8/22942
https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Win64%20-%20msvc/5731

Original change's description:
> [parser] Optimize directive parsing especially for preparser
> 
> - Avoid allocating AstRawString in the preparser
> - Use fast LiteralEquals to compare the directive.
> 
> Bug: chromium:901250
> Change-Id: I178aca812f6c0ffa28d7f48b707316a5a99a2ac0
> Reviewed-on: https://chromium-review.googlesource.com/c/1314570
> Commit-Queue: Toon Verwaest <verwaest@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#57217}

TBR=ishell@chromium.org,verwaest@chromium.org

Change-Id: I47381358c5a8e9c39fe2af6e72481ebfe9d74a55
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:901250
Reviewed-on: https://chromium-review.googlesource.com/c/1314577Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57218}

- Avoid allocating AstRawString in the preparser
- Use fast LiteralEquals to compare the directive.

Bug: chromium:901250
Change-Id: I178aca812f6c0ffa28d7f48b707316a5a99a2ac0
Reviewed-on: https://chromium-review.googlesource.com/c/1314570
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57217}

On MIPS32R6, instruction JIC and JIALC where not properly
patched and this caused compilation failure in snapshot
generating phase

Change-Id: I29d8323faf22f825116e295cd2a2d55e714e61ed
Reviewed-on: https://chromium-review.googlesource.com/c/1314118Reviewed-by: Sreten Kovacevic <skovacevic@wavecomp.com>
Commit-Queue: Ivica Bogosavljevic <ibogosavljevic@wavecomp.com>
Cr-Commit-Position: refs/heads/master@{#57216}

NOTRY=true
R=sergiyb@chromium.org

Bug: chromium:901304
Change-Id: I343fa257f21afb4eff103b1bc52ba2bcb59fecc8
Reviewed-on: https://chromium-review.googlesource.com/c/1314573Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57215}

... and use it in JSCallReducer.

Bug: v8:7790
Change-Id: If8ed329fef4a4de8938a2d7009cb94c0e85242f0
Reviewed-on: https://chromium-review.googlesource.com/c/1314568Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57214}

TBR=sergiyb@chromium.org

Bug: v8:8291
Change-Id: I3fe107ae4d5853b71238521218017943f2d56393
Reviewed-on: https://chromium-review.googlesource.com/c/1314569
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57213}

Bug: v8:7790
Change-Id: Ifbcfaa3ae0cc8bef119da52e66a2b9371d6ecf03
Reviewed-on: https://chromium-review.googlesource.com/c/1314548
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57212}

Bug: v8:8393
Change-Id: I6ab34cbe6c17f358c570e0bd27bf2de917f71b71
Reviewed-on: https://chromium-review.googlesource.com/c/1309764
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Daniel Clifford <danno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57211}