This is a reland of f77d98f7.
The issue was already fixed when this got reverted.

Original change's description:
> Reland "[arm] [simulator] Do also execute tests on real hardware"
> 
> This is a reland of 8bacd848.
> The failing test is disabled if not executing in the simulator.
> 
> Original change's description:
> > [arm] [simulator] Do also execute tests on real hardware
> > 
> > In order to avoid writing tests that *only* pass in the simulator, but
> > not on real hardware, do also execute the simulator tests on real
> > hardware.
> > 
> > R=ahaas@chromium.org, rodolph.perfetta@arm.com
> > 
> > Bug: v8:6947
> > Change-Id: Ibdf1719fff20e17620c0aaa343d7ea28e48f3837
> > Reviewed-on: https://chromium-review.googlesource.com/722961
> > Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> > Reviewed-by: Rodolph Perfetta <rodolph.perfetta@arm.com>
> > Reviewed-by: Andreas Haas <ahaas@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#48706}
> 
> Bug: v8:6947, v8:6963
> Change-Id: I5733794bc5ca223c8e66afcdeb8414b1b4121314
> Reviewed-on: https://chromium-review.googlesource.com/727880
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#48734}

Bug: v8:6947, v8:6963
Change-Id: I6124164ff92a2387d714ce974000b6f615b91983
Reviewed-on: https://chromium-review.googlesource.com/727207Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48752}

This patch moves initialization of inobject_properties and
unused_property_fields of a map to the construction time of the map.

Map::AppendDescriptor now properly decrements unused_property_fields
and thus maintains the invariant for property field counters.

Bug: chromium:774644
Change-Id: I78e5d5c767e22148cb64e8cabe0564e7a13988f5
Reviewed-on: https://chromium-review.googlesource.com/725726Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48751}

Bug: 
No-try: true
Change-Id: I5c4f050d338cb75e93e17aa645922673c74f16e7
Reviewed-on: https://chromium-review.googlesource.com/721664Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Daniel Clifford <danno@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48750}

This revert is manual, but almost completely automatic. 
It was just blocked by a single-line irrelevant refactoring change.
This reverts commit 1cee0e01.

Reason for revert: chromium:776256

Original change's description:
> Reland^4 "[turbofan] eagerly prune None types and deadness from the graph"
>
> This fixes https://bugs.chromium.org/p/chromium/issues/detail?id=773954.
> The issue was that in the EffectControlLinearizer, the effect input of an
> {Unreachable} node was not updated, leaving a {Checkpoint} behind.
>
> This is a reland of 4cf47645
> Original change's description:
> > Reland^3 "[turbofan] eagerly prune None types and deadness from the graph"
> >
> > This fixes the issues
> > https://bugs.chromium.org/p/chromium/issues/detail?id=772873
> > and https://bugs.chromium.org/p/chromium/issues/detail?id=772872.
> >
> > One problem was that mutating an effect node into Unreachable confused
> > the LoadElimination sidetables, so I just always create a new node now.
> >
> > The other problem was that UpdateBlockControl() was executed after
> > UpdateEffectPhi() in the lazy case. This reverted the update to the Merge input.
> > So now I make sure that UpdateEffectPhi() is always executed last.
> >
> > This is a reland of 6ddb5e7d
> > Original change's description:
> > > Reland^2 "[turbofan] eagerly prune None types and deadness from the graph"
> > >
> > > Now, the EffectControlLinearizer connects all occurrences of Unreachable to the
> > > graph end. This fixes issues with later phases running DeadCodeElimination and
> > > introducing new DeadValue nodes when processing uses of Unreachable.
> > >
> > > This is a reland of 3c4bc27f
> > > Original change's description:
> > > > Reland "[turbofan] eagerly prune None types and deadness from the graph"
> > > >
> > > > This is a reland of e1cdda25
> > > > Original change's description:
> > > > > [turbofan] eagerly prune None types and deadness from the graph
> > > > >
> > > > > In addition to using the {Dead} node to prune dead control nodes and nodes that
> > > > > depend on them, we introduce a {DeadValue} node representing an impossible value
> > > > > that can occur at any position in the graph. The extended {DeadCodeElimination}
> > > > > prunes {DeadValue} and its uses, inserting a crashing {Unreachable} node into
> > > > > the effect chain when possible. The remaining uses of {DeadValue} are handled
> > > > > in {EffectControlLinearizer}, where we always have access to the effect chain.
> > > > > In addition to explicitly introduced {DeadValue} nodes, we consider any value use
> > > > > of a node with type {None} as dead.
> > > > >
> > > > > Bug: chromium:741225
> > > > > Change-Id: Icc4b636d1d018c452ba1a2fa7cd3e00e522f1655
> > > > > Reviewed-on: https://chromium-review.googlesource.com/641250
> > > > > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > > > > Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> > > > > Cr-Commit-Position: refs/heads/master@{#48208}
> > > >
> > > > Bug: chromium:741225
> > > > Change-Id: I21316913dae02864f7a6d7c9269405a79f054138
> > > > Reviewed-on: https://chromium-review.googlesource.com/692034
> > > > Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> > > > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > > > Cr-Commit-Position: refs/heads/master@{#48232}
> > >
> > > Bug: chromium:741225
> > > Change-Id: I5702ec34856c075717162153adc765774453c45f
> > > Reviewed-on: https://chromium-review.googlesource.com/702264
> > > Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> > > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > > Cr-Commit-Position: refs/heads/master@{#48366}
> >
> > Bug: chromium:741225
> > Change-Id: I4054a694d2521c2e1f0c4a3ad0f3cf100b5c536f
> > Reviewed-on: https://chromium-review.googlesource.com/709214
> > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#48469}
>
> Bug: chromium:741225
> Change-Id: Id9d4f3a3ae36cb3e38f80edcdba88efa7922ca24
> Reviewed-on: https://chromium-review.googlesource.com/715716
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#48660}

TBR=jarin@chromium.org,tebbi@chromium.org,bmeurer@chromium.org


Bug: chromium:741225 chromium:776256
Change-Id: Iaf2af3cb6dea5fdece43297cb9d987e7decc726d
Reviewed-on: https://chromium-review.googlesource.com/727804
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48749}

- Add StringRaw CPP Builtin
- Remove string.js

Bug: v8:5049
Change-Id: I0d067c5b5aa9231383c2f9f2a9cf80f478fbbaa8
Reviewed-on: https://chromium-review.googlesource.com/727723Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48748}

This also changes modulo to be more like others, e.g., Pow:
- have an inline Modulo
- have a modulo_double_double that we can use as FUNCTION_ADDR in assembler.cc

Bug: 
Change-Id: Id360e4adcde5712ffc5ac22abd3bbaab6aec09f5
Reviewed-on: https://chromium-review.googlesource.com/728027
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48747}

We don't need to save any data for top-level leaf
funcs (they contain no skippable funcs), so we
don't need scope analysis for them either.

BUG=v8:5516

Change-Id: I75700838a3df2f19da559145611c99e2c7ffd088
Reviewed-on: https://chromium-review.googlesource.com/691976
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48746}

This reverts commit 6f93d59d.

Reason for revert: Breaks full-debug build:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20full%20debug/builds/2239

Original change's description:
> [test] Add nan bit patterns to uint{32,64}_vector
> 
> If you just cast those patterns to float or double and pass them
> around, the quiet/signaling NaN bit might change. We had several bugs
> around this, so add these patterns to the general input vectors.
> 
> This oncovers a bug in the wasm interpreter, which will be fixed in a
> separate CL.
> 
> R=​ahaas@chromium.org
> 
> Bug: v8:6947, v8:6954
> Change-Id: I205b8ab784b087b1e4988190fa725df0b90e7ee0
> Reviewed-on: https://chromium-review.googlesource.com/725345
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#48731}

TBR=ahaas@chromium.org,clemensh@chromium.org

Change-Id: I4ceb82eab5d4cbf1f335bf6f358178a17a2fd0ba
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6947, v8:6954
Reviewed-on: https://chromium-review.googlesource.com/728101Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48745}

Change-Id: I67d75423a4f1db330fc79ec274ed7b3c6a9e2cd2
Reviewed-on: https://chromium-review.googlesource.com/725734Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Daniel Clifford <danno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48744}

This reverts commit f77d98f7.

Reason for revert: Still fails:
https://build.chromium.org/p/client.v8.ports/builders/V8%20Arm/builds/4978

Original change's description:
> Reland "[arm] [simulator] Do also execute tests on real hardware"
> 
> This is a reland of 8bacd848.
> The failing test is disabled if not executing in the simulator.
> 
> Original change's description:
> > [arm] [simulator] Do also execute tests on real hardware
> > 
> > In order to avoid writing tests that *only* pass in the simulator, but
> > not on real hardware, do also execute the simulator tests on real
> > hardware.
> > 
> > R=ahaas@chromium.org, rodolph.perfetta@arm.com
> > 
> > Bug: v8:6947
> > Change-Id: Ibdf1719fff20e17620c0aaa343d7ea28e48f3837
> > Reviewed-on: https://chromium-review.googlesource.com/722961
> > Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> > Reviewed-by: Rodolph Perfetta <rodolph.perfetta@arm.com>
> > Reviewed-by: Andreas Haas <ahaas@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#48706}
> 
> Bug: v8:6947, v8:6963
> Change-Id: I5733794bc5ca223c8e66afcdeb8414b1b4121314
> Reviewed-on: https://chromium-review.googlesource.com/727880
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#48734}

TBR=rodolph.perfetta@arm.com,ahaas@chromium.org,clemensh@chromium.org

Change-Id: I0ed35fc9e1dd5d30b0871479d17f0678fec17499
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6947, v8:6963
Reviewed-on: https://chromium-review.googlesource.com/727903Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48743}

Changes:
- introduce the notion of unreachable abstract states.

- reconnect unreachables states to runtime abort in effect phis (so that
  the merged states are not polluted by unreachable branches while
  preserving SSA).

- mark states with failed map checks, unreachable map guars as unreachable.

- add instance type to AbstractMaps, only invalidate instance type on
  mismatched effect merges.


This results in 2-3% improvement on ARES/ML steady state.

Bug: v8:6396
Change-Id: I35b0d4482fa400ba7ee9a754f8ef1b2663ebc7dc
Reviewed-on: https://chromium-review.googlesource.com/727761Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48742}

If we have good lower bound type information in simplified lowering
that the input to PlainPrimitiveToNumber is a string, then we'd like
to introduce a call to the StringToNumber builtin. However, this
requires more careful management of the effect chain than we had
previously. To fix this, introduce a StringToNumber opcode which
defers the graph alteration until effect-control-linearization,
when the effect chain is available for careful wiring.

Bug: v8:6929
Change-Id: I4f0e43fe474a44d0dfa095a3a01caece649d82db
Reviewed-on: https://chromium-review.googlesource.com/727934Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48741}

TBR=sergiyb@chromium.org

Bug: v8:6917
Change-Id: I96cedba176cd3c35ca39bb2d4604956cded114fc
Reviewed-on: https://chromium-review.googlesource.com/728023Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48740}

The test was recently enabled (together with other simulator tests) to
also run on native hardware (in https://crrev.com/c/727880).
Temporarlily disable this one test again until the issue is fixed.

R=ahaas@chromium.org

Bug: v8:6963
Change-Id: Ib6bae773a1d54541c87c37fb8547413ee7deac58
Reviewed-on: https://chromium-review.googlesource.com/728021Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48739}

This allocates and populates potential deoptimization data arrays before
the underlying {Code} objects is allocated. It aims at making the field
holding said data immutable after allocation. Note that we still mutate
this field during deoptimization.

R=verwaest@chromium.org
BUG=v8:6792

Change-Id: Id0c2cfb65e782d7292d2df6bff41c54b2b8c3351
Reviewed-on: https://chromium-review.googlesource.com/725704Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48738}

R=jgruber@chromium.org

Change-Id: I5748dcf1456a19be66058b1b7025da44bcbd999c
Reviewed-on: https://chromium-review.googlesource.com/725735
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48737}

- Throw a TypeError exception if a given target argument is not a typed
array before converting a given offset argument to an integer.
- Add a testcase

Bug: chromium:768775
Change-Id: Id132a0f154fcf930f211922fcbef6c66f9d6f285
Reviewed-on: https://chromium-review.googlesource.com/728120Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48736}

TBR=sergiyb@chromium.org
NOTRY=true

Bug: v8:6917
Change-Id: Ia417ab5cf59a6c2894de67d5519394629b6ab1b9
Reviewed-on: https://chromium-review.googlesource.com/727936Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48735}

This is a reland of 8bacd848.
The failing test is disabled if not executing in the simulator.

Original change's description:
> [arm] [simulator] Do also execute tests on real hardware
> 
> In order to avoid writing tests that *only* pass in the simulator, but
> not on real hardware, do also execute the simulator tests on real
> hardware.
> 
> R=ahaas@chromium.org, rodolph.perfetta@arm.com
> 
> Bug: v8:6947
> Change-Id: Ibdf1719fff20e17620c0aaa343d7ea28e48f3837
> Reviewed-on: https://chromium-review.googlesource.com/722961
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Reviewed-by: Rodolph Perfetta <rodolph.perfetta@arm.com>
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#48706}

Bug: v8:6947, v8:6963
Change-Id: I5733794bc5ca223c8e66afcdeb8414b1b4121314
Reviewed-on: https://chromium-review.googlesource.com/727880
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48734}

Bug: v8:6921
Change-Id: Id73a9ecc476c3c3ce0718bef81684787b72e366e
Reviewed-on: https://chromium-review.googlesource.com/727202Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48733}

R=bmeurer@chromium.org
BUG=v8:6792

Change-Id: I9f3be5304917215283643385ba4a216023c822ab
Reviewed-on: https://chromium-review.googlesource.com/725800
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48732}

If you just cast those patterns to float or double and pass them
around, the quiet/signaling NaN bit might change. We had several bugs
around this, so add these patterns to the general input vectors.

This oncovers a bug in the wasm interpreter, which will be fixed in a
separate CL.

R=ahaas@chromium.org

Bug: v8:6947, v8:6954
Change-Id: I205b8ab784b087b1e4988190fa725df0b90e7ee0
Reviewed-on: https://chromium-review.googlesource.com/725345
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48731}

This adds BigInt support to JavaScript's abstract equality (== and !=),
implemented mainly via CodeStubAssembler::Equal and via Object::Equals.

Bug: v8:6791
Change-Id: I53219f2f71baa760b142cc676f18931731b87226
Reviewed-on: https://chromium-review.googlesource.com/725701
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48730}

Use the (D)CHECK_{EQ,NE,GT,...} macros instead of (D)CHECK with an
embedded comparison. This gives better error messages and also does the
right comparison for signed/unsigned mismatches.

This will allow us to reenable the readability/check cpplint check.

R=ishell@chromium.org

Bug: v8:6837, v8:6921
Change-Id: If44435035d234e90c1dc306a306832c9d36013a2
Reviewed-on: https://chromium-review.googlesource.com/723019Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48729}

This makes jumbo_file_merge_limit=50 work again.

Bug: chromium:770684
Change-Id: I5db6566da876d71ea6ba50ff03b7652074b0a35f
Reviewed-on: https://chromium-review.googlesource.com/725818Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Mostyn Bramley-Moore <mostynb@vewd.com>
Cr-Commit-Position: refs/heads/master@{#48728}

Because the toboolean operator may lower to a builtin call (which is
effectful in turbofan parlance after effect control linearization),
it really should be encoded as a simplified operator, which can
be optimized with respect for the effect chain in linearization.

No new functionality here, rather a furniture rearrangement in
the TurboFan node structure.

Bug: v8:6929
Change-Id: I371fd22941397d5c28d13bded2738161d8da8275
Reviewed-on: https://chromium-review.googlesource.com/725721Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48727}

This is a reland of e737b4ce.
The issue on windows bots was fixed in https://crrev.com/c/725733.

Original change's description:
> [test] Avoid unnecessary std::vector allocations
> 
> Instead of copying an array of fixed values into an std::vector for
> each usage of the FOR_INPUTS macro, just iterate the constant data
> directly.
> This also makes the <type>_vector() functions return {constexpr Vector}
> instead of {std::vector}.
> 
> R=tebbi@chromium.org
> 
> Change-Id: Ifc3e5509b2fbf5e383c967c2f46acf2b07f7b5b4
> Reviewed-on: https://chromium-review.googlesource.com/725427
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#48688}

Change-Id: I9ad5d22803bbbf35c458965497acc603cfa01b20
Reviewed-on: https://chromium-review.googlesource.com/725979Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48726}

Encapsulates special reservation / allocation behavior for builtin
serialization.

This allows us to remove special logic around kNextChunk in builtin
deserialization (since we don't generate that bytecode anymore for
builtins).

Bug: v8:6624
Change-Id: Ice7673006cee53b9d11cdfb7f84d4175221c7984
Reviewed-on: https://chromium-review.googlesource.com/720357Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48725}

Change-Id: I1157ef6baaf60bdbf5d55a1b8f75edb15794baef
Bug: v8:6916
Reviewed-on: https://chromium-review.googlesource.com/715800Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48724}

Replace GetElement and SetElement to Get and Set, and use CopyElements,
which reduces 4x-13x overheads.

Bug: chromium:768775
Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng
Change-Id: I58534b30c2035195c5f4b8f2c04e7c459bdbebaa
Reviewed-on: https://chromium-review.googlesource.com/720661Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48723}

This addresses the odd performance cliff, where the CallIC tracks known
JSFunction targets, but goes MEGAMORPHIC when it sees a JSBoundFunction
target. With this fix in place the micro-benchmark on the bug goes from

  arrowCall: 82 ms.
  boundCall: 234 ms.

to

  arrowCall: 81 ms.
  boundCall: 80 ms.

so Function#bind doesn't cause any additional overhead anymore.

Bug: v8:5267, v8:6962
Change-Id: Iaceaf89fd3e99e2afe2ae45e96a6813a3ef8b1d2
Reviewed-on: https://chromium-review.googlesource.com/727879
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48722}

Intent to ship: goo.gl/QZ4QZ5

Bug: v8:5437
Change-Id: Icdacceefa3085f2657edd7f99c7d8f4dbbb76814
Reviewed-on: https://chromium-review.googlesource.com/727200Reviewed-by: Michael Hablich <hablich@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48721}

Example before:
Slot #0 BinaryOp MONOMORPHIC
 [0]: 15
Slot #1 CompareOp MONOMORPHIC
 [1]: 1

And after:
Slot #0 BinaryOp MONOMORPHIC (NumberOrOddball)
 [0]: 15
Slot #1 CompareOp MONOMORPHIC (SignedSmall)
 [1]: 1

R=jarin@chromium.org

Bug: 
Change-Id: Ia22437c52289a13bcfd8847d6e5677ad44529b39
Reviewed-on: https://chromium-review.googlesource.com/725815Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48720}

Broke in:
https://chromium-review.googlesource.com/c/v8/v8/+/725706

TBR=sergiyb@chromium.org
NOTRY=true

Bug: v8:6917
Change-Id: Ieb91c06a6bc1447acbe68c9ce881478c9a4a6149
Reviewed-on: https://chromium-review.googlesource.com/727800Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48719}

This patch provides "Abstract Comparison" functions on the BigInt
class for comparing BigInts to Numbers and Strings.
The functionality is not exposed to JavaScript yet.

Bug: v8:6791
Change-Id: I835f290203a31f363970b1edb359e19af6dabc5d
Reviewed-on: https://chromium-review.googlesource.com/722324
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48718}

Bug: v8:6917
Change-Id: Ia768c9aaf71e70d1376ae21a35fd539a7315b0cd
Reviewed-on: https://chromium-review.googlesource.com/725802
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48717}

This reverts commit 8bacd848.

Reason for revert: Fails on chromebooks:
https://build.chromium.org/p/client.v8.ports/builders/V8%20Arm%20-%20debug/builds/4820

Original change's description:
> [arm] [simulator] Do also execute tests on real hardware
> 
> In order to avoid writing tests that *only* pass in the simulator, but
> not on real hardware, do also execute the simulator tests on real
> hardware.
> 
> R=​ahaas@chromium.org, rodolph.perfetta@arm.com
> 
> Bug: v8:6947
> Change-Id: Ibdf1719fff20e17620c0aaa343d7ea28e48f3837
> Reviewed-on: https://chromium-review.googlesource.com/722961
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Reviewed-by: Rodolph Perfetta <rodolph.perfetta@arm.com>
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#48706}

TBR=rodolph.perfetta@arm.com,ahaas@chromium.org,clemensh@chromium.org

Change-Id: I4ec1c6ce4f6e86916a83a748819752ba00179ca2
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6947
Reviewed-on: https://chromium-review.googlesource.com/727760Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48716}

This ports the build_config json from GN to GYP to prepare deprecating
tedious flags passing to the test runner.

This also removes two unused GN flags that only hold temporary values.

Bug: v8:6917
Change-Id: I976185f1541277dc5c9bfbaa7578f35c19dd254c
Reviewed-on: https://chromium-review.googlesource.com/725706
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48715}

NOTRY=true

Bug: chromium:772816, v8:6918
Change-Id: I60d00d5fe6a46017fc8923dfc3dd922bca65d41f
Reviewed-on: https://chromium-review.googlesource.com/725807Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48714}

So far the JSCallReducer was only able to unfold constant
JSBoundFunction targets for JSCall nodes, which is not the
common case. With the introduction of JSCreateBoundFunction
operator earlier, we can now also recognize calls to bound
functions where the bind happens earlier in the function,
i.e. as the example of

  a.map(f.bind(self))

in https://twitter.com/BenLesh/status/920700003974123520, which
is a handy way to use Function#bind. So this transformation
takes a node like

  JSCall(JSCreateBoundFunction(bound_target_function,
                               bound_this,
                               a1,...,aN),
         receiver, p1,...,pM)

and turns that into

  JSCall(bound_target_function, bound_this, a1,...,aN,p1,...,pM)

allowing TurboFan to further inline the bound_target_function
at this call site if that's also inlinable (i.e. it's a known
constant JSFunction or the result of a JSCreateClosure call).

This improves the micro-benchmark from

  arrowCall: 55 ms.
  boundCall: 221 ms.
  arrowMap: 181 ms.
  boundMap: 806 ms.

to

  arrowCall: 71 ms.
  boundCall: 76 ms.
  arrowMap: 188 ms.
  boundMap: 186 ms.

so that Function#bind in this case is as fast as using closures,
which is an up to 4.3x improvement in the Array#map example.

Bug: v8:5257, v8:6961
Change-Id: Ibca650faad912bf9db1db6fbc48772e7551289a6
Reviewed-on: https://chromium-review.googlesource.com/727799Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48713}