TBR=sigurds@chromium.org
NOTRY=true

Bug: v8:7783
Change-Id: I17f1c17be365db7398e7e13dd62a6dd86a6cb008
Reviewed-on: https://chromium-review.googlesource.com/c/1319569
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57260}

Unlike other v8::Context getter on v8::Isolate, the v8::Context returned
by GetEnteredOrMicrotaskContext may be non-NativeContext. However,
Blink implicitly assumes all v8::Context is backed by NativeContexts.

This CL updates GetEnteredOrMicrotaskContext() to check the resulting
Context is NativeContext, and updates callers of EnterMicrotaskContext
to use NativeContext.

Change-Id: Ifae528f4ce8feb067f4ad1a43330dc55f4a8ed79
Reviewed-on: https://chromium-review.googlesource.com/c/1301653Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Taiju Tsuiki <tzik@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57259}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/b5b1fdc..47ccdba

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/03ce64d..9a5dbc6

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/7e0b0c4..459aaba

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: I24add833a4dee7301efa3f1ee2248351e3864074
Reviewed-on: https://chromium-review.googlesource.com/c/1319250Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#57258}

This reverts commit de88bfb2.

Reason for revert: Breaks msvc build https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Win64%20-%20msvc/5765

Original change's description:
> [wasm-simd] Implement remaining I8x16 SIMD ops on x64
> 
>  - Implementation for I8x16 Shifts, and Mul
>  - Fix convert bug
>  - Enable all tests except for shuffle tests
> 
> Change-Id: Id1a469d2883c30ea782c51d21dc462d211f94420
> Reviewed-on: https://chromium-review.googlesource.com/c/1318609
> Reviewed-by: Bill Budge <bbudge@chromium.org>
> Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#57254}

TBR=bbudge@chromium.org,gdeepti@chromium.org

Change-Id: I09efd8002e27f457e89250336e6c3a12d8d9682c
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/1318097Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57257}

This should allow for better parallelization when running these tests.

Change-Id: Ib3cae7d6e8f0d2608470ca616eeac7eecae3b7ab
Reviewed-on: https://chromium-review.googlesource.com/c/1318094Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57256}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/cd2c8fe..b5b1fdc

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/8c035b3..03ce64d

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: I5df515eea0c133826fcc1a78fb2453a2a8043c98
Reviewed-on: https://chromium-review.googlesource.com/c/1318093
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#57255}

 - Implementation for I8x16 Shifts, and Mul
 - Fix convert bug
 - Enable all tests except for shuffle tests

Change-Id: Id1a469d2883c30ea782c51d21dc462d211f94420
Reviewed-on: https://chromium-review.googlesource.com/c/1318609Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57254}

TBR=machenbach@chromium.org

Bug: chromium:899721
Change-Id: Ifdb4864e47a56cb0fe2565e44e79f3def496b138
Reviewed-on: https://chromium-review.googlesource.com/c/1317821
Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org>
Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57253}

and split Smi out of objects.h into smi.h.

Bug: v8:3770, v8:5402
Change-Id: I5ff7461495d29c785a76c79aca2616816a29ab1e
Reviewed-on: https://chromium-review.googlesource.com/c/1313035Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57252}

Change-Id: I273764acb3881a5f682d3cc77e2c8f66bbb7b071
Reviewed-on: https://chromium-review.googlesource.com/c/1318091Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#57251}

This will give us some clusterfuzz coverage.

Bug: v8:7871
Change-Id: I670572454e196b7617a446769216722302f697a9
Reviewed-on: https://chromium-review.googlesource.com/c/1306973Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57250}

Bug: v8:7834
Change-Id: Ib53448757bbaf785ff39ba0da6f54c91e449035b
Reviewed-on: https://chromium-review.googlesource.com/c/1314113Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57249}

CanUseSameAccessor<ElementsAccessor: type> is array-sort.tq is super
performance-critical. Reverting the type-safe cleanup made in this
function while landing Array.prototype.slice.

Bug=chromium:852764

Change-Id: I1252d2ff8e431581f916794807e59abb39248abb
Reviewed-on: https://chromium-review.googlesource.com/c/1317815Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Daniel Clifford <danno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57248}

The maps in question are already processed in
NativeContextData::Serialize.

R=jarin@chromium.org

Bug: v8:7790
Change-Id: Ifbbff64e10458605b09c74fe09e574b2f2659839
Reviewed-on: https://chromium-review.googlesource.com/c/1317809
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57247}

In particular FunctionLiteral body. Now clients cannot use
function_literal->body() == nullptr anymore to figure out whether it was
preparsed; but have to check the eager compile hint.

Change-Id: Ia0d3a6b51c6fb7e803157e98a9d224224e03c8a7
Reviewed-on: https://chromium-review.googlesource.com/c/1317811Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57246}

Use early returns instead. The general scheme is to return early in the
abnormal case (e.g. error) and fall through to the end of the method in
the normal case.

R=ahaas@chromium.org

Bug: v8:8238
Change-Id: I281d35f5aad1f51b6d476fdc685565d9819397bb
Reviewed-on: https://chromium-review.googlesource.com/c/1317812
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57245}

A Property access is only a valid reference expression if the accessed object
is a valid expression.

Bug: v8:8409
Change-Id: I9bc9ac60ca3bf4e261d10af97aba18e9db2085ea
Reviewed-on: https://chromium-review.googlesource.com/c/1317816Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57244}

R=herhut@chromium.org

Change-Id: Ice45defac8f065b6b1c848fd42ead6ab46da89ab
Reviewed-on: https://chromium-review.googlesource.com/c/1317573Reviewed-by: Stephan Herhut <herhut@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57243}

- Add the WeakRef class and its deref() function.

- Add WeakFactory.prototype.makeRef

- Implement the "keep during job" behavior for WeakRef constructor and deref().

- Here we keep the targets alive longer than until the end of the job
  (microtask), contradicting the spec. However, this is probably the indended
  behavior, see https://github.com/tc39/proposal-weakrefs/issues/39 .

BUG=v8:8179

Change-Id: I41990d41ac1799e34f675d8431b9a7aa7ed3d48d
Reviewed-on: https://chromium-review.googlesource.com/c/1306435
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57242}

This is resurrecting an optimization from the pre-torque version.
Avoid allocating another sequential string for the result when there's only one
element, just return the ToString-ed element.  This not only saves time writing
to this destination string, but also reduce GC pressure.

The System Health Memory Benchmark (load:media:google_images) exposed this missing
optimization with a 15% regression in memory usage.  Very large external strings
were being copied into V8's heap as sequential string.

Bug: chromium:896612
Change-Id: Ieb61906f64100cdc15bf96f3ebcccb1207f75356
Reviewed-on: https://chromium-review.googlesource.com/c/1316620Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Peter Wong <peter.wm.wong@gmail.com>
Cr-Commit-Position: refs/heads/master@{#57241}

This is a reland of 7bd9eb7e. No changes
to that patch other than adding a test case. The bug that lead to the
revert has been fixed in 9bf8f72c.

Original change's description:
> Add fast paths to Array.from.
>
> This reuses the fast path from IterableToList for Array.from. The fast
> paths are taken when .from is called with the receiver Array and the only
> argument is the iterable (no mapping function or thisArg).
>
> Bug: v8:7980
> Change-Id: I975b0c5e3f838262d7b71ad4dec5111fb031d746
> Reviewed-on: https://chromium-review.googlesource.com/c/1297322
> Commit-Queue: Hai Dang <dhai@google.com>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#56993}

Bug: v8:7980
Change-Id: Id081837946c0989ec2b31ce991f48d09e0219b09
Reviewed-on: https://chromium-review.googlesource.com/c/1317586Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57240}

The relocation mode in question was by now only used in tests to model a
wrapper call from wrapper code (on the GC'ed heap) to a non-movable wasm
code object. Instead of using a special relocation mode, we switch to
using the existing {EXTERNAL_REFERENCE} mode similar to other static C++
functions called from generated code.

R=sigurds@chromium.org
BUG=v8:8238

Change-Id: I30af98b92aed207c52ccccaf018a455ecac39c2b
Reviewed-on: https://chromium-review.googlesource.com/c/1309821Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57239}

This introduces a new syntax for identifiers and calls: modulename::foo.
Such a name is resolved by trying to find a module modulename in one of
the parent scopes and looking for foo there. So this roughly corresponds
to C++ qualified namespace lookup.

Bug: v8:7793
Change-Id: Iedc43e6ebe125cd74575cbbcbf990bbcc0155a1f
Reviewed-on: https://chromium-review.googlesource.com/c/1309818
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Daniel Clifford <danno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57238}

R=ahaas@chromium.org

Bug: v8:8238, v8:7490
Change-Id: I27a57a43ad767d77e64764eda1d9017db87bdfcb
Reviewed-on: https://chromium-review.googlesource.com/c/1317588Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57237}

There's only one allocator kind left post-builtin-snapshot-removal,
so the 'Default' prefix can be removed.

Bug: v8:6666, v8:7990
Change-Id: Ib3c3eeb121792708591ca7be1e30adef77d3c111
Reviewed-on: https://chromium-review.googlesource.com/c/1309638
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57236}

No longer use inheritance to associate Torque-generated assemblers
with corresponding CSA subclasses. Instead, all references to CSA
and CSA-derived assemblers are now explicitly qualified, by generating
a short-lived assembler instance in-place. As a consequence, Torque
files have to mention the assembler external macros live in.
The CodeStubAssembler is the default for this and can be omitted.
As a drive-by cleanup, also distinguish between names that are emitted
in C++ and names that are intended to be read in error messages. This
is relevant for generic instantiations, where the generated names are
rather unreadably mangled.

As a follow-up, it will be easy to allow for qualified access to
different modules, thus implementing full namespace semantics for
modules.

Bug: v8:7793
Change-Id: Ie6f1b6b549b510fb49be2442393d898d5f130950
Reviewed-on: https://chromium-review.googlesource.com/c/1309636
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Daniel Clifford <danno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57235}

Ignore invalid input for all arguments of OptimizeFunctionOnNextCall
potentially produced by fuzzers.

Bug: chromium:901645
Change-Id: Ic185812c228a92f8dbb48212c45685bd14892947
Reviewed-on: https://chromium-review.googlesource.com/c/1317567Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57234}

R=clemensh@chromium.org

Change-Id: Icba445650131dcd54495f40f194ffe64cce24f94
Reviewed-on: https://chromium-review.googlesource.com/c/1317587Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57233}

The fast paths for sets and maps did not support allocation in
large object space, yet they were taken in these cases. This CL
adds support, simply by passing the kAllowLargeObjectAllocation
argument to AllocateJSArray.

It also changes the fast path for strings to use this argument
rather than take the slow path.

Bug: v8:7980, v8:8410
Change-Id: I18e88cb4ceb7ebeca250edd8b8b0eb401fdbd6e4
Reviewed-on: https://chromium-review.googlesource.com/c/1317507
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57232}

- Name lookup in module scopes has namespace semantics now: All
  overloads from all parent modules are combined before overload
  resolution.
- Allow overloads of different callables: runtime-functions,
  macros, builtins, and generics.
- The duplication between the DeclarationVisitor and the
  ImplementationVisitor is removed: The DeclarationVisitor creates
  declarables for everything except for implicit generic specializations.
  The ImplementationVisitor iterates over declarables.
  The DeclarationVisitor only looks at the header of declarations, not
  at the body.
- Modules become Declarable's, which will enable them to be nested.
- Modules replace the existing Scope chain mechanism, which will make it
  easier to inline macros.
- The DeclarationVisitor and Declarations become stateless. All state is
  moved to contextual variables and the GlobalContext.
- Implicit specializations are created directly from the
  ImplementationVisitor. This will enable template parameter inference.
- As a consequence, the list of all builtins is only available after the
  ImplementationVisitor has run. Thus GenerateBuiltinDefinitions has to
  move to the ImplementationVisitor. Also, this makes it necessary to
  resolve the link from function pointer types to example builtins only
  at this point.


Bug: v8:7793
Change-Id: I61cef2fd3e954ab148c252974344a6e38ee2d01d
Reviewed-on: https://chromium-review.googlesource.com/c/1304294
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Daniel Clifford <danno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57231}

BUG=chromium:901040

Change-Id: I0c28a2bd9a43d107e8afe8a8c0d53d1d3278121a
Reviewed-on: https://chromium-review.googlesource.com/c/1317506
Commit-Queue: Daniel Clifford <danno@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57230}

I will enable /Zc:DllexportInlines- flags for faster build time on windows.
But the flag makes clang's -Wundefined-inline check more strict as a secondary effect.

Actually, having inline function specifier for the function not defined in header file seems bit strange.
Let me remove inline specifier from such functions.

Bug: chromium:857548, chromium:901709
Change-Id: Ic06d10e2445cfedc7af67b72154f93a51ac26853
Reviewed-on: https://chromium-review.googlesource.com/c/1186017
Commit-Queue: Takuto Ikuta <tikuta@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57229}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/5fafa7f..cd2c8fe

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: I841cf4971c83f84dbe02d1ca771f503ca4856f82
Reviewed-on: https://chromium-review.googlesource.com/c/1316621
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#57228}

ICU 63.1 fixed it and v8's ICU was rolled to ICU 63.1

TBR=sigurds@chromium.org

Bug: v8:8110
Change-Id: Ic44c8f4293d6d39b597a90318f0acbf5aea6eccf
Reviewed-on: https://chromium-review.googlesource.com/c/1316615Reviewed-by: Jungshik Shin <jshin@chromium.org>
Commit-Queue: Jungshik Shin <jshin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57227}

CopyWords, as the name implies, copies raw words anyway, so there
is no need for type specialization.
MoveWords was dead code.

Bug: v8:8238
Change-Id: Ib497cfbabdcf8bac672ac74ef69f679b50ddfd6e
Reviewed-on: https://chromium-review.googlesource.com/c/1316609Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57226}

as part of the ongoing quest to get rid of Object*/Object** entirely.

Bug: v8:3770
Change-Id: Id3c6112a48a7a7ddb5441c72d81f4e4be61e3eae
Reviewed-on: https://chromium-review.googlesource.com/c/1316610Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57225}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/cf39c38..5fafa7f

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/c02ed04..8c035b3

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/a98da07..7e0b0c4

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: I42ab117eb558e08ba1b5b9e56c288e6a5d3be66a
Reviewed-on: https://chromium-review.googlesource.com/c/1316613
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#57224}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/6231c05..cf39c38

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/971689c..c02ed04

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/fec80c4..a98da07

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/36daae0..b2235ed

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: I27fbc4176c251e107b3793ebbb26cc5d298829b9
Reviewed-on: https://chromium-review.googlesource.com/c/1316611Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#57223}

TBR=sergiyb@chromium.org

No-Try: true
Bug: chromium:616879
Change-Id: Ic04e8a4dc58e34aada90e9d2801f88df5bcf8fd8
Reviewed-on: https://chromium-review.googlesource.com/c/1297962
Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org>
Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57222}

This reverts commit 7bd9eb7e.

Reason for revert: crashes on canary, see https://crbug.com/901010

Original change's description:
> Add fast paths to Array.from.
>
> This reuses the fast path from IterableToList for Array.from. The fast
> paths are taken when .from is called with the receiver Array and the only
> argument is the iterable (no mapping function or thisArg).
>
> Bug: v8:7980
> Change-Id: I975b0c5e3f838262d7b71ad4dec5111fb031d746
> Reviewed-on: https://chromium-review.googlesource.com/c/1297322
> Commit-Queue: Hai Dang <dhai@google.com>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#56993}

TBR=neis@chromium.org,dhai@google.com
Bug: v8:7980, chromium:901010, v8:8410

Change-Id: I5e73267f0b3a905582c57a6fad1459c031600a73
Reviewed-on: https://chromium-review.googlesource.com/c/1315935
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57221}