Revert of Make some functions that are hit during renderer startup available for inlining (patchset #3 id:40001 of https://codereview.chromium.org/2950993002/ )

Reason for revert:
Blocks roll:
https://codereview.chromium.org/2954833002/

E.g.:
https://build.chromium.org/p/tryserver.chromium.mac/builders/mac_chromium_compile_dbg_ng/builds/449680
https://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_compile_dbg_ng/builds/324953

Please include those chromium trybots on reland. Maybe missing symbol export?

Original issue's description:
> Make some functions that are hit during renderer startup available for inlining
>
> This is towards closing the perf gap between the MSVC build (which uses link-
> time optimization) and Clang (where LTO isn't ready on Windows yet). We did
> a study (see bug) to see which non-inlined functions are hit a lot during render
> start-up, and which would be inlined during LTO. This should benefit performance
> in all builds which currently don't use LTO (Android, Linux, Mac) as well as
> the Win/Clang build.
>
> The binary size of chrome_child.dll increases by 2KB with this.
>
> BUG=chromium:728324
>
> Review-Url: https://codereview.chromium.org/2950993002
> Cr-Commit-Position: refs/heads/master@{#46191}
> Committed: https://chromium.googlesource.com/v8/v8/+/d00d52be1fce9c1bf5558c8b26bf984efd09e65b

TBR=jochen@chromium.org,mstarzinger@chromium.org,rmcilroy@chromium.org,vogelheim@chromium.org,marja@chromium.org,mlippautz@chromium.org,thakis@chromium.org,hans@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=chromium:728324
NOTRY=true
NOPRESUBMIT=true

Review-Url: https://codereview.chromium.org/2955793002
Cr-Commit-Position: refs/heads/master@{#46195}

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/28f796f..d4f2d77

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: Iddd29943ce0e5ed59b957106313e235c32d56e3d
Reviewed-on: https://chromium-review.googlesource.com/547096Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46194}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/a4ae1b7..564be75

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/buildtools/+log/38477c2..7f2cacb

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/e810453..28f796f

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/9bb118e..ad52f33

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: I9e0e4ebca5fcf782b11bf8e4c4348b46e3f90c80
Reviewed-on: https://chromium-review.googlesource.com/547296Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46193}

Port a42473ab

Original Commit Message:

    These are no longer being used.

R=mvstanton@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, bjaideep@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:6408
LOG=N

Review-Url: https://codereview.chromium.org/2949103005
Cr-Commit-Position: refs/heads/master@{#46192}

This is towards closing the perf gap between the MSVC build (which uses link-
time optimization) and Clang (where LTO isn't ready on Windows yet). We did
a study (see bug) to see which non-inlined functions are hit a lot during render
start-up, and which would be inlined during LTO. This should benefit performance
in all builds which currently don't use LTO (Android, Linux, Mac) as well as
the Win/Clang build.

The binary size of chrome_child.dll increases by 2KB with this.

BUG=chromium:728324

Review-Url: https://codereview.chromium.org/2950993002
Cr-Commit-Position: refs/heads/master@{#46191}

This is a fix to https://codereview.chromium.org/2929853003 that got
reverted. The DCHECK checked to see that it was not in a background
thread. While this is a property we want for v8, it is also used
by blink, and blink violates this property.

Therefore, this CL removes the DCHECK for now.

BUG=v8:6361

Review-Url: https://codereview.chromium.org/2961443002
Cr-Commit-Position: refs/heads/master@{#46190}

Port 21701297

Original Commit Message:

    Add a new JSConstructWithArrayLike operator that is backed by the
    ConstructWithArrayLike builtin (similar to what was done before
    for the JSCallWithArrayLike operator), and use that operator to
    optimize Reflect.construct inlining in TurboFan. This is handled
    uniformly with JSConstructWithSpread in the JSCallReducer.

    Also add missing test coverage for Reflect.construct in optimized
    code, especially for some interesting corner cases.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:4587,v8:5269
LOG=N

Change-Id: Idaf247317036ddec74b9aa3addd2e7d75b65bfaf
Reviewed-on: https://chromium-review.googlesource.com/546716
Commit-Queue: Jaideep Bajwa <bjaideep@ca.ibm.com>
Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#46189}

Port 767ce788

Original Commit Message:

    Add a new JSCallWithArrayLike operator that is backed by the
    CallWithArrayLike builtin, and use that operator for both
    Function.prototype.apply and Reflect.apply inlining. Also unify
    the handling of JSCallWithArrayLike and JSCallWithSpread in
    the JSCallReducer to reduce the copy&paste overhead.

    Function.prototype.apply in optimized code, especially for some
    corner cases, which was missing so far.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:4587,v8:5269
LOG=N

Change-Id: I930845df7e87b8962588cc79f6069477865fa086
Reviewed-on: https://chromium-review.googlesource.com/546735Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Jaideep Bajwa <bjaideep@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#46188}

Port a971a64d

Original Commit Message:

    We can remove a lot of native code and rely on CallOrConstructVarargs
    to do the stack manipulation for us.

    This will also take advantage of the fast-path for double arrays in
    CallOrConstructDoubleVarargs.

    We can also remove Runtime_SpreadIterableFixed because it isn't used
    anymore. We just call directly into spread_iterable from CSA.

R=petermarshall@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: Idad830c9aace4151db866c9f863158cd7525e881
Reviewed-on: https://chromium-review.googlesource.com/546575Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Jaideep Bajwa <bjaideep@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#46187}

Each frame within an optimized frame needs to be re-verified as being
subject to debugging. The specific crash from the linked bug was caused
by the fact that non-user JS frames don't necessarily have an associated
script. We'd ignore that and attempt to call
Script::GetPositionInfo() on the Undefined constant.

BUG=chromium:732408

Change-Id: Ib2982890529623d150092fa57e26fcb237fef59f
Reviewed-on: https://chromium-review.googlesource.com/545895Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46186}

When executing a script that does import("foo"), "foo" should be
relative to the script's directory, not relative to the current working
directory of the d8 process.

R=gsathya@chromium.org

Bug: v8:5785
Change-Id: Id6ceccb242905bd6b54b07038ece60b93d92e4a0
Reviewed-on: https://chromium-review.googlesource.com/546375
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46185}

In bits.h, instead of relying on C++ overloading for 32/64 bits integers
(which can be ambiguous when the input isn't the exact type typedef-ed
by uint64_t or uint32_t), use templates and std::enable_if to switch
between integers of different sizes.

This means that we can get rid of an awkward sizeof check in
bit-vector.cc, which was necessary to compile on Mac.

Change-Id: Id0eaf0f855cdbd2dc4d7bc1c481037fcd9b73953
Reviewed-on: https://chromium-review.googlesource.com/543480
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46184}

Move bytecode array writing logic into the array builder, allowing us to
remove the bytecode array writer and bytecode node, and convert runtime
operand writing to compile-time bytecode operand writing using the
information statically known at compile time.

Bug: v8:6474
Change-Id: I210cd9897fd41293745614e4a253c7c251dfffc9
Reviewed-on: https://chromium-review.googlesource.com/533055
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46183}

BUG=chromium:694255

Change-Id: I80657c5ec11fb36766a79af8584c1f1e3afaa497
Reviewed-on: https://chromium-review.googlesource.com/545595
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46182}

Bug: chromium:662388
Change-Id: Ia50889a6f4313270f1aadd19cc3f91eb25989c96
Reviewed-on: https://chromium-review.googlesource.com/544882
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46181}

Bug: 
Change-Id: Ice0781822308ba44934abbe5802585a70e744eb0
Reviewed-on: https://chromium-review.googlesource.com/544994
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46180}

Bug: v8:126
Change-Id: I13d42f0dccb0899f0aad572d33501e856073db9d
Reviewed-on: https://chromium-review.googlesource.com/544968
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46179}

This prepares ground for switching mark-compactor to use
Worklist data-structure instead of the existing marking deque.

BUG=chromium:694255

Change-Id: I0ac4c563018a9619962fb4bf388b5f3cceffb86d
Reviewed-on: https://chromium-review.googlesource.com/544933Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46178}

Bug: 
Change-Id: I0415b3946e6efd97c3b2fb770fda7dba265ee8cd
Reviewed-on: https://chromium-review.googlesource.com/545000Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46177}

This removes the include from:
assembler.h (moved Isolate::AddressId to globals.h / IsolateAddressId)
counters.h (ditto)
elements.h (trivial)
keys.h (trivial + iwyu fixes)
property.h (trivial)
transitions.h (trivial)
vm-state.h (trivial)
heap/code-stats.h (trivial + drive-by iwyuing)

BUG=v8:5294

Change-Id: I36b8c07d4edf4177f1a987a393569f5191167ed3
Reviewed-on: https://chromium-review.googlesource.com/532879Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46176}

The race happens when the layout descriptor is evacuated at the same
time as an object that has this layout descriptor is evacuated.

Change-Id: I0a5fc545cf359fdfe738d8b6359713f5ea170986
Reviewed-on: https://chromium-review.googlesource.com/544953
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46175}

This partially reverts commit 015edc60.

Reason for revert: Performance regression on richards

Bug: v8:6211
Change-Id: Ib69a1ed90b2015addcc54d7f299bdd654d964b54
Reviewed-on: https://chromium-review.googlesource.com/544992Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46174}

Bug: 
Change-Id: I240356157c71a544d94f8898029d54010b2f4d37
Reviewed-on: https://chromium-review.googlesource.com/544309
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46173}

NOTRY=true
NOTREECHECKS=true
TBR=ulan@chromium.org

Bug: chromium:735951
Change-Id: I8b54ba272d353b1fb499fcfccef1f49b9c47a137
Reviewed-on: https://chromium-review.googlesource.com/544828
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46172}

This reverts commit 217d654c.

Reason for revert: Changes layout tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/16520

Original change's description:
> [parser] moved load property position after dot
> 
> Currently LdaNamedProperty bytecode for expressions like a.b has position before dot. This CL moves this location after dot.
> It's important for later removing of Nop bytecodes in expressions like a.b() where a is local variable, property call and property load should have the same position.
> 
> R=​jgruber@chromium.org
> 
> Bug: v8:6425
> Change-Id: I528c5007de52215beba80851ab04693ecec038e2
> Reviewed-on: https://chromium-review.googlesource.com/543047
> Reviewed-by: Marja Hölttä <marja@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46163}

TBR=marja@chromium.org,kozyatinskiy@chromium.org,jgruber@chromium.org

Change-Id: I94543526f39f0a20452fbce1a7bc6744cac66621
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6425
Reviewed-on: https://chromium-review.googlesource.com/544993Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46171}

For correct error positions, the FunctionBody struct stored a {base}
pointer to the beginning of the wasm module bytes, in addition to the
{start} and {end} pointer of the function body within the module bytes.
For streaming compilation, we do not have all module bytes in a single
chunk of memory. Therefore this CL changes the FunctionBody such that it
does not store the base pointer but the offset of the function body
within the module. I did the same change already some time ago for the
{Decoder}.

R=clemensh@chromium.org, mtrofin@chromium.org

Change-Id: I5138fbe270d0f5166a7dcc5cb8f3fe78a298bff6
Reviewed-on: https://chromium-review.googlesource.com/544863Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46170}

Make PreParser match what Parser does.

BUG=v8:5516

Change-Id: I2801206fd17b9a5047bc43c6112f4945971596b7
Reviewed-on: https://chromium-review.googlesource.com/544949
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46169}

Drive-by-fixes: Singleton ranges past EOF, disable optimization
for block count mode.

Bug: v8:6000
Change-Id: I718891f8821285ce3d7d8360faaa91a43de5b93d
Reviewed-on: https://chromium-review.googlesource.com/541300Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46168}

This removes the --turbo flag and solely relies on the filter pattern
provided via --turbo-filter when deciding whether to use TurboFan. Note
that disabling optimization wholesale can still be done with --no-opt,
which should be used in favor of --no-turbo everywhere.

Also note that this contains semantic changes to the TurboFan activation
criteria. We respect the filter pattern more stringently and no longer
activate TurboFan just because the source contains patterns forcing use
of Ignition via {AstNumberingVisitor::DisableFullCodegenAndCrankshaft}.

R=rmcilroy@chromium.org
BUG=v8:6408

Change-Id: I0c855f6a62350eb62283a3431c8cc1baa750950e
Reviewed-on: https://chromium-review.googlesource.com/528121Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46167}

Factory::NewUninitializedFixedArray is unsafe for GC. If performance
allows, we should remove the function.

Change-Id: I3f80352797e9768b788c2996c3f29e823c067f74
Reviewed-on: https://chromium-review.googlesource.com/517794Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46166}

Async generator yield* is still desugared in the parser, to be moved to the BytecodeGenerator in a future CL.

Bug: v8:6472
Change-Id: I8b33e2f9e931949f7375540099cd8ec3a6b27cf1
Reviewed-on: https://chromium-review.googlesource.com/539335
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46165}

Change-Id: I5d5df00a38b7196001fb91e2642914271d8e66d0
Reviewed-on: https://chromium-review.googlesource.com/544932
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46164}

Currently LdaNamedProperty bytecode for expressions like a.b has position before dot. This CL moves this location after dot.
It's important for later removing of Nop bytecodes in expressions like a.b() where a is local variable, property call and property load should have the same position.

R=jgruber@chromium.org

Bug: v8:6425
Change-Id: I528c5007de52215beba80851ab04693ecec038e2
Reviewed-on: https://chromium-review.googlesource.com/543047Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46163}

Completely shares first-level visitation with the Scavenger.

Remove marking recursively on the way as we cannot reliable check for
stack overflow on background tasks.

Bug: chromium:651354
Change-Id: I6da1dc787cdfb4232ea4b6cb8e72e0f736cabf10
Reviewed-on: https://chromium-review.googlesource.com/544967
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46162}

This also adds libraries recursively under the obj dir.

Dropping v8_shell from globs since it's not included in the targets.

NOTRY=true

Bug: v8:5918
Change-Id: Ibfadb60dd7b347cf4a742f07e8b110c70e67cb06
Reviewed-on: https://chromium-review.googlesource.com/544308
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46161}

Reduces binary size, see bug.

Bug: chromium:736097
Change-Id: I89b4b873accf2de85d5913a30fac53972d98e78d
Reviewed-on: https://chromium-review.googlesource.com/544984Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46160}

Remove PageParallelJob as it is completely replaced now. It served us
well.

Bug: chromium:651354
Change-Id: I620fa7bb0dcaf7cd3710492913c501bcb162c781
Reviewed-on: https://chromium-review.googlesource.com/544950Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46159}

Bug: 
Change-Id: I90e0c469d096cbffbecf01add6cfabbf3af275fa
Reviewed-on: https://chromium-review.googlesource.com/544307Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46158}

This piggy-backs on top of existing precise and best-effort coverage to expose
block coverage through the inspector protocol.

Coverage collection now implicitly reports block-granularity coverage when
available.  A new 'isBlockCoverage' property on Inspector's FunctionCoverage
type specifies the granularity of reported coverage.

For now, only count-based block coverage is supported, but binary block
coverage should follow soon.

Support is still gated behind the --block-coverage flag.

Bug: v8:6000
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I9c4d64e1d2a098e66178b3a68dcee800de0081af
Reviewed-on: https://chromium-review.googlesource.com/532975
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46157}

Should've been part of https://chromium-review.googlesource.com/544300

BUG=v8:5516

Change-Id: I315b37d313b64c738174a6cd7461e5c46e362734
Reviewed-on: https://chromium-review.googlesource.com/544939Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46156}