This CL introduces a new operator that loads the feedback vector and
checks against maps at runtime, rather than embedding the map directly
in the generated code.

A follow on CL will use this operator when generating code for named
property access.

Bug: v8:10582, v8:9684
Change-Id: I372a01586d3048427760f0cb27619a59afc3f59e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2241518Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68930}

Original design doc:
https://docs.google.com/document/d/1dthXsVHMc1Sd_oYf9a-KZSFOd_a8dUgnt4REAG8YIXA

Design changes:
https://docs.google.com/document/d/1aeEGDm1XSqoJkQQKz9F75WqnuAa2caktxGy_O_KpO9Y

Previous (reverted) version:  https://chromium-review.googlesource.com/c/v8/v8/+/2202981

Relanding with fix: tests need --noincremental-marking

TBR=ishell@chromium.org, ulan@chromium.org, syg@chromium.org, ahaas@chromium.org

Bug: v8:10239
Change-Id: Id122225d5d2ed67cbeb3269df115c7208a33a281
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2306791Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68929}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/056b939..9862443

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/19856e6..4ed789b

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I610ee0e5bcf4b977a596e6f50b3dcf4c0eb631c7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2306521Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#68928}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/4ab4e6a..056b939

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/4bbdfa5..642be1d

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: Ic5373acd30be2d97152bf1e597e68760e69a036a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2306471Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#68927}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/a101f69..4ab4e6a

Rolling v8/third_party/aemu-linux-x64: DGIj4lLT8ky5-X2nCeWM01poovHhDF8f2Lyu7xDeEjoC..bMBorsHPd-GA42g-lfkvaE5HhiZVCcqkoLNKDzb8ElUC

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/233589f..4bbdfa5

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I469a6865818a06c91222cc893a16b5260c17a535
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2305769Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#68926}

Support more 3 letters timezones and SystemV/XXX timezones

Bug: chromium:364374
Change-Id: I710eeee62ba65f7e30203a44a4bd2d95365cc6fc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2303896
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68925}

In preparation for AllocationObserver changes, move AllocationObserver
related code into its own file.

Bug: v8:10315
Change-Id: I65d5a51662ff192c7b05d4229d8ca27f4a53aa3e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2304580Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68924}

This reverts commit 29ec319f.

Reason for revert: Will disable gclient update

Original change's description:
> Revert "[release] Replace raw DEPS processing with gclient getdep"
> 
> This reverts commit 0ba1c23c.
> 
> Reason for revert: Doesn't work yet
> 
> Original change's description:
> > [release] Replace raw DEPS processing with gclient getdep
> > 
> > No-Try: true
> > Bug: chromium:1106435
> > Change-Id: I120d3930e4e8be7010d8d1f1928829ca0882638d
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2304578
> > Reviewed-by: Tamer Tas <tmrts@chromium.org>
> > Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#68913}
> 
> TBR=machenbach@chromium.org,tmrts@chromium.org,liviurau@chromium.org
> 
> Change-Id: I76e02bfa50fdc5967ab72784cd71114bb82b7261
> No-Presubmit: true
> No-Tree-Checks: true
> No-Try: true
> Bug: chromium:1106435
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2304585
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#68914}

TBR=machenbach@chromium.org,tmrts@chromium.org,liviurau@chromium.org

Change-Id: I3d6192a18b7bb14ccdcef6483483b1afe4fbb485
No-Try: true
Bug: chromium:1106435
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2304811Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68923}

This reverts commit 5c84b6be.

Reason for revert: found another way

Original change's description:
> [release] Work-around deps-processing problem
> 
> TBR=tmrts@chromium.org
> 
> No-Try: true
> Bug: chromium:1106435
> Change-Id: I52657b4ee924e5e0133b0784bc12a0d75f94ec9d
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2304586
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#68915}

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: I8925bef7525f453a9e2ee6cb298171813554b2a5
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:1106435
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2304810Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68922}

Exposes initial_async_iterator_prototype the same way that
initial_iterator_prototype is exposed, to let blink implement
async iterables better.

Bug: chromium:1087157
Change-Id: I94f65eedb3aad0bf62cb4808935f320fe4bf4e9c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2300779
Commit-Queue: Marijn Kruisselbrink <mek@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68921}

Bug: v8:10572
Change-Id: I0caf2f4a36e21d889e931b75ec86bae5b1571511
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2302895Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68920}

Bug: chromium:1105172
Change-Id: I55213b28b619479aadcaaf830453ffde33f0005e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2304569
Commit-Queue: Kim-Anh Tran <kimanh@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68919}

This CL removes the duplicated code for handling global
state of the app. Increases readability of the app
class.

Bug: v8:10673, v8:10644

Change-Id: I08e0bfdc67e023264fce22a96bfd3ef94644e70c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2302894Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Zeynep Cankara <zcankara@google.com>
Cr-Commit-Position: refs/heads/master@{#68918}

The AsmParser kept pointers into ZoneVectors, which were accessed even
after those vector might have grown. For regular vectors, this would be
a use-after-free; with ZoneVectors it is technically allowed, since the
old memory stays alive. This will change with
https://crrev.com/c/2302895, which zaps zone memory which is
deallocated. Eventually, we might want to reuse large deallocations in
zone memory, hence this "use after free" needs to be fixed.

This CL fixes the issue by explicitly re-allocating in the zone instead
of using ZoneVectors. This makes sure that the old memory stays alive.
This is kind of a quick-fix, but since asm.js is more or less deprecated
anyway (in favor of Wasm), it's OK if this code does not profit from
future ZoneVector memory re-use optimizations.

Drive-by: Move field initializers to the field declaration.

R=ishell@chromium.org

Bug: v8:10717
Change-Id: I56c1feb49d05080e78a6620273b55b4e18156254
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2304581Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68917}

The {operator==} on {VarState} did not check the spill offset, so when
merging stack states, we forgot to move stack values if both source and
destination were stack slots, but at different offsets.
This CL fixes this by removing the {operator==}, because the semantics
(and use) are not clear, and it's only used in one place anyway.
The equality check was mostly redundant, so inlining it also makes the
code smaller and faster.

R=ahaas@chromium.org

Bug: v8:10702
Change-Id: I6c8b2cfd1002274175c9a17d305692e4631fd7dc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2304574Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68916}

TBR=tmrts@chromium.org

No-Try: true
Bug: chromium:1106435
Change-Id: I52657b4ee924e5e0133b0784bc12a0d75f94ec9d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2304586Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68915}

This reverts commit 0ba1c23c.

Reason for revert: Doesn't work yet

Original change's description:
> [release] Replace raw DEPS processing with gclient getdep
> 
> No-Try: true
> Bug: chromium:1106435
> Change-Id: I120d3930e4e8be7010d8d1f1928829ca0882638d
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2304578
> Reviewed-by: Tamer Tas <tmrts@chromium.org>
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#68913}

TBR=machenbach@chromium.org,tmrts@chromium.org,liviurau@chromium.org

Change-Id: I76e02bfa50fdc5967ab72784cd71114bb82b7261
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:1106435
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2304585Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68914}

No-Try: true
Bug: chromium:1106435
Change-Id: I120d3930e4e8be7010d8d1f1928829ca0882638d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2304578Reviewed-by: Tamer Tas <tmrts@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68913}

This commit moves the d8 Synopsis/Usage string from flags.cc into d8.cc.

The motivation for this is that Commit
c8679386 ("[snapshot] enable mksnapshot
usage to be displayed") enabled a usage string to be passed into

means mksnapshot --help will first print it's own usage string followed
by d8's.

FlagList: :SetFlagsFromCommandLine and be printed, but
FlagList: :PrintHelp currently still prints the Synopsis for d8 which
Change-Id: I9c79b2cdc5570106e12096c0c53e640cf80742e9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2299365Reviewed-by: Dan Elphick <delphick@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68912}

This CL changes colors of map panel
and layout of IC panel legend for organize
UI better.

Bug: v8:10673, v8:10644

Change-Id: Iead0a82fcdae09a9368d30b493565615e24dcc2e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2301932Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Zeynep Cankara <zcankara@google.com>
Cr-Commit-Position: refs/heads/master@{#68911}

This reverts commit 1ec8f1da.

Reason for revert: Fails presubmit: https://ci.chromium.org/p/v8/builders/ci/V8%20Presubmit/11696

Original change's description:
> [presubmit] Add JS formatting for tools/system-analyzer
> 
> Bug: v8:10670
> Change-Id: Ifb653ada003719faff261b6e5b2169db37cffdaf
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2282522
> Reviewed-by: Tamer Tas <tmrts@chromium.org>
> Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#68909}

TBR=gsathya@chromium.org,tmrts@chromium.org

Change-Id: I0824ede745b5fe054b8e9984440f6013de271b83
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10670
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2304577Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68910}

Bug: v8:10670
Change-Id: Ifb653ada003719faff261b6e5b2169db37cffdaf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2282522Reviewed-by: Tamer Tas <tmrts@chromium.org>
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68909}

This CL moves the timeline related methods of the
map model into timeline panel to encapsulate timeline
web component.

Bug: v8:10673, v8:10644

Change-Id: Ie82ca8dc920cb64bd5ba81ead1a346492bd2b738
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2302893Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Zeynep Cankara <zcankara@google.com>
Cr-Commit-Position: refs/heads/master@{#68908}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/a96f200..a101f69

Rolling v8/third_party/aemu-linux-x64: 7UW9Qc56aQ1K23_T0oZ9qoVs9Hbuka0eN2NRy-z2UV0C..DGIj4lLT8ky5-X2nCeWM01poovHhDF8f2Lyu7xDeEjoC

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/0ea0cd5..19856e6

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/ed9e5ac..233589f

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I087560a179e85f664e7bb9a499b6bbf7d8b85324
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2302797Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#68907}

SSE requires operand0 to be a register, since we don't have memory
alignment yet. AVX can have performance issues for unaligned access.

Bug: v8:9198,chromium:1106285
Change-Id: Ic587d9e0d601664cf6010061d74b22740ba47702
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2303590Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68906}

... by migrating old-style code
  MyObject* obj = new (zone) MyObject(...)

to the new style
  MyObject* obj = zone->New<MyObject>(...)

... and prohibiting accidental use of the old-style.

Bug: v8:10689
Change-Id: Id75774ac12e3d0f95cb3a538066dffbf7815e438
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2300490
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68905}

1) turn static methods to instance ones.
2) change New/Delete to NewArray/DeleteArray getting array length as
   argument instead of raw size.
3) propagate type tags through allocate/delete methods of existing
   AllocationPolicy classes.

This will allow implementing accounting of deallocated zone memory.

Bug: v8:10572
Change-Id: Ib41c646044814ac6d75d50b2847bbb8964ce25d3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2300489Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68904}

Bug: chromium:1105318
Change-Id: I7b1c57b7ff7beaaa53c19a270d5a8c36b11baf17
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2301082Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68903}

This CL depreciates the TransitionView Class of the
app model to handle map transition only within map
model. It isolates the Map Panel to comply web
component standards.

Bug: v8:10667, v8:10644

Change-Id: Idf8ca58744aacd0159ee4af6e71886374385377e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2300541
Commit-Queue: Zeynep Cankara <zcankara@google.com>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68902}

Change-Id: I46efe24dc9d2513fc8d099ef4af9e25ddf3ea697
Bug: v8:10201
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2302049
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68901}

Replacing EnsureSweepingCompleted() with DrainSweepingWorklistForSpace()
caused sweeping to be completed later. This resulted in longer scavenger
pauses, since the scavenger had to stop & resume sweeping more often.
To avoid this, the scavenger now completes sweeping when all pages are
swept.

Bug: chromium:1106295, v8:10315
Change-Id: Ia46efdfb1f2492e9228f0349936be32a467f502b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2301935Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68900}

This CL adds a helper class for commonly used
helper methods inside web components, decreasing
the amount of duplicated code across the app.

Bug: v8:10667, v8:10644

Change-Id: I754396a9b3598d0930a82fc487857e946bfd3805
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2299359Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Zeynep Cankara <zcankara@google.com>
Cr-Commit-Position: refs/heads/master@{#68899}

Property descriptor interceptor may and may not throw an
exception.  If it's thrown, V8 has to propagate the exception
appropriately.

Especially HTML ([1][2]) requires that the cross origin case of
getOwnPropertyDescriptor throws a SecurityError.  Hence, Blink
is going to throw a SecurityError in the cross origin descriptor
interceptor.  Then, this fix is necessary.

[1] https://html.spec.whatwg.org/C#windowproxy-getownproperty
[2] https://html.spec.whatwg.org/C#location-getownproperty

Change-Id: I7e3a92f1a16f1a2cda3818fd585a89fd83989003
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2297076Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Yuki Shiino <yukishiino@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68898}

This is exactly the same issue as in https://crrev.com/c/2299364 for test-torque.cc

Change-Id: I066d93918c94d0c68278c72d9b60ec92a1c5f68b
Bug: v8:10201
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2300546
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68897}

... this reduces the size of VariableMap object by one word which in
turn reduces zone memory pressure. The Scope class which contains
VariableMap as a field is usually in top 5 of all allocated objects
in zone memory.

Bug: v8:9923
Change-Id: I79c6bd9ae97db72f24b831fd5e3733d8d7e4c0fd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2300486
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68896}

This CL deletes the duplicated getters and setters
for timeline in Stats panel.

Change-Id: I3a08cfc84e6d099084cb5eeb0e25526a76a891a0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2301930Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Zeynep Cankara <zcankara@google.com>
Cr-Commit-Position: refs/heads/master@{#68895}

... which might use an outdated result of a lookup.
Currently it's not an issue, since we don't reuse container's backing
stores allocated in zone memory.

Bug: v8:7790
Change-Id: I30cc0ba747fd704403422711d1f1a5952fe6d68c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2301931
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68894}

We must perform "smi-checks" before loading an object's map
whenever the object might be an i31ref.

Bug: v8:7748
Change-Id: I2d9839ddcb0c2e8c35b9bea38afe50d55dd084cb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2299370Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68893}

Bug: v8:7748
Change-Id: I30eb7b08b40159e399730eef5866e1f0fbf706e1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2299368
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68892}

This CL ports MarkingVerifier from blink.

The existing verifier checks only references on heap.
This new verifier checks references both on heap and on stack.

Bug: chromium:1056170
Change-Id: I083dcb0087125312cca34a2201015a9aecfe6ea4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2300484
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68891}