Also properly support loading from holey double element backing stores
in JSNativeContextSpecialization. This adds a new simplified operator
NumberIsHoleNaN, which checks whether a certain value is the special NaN
that we use to encode "the hole" in holey double element backing stores.

R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1448343002

Cr-Commit-Position: refs/heads/master@{#32039}

Revert of Remove redundant activation threshold for incremental marking. (patchset #1 id:1 of https://codereview.chromium.org/1418293006/ )

Reason for revert:
Regression in thread_times.key_idle_power_cases (crbug.com/555153)

Original issue's description:
> Remove redundant activation threshold for incremental marking.
>
> The minimum allocation limit already enforces this constraint for normal GCs.
>
> GCs triggered by the memory reducer and external limit should work for all heap sizes.
>
> BUG=chromium:552305
> LOG=NO
>
> Committed: https://crrev.com/e28e4d5f52852e2f14facc37a02069b6bfc82c4e
> Cr-Commit-Position: refs/heads/master@{#31921}

TBR=hpayer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:552305

Review URL: https://codereview.chromium.org/1456523002

Cr-Commit-Position: refs/heads/master@{#32038}

using the new JSReceiver::GetOwnPropertyDescriptor implementation.

BUG=v8:1543
LOG=n
R=cbruni@chromium.org

Review URL: https://codereview.chromium.org/1451703003

Cr-Commit-Position: refs/heads/master@{#32037}

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1450353002

Cr-Commit-Position: refs/heads/master@{#32036}

BUG=4134
R=epertoso@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1449393002

Cr-Commit-Position: refs/heads/master@{#32035}

Review URL: https://codereview.chromium.org/1453103002

Cr-Commit-Position: refs/heads/master@{#32034}

Adds support for visiting the Call bytecode to the bytecode graph builder.
This change also adds the call type feedback slot to the Call bytecode.
This is not currently used by the interpreter, but is used by the
graph builder.

Also adds a CallWide varient of the Call bytecode, and adds the kCount16
operand type.

Landed on behalf of rmcilroy.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1456453002

Cr-Commit-Position: refs/heads/master@{#32033}

Revert of Experimental support for RegExp lookbehind. (patchset #18 id:340001 of https://codereview.chromium.org/1418963009/ )

Reason for revert:
gc stress breaks due to string_start_minus_one not being set correctly.

Original issue's description:
> Experimental support for RegExp lookbehind.
>
> R=erikcorry@chromium.org, littledan@chromium.org
> BUG=v8:4545
> LOG=N
>
> Committed: https://crrev.com/37632606bbce1418238b13fd90cb6ef6705871cd
> Cr-Commit-Position: refs/heads/master@{#32029}

TBR=littledan@chromium.org,erikcorry@chromium.org,erikcorry@google.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4545

Review URL: https://codereview.chromium.org/1451373003

Cr-Commit-Position: refs/heads/master@{#32032}

and ppc64.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1438013003

Cr-Commit-Position: refs/heads/master@{#32031}

Minor cleanup in VisitorId selection.

Review URL: https://codereview.chromium.org/1448313002

Cr-Commit-Position: refs/heads/master@{#32030}

R=erikcorry@chromium.org, littledan@chromium.org
BUG=v8:4545
LOG=N

Review URL: https://codereview.chromium.org/1418963009

Cr-Commit-Position: refs/heads/master@{#32029}

Review URL: https://codereview.chromium.org/1452113002

Cr-Commit-Position: refs/heads/master@{#32028}

Review URL: https://codereview.chromium.org/1453043003

Cr-Commit-Position: refs/heads/master@{#32027}

Adds implementation and tests for following operators in bytecode graph builder:
-VisitLoadICSloppy
-VisitLoadICStrict
-VisitLoadICSloppyWide
-VisitLoadICStrictWide

The current implementation introduces empty frame states for frame state inputs expected by these operations.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1419373007

Cr-Commit-Position: refs/heads/master@{#32026}

BUG=chromium:556543
LOG=n

Review URL: https://codereview.chromium.org/1450883003

Cr-Commit-Position: refs/heads/master@{#32025}

    port e5edd66d (r32022)

    original commit message:
    This is the first part to refactoring the JSNativeContextSpecialization
    class, which has grown way too big recently.

    Also don't collect cross context feedback for the CallIC in general.
    Neither TurboFan nor Crankshaft can make any use of cross context
    JSFunction feedback that is collected by the CallIC, so there's no
    point in gathering that feedback at all (it just complicates the
    checking that is necessary in the compilers). What we should do
    instead at some point (when Crankshaft becomes less important) is
    to collect the SharedFunctionInfo as feedback for those cases.

BUG=

Review URL: https://codereview.chromium.org/1453033002

Cr-Commit-Position: refs/heads/master@{#32024}

BUG=

Review URL: https://codereview.chromium.org/1442643009

Cr-Commit-Position: refs/heads/master@{#32023}

This is the first part to refactoring the JSNativeContextSpecialization
class, which has grown way too big recently.

Also don't collect cross context feedback for the CallIC in general.
Neither TurboFan nor Crankshaft can make any use of cross context
JSFunction feedback that is collected by the CallIC, so there's no
point in gathering that feedback at all (it just complicates the
checking that is necessary in the compilers). What we should do
instead at some point (when Crankshaft becomes less important) is
to collect the SharedFunctionInfo as feedback for those cases.

R=yangguo@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1451273002

Cr-Commit-Position: refs/heads/master@{#32022}

Rolling v8/buildtools to 277db9302c7ff55beee2a9daf380675dc03bea83

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1454553003

Cr-Commit-Position: refs/heads/master@{#32021}

- Removed PASS/FAIL line for arrow/rest params test which should now pass.
- Moved soon-to-be-changed tests about built-in prototypes as plain objects
  to INVALID section (and noted that they'll be fixed with the
  next test262 roll).

R=littledan@chromium.org

Review URL: https://codereview.chromium.org/1450243002

Cr-Commit-Position: refs/heads/master@{#32020}

TEST=
BUG=

Review URL: https://codereview.chromium.org/1453573002

Cr-Commit-Position: refs/heads/master@{#32019}

TEST=
BUG=

Review URL: https://codereview.chromium.org/1446363002

Cr-Commit-Position: refs/heads/master@{#32018}

BUG=chromium:555543
LOG=N

Review URL: https://codereview.chromium.org/1448033002

Cr-Commit-Position: refs/heads/master@{#32017}

All uses of Token::INIT also have access to the relevant VariableMode,
so there's no reason to have more than one token representing an
initializing assignment.

Review URL: https://codereview.chromium.org/1431873006

Cr-Commit-Position: refs/heads/master@{#32016}

Port 34b7b21d

Original commit message:
    If inline allocation fails, we can just use the %NewObject fallback,
    which will do the right thing. We don't need a dedicated fallback to
    %AllocateInNewSpace.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1448063002

Cr-Commit-Position: refs/heads/master@{#32015}

BUG=none
R=verwaest@chromium.org,rossberg@chromium.org,bmeurer@chromium.org,neis@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/1413463006

Cr-Commit-Position: refs/heads/master@{#32014}

While all allocated objects need to have correct alignment, this requirement
doesn't make a lot of sense for the allocation limit. Removing this assertion
would makes it possible to make the inline-allocation-observers accurate. This
could be done in other ways, but removing this assertion is the most elegant way
to go about it.

R=hpayer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1444883003

Cr-Commit-Position: refs/heads/master@{#32013}

This adds support for load/store access to FAST_HOLEY_ELEMENTS and
FAST_HOLEY_SMI_ELEMENTS backing stores. We don't currently fully support
the double holes, because we make some difficult assumptions in
Crankshaft there.

R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1448903002

Cr-Commit-Position: refs/heads/master@{#32012}

BUG=4134
R=epertoso@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1451733002

Cr-Commit-Position: refs/heads/master@{#32011}

Revert of Reland "[heap] Turn on parallel compaction" (patchset #1 id:1 of https://codereview.chromium.org/1444283002/ )

Reason for revert:
Looks like tasks are still scheduled during isolate shutdown after waiting for remaining tasks:
  https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/builds/5310/

Original issue's description:
> Reland "[heap] Turn on parallel compaction"
>
> This reverts commit e6820480.
>
> BUG=chromium:524425
> LOG=N
> CQ_EXTRA_TRYBOTS=tryserver.v8:v8_linux_arm64_gc_stress_dbg;tryserver.v8:v8_linux_gc_stress_dbg;tryserver.v8:v8_mac_gc_stress_dbg;tryserver.v8:v8_linux64_msan_rel;tryserver.v8:v8_linux64_tsan_rel
>
> Committed: https://crrev.com/c82d2323ffd5c399ba37da389ba0cdc72f46c97f
> Cr-Commit-Position: refs/heads/master@{#32009}

TBR=hpayer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:524425

Review URL: https://codereview.chromium.org/1445093002

Cr-Commit-Position: refs/heads/master@{#32010}

This reverts commit e6820480.

BUG=chromium:524425
LOG=N
CQ_EXTRA_TRYBOTS=tryserver.v8:v8_linux_arm64_gc_stress_dbg;tryserver.v8:v8_linux_gc_stress_dbg;tryserver.v8:v8_mac_gc_stress_dbg;tryserver.v8:v8_linux64_msan_rel;tryserver.v8:v8_linux64_tsan_rel

Review URL: https://codereview.chromium.org/1444283002

Cr-Commit-Position: refs/heads/master@{#32009}

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1448803003

Cr-Commit-Position: refs/heads/master@{#32008}

This way we can properly cancel them on the main thread in case they never get
scheduled by the platform.

BUG=chromium:524425
LOG=N
CQ_EXTRA_TRYBOTS=tryserver.v8:v8_linux_arm64_gc_stress_dbg;tryserver.v8:v8_linux_gc_stress_dbg;tryserver.v8:v8_mac_gc_stress_dbg;tryserver.v8:v8_linux64_msan_rel;tryserver.v8:v8_linux64_tsan_rel;tryserver.v8:v8_mac64_asan_rel

Review URL: https://codereview.chromium.org/1446523003

Cr-Commit-Position: refs/heads/master@{#32007}

Next step: expose it to JS and test it.

BUG=v8:1543
LOG=n
R=cbruni@chromium.org

Review URL: https://codereview.chromium.org/1439353004

Cr-Commit-Position: refs/heads/master@{#32006}

The TiesEven rounding mode rounds float64 numbers to the nearest
integer. If there are two nearest integers, then the number is rounded
to the even one.  This is the default rounding mode according to
IEEE~754.

I implemented the operator on ia32, x64, arm, arm64, mips, and mips64.

I think there is a bug in the current implementation of the ppc
simulator, which kept me from implementing the operator on ppc.
According to my understanding of the ppc instruction manual, the FRIN
instruction provides the right behavior for Float64RoundTiesEven. In the
simulator, however, FRIN provides a different semantics. If there are
two nearest integers, then the simulator returns the one which is
further away form 0.

Review URL: https://codereview.chromium.org/1440293002

Cr-Commit-Position: refs/heads/master@{#32005}

I implemented it on x64, ia32, arm, arm64, mips, mips64, and ppc.

Review URL: https://codereview.chromium.org/1444583002

Cr-Commit-Position: refs/heads/master@{#32004}

Extend the ElementAccessInfo machinery with support for elements kind
transitions, which can be either in-place updates of the map (i.e. when
going from FAST_SMI_ELEMENTS to FAST_ELEMENTS) or instance migrations
utilizing the TransitionElementsKindStub.

R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1452563002

Cr-Commit-Position: refs/heads/master@{#32003}

  port 34b7b21d (r32000)

  original commit message:
  If inline allocation fails, we can just use the %NewObject fallback,
  which will do the right thing. We don't need a dedicated fallback to
  %AllocateInNewSpace.

BUG=

Review URL: https://codereview.chromium.org/1451603002

Cr-Commit-Position: refs/heads/master@{#32002}

    port ff283f7d (r31987)

    original commit message:
    * Limit triggering of tail calls to explicit use of a new inline runtime
      function %_TailCall. %_TailCall works just like %_Call except for using
      tail-calling mechanics (currently only in TF).
    * Remove hack that recognized some specific usages of %_Call and converted them
      into tail calls.
    * Support tail calls for all calls where the number of callee stack parameters
      is less than or equal to the number of caller stack parameters.
    * Use the gap resolver to swizzle parameters and registers to tail calls.

BUG=

Review URL: https://codereview.chromium.org/1445023002

Cr-Commit-Position: refs/heads/master@{#32001}

If inline allocation fails, we can just use the %NewObject fallback,
which will do the right thing. We don't need a dedicated fallback to
%AllocateInNewSpace.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/1440193003

Cr-Commit-Position: refs/heads/master@{#32000}