It is legal to stringify other kinds of values, like strings and numbers.
Since Local<Object> is convertible to Local<Value>, this is unlikely to
break callers.

Bug: v8:6810
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Ie8e97c86308d62cdf0a2a17490a6e20de58fc76e
Reviewed-on: https://chromium-review.googlesource.com/657633Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Jeremy Roman <jbroman@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47935}

[turbofan] Reland^3 "Polymorphic inlining - try merge map check dispatch with function call dispatch."

This reverts commit ae28e0cf.

Bug: chromium:758096
Change-Id: I6541bd1ba46cd5dfb942ed3f3d382e047fb1f3e6
Reviewed-on: https://chromium-review.googlesource.com/657401Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47934}

Port 9e995e12
Port 408f252b

  Up to now, each architecture defined all Register types as structs,
  with lots of redundancy. An often found comment noted that they cannot
  be classes due to initialization order problems. As these problems are
  gone with C++11 constexpr constants, I now tried making Registers
  classes again.
  All register types now inherit from RegisterBase, which provides a
  default set of methods and named constructors (like ::from_code,
  code(), bit(), is_valid(), ...).
  This design allows to guarantee an interesting property: Each register
  is either valid, or it's the no_reg register. There are no other
  invalid registers. This is guaranteed statically by the constexpr
  constructor, and dynamically by ::from_code.

  I decided to disallow the default constructor completely, so instead of
  "Register reg;" you now need "Register reg = no_reg;". This makes
  explicit how the Register is initialized.

  I did this change to the x64, ia32, arm, arm64, mips and mips64 ports.
  Overall, code got much more compact and more safe. In theory, it should
  also increase performance (since the is_valid() check is simpler), but
  this is probably not measurable.

R=bjaideep@ca.ibm.com, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I2e87efc8790290c64fd6c0a2d093326710b30ed3
Reviewed-on: https://chromium-review.googlesource.com/658065Reviewed-by: Jaideep Bajwa <bjaideep@ca.ibm.com>
Commit-Queue: Jaideep Bajwa <bjaideep@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#47933}

Bug: v8:5967
Change-Id: I10388495158fe72ff06cc0f9f9a7b9522705f6e6
Reviewed-on: https://chromium-review.googlesource.com/658301Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47932}

We should add this define to external_config because it is used in
public include v8.h (e.g.: https://cs.chromium.org/chromium/src/v8/include/v8.h?l=272&rcl=5cd6565d5ad06a8cb5a1d9d502d15a54e4fa5bbe)

Change-Id: Idf29830a43f348fbf658fada0036c65ab410b155
Reviewed-on: https://chromium-review.googlesource.com/657397Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47931}

Even though we were generating additional arguments with default value
in the case that the caller was not providing enough, we then passed
the original pointer, leading to potential out-of-bounds accesses.

R=ahaas@chromium.org

Bug: chromium:763294,chromium:763297
Change-Id: Id18622d0d40e0408e26a5fc6f97494b5f9e18d17
Reviewed-on: https://chromium-review.googlesource.com/657699Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47930}

TSAN finds data races in generated JavaScript code that use
access the SharedArrayBuffer backing store racily. These are races, but
they are OK in the sense that the JavaScript memory model allows for the
potential bad behavior they could introduce (e.g. potentially tearing
reads). Relaxed atomics could be used here instead, but that could
introduce performance regressions.

This change adds TSAN annotations to the TypedArray reads/writes to
prevent TSAN from warning about them.

Bug: chromium:722871
Change-Id: I0776475f02a352b678ade7d32ed6bd4a6be98c36
Reviewed-on: https://chromium-review.googlesource.com/656509
Commit-Queue: Ben Smith <binji@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47929}

The previous %StringCharCodeAt runtime entry (and the inlined intrinsic)
are obsolete and not used anymore (except in dedicated tests for this
runtime function), so remove it. And rename the %StringCharCodeAtRT
function, which is actually used to %StringCharCodeAt instead to have
a consistent naming scheme for runtime fallbacks.

Bug: v8:5049
Change-Id: I619429ef54f6efea61fc51ab9ed1d5cfe4417f99
Reviewed-on: https://chromium-review.googlesource.com/657719
Commit-Queue: Yang Guo <yangguo@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47928}

R=mvstanton@chromium.org
BUG=v8:6409

Change-Id: I9252055a395287381d2646fedc59c8c376333694
Reviewed-on: https://chromium-review.googlesource.com/652469Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47927}

This is a cleanup for a presubmit check that might get enabled soon:
https://chromium-review.googlesource.com/c/v8/v8/+/657104

R=ahaas@chromium.org
CC=mstarzinger@chromium.org

Change-Id: Id431f2d4e8fcbb88a777b63e3fb136fa8ceac70a
Reviewed-on: https://chromium-review.googlesource.com/657400
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47926}

Change-Id: I61d9e2555fa6063e6e047f7cadb9fbcf4cdba312
Reviewed-on: https://chromium-review.googlesource.com/654869
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47925}

This reverts commit de9269f3.

Something's still wrong in the encoding handling (see bug).

Bug: chromium:763106
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Icd19dd42b84b9d090e191375a2942b9941110bcf
Reviewed-on: https://chromium-review.googlesource.com/657386
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47924}

This can be useful when there may be multiple callbacks attached by
code that's not directly tied to a single isolate, e.g. working
on a per-context basis.

This also allows rephrasing the global non-isolate APIs in terms
of this new API, rather than working around it inside `src/heap`.

TBR=hpayer@chromium.org

Bug: 
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I2e490ec40d1a34ea812f25f41ef9741d2116d965
Reviewed-on: https://chromium-review.googlesource.com/647548Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47923}

The advantage of an explicit Abort that the interpreter and the compiler know
that aborting cannot continue or throw or deopt. As a result we generate less
code and we do not confuse the compiler if the environment is not set up for
throwing (as in the generator dispatch that fails validation in
crbug.com/762057).

Bug: chromium:762057
Change-Id: I3e88f78be32f31ac49b1845595255f802c405ed7
Reviewed-on: https://chromium-review.googlesource.com/657025
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47922}

R=clemensh@chromium.org

Change-Id: I35a69e690a0647e1e6092bf881007198b252d3e8
Reviewed-on: https://chromium-review.googlesource.com/657577Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47921}

JavaScript is a dynamically typed language. But most code is 
written with fixed types in mind. When debugging JavaScript, 
it is helpful to know the types of variables and parameters 
at runtime. It is often hard to infer types for complex code. 
Type profiling provides this information at runtime.

Node.js uses the inspector protocol. This CL allows Node.js users 
to access and analyse type profile for via Node modules or the
in-procress api. Type Profile helps developers to analyze 
their code for correctness and performance.  

Design doc: https://docs.google.com/a/google.com/document/d/1O1uepXZXBI6IwiawTrYC3ohhiNgzkyTdjn3R8ysbYgk/edit?usp=sharing

Add `takeTypeProfile` to the inspector protocol. It returns a list
of TypeProfileForScripts, which in turn contains the type profile for
each function. We can use TypeProfile data to annotate JavaScript code. 

Sample script with data from TypeProfile:
function f(/*Object, number, undefined*/a, 
           /*Array, number, null*/b, 
           /*boolean, Object, symbol*/c) {
  return 'bye';
/*string*/};
f({}, [], true);
f(3, 2.3, {a: 42});
f(undefined, null, Symbol('hello'));/*string*/

Bug: v8:5933
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I626bfb886b752f90b9c86cc6953601558b18b60d
Reviewed-on: https://chromium-review.googlesource.com/508588
Commit-Queue: Franziska Hinkelmann <franzih@chromium.org>
Reviewed-by: Pavel Feldman <pfeldman@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47920}

R=clemensh@chromium.org

Change-Id: I4e2108beee792e54d4ff54c36fd326a058272b73
Reviewed-on: https://chromium-review.googlesource.com/657179Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47919}

Map::kBitFieldOffset should be loaded as a byte data.  This patch
fixes the loading instruction of Map::kBitFieldOffset in lazy
accessors.

Bug: v8:6795, v8:6156
Change-Id: I8fbc88ed44fb43a24335fc81f75b7199ca80212c
Reviewed-on: https://chromium-review.googlesource.com/656862
Commit-Queue: Yuki Shiino <yukishiino@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47918}

This removes logic related to healing of the optimized code slot within
the feedback vector from the {FastNewClosure} builtin. The underlying
code will by now self-heal making it obsolete during closure creation.
It will also simplify future inline allocation of closures.

R=jarin@chromium.org
BUG=v8:6563

Change-Id: If57fe00e3a98c2af423a833c98a465a669b8f3bc
Reviewed-on: https://chromium-review.googlesource.com/649551Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47917}

R=petermarshall@chromium.org

Bug: 
Change-Id: I4c14032aa1bd4fad39cf3db36556d53a529a52b3
Reviewed-on: https://chromium-review.googlesource.com/654865Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47916}

Bug: 
Change-Id: I236e6efe4142741ae8dc7e4ca4acdf8a65890c16
Reviewed-on: https://chromium-review.googlesource.com/647534Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47915}

This removes the ability to create a copy of a code-stub with a given
replacement pattern applied. It is in preparation of having the ability
to write-protect code objects.

R=ishell@chromium.org
BUG=v8:6409

Change-Id: Id7528b3bfc53ece73d8c58b0ac96c6e5702a9d45
Reviewed-on: https://chromium-review.googlesource.com/654605Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47914}

Add support to the JSCallReducer to recognize JSConstruct nodes where
the target is the Object constructor, and reduce them to JSCreate
nodes if either

 (a) no value is passed to the Object constructor, or
 (b) the target and new.target are definitely not identical, by checking
     whether both target and new.target are different HeapConstants
     (if they are not, then the JSCreateLowering will not be able to
     do a lot with the JSCreate anyways).

This should cover the relevant cases for subclassing appropriately. It
fixes the 3-4x slowdown on the micro-benchmark mentioned in the linked
bug,

  baseNoExtends: 752 ms.
  baseExtendsObject: 752 ms.
  baseExtendsViaFactory: 751 ms.

and thus removes the performance cliff.

R=jarin@chromium.org

Bug: v8:6801
Change-Id: Id265fd1399302a67b5790a6d0156679920c58bdd
Reviewed-on: https://chromium-review.googlesource.com/657019Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47913}

This reverts commit 9c0471b3.

Reason for revert: blocks roll https://chromium-review.googlesource.com/c/chromium/src/+/656897

Original change's description:
> Add V8_ENABLE_CHECKS define to public config
> 
> We should add this define to external_config because it is used in
> public include v8.h (e.g.: https://cs.chromium.org/chromium/src/v8/include/v8.h?l=272&rcl=5cd6565d5ad06a8cb5a1d9d502d15a54e4fa5bbe)
> 
> Change-Id: I795a3de448029e34033cf8f83094bdea3590bbb9
> Reviewed-on: https://chromium-review.googlesource.com/654876
> Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
> Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#47901}

TBR=gsathya@chromium.org,atimoxin@yandex-team.ru

Change-Id: I8265f78a9ab260b719226843afd649245e72434f
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/657157Reviewed-by: Michael Hablich <hablich@chromium.org>
Commit-Queue: Michael Hablich <hablich@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47912}

R=mstarzinger@chromium.org

Change-Id: I6cb9d9b7b82ce05299bb6088b187e91c4fa2ca0f
Reviewed-on: https://chromium-review.googlesource.com/649750
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47911}

This is revert of commit aee1e1fb with the fix for A1 and N6 jetstream failure.

R=bradnelson@chromium.org,mtrofin@chromium.org,clemensh@chromium.org
Bug: chromium:750828

Change-Id: Id38896af51315f76a0667ace32c77a2ba7287eec
Reviewed-on: https://chromium-review.googlesource.com/607092
Commit-Queue: Mircea Trofin <mtrofin@chromium.org>
Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47910}

The previous design assumed we can't possibly have a cycle involving
an instance, however, we can. For example: a script can reference
an instance, which ends up referencing the native context because
of how we generate wasm-to-js wrappers; that references the global
object, which then references the script. A global handle to the
indirect function table can then root such a cycle. That means
the instance is never collected, which never deletes the global
handle.

This change addresses that by making the handles weak.

Bug: 
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel
Change-Id: Ief7263af83974bf96505a4fba65d162474fe7c7c
Reviewed-on: https://chromium-review.googlesource.com/653852
Commit-Queue: Mircea Trofin <mtrofin@chromium.org>
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Reviewed-by: Aseem Garg <aseemgarg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47909}

Port e67420cb

Original Commit Message:

    There are two main reasons to move DeserializeLazy to ASM:

    1. We avoid complications around the distinction between Call/Construct
       cases by making sure relevant registers (e.g. new_target) remain
       unclobbered.

    2. We can avoid the tail-call through CodeFactory::Call/Construct by
       jumping directly to the deserialized code object.

R=jgruber@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:6624
LOG=N

Change-Id: Idd9f1fd967d64e952f48e5b35d2d4b49a9c28007
Reviewed-on: https://chromium-review.googlesource.com/656502Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Jaideep Bajwa <bjaideep@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#47908}

This issue was exposed with this CL
https://chromium-review.googlesource.com/c/v8/v8/+/654257

R=joransiu@ca.ibm.com, jyan@ca.ibm.com
BUG=
LOG=N

Change-Id: I216bfc8079bf62a58f8e6c20d4ac9d22bc445b51
Reviewed-on: https://chromium-review.googlesource.com/656306Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Jaideep Bajwa <bjaideep@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#47907}

This is a reland of a2ed0514
Original change's description:
> [debug] Add test for promise finally
> 
> As of v8:6536, we no longer have to mark builtins explicitly.
> 
> Also remove test whitelist for promise finally
> builtins.
> 
> Bug: v8:6088, v8:5967
> Change-Id: I7f98dfe7708678653e944ac76ba9938205490b16
> Reviewed-on: https://chromium-review.googlesource.com/654067
> Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#47896}

TBR=jgruber@chromium.org

Bug: v8:6088, v8:5967
Change-Id: I25a1820e04596a44769fc8ded80678f3663bbcd5
Reviewed-on: https://chromium-review.googlesource.com/655740Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47906}

When the bailout triggered, we assumed we're generating data (i.e., we're inside
a non-arrow function). This is not true; it's possible that we're already inside
an arrow function and not generating data anyway.

BUG=v8:5516,chromium:761980

Change-Id: Iad9c8dde283031630953ef9a46c1e68bc0cee048
Reviewed-on: https://chromium-review.googlesource.com/655081Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47905}

Tracking labels for most of these statements made no difference: only
try-statements require the special treatment of being wrapped in a
block. The previous code existed to support strong mode, which is
long gone.

This also results in a tiny regression of the error message for
a labelled `continue` statement targeting itself, but I'm not
convinced that anyone would ever intend to label a continue
statement (and Chakra and SpiderMonkey give similarly inaccurate
error messages for this case).

This is effectively a revert of d8bccfe9.

Bug: v8:6092
Change-Id: I25b62e10f6a20597e9686f08df76ba9724249618
Reviewed-on: https://chromium-review.googlesource.com/653380Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47904}

R=bjaideep@ca.ibm.com, joransiu@ca.ibm.com

Bug: 
Change-Id: I83d3c7c2a318eb6c1c4025603b01e894f196bac6
Reviewed-on: https://chromium-review.googlesource.com/655131
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Reviewed-by: Jaideep Bajwa <bjaideep@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#47903}

This is in preparation for BigInt, since for BigInt operands the desugared
operations will no longer be equivalent.

Future CLs can move the handling of these operations further down the
pipeline; this is merely a start to get the Parser out of this business.

Bug: v8:6791
Change-Id: I9df89e03d3ca2bf627c75fc5efb10463c3ed8cf9
Reviewed-on: https://chromium-review.googlesource.com/653433
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47902}

We should add this define to external_config because it is used in
public include v8.h (e.g.: https://cs.chromium.org/chromium/src/v8/include/v8.h?l=272&rcl=5cd6565d5ad06a8cb5a1d9d502d15a54e4fa5bbe)

Change-Id: I795a3de448029e34033cf8f83094bdea3590bbb9
Reviewed-on: https://chromium-review.googlesource.com/654876Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47901}

This reverts commit da6aab43.

Reason for revert: breaks ARM
https://build.chromium.org/p/client.v8.ports/builders/V8%20Arm%20-%20debug/builds/4376

Original change's description:
> [snapshot] Temporarily enable --lazy-deserialization
> 
> Flip the flag for one day to determine impact and flush out bugs.
> Please add crashes and regressions to https://crbug.com/v8/6796.
> 
> Bug: v8:6624,v8:6796
> Change-Id: I8b0581c40d956e01f94e9098ff935fdd5af36156
> Reviewed-on: https://chromium-review.googlesource.com/651408
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Reviewed-by: Michael Hablich <hablich@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#47893}

TBR=yangguo@chromium.org,hablich@chromium.org,jgruber@chromium.org

Change-Id: I65efccb4696777a3dae30984991e29d023236b12
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6624, v8:6796
Reviewed-on: https://chromium-review.googlesource.com/655897Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47900}

This reverts commit a2ed0514.

Reason for revert: Breaks ARM debug -
https://build.chromium.org/p/client.v8.ports/builders/V8%20Arm%20-%20debug/builds/4377

Original change's description:
> [debug] Add test for promise finally
> 
> As of v8:6536, we no longer have to mark builtins explicitly.
> 
> Also remove test whitelist for promise finally
> builtins.
> 
> Bug: v8:6088, v8:5967
> Change-Id: I7f98dfe7708678653e944ac76ba9938205490b16
> Reviewed-on: https://chromium-review.googlesource.com/654067
> Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#47896}

TBR=gsathya@chromium.org,jgruber@chromium.org

Change-Id: I2c064671a7650c3c97840e20dfdad4d6343ed0a4
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6088, v8:5967
Reviewed-on: https://chromium-review.googlesource.com/655737Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47899}

The spec calls out to Promise.prototype.then and also passes around
the constructor of the receiver to Promise.prototype.finally.

Adds a new constructor slot to PromiseFinallyContext enum and this is
used to create a new promise in the thenFinally/catchFinally callbacks.

Created a new PromiseResolve TFS builtin refactored from
the existing PromiseResolve builtin. PromiseResolveWrapper
calls out to this TFS Builtin and is now exposed as Promise.resolve.
The thenFinally and catchFinally callbacks also call out to the
PromiseResolve TFS builtin.

Spec -- https://tc39.github.io/proposal-promise-finally/

Bug: v8:5967
Change-Id: I2ce89f14d3b149619d11e424b6e37062e466c4d5
Reviewed-on: https://chromium-review.googlesource.com/652026Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47898}

Bug: v8:6772
Tbr: jarin@chromium.org
Change-Id: I48b21fbdec42d4b1c10800913f7fa222a5509a8d
Reviewed-on: https://chromium-review.googlesource.com/654873Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47897}

As of v8:6536, we no longer have to mark builtins explicitly.

Also remove test whitelist for promise finally
builtins.

Bug: v8:6088, v8:5967
Change-Id: I7f98dfe7708678653e944ac76ba9938205490b16
Reviewed-on: https://chromium-review.googlesource.com/654067
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47896}