R=leszeks@chromium.org, rmcilroy@chromium.org

Bug: v8:8766
Change-Id: I85ac658dddffaea69f64864185e87db2fdb2f90f
Reviewed-on: https://chromium-review.googlesource.com/c/1450132Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#59304}

The result of Object::ToInteger is a number rounded to an
integer value, but not necessarily in the range of what a
C++ "int" can represent. Doing the 2 <= radix <= 36 range
check first makes the subsequent cast safe.

Bug: chromium:927212
Change-Id: I49f115140f6dc1f951cbc08a3025b3ac92ec8628
Reviewed-on: https://chromium-review.googlesource.com/c/1449040
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59303}

This is a reland of ac2fb66b.
Crashes were fixed in https://crrev.com/c/1429862.

Original change's description:
> [wasm] Remove finisher task
>
> This removes the finisher task and instead finishes compilation units
> from the background.
> It also changes ownership of the AsyncCompileJob to be shared among all
> tasks that still operate on it. The AsyncCompileJob dies when the last
> reference dies.
>
> R=ahaas@chromium.org
> CC=​​mstarzinger@chromium.org
>
> Bug: v8:7921, v8:8423
> Change-Id: Id09378327dfc146459ef41bc97176a8716756ae4
> Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_rel
> Reviewed-on: https://chromium-review.googlesource.com/c/1335553
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#58630}

Bug: v8:7921, v8:8423
Change-Id: I3dcee4e8e56d2a524d302af91b5cb4a7a9ceb8ce
Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_rel
Reviewed-on: https://chromium-review.googlesource.com/c/1400781
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59302}

BUG=v8:7294,v8:8562

Change-Id: I1ed3b6d6a2fed2aee224e22ae8db5d76a52998a5
Reviewed-on: https://chromium-review.googlesource.com/c/1449731Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59301}

This reverts commit a1b431d7.

Reason for revert: https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Linux%20-%20nosnap%20-%20debug/22809

Original change's description:
> [serializer] share class positions tuple across contexts
> 
> Class positions is a struct that stores the start and end positions of a class
> literal. It is stored both on class objects, and the template used to
> instantiate class objects.
> 
> The template is reachable from the bytecode array and therefore serialized by
> the startup serializer. Class objects are context-dependent and therefore
> serialized by the partial serializer. Serializing class positions from both
> serializers violates the assumption that we don't serialize any object twice.
> 
> R=​gsathya@chromium.org
> 
> Bug: v8:8761
> Change-Id: If22c554cc7396d63998a015454ce0c67a7d2e05c
> Reviewed-on: https://chromium-review.googlesource.com/c/1444956
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
> Commit-Queue: Yang Guo <yangguo@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#59292}

TBR=yangguo@chromium.org,mstarzinger@chromium.org,gsathya@chromium.org

Change-Id: I9f3fd1b29b5991b450223f8b27dfc7aa7e5a3171
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:8761
Reviewed-on: https://chromium-review.googlesource.com/c/1450116Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59300}

This basically adjusts reality to match our expectations. Methods based
on Code::kConstantPoolOffset expected the constant pool to be located
immediately following the handler table and before the code comments
section, while it was actually emitted before the jump table. We did
not notice earlier since this is only relevant on ppc.

Bug: v8:8758
Change-Id: I189af491fe133a7dc480ff4056372ba7a27faa81
Reviewed-on: https://chromium-review.googlesource.com/c/1445880
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#59299}

Clean up some redundant variables after https://crrev.com/c/1449615.

R=mstarzinger@chromium.org

Bug: v8:8562
Change-Id: I44d46b037978f8feff7486cdc5c521c74c0a1c9e
Reviewed-on: https://chromium-review.googlesource.com/c/1449617
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59298}

Users should switch to TracedGlobal and the newly added methods of
v8::EmbedderHeapTracer.

Bug: chromium:923361, v8:8562
Change-Id: I3e5ed5785a0a49c0b65c7b1d1d103e568dd3e938
Reviewed-on: https://chromium-review.googlesource.com/c/1445752
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59297}

This CL revises some of our error messages, and removes unneeded parts
(like "AsyncCompilation: " or "(null): "). It also extends existing
tests to check for the precise error message more thoroughly to detect
changes or nondeterminism earlier.

R=titzer@chromium.org, ahaas@chromium.org

Cq-Include-Trybots: luci.chromium.try:linux-blink-rel
Bug: chromium:926311
Change-Id: I1ccfb307d4a61291f4582330152a53fbadd0848f
Reviewed-on: https://chromium-review.googlesource.com/c/1445897
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59296}

This adds support for integrity level transitions (preventExtensions,
seal and freeze) to MapUpdater and Map::TryUpdate.

In both cases, we first try to detect whether there were integrity
level transitions in the transition tree to the old map and make note
of the most restrictive integrity transition and the map just before
the transition (integrity-source-map). Then we find an appropriate root
(based on integrity-source-map's elements kind) and replay the
transitions based on the integrity-source-map's descriptor
array. Finally, if we saw an integrity level transition in
the beginning, we will find-or-create that transition (on the
updated version of integrity-source-map).

For the following micro-benchmark, we get about 10x speedup.

```
function C() {
  this.x = 1;
  Object.seal(this);
  this.x = 0.1;
}

const start = Date.now();
for (let i = 0; i < 1e7; i++) {
  new C();
}
console.log("Reconfigure sealed: " + (Date.now() - start));
```

Before:
> Reconfigure sealed: 5202

After:
> Reconfigure sealed: 479

Bug: v8:8538
Change-Id: If695be7469d8b6ccd44ac4528be8aa34b65b3e4d
Reviewed-on: https://chromium-review.googlesource.com/c/1442640
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59295}

BUG=v8:8395

Change-Id: I717f4c35fb9764a2ffb97662eef0148ad04284e6
Reviewed-on: https://chromium-review.googlesource.com/c/1449633Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59294}

Change-Id: Ifa1f7cbfd62f16118f97848e9d6b60744d9ba515
Reviewed-on: https://chromium-review.googlesource.com/c/1450112Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59293}

Class positions is a struct that stores the start and end positions of a class
literal. It is stored both on class objects, and the template used to
instantiate class objects.

The template is reachable from the bytecode array and therefore serialized by
the startup serializer. Class objects are context-dependent and therefore
serialized by the partial serializer. Serializing class positions from both
serializers violates the assumption that we don't serialize any object twice.

R=gsathya@chromium.org

Bug: v8:8761
Change-Id: If22c554cc7396d63998a015454ce0c67a7d2e05c
Reviewed-on: https://chromium-review.googlesource.com/c/1444956Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59292}

This CL is mostly a mechanical change. Loading either the receiver,
the backing store or the temp array from the sort state is pushed down
into each respective Load/Store builtin. This eliminates the need
for reloading the elements pointer after each compare function call.

R=jgruber@chromium.org, tebbi@chromium.org

Bug: v8:8562
Change-Id: I453e98635f9d891da58cf7b2a86c5c58f4a4069c
Reviewed-on: https://chromium-review.googlesource.com/c/1449613Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59291}

BUG=v8:8562

Change-Id: I66b729aeb306ecfbf92ee6e992c3abb6f854949c
Reviewed-on: https://chromium-review.googlesource.com/c/1449733Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59290}

This reverts commit b8c821f4.

Reason for revert: compile errors, e.g. https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Linux%20-%20builder/39320

Original change's description:
> Extract JSObject class from objects.cc
> 
> I extracted following class member functions to js-objects.cc
> * JSReceiver
> * JSObject
> * JSBoundFunction
> * JSFunction
> * JSGlobalObject
> * JSDate
> * JSMessageObject
> 
> Declaration of all above class are in js-objects.h.
> 
> I also moved AllocationSite::DigestTransitionFeedback used in JSObject::UpdateAllocationSite
> and ShouldConvertToSlowElements used in JSObject and JSArray
> 
> This patch makes compile time of objects.cc from 17.6s to 14.1s on Z840 Linux.
> And js-objects.cc takes 8.69s for compile.
> 
> Bug: v8:7629
> Change-Id: I989f22363667445dd28d7f8c06c81ff79d6ed45f
> Reviewed-on: https://chromium-review.googlesource.com/c/1447916
> Commit-Queue: Takuto Ikuta <tikuta@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Reviewed-by: Marja Hölttä <marja@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#59288}

TBR=marja@chromium.org,mstarzinger@chromium.org,titzer@chromium.org,tikuta@chromium.org

Change-Id: I18a8af8a7970f96b2ec3e56b2b1871b4f080ab01
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7629
Reviewed-on: https://chromium-review.googlesource.com/c/1449635Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59289}

I extracted following class member functions to js-objects.cc
* JSReceiver
* JSObject
* JSBoundFunction
* JSFunction
* JSGlobalObject
* JSDate
* JSMessageObject

Declaration of all above class are in js-objects.h.

I also moved AllocationSite::DigestTransitionFeedback used in JSObject::UpdateAllocationSite
and ShouldConvertToSlowElements used in JSObject and JSArray

This patch makes compile time of objects.cc from 17.6s to 14.1s on Z840 Linux.
And js-objects.cc takes 8.69s for compile.

Bug: v8:7629
Change-Id: I989f22363667445dd28d7f8c06c81ff79d6ed45f
Reviewed-on: https://chromium-review.googlesource.com/c/1447916
Commit-Queue: Takuto Ikuta <tikuta@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59288}

This CL changes the usage pattern from
FOR_XXX_VALUES(i) { Use(*i); }
to
FOR_XXX_VALUES(i) { Use(i); }
which is way more intuitive.

Note that the replacement in the uses was done via regular expression,
so it's purely mechanical. In two locations I removed unneeded braces
around the macro, because they confused clang-format.
I plan to do more cleanups (remove redundant assignments within the
FOR_XXX_VALUES body) in a follow-up CL.

R=mstarzinger@chromium.org

Bug: v8:8562
Change-Id: I4329bfcf34e5b077d19b50f4204ceb3b4340fe61
Reviewed-on: https://chromium-review.googlesource.com/c/1449615
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59287}

BUG=v8:7490,v8:8562

Change-Id: I0fb021492d723abe59728cc23bd4b138d68b702e
Reviewed-on: https://chromium-review.googlesource.com/c/1449614Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59286}

If we need to allocate a DOUBLE_ELEMENTS backing store, it's important
to allow large object space allocation.

BUG: chromium:926856

Change-Id: I9dd94f7176891a6f8f11d5f579b67df8151a40b5
Reviewed-on: https://chromium-review.googlesource.com/c/1449531Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59285}

This reverts commit a9e93572.

Reason for revert:
https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/23956
Happened already 2 builds earlier, but the output is corrupted due to
an outage.

Original change's description:
> [test] Check for illegal uses of mjsunit methods
> 
> The assertThrows and assertDoesNotThrow methods expect either a
> function to execute, or a string to eval. In several tests however we
> accidentally passed the *result* of the statement to be tested instead
> of the code.
> This CL adds check to catch such error early, and removes wrong uses.
> In most places, we do not need to use assertDoesNotThrow anyway,
> because exceptions are handled as test failures.
> 
> Drive-by: Unify catch syntax in mjsunit.js and make sure to propagate
> MjsUnitAssertionErrors correctly.
> 
> R=​mathias@chromium.org
> 
> Bug: v8:8562
> Change-Id: I88894a667cbe0570774f748a9a23e8a527887a49
> Reviewed-on: https://chromium-review.googlesource.com/c/1439238
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#59277}

TBR=ahaas@chromium.org,clemensh@chromium.org,mathias@chromium.org

Change-Id: Iec06c95dd3223f27297e5c6e02835d26b5e753e7
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:8562
Reviewed-on: https://chromium-review.googlesource.com/c/1449634Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59284}

This is a reland of 101fd4dd

Original change's description:
> [testrunner] catch unforeseen exceptions
>
> Testrunner doesn't catch exceptions except TestRunnererror, KeyboardInterrupt.
>
> Unforeseen exceptions should fail the CI step.
>
> This CL returns an error exit code for uncaught exceptions.
>
> R=machenbach@chromium.org
> CC=yangguo@chromium.org,sergiyb@chromium.org
>
> Bug: v8:8731
> Change-Id: I7fb20dad4a3eea29f1dfa87ef91d45381ee08692
> Reviewed-on: https://chromium-review.googlesource.com/c/1434034
> Commit-Queue: Tamer Tas <tmrts@chromium.org>
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#59278}

Bug: v8:8731
No-Try: true
No-Tree-Checks: true
Change-Id: Ic580b334697ecebec923e76ff4a3e09fdf24dc8c
Reviewed-on: https://chromium-review.googlesource.com/c/1449632Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Tamer Tas <tmrts@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59283}

This reverts commit 101fd4dd.

Reason for revert: Uncaught exception in the recipe API https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Linux/29928

Original change's description:
> [testrunner] catch unforeseen exceptions
> 
> Testrunner doesn't catch exceptions except TestRunnererror, KeyboardInterrupt.
> 
> Unforeseen exceptions should fail the CI step.
> 
> This CL returns an error exit code for uncaught exceptions.
> 
> R=​machenbach@chromium.org
> CC=​yangguo@chromium.org,sergiyb@chromium.org
> 
> Bug: v8:8731
> Change-Id: I7fb20dad4a3eea29f1dfa87ef91d45381ee08692
> Reviewed-on: https://chromium-review.googlesource.com/c/1434034
> Commit-Queue: Tamer Tas <tmrts@chromium.org>
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#59278}

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: Ia2b661c1a71d1799693383bc942a9a1d47668b24
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:8731
Reviewed-on: https://chromium-review.googlesource.com/c/1449692Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59282}

A JSFunction that is in the old space could move during a scavenge
between being marked and the ClearFlushedJSFunctions, therefore only add
candidates that are in the old generation.

BUG=v8:8755,v8:8395

Change-Id: I3850188e8a0f9f39de994e170b4cda4fe6961079
Reviewed-on: https://chromium-review.googlesource.com/c/1448277Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59281}

BUG=v8:7490,v8:8562

Change-Id: I156b0123ed2da3143c353b164fb80e89f279545e
Reviewed-on: https://chromium-review.googlesource.com/c/1449572Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59280}

NOTRY=true

Bug: v8:8763
Change-Id: I9b4e2edbb5f1eeeaa88d35efaa25a4eb0c35c95c
Reviewed-on: https://chromium-review.googlesource.com/c/1449612
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Sergiy Belozorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59279}

Testrunner doesn't catch exceptions except TestRunnererror, KeyboardInterrupt.

Unforeseen exceptions should fail the CI step.

This CL returns an error exit code for uncaught exceptions.

R=machenbach@chromium.org
CC=yangguo@chromium.org,sergiyb@chromium.org

Bug: v8:8731
Change-Id: I7fb20dad4a3eea29f1dfa87ef91d45381ee08692
Reviewed-on: https://chromium-review.googlesource.com/c/1434034
Commit-Queue: Tamer Tas <tmrts@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59278}

The assertThrows and assertDoesNotThrow methods expect either a
function to execute, or a string to eval. In several tests however we
accidentally passed the *result* of the statement to be tested instead
of the code.
This CL adds check to catch such error early, and removes wrong uses.
In most places, we do not need to use assertDoesNotThrow anyway,
because exceptions are handled as test failures.

Drive-by: Unify catch syntax in mjsunit.js and make sure to propagate
MjsUnitAssertionErrors correctly.

R=mathias@chromium.org

Bug: v8:8562
Change-Id: I88894a667cbe0570774f748a9a23e8a527887a49
Reviewed-on: https://chromium-review.googlesource.com/c/1439238Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59277}

Discovered when working on other stuff.

BUG=v8:7490,v8:8562

Change-Id: I9707c95c33e52b1565cca238494e3349a472f604
Reviewed-on: https://chromium-review.googlesource.com/c/1449532Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59276}

R=machenbach@chromium.org

No-Try: true
Change-Id: I3ec0adc9be2ea09f63c12bf71803865f224fba09
Reviewed-on: https://chromium-review.googlesource.com/c/1449611
Commit-Queue: Tamer Tas <tmrts@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59275}

R=machenbach@chromium.org

No-Try: true
Change-Id: Iadb464e55fd30cc01ad6f250efd01588610407d0
Reviewed-on: https://chromium-review.googlesource.com/c/1449534
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59274}

This fixes stack height management when a call to an external function
raises a type error trap. It also adds a test case that such exceptions
can be caught locally.

R=clemensh@chromium.org
TEST=cctest/test-run-wasm-exceptions
BUG=v8:8729

Change-Id: I54b19ba86eb937695584229753d7f6cfa7e1a15d
Reviewed-on: https://chromium-review.googlesource.com/c/1447773Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59273}

This reverts commit b43e9d5e.

Reason for revert: Speculative revert, possibly breaking layout tests - https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8-Blink%20Linux%2064/29678

Original change's description:
> Reland "Enable 31bit Smis everywhere"
> 
> This is a reland of c1bf25bb
> 
> Node bot will turn green after github.com/v8/node/pull/89/
> has landed.
> 
> Original change's description:
> > Enable 31bit Smis everywhere
> >
> > This is a experiment to see how performance is impacted. If we tank
> > too much, we can revert this change.
> >
> > Change-Id: I01be33f5dd78aee6a5beecdc62adbaa6c3850eb1
> > Bug: v8:8344
> > Reviewed-on: https://chromium-review.googlesource.com/c/1355279
> > Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
> > Reviewed-by: Igor Sheludko <ishell@chromium.org>
> > Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#58157}
> 
> Bug: v8:8344
> Change-Id: I85a6e5c479f1090f50df3df042571227279a0692
> Reviewed-on: https://chromium-review.googlesource.com/c/1448314
> Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#59251}

TBR=jarin@chromium.org,sigurds@chromium.org,ishell@chromium.org

Change-Id: Ie388de7e1cc28fcf8bc576f564f3b463002bf1b4
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:8344
Reviewed-on: https://chromium-review.googlesource.com/c/1449533Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59272}

This CL replaces the current TypedArray#sort with a simpler mergesort.
The fastpath when the user does not provide a comparison function
is still used.

In addition, TypedArray#sort now converts all elements in the
TypedArray to tagged values upfront, sorts them and writes them
back into the TypedArray as the final step.

R=jgruber@chromium.org, tebbi@chromium.org

Bug: v8:8567
Change-Id: Ib672c5cf510f7c0a2e722d1baa2704305a9ff235
Reviewed-on: https://chromium-review.googlesource.com/c/1445987
Commit-Queue: Simon Zünd <szuend@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59271}

I extracted following class member functions to map.cc
* Map
* NormalizedMapCache

Declaration of all above class are in map.h.

This patch makes compile time of objects.cc from 18.9s to 17.6s on Z840 Linux.
And map.cc takes 6.14s for compile.

Bug: v8:7629
Change-Id: Id1e45dff243ab3f5449c0a7e2a861fba0bc7abf6
Reviewed-on: https://chromium-review.googlesource.com/c/1447914
Commit-Queue: Takuto Ikuta <tikuta@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59270}

Tbr: sigurds@chromium.org
Bug: v8:8723
Change-Id: Ieffeccf9b4f3f23a61f8247594eac2ea8c2a5ca4
Reviewed-on: https://chromium-review.googlesource.com/c/1448326Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59269}

The config migrated here:
https://crrev.com/c/1435917

NOTRY=true

Bug: chromium:916292
Change-Id: Ia74b631d53b8ac999f2a0d62ef7c1c43a0871bfa
Reviewed-on: https://chromium-review.googlesource.com/c/1444955Reviewed-by: Sergiy Belozorov <sergiyb@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59268}

R=mstarzinger@chromium.org

Bug: v8:8562
Change-Id: I05abb6d9e594c797cad558befac4376b376bc514
Reviewed-on: https://chromium-review.googlesource.com/c/1448274Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59267}

This way we can remove them correctly and avoid leaks.

R=mstarzinger@chromium.org, ulan@chromium.org

Bug: v8:8725
Change-Id: I52cbbf34a94171aaeb581b55aecb25311465544d
Reviewed-on: https://chromium-review.googlesource.com/c/1446453Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59266}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/f27d150..c1ab94d

Rolling v8/test/wasm-js/data: https://chromium.googlesource.com/external/github.com/WebAssembly/spec/+log/96c4188..d52eade

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/bc2b64b..b6cc5a6

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/1131ccb..39b0b8e

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/3a06ff3..3114fbc

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: Ieebaf197c097dd917a4561618feb2b66fc51c895
Reviewed-on: https://chromium-review.googlesource.com/c/1449041Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#59265}