As a first step towards moving accesses to the broker, this moves
heap accesses from BitsetType::Lub to the broker.

Bug: v8:7790
Change-Id: Ie240b84b979717caae42cb8aa06ee8d9877a446d
Reviewed-on: https://chromium-review.googlesource.com/1088695
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53571}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/a429f60..2e17643

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/buildtools/+log/893eb86..6f4dae2

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/517100c..93a962f

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/cf4aced..e89dcf7

Rolling v8/third_party/fuchsia-sdk: https://chromium.googlesource.com/chromium/src/third_party/fuchsia-sdk/+log/afac8ec..adae55a

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/c893c7e..7e986fd

Rolling v8/tools/luci-go: https://chromium.googlesource.com/chromium/src/tools/luci-go/+log/ff0709d..4cc6820

Rolling v8/tools/swarming_client: https://chromium.googlesource.com/infra/luci/client-py/+log/3543e21..281c390

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: Iaffee27a98872b52bc238038c352e8c7c03728a9
Reviewed-on: https://chromium-review.googlesource.com/1090329
Commit-Queue: <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Reviewed-by: <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#53570}

Use a passed in Isolate/Heap directly rather than using GetIsolate() on
HeapObjects which may not in future be tied to an isolate.

Bug: v8:7786
Change-Id: I89d8706544aa135049434cf20c4e1308474c678b
Reviewed-on: https://chromium-review.googlesource.com/1089334Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53569}

Remove unused methods, duplicate logic.

Bug: v8:7790
Change-Id: Ic8e47158084df5239e3f4b4bf1df7d266c7d2585
Reviewed-on: https://chromium-review.googlesource.com/1090490Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53568}

Change-Id: Ieec4dccdf8a5241f439bde9fffc75f4f300930e1
Reviewed-on: https://chromium-review.googlesource.com/1089333Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53567}

This CL adds the simplest version of a trap handler fallback. At
instantiation time, we check whether the module was compiled to use
trap handlers and the memory is guarded. If the memory is not guarded
but the module is supposed to use trap handlers, we recompile the
module with bounds checks so that we can use an unguarded memory.

The compiled module is replaced with a bounds checking version, meaning
future instances from this module will also use bounds checks.

Some likely desirable features that are current missing but can be
added future CLs include:
* Disabling trap handler mode entirely.
* Recompiling all old instances so that trap handler and bounds checked
  code does not coexist in the same process.

Bug: v8:7143

Change-Id: I161fc0d544133b07dc4a93cc6af813369aaf3efe
Reviewed-on: https://chromium-review.googlesource.com/1018182
Commit-Queue: Eric Holk <eholk@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53566}

Removes most explicit calls to GetIsolate/GetHeap from heap/ and implicit
calls via the single argument Handle constructor and handle function by
passing it in through calling functions.

(One GetHeap remains in FreeList in heap/spaces.cc for now).

Bug: v8:7786
Change-Id: I14fd099d26f94b9afbcfad41aa873c8f843297dd
Reviewed-on: https://chromium-review.googlesource.com/1087002Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53565}

Explicitly pass Isolate* to the Handle constructor even if it means
calling GetIsolate. (Shortly, I want to remove that constructor
completely since its an invisible source of implicit GetIsolates).

Bug: v8:7786
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I3454e8c92e12bf5c5eb1d4e2018dff7c42949d26
Reviewed-on: https://chromium-review.googlesource.com/1089058
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53564}

Bug: v8:7786

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I16961e0943f19e8120a340d8bcd8eeb51f78b79e
Reviewed-on: https://chromium-review.googlesource.com/1089010
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53563}

This allows redifinitions of generics with the same name but differing parameter
type lists, e.g.

  macro coerce<Dest: type>(from: HeapObject): Dest;
  coerce<int32>(from: HeapObject): int32 {...}
  macro coerce<Dest: type>(from: Smi): Dest;
  coerce<int32>(from: Smi): int32 {...}

In order to allow multiple overloads of generic macros with the same name,
a more nuanced lookup of calls has been implemented using the
ParameterDifference utility class. There is still work to be done to unify
when ParameterDifference is used for lookup (e.g. removing it from operator
lookup when operators become simple aliases for macro names), but that work
will be done in a separate CL.

As part of this CL, the custom handling of "cast<>" operator in the .g4
grammar has been removed and replaced by a handful of equivalent overloads of
a generic "cast" macro.

Bug: v8:7793
Change-Id: Ibb2cdd3d58632b7f7f7ba683499f9688ae07f4f8
Reviewed-on: https://chromium-review.googlesource.com/1087873
Commit-Queue: Daniel Clifford <danno@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53562}

Change-Id: I15b43383d7f9d44f98be866bf77274635242e4ff
Reviewed-on: https://chromium-review.googlesource.com/1088709
Commit-Queue: Dominik Inführ <dinfuehr@google.com>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53561}

This lead to link errors in an unrelated CL. The function was declared
with "const PrintableInstructionBlock&", but defined with
"PrintableInstructionBlock&".

R=mstarzinger@chromium.org

Change-Id: I08a9837dc44dc9d8f508c914da92549179a6790e
Reviewed-on: https://chromium-review.googlesource.com/1088910Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53560}

On Android, %DebugPrint should output to the Android log instead of
stdout.

R=mstarzinger@chromium.org

Bug: v8:7820
Change-Id: Ia2ab14f1e4ae15914a1e0e721457f83b288683ff
Reviewed-on: https://chromium-review.googlesource.com/1088691
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53559}

This will prevent failures like this one:
https://ci.chromium.org/p/v8/builds/b8945509831610302560

R=machenbach@chromium.org

No-Try: true
Bug: chromium:831171
Change-Id: I3f5c5ce6ea2148c22e4ef0b18495e10e37fd3fed
Reviewed-on: https://chromium-review.googlesource.com/1074367Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53558}

This avoids embedding {RelocInfo::CODE_TARGET} addresses into WasmCode
by calling a WebAssembly runtime stub instead. The stubs themselves are
not yet independent of the Isolate, but will be made so soon.

Note that this also introduces a proper {compiler::TrapId} to avoid
accidental parameter type confusion with {TrapIf} and {TrapUnless}
operators.

R=clemensh@chromium.org
BUG=v8:7424

Change-Id: I32ef5a1253f336fc739d2192247826e9458456df
Reviewed-on: https://chromium-review.googlesource.com/1086937Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53557}

The typical use of assertThrowsEquals is to check that a specific
object is thrown. However, assertEquals only does a proper equality
check for primitive types, not for complex types. Using assertSame
does a reference equality check on objects, which is more what you
would expect from assertThrowsEquals. For exception kind testing,
assertThrowsEquals actually did not work correctly, assertThrows is
better for that case.

R=clemensh@chromium.org, mythria@chromium.org

Change-Id: I24fb22e75fa33ebe90eb4bae40825119a054bba5
Reviewed-on: https://chromium-review.googlesource.com/1087952Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53556}

This reverts commit 3c4d0316.

Reason for revert: Breaks MSAN on ARM64

https://ci.chromium.org/buildbot/client.v8/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/21425

'enabled' field not initialized in constructor?

Original change's description:
> [async] Expose async hooks to d8
> 
> This implementation follows the Node.js API as a guideline.
> 
> Change-Id: I09274ea25ccdbb9794a7440d6c14f26b9febb4f4
> Reviewed-on: https://chromium-review.googlesource.com/1065818
> Commit-Queue: Maya Lekova <mslekova@chromium.org>
> Reviewed-by: Ali Ijaz Sheikh <ofrobots@google.com>
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#53551}

TBR=ofrobots@google.com,gsathya@chromium.org,bmeurer@chromium.org,mslekova@chromium.org

Change-Id: I8b2bedb51cba18c77578d4e223474015d819e428
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/1088811Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53555}

Using DCHECK seems to be the common V8 style.

Change-Id: I6dab91e5225a222cbfe07ebeeec4ed1b274fe5bd
Reviewed-on: https://chromium-review.googlesource.com/1088698Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Stephan Herhut <herhut@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53554}

This CL fully implements the DataView getters for the Uint8, Int8,
Uint16, Int16, Uint32 and Int32 types in Torque, and removes
the runtime implementation that is not needed anymore.

There should be a light but visible performance increase compared to
the former runtime implementation.

Change-Id: I7d85097fd5953b9629f3ac6bed93b068889712b2
Reviewed-on: https://chromium-review.googlesource.com/1078349
Commit-Queue: Théotime Grohens <theotime@google.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53553}

Add code to measure timer resolution on POSIX systems

Change-Id: I980f7e416725effe1872f2c5e75805d753e3b0ae
Reviewed-on: https://chromium-review.googlesource.com/1086994
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53552}

This implementation follows the Node.js API as a guideline.

Change-Id: I09274ea25ccdbb9794a7440d6c14f26b9febb4f4
Reviewed-on: https://chromium-review.googlesource.com/1065818
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Ali Ijaz Sheikh <ofrobots@google.com>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53551}

Also, fix latency for NEG_S and NEG_D on mips.

Change-Id: I74626a787c67f79d430e55e715446d21b39ef937
Reviewed-on: https://chromium-review.googlesource.com/1088611Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Commit-Queue: Sreten Kovacevic <sreten.kovacevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#53550}

This makes sure {WasmCode} object are printed right after they have been
added to a {NativeModule} instead of waiting until the module is done.
This way debug output can be inspected as early as possible and works
even when there are issues later before the module is finished.

R=herhut@chromium.org
BUG=chromium:849713

Change-Id: Icced39cfaad7c033de569fbec21c26506f5796a6
Reviewed-on: https://chromium-review.googlesource.com/1088614Reviewed-by: Stephan Herhut <herhut@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53549}

Test ThreadTicks.ThreadNow fails on systems with low resolution
thread timers because the tests detects that no time elapsed
since the beginning of the test.
This CL adds a counting loop that makes sure the thread
timer has progressed by at least one tick.

TEST=unittests/ThreadTicks.ThreadNow

Change-Id: I910309208b3a154798cbc43813d41d3755ab819d
Reviewed-on: https://chromium-review.googlesource.com/1082352
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53548}

Drive-by-fix:
 - improve log parsing by not wrapping single lines in arrays

Change-Id: Ic4c5fdeb7875c8c5db57843f583e93285026ff74
BUG: chromium:757467, chromium:850038
Reviewed-on: https://chromium-review.googlesource.com/1078753
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53547}

Bug: chromium:850005
Change-Id: I287a274b86941e7d29705a24e479e4a02ecdfb07
Reviewed-on: https://chromium-review.googlesource.com/1088608Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53546}

`SetBuildEmbedderGraphCallback`, unlike `SetWrapperClassInfoProvider`,
assumes a monolithic embedder that can provide all necessary information.
That is not the case for e.g. Node.js, which can e.g. provide multiple Node.js
instances per V8 Isolate, as well as native addons that may allocate resources
on their own.

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: Ib53dfde82416dd69934b08623e27d674a483ac2d
Reviewed-on: https://chromium-review.googlesource.com/1082441
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53545}

Enabling once again post-branch point. This CL is expected to come
with major memory improvements and slight performance regressions.

Recent work on performance improvements has focused on x64, hence only
enabling there for now.

Bug: v8:6666
Change-Id: I29dc55eb4e592465073559647e280f74253b73e1
Reviewed-on: https://chromium-review.googlesource.com/1076247
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53544}

In order to port CompileLazy and DeserializeLazy builtins to CSA we need to
support this mode to be able to tail call to compiled or deserialized JS code
object.

Bug: v8:5269, v8:7703
Change-Id: I6abdc989af16774f6454b2ea0a97b1ce5ece5125
Reviewed-on: https://chromium-review.googlesource.com/1087452Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53543}

This reverts commit 91bab558.

Reason for revert: Seems to break a layout test:
https://ci.chromium.org/buildbot/client.v8.fyi/V8-Blink%20Linux%2064/23895

See also:
https://github.com/v8/v8/wiki/Blink-layout-tests

Original change's description:
> [array] Use random middle element to determine pivot during sorting
> 
> This CL adds a "random state" to the Smi Root list and implements a
> basic Linear congruential pseudo random number generator in Torque.
> 
> The RNG is used to determine the pivot element for sorting. This will
> prevent the worst cases for certain data layouts.
> 
> Drive-by-fix: Make sorting of ranges and execution pauses for profviz
> deterministic by adding a secondary sorting criteria.
> 
> Bug: v8:7382
> Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
> Change-Id: Ieb871e98e74bdb803f821b0cd35d2f67ee0f2868
> Reviewed-on: https://chromium-review.googlesource.com/1082193
> Reviewed-by: Hannes Payer <hpayer@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Camillo Bruni <cbruni@chromium.org>
> Commit-Queue: Simon Zünd <szuend@google.com>
> Cr-Commit-Position: refs/heads/master@{#53524}

TBR=hpayer@chromium.org,cbruni@chromium.org,jgruber@chromium.org,szuend@google.com

Change-Id: I54f5d3f719428fd089ff12ff217d1c819f9ad1f7
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7382
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/1088506Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53542}

Merge sub with lea if pc_offset is not zero when computing code start address.

Change-Id: I20df6bc1b9a6c1d1f2c97b3de3e85252cea7caec
Reviewed-on: https://chromium-review.googlesource.com/1088318Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Shiyu Zhang <shiyu.zhang@intel.com>
Cr-Commit-Position: refs/heads/master@{#53541}

Fix instance of PrintRegisters only seen by compiler if
V8_TRACE_IGNITION is set.

Bug: v8:7786
Change-Id: I512e0ac111d61ff586c6cfa4a41878792a834602
Reviewed-on: https://chromium-review.googlesource.com/1087458Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53540}

As per (https://github.com/tc39/proposal-string-matchall/pull/35), the
call to IsRegExp after CreateRegExp was removed and additional
checking was replaced by an Assert.

Updates to Test262 has been submitted:
https://github.com/tc39/test262/pull/1587

Bug: v8:6890
Change-Id: I942b6846bb46cf85b1ea5566f9c19de7d2dbf03e
Reviewed-on: https://chromium-review.googlesource.com/1086419Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Commit-Queue: Peter Wong <peter.wm.wong@gmail.com>
Cr-Commit-Position: refs/heads/master@{#53539}

If executionContextId then binding is installed only once in given
context.

R=pfeldman@chromium.org

Bug: chromium:849552
Cq-Include-Trybots: luci.chromium.try:linux_chromium_headless_rel;master.tryserver.blink:linux_trusty_blink_rel
Change-Id: I474fcf9ad5e704b0a12c9aaa321cc90bb7957e2c
Reviewed-on: https://chromium-review.googlesource.com/1087489
Commit-Queue: Pavel Feldman <pfeldman@chromium.org>
Reviewed-by: Pavel Feldman <pfeldman@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53538}

R=clemensh@chromium.org
BUG=v8:6020

Change-Id: I03ad47ea119be699bd9defde6d962d32295be40c
Reviewed-on: https://chromium-review.googlesource.com/1083694
Commit-Queue: Aseem Garg <aseemgarg@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53537}

Avoid calling GetIsolate by passing the Isolate directly to
Accessors::IsJSObjectFieldAccessor.

Bug: v8:7786
Change-Id: I8a3b26080da64110b0c40df63395cab4e85704b7
Reviewed-on: https://chromium-review.googlesource.com/1080808Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53536}

R=mstarzinger@chromium.org

Bug: chromium:849656
Change-Id: I4c1990e10905969c94913f434ec0013e5cbbfb19
Reviewed-on: https://chromium-review.googlesource.com/1087273Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53535}

R=mstarzinger@chromium.org

Bug: chromium:849656
Change-Id: I34effca4770f732216b93b5e4e8c28383f2f9963
Reviewed-on: https://chromium-review.googlesource.com/1087271Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53534}

R=clemensh@chromium.org
BUG=chromium:849713

Change-Id: I3af8a654c32f8eb77dcdd3dffeb2dd826b90db9d
Reviewed-on: https://chromium-review.googlesource.com/1087451Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53533}

Port e3e3480b

Original Commit Message:

    The builtins table is an array of pointers to builtin code objects. It
    used to be located within the Builtins class, which itself was part of
    the Isolate.

    To enable faster isolate-independent access to builtin code objects,
    this CL moves the builtins table into the heap, at a constant known
    offset from the roots table. With this change, builtins can be accessed
    through the root pointer with a single instruction:

     mov reg, [kRootPointer, <offset to builtin>]

    TurboAssembler::LookupConstant is also extended in this CL to
    potentially shortcut the slow-ish constants table lookup: root
    constants are loaded through the root list, and builtin constants
    through the builtins table.

R=jgruber@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I1dac4ad30960d50f77aba7ec7da63b1f1259613d
Reviewed-on: https://chromium-review.googlesource.com/1087410Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#53532}