We may get an empty handle passed to the side-effect check in places
where we have not implemented the flag check yet.

R=luoe@chromium.org

Bug: v8:7515
Change-Id: I088b223c4e8cc3aa262bebe34458c2e95b30e347
Reviewed-on: https://chromium-review.googlesource.com/951768Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51783}

MIPS[64] big endian doesn't have LiftOff implementation yet.
This CL skips offending tests.

Change-Id: I75797f2f234bbcafc535f3ff97670acabc32e216
Reviewed-on: https://chromium-review.googlesource.com/951486Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#51782}

Change-Id: I2108cdb952c0bb9439da9ab4911b2b7045397595
Reviewed-on: https://chromium-review.googlesource.com/952447Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51781}

BUG=v8:7308

Change-Id: I0e029bcc157a0e62bf7aa2d222118003a29b4436
Reviewed-on: https://chromium-review.googlesource.com/952443Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51780}

The VM state is a property of the isolate, not the CPU profiler.
Having to create a v8::CpuProfiler instance in order to change
the property is somewhat inefficient.

See https://github.com/nodejs/node/issues/18039 and
https://github.com/nodejs/node/pull/18534 for context.

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I70e31deca6529bccc05a0f4ed500ee268fb63cb8
Reviewed-on: https://chromium-review.googlesource.com/900622
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51779}

R=mstarzinger@chromium.org

Change-Id: I77356a84a89ff94dc5516e3507e11d0b5c429107
Reviewed-on: https://chromium-review.googlesource.com/951927Reviewed-by: Eric Holk <eholk@chromium.org>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#51778}

R=joransiu@ca.ibm.com

Change-Id: I441427d7b769c448b1355956b16a4e7f105b149d
Reviewed-on: https://chromium-review.googlesource.com/952022Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#51777}

Bug: chromium:819026
Change-Id: I2c58d5e2892f683747966e00aa047153085ac121
Reviewed-on: https://chromium-review.googlesource.com/950472Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51776}

Change-Id: If97eda2cc2da4501da7f4a753107f58c2797f237
Reviewed-on: https://chromium-review.googlesource.com/885181
Commit-Queue: Eric Holk <eholk@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51775}

The test is flaky because the OS does not sleep for the full requested
time. Adding a check for the OS sleep time.

Bug: v8:7492
Change-Id: I495ecc6595238bc1771adc434e766543513a0256
Reviewed-on: https://chromium-review.googlesource.com/937818Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Fadi Meawad <fmeawad@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51774}

We are not allowed to use t0 and t1 as temporary registers in
macro assembler as they are allocatable. This CL fixes the
issue.

Change-Id: I328532e669b081e5215887b725b0b645a86d98b1
Reviewed-on: https://chromium-review.googlesource.com/951488
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Reviewed-by: Sreten Kovacevic <sreten.kovacevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#51773}

This reverts commit 75d19b5b.

Reason for revert: Breaking Mac: https://build.chromium.org/p/client.v8.fyi/builders/Mac%20V8%20FYI%20Release%20%28Intel%29/builds/290

Original change's description:
> Reland "[builtins] Embed builtins into the binary"
> 
> This is a reland of 491d5a81
> 
> Original change's description:
> > [builtins] Embed builtins into the binary
> >
> > This embeds code for off-heap-safe builtins into the binary. Actual
> > execution of embedded code is not implemented yet.
> >
> > The embedded file has the following format:
> >
> > namespace v8 {
> > namespace internal {
> >
> > namespace {
> >
> > V8_EMBEDDED_TEXT_HEADER(v8_embedded_blob_)
> > __asm__( /* builtin offsets and lengths */ );
> > __asm__(V8_ASM_LABEL("Builtins_RecordWrite"));
> > __asm__( /* binary instruction stream */ );
> > /* Repeat for other builtins. */
> >
> > extern "C" const uint8_t v8_embedded_blob_[];
> > static const uint32_t v8_embedded_blob_size_ = /* size in bytes */;
> >
> > }  // namespace
> >
> > const uint8_t* DefaultEmbeddedBlob() { return v8_embedded_blob_; }
> > uint32_t DefaultEmbeddedBlobSize() { return v8_embedded_blob_size_; }
> >
> > }  // namespace internal
> > }  // namespace v8
> >
> > Bug: v8:6666
> > Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;luci.v8.try:v8_linux64_fyi_rel_ng
> > Change-Id: Ic989f01da69ebe2863f31d934bfbe2c5d6e80864
> > Reviewed-on: https://chromium-review.googlesource.com/946011
> > Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> > Reviewed-by: Yang Guo <yangguo@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#51759}
> 
> TBR=yangguo@chromium.org
> 
> Bug: v8:6666
> Change-Id: Iba245976ce46c62474dcba94a99ab4a217b2e20e
> Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;luci.v8.try:v8_linux64_fyi_rel_ng
> Reviewed-on: https://chromium-review.googlesource.com/950983
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#51769}

TBR=yangguo@chromium.org,jgruber@chromium.org

Change-Id: If2560e5ea57585421ba5c3da35717abb9b31766f
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6666
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;luci.v8.try:v8_linux64_fyi_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/951562Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51772}

RecordWrite is not isolate-independent on arm/arm64.

TBR=yangguo@chromium.org
NOTRY=true

Bug: v8:6666
Change-Id: Ie1160434dc9fcb0da91ce53ea06addf9f87434dd
Reviewed-on: https://chromium-review.googlesource.com/951247
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51771}

The idea of GetUnaryOpTargetRegister and GetBinaryOpTargetRegister is
to reuse the register of one of the operands instead of using an
separate third one, because we can often generate better code if the
destination register matches the src or lhs.
This was implemented by looking at the top or the first two stack
entries, and using one of their registers if there is only one use.
Instead of doing that we can also just pop them and then later check
whether this was the only use. This makes the code smaller, more
readable and probably faster.

R=titzer@chromium.org

Bug: v8:6600
Change-Id: Ia5d9e320bdb3add5032400455a64a0c7fee77cbd
Reviewed-on: https://chromium-review.googlesource.com/950947Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51770}

This is a reland of 491d5a81

Original change's description:
> [builtins] Embed builtins into the binary
>
> This embeds code for off-heap-safe builtins into the binary. Actual
> execution of embedded code is not implemented yet.
>
> The embedded file has the following format:
>
> namespace v8 {
> namespace internal {
>
> namespace {
>
> V8_EMBEDDED_TEXT_HEADER(v8_embedded_blob_)
> __asm__( /* builtin offsets and lengths */ );
> __asm__(V8_ASM_LABEL("Builtins_RecordWrite"));
> __asm__( /* binary instruction stream */ );
> /* Repeat for other builtins. */
>
> extern "C" const uint8_t v8_embedded_blob_[];
> static const uint32_t v8_embedded_blob_size_ = /* size in bytes */;
>
> }  // namespace
>
> const uint8_t* DefaultEmbeddedBlob() { return v8_embedded_blob_; }
> uint32_t DefaultEmbeddedBlobSize() { return v8_embedded_blob_size_; }
>
> }  // namespace internal
> }  // namespace v8
>
> Bug: v8:6666
> Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;luci.v8.try:v8_linux64_fyi_rel_ng
> Change-Id: Ic989f01da69ebe2863f31d934bfbe2c5d6e80864
> Reviewed-on: https://chromium-review.googlesource.com/946011
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#51759}

TBR=yangguo@chromium.org

Bug: v8:6666
Change-Id: Iba245976ce46c62474dcba94a99ab4a217b2e20e
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;luci.v8.try:v8_linux64_fyi_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/950983Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51769}

Tests are failing on MIPS with bus error because instruction cache is not flushed.

Change-Id: I1725a87ea2dc36ffde767d10a0c4deea0e069c09
Reviewed-on: https://chromium-review.googlesource.com/950722Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#51768}

This fixes HeapSnapshotGenerator::SetProgressTotal so that
ProgressReport is called with finished flag only once.

The DevTools front-end assumes that progress with finished flag is
reported only once.

Change-Id: Iad958478aa8ad27a520cb491419e521027967754
Reviewed-on: https://chromium-review.googlesource.com/949224
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Alexei Filippov <alph@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51767}

Bug: chromium:774108
Change-Id: Ifcf9939f29c9a3dc14ed686dc14608860ff32678
Reviewed-on: https://chromium-review.googlesource.com/950902Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Michael Hablich <hablich@chromium.org>
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51766}

[heap] Add a CodePageCollectionMemoryModificationScope to collect unprotected code pages on the fly.

Bug: chromium:774108
Change-Id: I95bfe672df13a6b8f40ba258c9ea42c6b18f6138
Reviewed-on: https://chromium-review.googlesource.com/949482Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51765}

R=clemensh@chromium.org
BUG=v8:7509

Change-Id: Ifa86cbc9d7bb915d5da9c56808d1425f2bc49c44
Reviewed-on: https://chromium-review.googlesource.com/950943Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51764}

ObjectSpace was only referred to in static_asserts and was otherwise
removed in http://codereview.chromium.org/7945009.

AllocationActions's last usage was removed in
https://codereview.chromium.org/1991293002.

Bug: v8:7310
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I2ccbf3b674517bc698b4c92754cd0b251229d342
Reviewed-on: https://chromium-review.googlesource.com/931887Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51763}

Instead of computing the disassmebly and offset tables eagerly on
registering a WASM function with a debugger agent, only generate
it when the source or offset tables are actually required. This is
implemented using a lazy, memoizing supplier that is shared
between the debugger agent and wasm translator.

Bug: chromium:794941
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I1a2f7dd71ab65c80f91ddee4f7babbdf33d2e74b
Reviewed-on: https://chromium-review.googlesource.com/918641
Commit-Queue: Stephan Herhut <herhut@chromium.org>
Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51762}

Make BuiltinsArrayAssembler::o() and len() into TNode<JSReceiver> and
TNode<Number> respectively.

Also adds typing to CodeStubAssembler::ToLength_Inline.

Fixes a type error in ArraySpeciesCreate which needs to take a Number rather
than a Smi.

Bug: v8:7310
Change-Id: Ie01d58ba195bddfe58ac7e4a31272c8f1a14c6ce
Reviewed-on: https://chromium-review.googlesource.com/934821
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51761}

This reverts commit 491d5a81.

Reason for revert: https://build.chromium.org/p/client.v8/builders/V8%20Mac64/builds/20696

Original change's description:
> [builtins] Embed builtins into the binary
> 
> This embeds code for off-heap-safe builtins into the binary. Actual
> execution of embedded code is not implemented yet.
> 
> The embedded file has the following format:
> 
> namespace v8 {
> namespace internal {
> 
> namespace {
> 
> V8_EMBEDDED_TEXT_HEADER(v8_embedded_blob_)
> __asm__( /* builtin offsets and lengths */ );
> __asm__(V8_ASM_LABEL("Builtins_RecordWrite"));
> __asm__( /* binary instruction stream */ );
> /* Repeat for other builtins. */
> 
> extern "C" const uint8_t v8_embedded_blob_[];
> static const uint32_t v8_embedded_blob_size_ = /* size in bytes */;
> 
> }  // namespace
> 
> const uint8_t* DefaultEmbeddedBlob() { return v8_embedded_blob_; }
> uint32_t DefaultEmbeddedBlobSize() { return v8_embedded_blob_size_; }
> 
> }  // namespace internal
> }  // namespace v8
> 
> Bug: v8:6666
> Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;luci.v8.try:v8_linux64_fyi_rel_ng
> Change-Id: Ic989f01da69ebe2863f31d934bfbe2c5d6e80864
> Reviewed-on: https://chromium-review.googlesource.com/946011
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#51759}

TBR=yangguo@chromium.org,jgruber@chromium.org

Change-Id: I36f5ee173fca565327b7f3e0ea20503ceef451fe
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6666
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;luci.v8.try:v8_linux64_fyi_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/950982Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51760}

This embeds code for off-heap-safe builtins into the binary. Actual
execution of embedded code is not implemented yet.

The embedded file has the following format:

namespace v8 {
namespace internal {

namespace {

V8_EMBEDDED_TEXT_HEADER(v8_embedded_blob_)
__asm__( /* builtin offsets and lengths */ );
__asm__(V8_ASM_LABEL("Builtins_RecordWrite"));
__asm__( /* binary instruction stream */ );
/* Repeat for other builtins. */

extern "C" const uint8_t v8_embedded_blob_[];
static const uint32_t v8_embedded_blob_size_ = /* size in bytes */;

}  // namespace

const uint8_t* DefaultEmbeddedBlob() { return v8_embedded_blob_; }
uint32_t DefaultEmbeddedBlobSize() { return v8_embedded_blob_size_; }

}  // namespace internal
}  // namespace v8

Bug: v8:6666
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;luci.v8.try:v8_linux64_fyi_rel_ng
Change-Id: Ic989f01da69ebe2863f31d934bfbe2c5d6e80864
Reviewed-on: https://chromium-review.googlesource.com/946011
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51759}

We now unconditionally both parse and compile StreamedSource on the background
thread.

BUG=v8:5203

Change-Id: I42d6fe9059bc1745da3a415d270f46cf1c08b306
Reviewed-on: https://chromium-review.googlesource.com/948854Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51758}

Note that {nullptr} is a dangerous sentinel value in V8's object model
because it can be interpreted as Smi(0) and hence will turn into a
completely different type than the declared return type at runtime.

R=ahaas@chromium.org
BUG=v8:7509

Change-Id: I89cffa1160a3bf6853f91c04fb90c74ad08888a3
Reviewed-on: https://chromium-review.googlesource.com/948907Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51757}

Instead of a hard-coded list of function addresses, we now use a flag
on the AccessorInfo object to annotate whether the getter can cause any
side effect.

Future changes will extend this to InterceptorInfo, CallHandlerInfo, and
expose this through the API.

R=jgruber@chromium.org, luoe@chromium.org

Bug: v8:7515
Change-Id: Id0fedf03493c3bd81913557a5681f8f63660f6a4
Reviewed-on: https://chromium-review.googlesource.com/945909
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51756}

R=franzih@chromium.org

Change-Id: I5717db794fc797e7c3b0b8f122ddb6dc0702a99e
Reviewed-on: https://chromium-review.googlesource.com/941126Reviewed-by: Franziska Hinkelmann <franzih@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51755}

For MIPS architecture release 6, following tests will be skipped:
cctest/test-run-machops/RunFloat64MulAndFloat64Add1
cctest/test-run-machops/RunFloat64MulAndFloat64Add2
cctest/test-run-machops/RunFloat64MulAndFloat64Sub1
cctest/test-run-machops/RunFloat64MulAndFloat64Sub2

TEST=
BUG=

Change-Id: Id359580b809d1387d504d98b6d25d6c112cfda78
Reviewed-on: https://chromium-review.googlesource.com/945689Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#51754}

The optimized code for %ArrayIteratorPrototype%.next for holey arrays
was wrong, since it would first store the [[NextIndex]] and then check
whether it hit a hole. However in that case TurboFan doesn't have any
point to deoptimize to, so we need to perform the side-effecting stores
only after all checks are done.

Bug: v8:7510, v8:7514, chromium:819086
Change-Id: I0214c7124833286113e4dc7403ddc20a82fa8da3
Reviewed-on: https://chromium-review.googlesource.com/950723Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51753}

Change-Id: I9854c151c9de636ba1d9ac3733c34485831e6cc4
Reviewed-on: https://chromium-review.googlesource.com/946858Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51752}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/0fc17e2..06a6e63

Rolling v8/third_party/android_ndk: https://chromium.googlesource.com/android_ndk/+log/e951c37..635bc38

Rolling v8/third_party/android_tools: https://chromium.googlesource.com/android_tools/+log/9a70d48..c22a664

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: Iadd11a087dd9348b2296d5df8adcd3584a6e6221
Reviewed-on: https://chromium-review.googlesource.com/950563Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51751}

R=joransiu@ca.ibm.com

Change-Id: I67364f29d494b09786a14b13743f73bef4b64582
Reviewed-on: https://chromium-review.googlesource.com/950242
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#51750}

Revert "Revert "[parser] Implements proposal-numeric-separator.""

This reverts commit 782f6401.

Original CL is https://chromium-review.googlesource.com/c/v8/v8/+/923441

Bug: v8:7317
Change-Id: I6f541c038bad0cff625094ba84aebe582bdeb12f
Reviewed-on: https://chromium-review.googlesource.com/945034Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51749}

xgr kills condition code on the branch

R=joransiu@ca.ibm.com

Change-Id: I90a75760c96319d8f27512395f904796a114c5e9
Reviewed-on: https://chromium-review.googlesource.com/950135Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#51748}

Port 88062a2c

Original Commit Message:

    Implement in-place weak reference handling in GC.

    Turn FeedbackVector::optimized_code_or_smi into an in-place weak reference (this
    is the only in-place weak reference at this point).

    (See bug for design doc.)

R=marja@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:7308
LOG=N

Change-Id: I00c6aa7c08524b7769d3428d0c18ce334f35a722
Reviewed-on: https://chromium-review.googlesource.com/949368Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#51747}

There must not be both an allocating function call and a handle deref
in the list of arguments to a call. Depending on the evaluation order
that the C++ compiler chooses, the deref could happen before the call
and the resulting raw pointer be invalidated by the GC.

Bug: chromium:818424
Change-Id: I525947252ff9d0b048a5bf82c2976e0acce739be
Reviewed-on: https://chromium-review.googlesource.com/949782Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51746}

I initially left them out because I thought they are harder to
implement than the other float binops, but it turns out it is actually
just the same.

R=ahaas@chromium.org

Bug: v8:6600
Change-Id: I68b98daf4dfaf4e00d57fc68257fe43977c4ae6a
Reviewed-on: https://chromium-review.googlesource.com/948543Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51745}

- Only show ElementsKind for JSObject Maps
- Display non-variable instance-size for non-JSObject Maps

Change-Id: I224b6ca2985f9c51635cc44ab5faa4cb977695ba
Reviewed-on: https://chromium-review.googlesource.com/946489
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51744}