The flag hash is used by code caching to recognize incompatible V8
configurations. When the flag hash differs, the cache is thrown out.

Code produced by embed/noembed builds is incompatible, and thus needs
to change the flag hash as well.

Bug: v8:6666, v8:7739
Change-Id: Icae8c6dc39b2eab491d28b2155f67103acf68181
Reviewed-on: https://chromium-review.googlesource.com/1057331Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53152}

This gets rid of the weakness hacks which were needed for remembering that maps
as handlers are weak, and other handles are strong.

BUG=v8:7308

Change-Id: I7fd3252ba67350803e2207dc12bbdf6abbae7e23
Reviewed-on: https://chromium-review.googlesource.com/1055449Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53151}

Module and script SharedFunctionInfos can't be used interchangeably
(e.g.: it should not be possible to bind a Module's SFI to a Context).

The dedicated type disambiguates the two.

This also adds an overload for CreateCodeCache which takes an unbound
module script instead of an unbound script. Both are just a SFI
underneath, so their behavior is identical.

Bug: v8:7685
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: Iab519d0d50b6b41c95abdb6397f5622e292da4d8
Reviewed-on: https://chromium-review.googlesource.com/1047107
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53150}

R=marja@chromium.org
BUG=v8:7490

Change-Id: Ib95662764db5659bd312327021cf5f44493c1cb3
Reviewed-on: https://chromium-review.googlesource.com/1057147Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53149}

Change-Id: I1815de5bc5fc955014cba8099e8c704a23a2e9be
Reviewed-on: https://chromium-review.googlesource.com/1044187Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53148}

The clusterfuzz issue crashes because VisitBinops expected only but 4
input operands but in the generated graph 5 input operands get created
The issue is fixed by increasing the size of the input operand buffer.

R=jarin@chromium.org

Bug: chromium:842501
Change-Id: I4bbb09a968e165e6f5a0a02d06eee97333f7aa38
Reviewed-on: https://chromium-review.googlesource.com/1056989Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53147}

Makes all but one data member private instead of protected and replaces
all Space::heap_ accesses with Space::heap().

Also moves Executability down from Space into PagedSpace and remove all
references in SemiSpace since it's always initialized with
NOT_EXECUTABLE.

Bug: v8:7754
Change-Id: Ic03ce35a5f970b3c1e25b32da53e4c9717b2ee1e
Reviewed-on: https://chromium-review.googlesource.com/1055510Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53146}

Shares the feedback slot when loading / storing named properties
when the name of the property and the variable corresponding
to the object are the same. This reduces the memory usage on most
real world benchmarks. There is a slight (~1%) increase in the overall
time spent in V8 on a couple of these pages.

There is also no overall performance regression on peak-performance
benchmarks like Octane, ARES. More detailed results are in this doc[1]

[1]: https://docs.google.com/document/d/1rPNjXU-WOlyNQovuQS28Zf2PHCENR97Bi76gV9mHHOc/edit?usp=sharing

BUG: v8:7530
Change-Id: I7dd98c2d26f4e6c94690ca7d9a8a4a8281b3142d
Reviewed-on: https://chromium-review.googlesource.com/966302
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53145}

We must not accept something of kBit representation as of
kWord32 representation (unless it's truncated accordingly).
Deopt instead.

Bug: v8:7740
Change-Id: Ib4f73600d66f8762a6e22f7ea1ce79e8ef451b34
Reviewed-on: https://chromium-review.googlesource.com/1054670
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53144}

Change-Id: I5e50e49a5ffe03f86e0da3d60083cafa83f5c6c6
Reviewed-on: https://chromium-review.googlesource.com/1055494Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Georgia Kouveli <georgia.kouveli@arm.com>
Cr-Commit-Position: refs/heads/master@{#53143}

We accidentally always enabled retpolines for indirect calls in
https://crrev.com/c/1047385. This regresses performance and code size
unnecessarily if the --no-untrusted-code-mitigations flag is used.

R=titzer@chromium.org

Bug: chromium:840376, chromium:798964
Change-Id: I6bab130e33d0dafa1f547ebf7e7930a23c4eba20
Reviewed-on: https://chromium-review.googlesource.com/1057128Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53142}

LSan is not implemented on windows, and trying to use the
{__lsan_ignore_object} function gives link error.
Since LSan is never enabled on windows, we also don't need the
annotations, so just disable them on windows.

R=bmeurer@chromium.org

Bug: chromium:842166,v8:7738
Change-Id: Ibaed77b4b884c09c7a08e081d953c56c53f907ff
Reviewed-on: https://chromium-review.googlesource.com/1056990Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53141}

This reverts commit 989285b7.

Reason for revert: broke internal bots

Original change's description:
> [tools] Add benchmark owners to the config
> 
> R=​machenbach@chromium.org
> 
> No-Try: true
> Bug: chromium:826280
> Change-Id: Ic34d13170dfecdd9e791974a34c33ba0248c7a38
> Reviewed-on: https://chromium-review.googlesource.com/1053809
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#53138}

TBR=machenbach@chromium.org,sergiyb@chromium.org

Change-Id: Iec3f8fa8eda77b1bcfb00274b28a12e4d233d6c4
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:826280
Reviewed-on: https://chromium-review.googlesource.com/1057091Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53140}

Revert "[async-await] Eliminate throwaway promise in async functions."

This reverts commit a840f1f8.

Revert "[async-generators] Also avoid throwaway promise here."

This reverts commit feb545ce.

Revert "[async-await] Turn await closures into intrinsics."

This reverts commit d97bb317.

Revert "[async-generators] Add fast-path for primitives in AsyncGeneratorYield."

This reverts commit e57b500e.

Revert "[async-generators] Add fast-path to skip "then" lookup in AsyncGeneratorResolve."

This reverts commit c15802e1.

Revert "[promises] Correctly run before/after hooks for await."

This reverts commit ca763923.

Bug: v8:7253, v8:7745
Change-Id: I25ad0d2df3cfbc84dbb431aa25b268bce8a39e89
Reviewed-on: https://chromium-review.googlesource.com/1049975
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53139}

R=machenbach@chromium.org

No-Try: true
Bug: chromium:826280
Change-Id: Ic34d13170dfecdd9e791974a34c33ba0248c7a38
Reviewed-on: https://chromium-review.googlesource.com/1053809Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53138}

This reverts commit 42334363.

Reason for revert: Seems to lead to floating point exceptions, i.e. with this code:

```js
__v_0 = 'x'.repeat();
var __f_1 = (function __f_0() {
  "use asm";
  function __f_1(__v_5, __v_0) {
    __v_5 = __v_5 | 0;
    __v_0 = __v_0 | 0;
    return ((__v_5 >>> 4) % (__v_0 >>> 1073741824)) | -1073741825;
  }
  return { __f_1: __f_1 };
})().__f_1;
  for (var __v_5 = 0; __v_5 < 4294967296; __v_5 += 3999773) {__v_5 % __v_0 | 0, __f_1();
  }
```

Running with UBSan via `d8-ubsan-vptr-linux-release-v8-component-53134/d8 --random-seed=54105979 --disable-in-process-stack-traces --stress-marking=100 fuzz-02382.js`

Original change's description:
> [turbofan][x64] Reduce compare-zero followed by flags-setting binop
> 
> On IA architecture, arithmetic and shifting operations set the flags
> according to the computation result.
> 
>     subl rsi,0x1
>     REX.W movq rbx,[rbx+0x17]
>     cmpl rsi, 0                       <-- TO BE REDUCED
>     jnz 0x3f54d2dcef0
> ==>
>     REX.W movq rbx,[rbx+0x17]
>     subl rsi,0x1
>     jnz 0x3f54d2dcef0
> &
>     orl rdx,rbx
>     cmpl rdx,0x0                      <-- TO BE REDUCED
>     jnz 0x3f54d22b0f5
> ==>
>     orl rdx,rbx
>     jnz 0x3f54d22b0f5
> 
> Change-Id: If69c023712212ad7b9fa8b29f4b98274f7885e35
> Reviewed-on: https://chromium-review.googlesource.com/1051445
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Commit-Queue: Kanghua Yu <kanghua.yu@intel.com>
> Cr-Commit-Position: refs/heads/master@{#53118}

TBR=bmeurer@chromium.org,kanghua.yu@intel.com

# Not skipping CQ checks because original CL landed > 1 day ago.

Change-Id: I8a177b9268a2fefcd6877d8f33134e7e0c980926
Reviewed-on: https://chromium-review.googlesource.com/1057067Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53137}

Change-Id: I37ed9115c099f3d17f23a26348a1bbf5f773ee32
Reviewed-on: https://chromium-review.googlesource.com/1056668Reviewed-by: Daniel Clifford <danno@chromium.org>
Commit-Queue: Peter Wong <peter.wm.wong@gmail.com>
Cr-Commit-Position: refs/heads/master@{#53136}

In the process, add a few simple tests for "constexpr" expressions, which
identified a few bugs that are also fixed in this CL.

Change-Id: I97486c781572642d2b574b92133b1f9cda3db592
Reviewed-on: https://chromium-review.googlesource.com/1055493
Commit-Queue: Daniel Clifford <danno@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53135}

Bug: chromium:842083
Change-Id: Ic28d47df055277878cb8e066cd2276cedf06d3cf
Reviewed-on: https://chromium-review.googlesource.com/1054074
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53134}

Change-Id: I8b9308d7628d7efc2a2212ef3a3aa52ccddbfb36
Reviewed-on: https://chromium-review.googlesource.com/1048036
Commit-Queue: Alexei Filippov <alph@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53133}

Node.js still support older versions of clang, and some of those
versions require us to explicitly declare default constructors for
classes. While updating V8 to 6.7 on Node.js we hit a build failure on
Mac OS X and FreeBSD because there was one constructor not complying
with that rule. This commit fixes it.

R=bmeurer@google.com, franzih@google.com, ofrobots@google.com, yangguo@google.com

Bug: v8:7743
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel
Change-Id: I1f57f0c88c27e4755c9e05f6fedd9def55d8cb77
Reviewed-on: https://chromium-review.googlesource.com/1050666Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Commit-Queue: Ali Ijaz Sheikh <ofrobots@google.com>
Cr-Commit-Position: refs/heads/master@{#53132}

This makes the fact that export wrapper code is shared across instances
explicit by hanging the {export_wrappers} array off the module object
instead of the instance-specific {WasmCompiledModule} object.

R=titzer@chromium.org

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: Ic5c73bcc17f759e520c105317361e5654628b99e
Reviewed-on: https://chromium-review.googlesource.com/1051987
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53131}

In case of {kLoadI32}, use same sequence of instructions as in case
of {kI64LoadI32S}. This fixes irregular behavior on target.

TEST=cctest/test-run-wasm/RunWasmLiftoff_I32ShrSOnDifferentRegisters

Change-Id: I7ae6915c8b9bacb682e01db2c00f0c280dbb8254
Reviewed-on: https://chromium-review.googlesource.com/1054878Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#53130}

This reverts commit be2f237d.

Original change's description:
> [heap] Unprotect code pages on demand in MinorMC
>
> This reduces average pause of MinorMC in Richards benchmark from 0.32ms
> to 0.25ms:
>
> baseline pause
>   len: 22
>   min: 0.3
>   max: 0.6
>   avg: 0.322727272727
>   [0,5[: 22
>
> pause
>   len: 22
>   min: 0.2
>   max: 0.7
>   avg: 0.254545454545
>   [0,5[: 22
>
> Bug: chromium:651354

Change-Id: I9d70037dda612528368fb1ba330dc6f6510a14a6
Reviewed-on: https://chromium-review.googlesource.com/1055450Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53129}

The root visitor now collects marked roots in the marking worklist and
filters out objects that are not in the new space.

This reduces average marking time in MinorMC in Richards from 0.08ms
to 0.04ms:

baseline mark:
  len: 22
  min: 0.07
  max: 0.18
  avg: 0.0809090909091
  [0,5[: 22

mark
  len: 22
  min: 0.03
  max: 0.13
  avg: 0.0409090909091
  [0,5[: 22

Bug: chromium:651354
Change-Id: I979e2f5ba331f88029b69bab23978f7fcadb7024
Reviewed-on: https://chromium-review.googlesource.com/1055490
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53128}

This reverts commit 0bf9c60c.

Reason for revert: breaks minor_mc bot

Original change's description:
> [heap] Unprotect code pages on demand in MinorMC
> 
> This reduces average pause of MinorMC in Richards benchmark from 0.32ms
> to 0.25ms:
> 
> baseline pause
>   len: 22
>   min: 0.3
>   max: 0.6
>   avg: 0.322727272727
>   [0,5[: 22
> 
> pause
>   len: 22
>   min: 0.2
>   max: 0.7
>   avg: 0.254545454545
>   [0,5[: 22
> 
> Bug: chromium:651354
> Change-Id: I701ca800d7c6986534d1de2e3051476e91a88d7d
> Reviewed-on: https://chromium-review.googlesource.com/1055507
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Hannes Payer <hpayer@chromium.org>
> Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#53125}

TBR=ulan@chromium.org,hpayer@chromium.org,mlippautz@chromium.org

Change-Id: Ib227e37fa60d608f94c3111a9b431baf0f488790
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:651354
Reviewed-on: https://chromium-review.googlesource.com/1053970Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53127}

R=titzer@chromium.org
BUG=v8:7754,v8:7490

Change-Id: Ib6d34c1716f9f877c7e04391ee59c2a12df2d0d3
Reviewed-on: https://chromium-review.googlesource.com/1054873Reviewed-by: Ben Titzer <titzer@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53126}

This reduces average pause of MinorMC in Richards benchmark from 0.32ms
to 0.25ms:

baseline pause
  len: 22
  min: 0.3
  max: 0.6
  avg: 0.322727272727
  [0,5[: 22

pause
  len: 22
  min: 0.2
  max: 0.7
  avg: 0.254545454545
  [0,5[: 22

Bug: chromium:651354
Change-Id: I701ca800d7c6986534d1de2e3051476e91a88d7d
Reviewed-on: https://chromium-review.googlesource.com/1055507Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53125}

This was already the case for 1-byte strings. This prevents crashes when
attempting to externalize such strings.

Bug: chromium:842078, v8:7464
Change-Id: I3092a6748edaf77b2689f7b6f6b949929998e508
Reviewed-on: https://chromium-review.googlesource.com/1054290Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53124}

Currently we are throwing an out-of-memory fatal error.

Bug: chromium:840329
Change-Id: I736dee890b6a338b458c9a4cc1c3fbb95e95742b
Reviewed-on: https://chromium-review.googlesource.com/1050285
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53123}

Bug: v8:7754
Change-Id: I44d20d55f5da0a0f95b89a565dbe21304c6d174c
Reviewed-on: https://chromium-review.googlesource.com/1052111
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53122}

Bug: chromium:842083
Change-Id: Ided2d8542e4501250208dde6146f00da77410f48
Reviewed-on: https://chromium-review.googlesource.com/1054234Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53121}

Bug: chromium:842083
Change-Id: I4ce2b58aa7fcafe7e886a3c80d3ddf7bfe3e4415
Reviewed-on: https://chromium-review.googlesource.com/1055389
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53120}

This reverts commit c280e7d4.

Reason for revert: <INSERT REASONING HERE>

Original change's description:
> [heap] Clear the memory of pooled pages when allocating from the pool.
>
> Bug: chromium:999634
> Change-Id: Ia7a0dd6ddc2477a7656a26548e9a247470d9143f
> Reviewed-on: https://chromium-review.googlesource.com/1041688
> Commit-Queue: Hannes Payer <hpayer@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52948}

TBR=hpayer@chromium.org,mlippautz@chromium.org

Change-Id: I838d5fe1e6c6ac8b726a90a44b2eacbea9057866
Reviewed-on: https://chromium-review.googlesource.com/1054070
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53119}

On IA architecture, arithmetic and shifting operations set the flags
according to the computation result.

    subl rsi,0x1
    REX.W movq rbx,[rbx+0x17]
    cmpl rsi, 0                       <-- TO BE REDUCED
    jnz 0x3f54d2dcef0
==>
    REX.W movq rbx,[rbx+0x17]
    subl rsi,0x1
    jnz 0x3f54d2dcef0
&
    orl rdx,rbx
    cmpl rdx,0x0                      <-- TO BE REDUCED
    jnz 0x3f54d22b0f5
==>
    orl rdx,rbx
    jnz 0x3f54d22b0f5

Change-Id: If69c023712212ad7b9fa8b29f4b98274f7885e35
Reviewed-on: https://chromium-review.googlesource.com/1051445Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Kanghua Yu <kanghua.yu@intel.com>
Cr-Commit-Position: refs/heads/master@{#53118}

Test mjsunit/wasm/compiled-module-serialization fails on those
architectures that do not support missaligned memory access.
We fix this by adding padding between code header and code start
in NativeModule serializer/deserializer so the code start is
properly aligned.

TEST=mjsunit/wasm/compiled-module-serializationx

Change-Id: I4f35b78a1190194088795b6f09becc3ad4251fdb
Reviewed-on: https://chromium-review.googlesource.com/1044186
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53117}

Avoid writing NumberOfElements to HashTable when it hasn't changed as
the HashTable could be in RO_SPACE and this operation will crash.

Bug: v8:841592
Change-Id: Iffadd567fc10aa9cd13d953da81275464b16c6c0
Reviewed-on: https://chromium-review.googlesource.com/1052693
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53116}

Allocation is super slow and produce big performance regression on
blink side.

Bug: chromium:839567,chromium:839809
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I3e9989435515ecfaedaee60c1f0c6939b9053e95
Reviewed-on: https://chromium-review.googlesource.com/1053105
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53115}

Remove cp from cache register list

Bug: v8:6600
Change-Id: If17d4558e4f89dd620c757e2a8288658f1489435
Reviewed-on: https://chromium-review.googlesource.com/1047645Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Vincent Belliard <vincent.belliard@arm.com>
Cr-Commit-Position: refs/heads/master@{#53114}

We cannot drop the deprecated API right away because we need to keep binary compatiblity.
As a short term solution create CPU profiler lazily if the API is called.

BUG=v8:7070

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I04029844895976b25db165f4fba6afbfe1681913
Reviewed-on: https://chromium-review.googlesource.com/1047848Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Alexei Filippov <alph@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53113}