This CL changes certain frequently-called Array builtins to use CodeStubArguments
rather than peek at the stack frames above array builtins to determine if options
arguments have been passed into them.

Previous failure cannot be reproed with failing config. Flake?

BUG=v8:1956
LOG=N

Review-Url: https://codereview.chromium.org/2829093004
Cr-Commit-Position: refs/heads/master@{#44996}

Revert of [turbofan] Avoid going through ArgumentsAdaptorTrampoline for CSA/C++ builtins (patchset #8 id:140001 of https://codereview.chromium.org/2829093004/ )

Reason for revert:
Nosnap failure

Original issue's description:
> [turbofan] Avoid going through ArgumentsAdaptorTrampoline for select CSA/C++ builtins
>
> This CL changes certain frequently-called Array builtins to use CodeStubArguments
> rather than peek at the stack frames above array builtins to determine if options
> arguments have been passed into them.
>
> BUG=v8:1956
> LOG=N
>
> Review-Url: https://codereview.chromium.org/2829093004
> Cr-Commit-Position: refs/heads/master@{#44994}
> Committed: https://chromium.googlesource.com/v8/v8/+/680356278ddc7577e3b967fcc92055522ce00856

TBR=mvstanton@chromium.org,ishell@chromium.org,bmeurer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:1956

Review-Url: https://codereview.chromium.org/2851703005
Cr-Commit-Position: refs/heads/master@{#44995}

This CL changes certain frequently-called Array builtins to use CodeStubArguments
rather than peek at the stack frames above array builtins to determine if options
arguments have been passed into them.

BUG=v8:1956
LOG=N

Review-Url: https://codereview.chromium.org/2829093004
Cr-Commit-Position: refs/heads/master@{#44994}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/02044bf..853f22f

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/9c9ac13..fa1d11d

Rolling v8/third_party/instrumented_libraries: https://chromium.googlesource.com/chromium/src/third_party/instrumented_libraries/+log/05d5695..0ad2bcb

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: I0621ed2aba116528d4699e8407d20b16c6cd8ae9
Reviewed-on: https://chromium-review.googlesource.com/490867Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44993}

This reverts commit 4968b2c4.

Reason for revert: Speculative revert for severe perf regression
https://bugs.chromium.org/p/chromium/issues/detail?id=716468#c3

Original change's description:
> [intl] Switch to using declared accessors
> 
> This patch cleans up the Intl code by switching to using declared
> accessors, rather than embedder fields, for holding references to
> ICU objects. Additionally:
> - Rename classes to be more similar to how other classes are named
> - Make some unreachable paths into check-fails, rather than throwing
>   JS exceptions
> - Move some macros from objects-inl.h into object-macros.h, to allow
>   the implementation here to not touch objects.h
> - Some setup logic is moved from runtime-i18n.cc to i18n.cc.
> 
> This patch leaves type tags as they are; a future patch should move
> from a special Intl type tagging system to object types as other system
> objects use. Future patches should also move more logic to i18n.cc
> 
> BUG=v8:5402,v8:5751,v8:6057
> CQ_INCLUDE_TRYBOTS=master.tryserver.v8:v8_linux_noi18n_rel_ng
> 
> Change-Id: Ia9cbb25cf8f52662e3deb15e64179d792c10842c
> Reviewed-on: https://chromium-review.googlesource.com/479651
> Commit-Queue: Daniel Ehrenberg <littledan@chromium.org>
> Reviewed-by: Adam Klein <adamk@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#44804}

TBR=adamk@chromium.org,marja@chromium.org,mstarzinger@chromium.org,littledan@chromium.org,jwolfe@igalia.com
# Not skipping CQ checks because original CL landed > 1 day ago.
BUG=v8:5402,v8:5751,v8:6057
CQ_INCLUDE_TRYBOTS=master.tryserver.v8:v8_linux_noi18n_rel_ng

Change-Id: I7a45d7def1f1de0f21e3efb7de9b31f6bcfea46d
Reviewed-on: https://chromium-review.googlesource.com/490328Reviewed-by: Daniel Ehrenberg <littledan@chromium.org>
Commit-Queue: Daniel Ehrenberg <littledan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44992}

The current test/fuzzer/wasm directory is used for two things:
1) as the corpus directory for clusterfuzz
2) to test in v8 that the fuzzer runs correctly.

With the newly added files from the wasm spec tests this directory grew
quite big and adds unnecessary load on the trybots. Therefore I want to
do the following steps:
1) In this CL for V8: create a new directory for the clusterfuzz corpus
2) In chromium: use the new corpus directory
3) In v8: clean up the old directory to use it on the trybots.

R=bradnelson@chromium.org
CC=mmoroz@chromium.org

Change-Id: If690022558bb5780edf5a3649fb9745ef9c7407a
Reviewed-on: https://chromium-review.googlesource.com/490367
Commit-Queue: Brad Nelson <bradnelson@chromium.org>
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44991}

- we should always set creation async stack if it's available regardless existing of current parent async stack,
- we should cleanup parent link iff there is no creation and schedule async stack for parent.

Let's consider example: Promise.resolve().then(x => x).then(x => x), there is three promises which will call following instrumentation:
1) created #1 (Promise.resolve()) - collected stack #1
2) scheduled #1 - collected stack #2
3) created #2 with #1 as parent (first .then) - collected stack #3
4) created #3 with #2 as parent (first .then) - collected stack #4
5) started #2 - use stack #2 as scheduled
6) scheduled #2 - collected stack #6
7) finished #2
8) started #3 - use stack #6 as scheduled
9) scheduled #3 - collected stack #7
10) finished #3

If we collect stacks between step 4 and 5, it's possible to collect scheduled stack #2 but still have creation stack for #2 - stack #3 - so we always need to add creation event if scheduled is collected.

If we collect stacks between created and scheduled we should not remove parent link even if parent was not scheduled yet.

BUG=v8:6189
R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2844753002
Cr-Commit-Position: refs/heads/master@{#44990}

This reduces sizeof of these classes by 8 bytes on 64-bit
(16 bytes considering allocation size granularity for some of these classes).

I don't know how many instances remain at the end of loading a page. These objects are Zone objects which makes it more difficult to count the number
of instances. But looking at allocations only on cnn.com I've got 70K for
BinaryOperation, 20K for CompareOperation, 1.5K for CaseClause. There aren't
not many allocations of NativeFunctionLiteral but I decided to fix it too to
keep the same layout pattern.

Before:
    class v8::internal::CaseClause [sizeof = 56]
      : public v8::internal::Expression {
      [sizeof=12] v8::internal::Expression
      <padding> (4 bytes)
      [sizeof=8] v8::internal::Expression* label_
      [sizeof=8] v8::internal::Label body_target_
      [sizeof=8] v8::internal::ZoneList<v8::internal::Statement *>* statements_
      [sizeof=8] v8::internal::AstType* compare_type_
      [sizeof=4] v8::internal::FeedbackSlot feedback_slot_
      <padding> (4 bytes)
    }

After:
    class v8::internal::CaseClause [sizeof = 48]
      : public v8::internal::Expression {
      [sizeof=12] v8::internal::Expression
      [sizeof=4] v8::internal::FeedbackSlot feedback_slot_
      [sizeof=8] v8::internal::Expression* label_
      [sizeof=8] v8::internal::Label body_target_
      [sizeof=8] v8::internal::ZoneList<v8::internal::Statement *>* statements_
      [sizeof=8] v8::internal::AstType* compare_type_
    }

Before:
    class v8::internal::BinaryOperation [sizeof = 56]
      : public v8::internal::Expression {
      [sizeof=12] v8::internal::Expression
      [sizeof=1] bool has_fixed_right_arg_
      <padding> (3 bytes)
      [sizeof=4] int fixed_right_arg_value_
      <padding> (4 bytes)
      [sizeof=8] v8::internal::Expression* left_
      [sizeof=8] v8::internal::Expression* right_
      [sizeof=8] v8::internal::Handle<v8::internal::AllocationSite> allocation_site_
      [sizeof=4] v8::internal::FeedbackSlot feedback_slot_
      <padding> (4 bytes)
    }

After:
    class v8::internal::BinaryOperation [sizeof = 48]
      : public v8::internal::Expression {
      [sizeof=12] v8::internal::Expression
      [sizeof=4] v8::internal::FeedbackSlot feedback_slot_
      [sizeof=8] v8::internal::Expression* left_
      [sizeof=8] v8::internal::Expression* right_
      [sizeof=8] v8::internal::Handle<v8::internal::AllocationSite> allocation_site_
      [sizeof=1] bool has_fixed_right_arg_
      <padding> (3 bytes)
      [sizeof=4] int fixed_right_arg_value_
    }

Before:
    class v8::internal::CompareOperation [sizeof = 48]
      : public v8::internal::Expression {
      [sizeof=12] v8::internal::Expression
      <padding> (4 bytes)
      [sizeof=8] v8::internal::Expression* left_
      [sizeof=8] v8::internal::Expression* right_
      [sizeof=8] v8::internal::AstType* combined_type_
      [sizeof=4] v8::internal::FeedbackSlot feedback_slot_
      <padding> (4 bytes)
    }

After:
    class v8::internal::CompareOperation [sizeof = 40]
      : public v8::internal::Expression {
      [sizeof=12] v8::internal::Expression
      [sizeof=4] v8::internal::FeedbackSlot feedback_slot_
      [sizeof=8] v8::internal::Expression* left_
      [sizeof=8] v8::internal::Expression* right_
      [sizeof=8] v8::internal::AstType* combined_type_
    }

Before:
    class v8::internal::NativeFunctionLiteral [sizeof = 40]
      : public v8::internal::Expression {
      [sizeof=12] v8::internal::Expression
      <padding> (4 bytes)
      [sizeof=8] v8::internal::AstRawString* name_
      [sizeof=8] v8::Extension* extension_
      [sizeof=4] v8::internal::FeedbackSlot literal_feedback_slot_
      <padding> (4 bytes)
    }

After:
    class v8::internal::NativeFunctionLiteral [sizeof = 32]
      : public v8::internal::Expression {
      [sizeof=12] v8::internal::Expression
      [sizeof=4] v8::internal::FeedbackSlot literal_feedback_slot_
      [sizeof=8] v8::internal::AstRawString* name_
      [sizeof=8] v8::Extension* extension_
    }

BUG=chromium:710933

Review-Url: https://codereview.chromium.org/2843293003
Cr-Commit-Position: refs/heads/master@{#44989}

Only WASM has the notion of changing the maximum memory pages. This
CL corrects the UMA stats to only collect this data for WASM only.

BUG=v8:6321
R=bradnelson@chromium.org,bbudge@chromium.org

Review-Url: https://codereview.chromium.org/2845163002
Cr-Commit-Position: refs/heads/master@{#44988}

Bug:v8:6325

Change-Id: I8ab20111f53207178e4d17bfe5b55266d7c17916
Reviewed-on: https://chromium-review.googlesource.com/490306Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Franziska Hinkelmann <franzih@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44987}

Bug:v8:6325

Change-Id: I0c66d24994a4b6811c7aec80f4aa298ba6d209e4
Reviewed-on: https://chromium-review.googlesource.com/490366Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Franziska Hinkelmann <franzih@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44986}

1. Replaces --crankshaft with --opt in tests.
2. Also fixes presubmit to check for --opt flag when
assertOptimized is used.
3. Updates testrunner/local/variants.py and 
v8_foozie.py to use --opt flag.
This would mean, nooptimize variant means there are
no optimizations. Not even with %OptimizeFunctionOnNextCall.

Bug:v8:6325

Change-Id: I638e743d0773a6729c6b9749e2ca1e2537f12ce6
Reviewed-on: https://chromium-review.googlesource.com/490206
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44985}

Bug: v8:6325
Change-Id: I2f15a504690c334a43620bfd396a7fab10340b46
Reviewed-on: https://chromium-review.googlesource.com/489524Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44984}

BUG=v8:6325, v8:6330

Review-Url: https://codereview.chromium.org/2847953002
Cr-Commit-Position: refs/heads/master@{#44983}

... and stop checking that the native contexts of maps recorded in feedback vector
match function's native context - the feedback vector machinery already guarantees
that.

BUG=v8:6325

Change-Id: Iacd3f3a5f703694ff57b774b9658e186ad66641b
Reviewed-on: https://chromium-review.googlesource.com/490084Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44982}

Also-by:ahaas@chromium.org
R:ahaas@chromium.org
Bug:v8:6325

Change-Id: I5fc7891a2201ac9a889bceec668b23b46e402545
Reviewed-on: https://chromium-review.googlesource.com/490109Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Franziska Hinkelmann <franzih@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44981}

There's no point in using our own implemention of List for this.

Bug:v8:6325

Change-Id: Idf3399bbaaf50f9e1fc7b16c67ea2c6246dd6574
Reviewed-on: https://chromium-review.googlesource.com/489949Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Franziska Hinkelmann <franzih@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44980}

BUG=v8:6325,v8:5402

Change-Id: If0c975fe377c0178c488fc1bedd02f9c8289ebbc
Reviewed-on: https://chromium-review.googlesource.com/490086Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44979}

Also-by:ahaas@chromium.org
R:ahaas@chromium.org

Bug:v8:6325

Change-Id: If9212dc1d47789d0732b72b69532676907cb21ab
Reviewed-on: https://chromium-review.googlesource.com/490089Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Franziska Hinkelmann <franzih@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44978}

BUG=v8:6325

Review-Url: https://codereview.chromium.org/2849763004
Cr-Commit-Position: refs/heads/master@{#44977}

This avoids generating redundant code for different template
instantiations.
I also introduce getters instead of accessing the fields directly.

R=ahaas@chromium.org
BUG=v8:6325

Change-Id: I3e0eca9ef6a01e0a3ebb73f4f357bcb59e120f43
Reviewed-on: https://chromium-review.googlesource.com/490166Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44976}

BUG=chromium:716032

Review-Url: https://codereview.chromium.org/2842303003
Cr-Commit-Position: refs/heads/master@{#44975}

BUG=v8:6325

Review-Url: https://codereview.chromium.org/2851723002
Cr-Commit-Position: refs/heads/master@{#44974}

The bot is at its resource limits.

TBR=yangguo@chromium.org,jgruber@chromium.org
NOTRY=true

Change-Id: I40520aa7ec8a85a16cce2c9f17544d6fb68166bb
Reviewed-on: https://chromium-review.googlesource.com/490087Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44973}

It's only needed to pass error information from step 1 to step 1b, thus
pass it explicitly to step 1b.

R=ahaas@chromium.org, mtrofin@chromium.org

Change-Id: Icca5ef8f94dedad65e797a4fb5a4d83145b7dfbd
Reviewed-on: https://chromium-review.googlesource.com/489521
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44972}

TBR=bmeurer@chromium.org
NOTRY=true

Change-Id: Iceccd5660bf1d486dcdc60b7735fb1273d5718b6
Reviewed-on: https://chromium-review.googlesource.com/490107Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44971}

When a FunctionTemplate-based function is used as a constructor
and returns a JSProxy, we incorrectly treated that result the same
as a non-object result. Now it is treated like any other object
result, i.e., it becomes the result of the constructor call.

R=verwaest@chromium.org
BUG=v8:6294

Review-Url: https://codereview.chromium.org/2845123002
Cr-Commit-Position: refs/heads/master@{#44970}

BUG=chromium:715862

Change-Id: I072ad02ca3ff2fce67c05e0e27708da9763bec44
Reviewed-on: https://chromium-review.googlesource.com/490106Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44969}

Bug: v8:6328
TBR=yangguo@chromium.org,bmeurer@chromium.org
NOTRY=true

Change-Id: Id0b01292635598fa8578dc2e6aa28ef104bcd878
Reviewed-on: https://chromium-review.googlesource.com/489987Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44968}

Bug: v8:6325
Change-Id: I20f59cfd4f309f456ff95aa8eb0aa4c8f9a55da6
Reviewed-on: https://chromium-review.googlesource.com/490066Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44967}

This reduces the amount of special paths for testing.
Setup the memory used for testing exactly the same way as in real world.
Also, always connect the interpreter to the instance being executed,
and to the existing WasmInstance struct. This keeps information
synchronized between interpreter and test runner.
These changes allow us to execute e.g. GrowMemory from cctests either
in the interpreter or in compiled code.

R=ahaas@chromium.org

Change-Id: Id4726d061f3cdba789275350f500d769d27d2d63
Reviewed-on: https://chromium-review.googlesource.com/488561
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44966}

Make each compile phase a separate task. This allows us to store
additional information in each task instead of "globally" on the
AsyncCompileJob.
This CL only does the initial refactoring, without changing where data
is actually stored.

R=ahaas@chromium.org, mtrofin@chromium.org

Change-Id: Iad73de7b7d09f716c527e6d241314fde52aa55f8
Reviewed-on: https://chromium-review.googlesource.com/488142
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44965}

Also add support for JSFunction::prototype and JSString::length
accessors to CodeStubAssembler::CallGetterIfAccessor and remove
the special case hack from the LoadIC_Uninitialized.

Also address the TODO to unify the implementation with the
LoadIC_FunctionPrototype handler.

BUG=v8:5269,v8:6325
R=ishell@chromium.org

Change-Id: Ic51221e35a051c403d3a86dc41213c913e8f9d85
Reviewed-on: https://chromium-review.googlesource.com/489946
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44964}

BUG=v8:6316
R=jbroman@chromium.org,yangguo@chromium.org

Change-Id: Icfc33e3e51cdbfad246a971a5a2737a8fdfba058
Reviewed-on: https://chromium-review.googlesource.com/488941
Commit-Queue: Jochen Eisinger <jochen@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44963}

TBR=yangguo@chromium.org,ahaas@chromium.org
NOTRY=true

Change-Id: I1612d95a3782b23371b70d3a8fed600945988486
Reviewed-on: https://chromium-review.googlesource.com/489522Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44962}

Call ToObject on the GetPropertyStub input first, so that lookups on
Strings and other primitives don't automatically hit the runtime, i.e.
as the stub is also used to lookup the special @@split and @@replace
symbols for various String builtins.

BUG=v8:5269
R=ishell@chromium.org

Change-Id: I5dbbc84aa2051173bf10be71c782fbe448481034
Reviewed-on: https://chromium-review.googlesource.com/488441
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44961}

The bot is too slow in it's current configuration.

TBR=bmeurer@chromium.org
NOTRY=true

Change-Id: Ic0318894c4501e47f441c0298a46474afdc45026
Reviewed-on: https://chromium-review.googlesource.com/489502
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44960}

The spec requires that a null @@split / @@replace symbol is treated exactly the
same as if it were undefined, i.e. execution should move on to the default
implementation instead of throwing a TypeError.

BUG=v8:6313

Review-Url: https://codereview.chromium.org/2845153002
Cr-Commit-Position: refs/heads/master@{#44959}

Revert of [turbofan] General consolidation of element access. (patchset #1 id:1 of https://codereview.chromium.org/2836913004/ )

Reason for revert:
Breaks load:tools:drive story

Original issue's description:
> [turbofan] General consolidation of element access.
>
> Avoid TransitionElementsKind when storing to objects which only differ
> in holeyness of their elements kind. Instead go for polymorphic
> CheckMaps, which can often by optimized and avoid the mutation of the
> array map.
>
> This generalizes the approach https://codereview.chromium.org/2836943003
> which covered only element loads.
>
> R=yangguo@chromium.org
> BUG=v8:5267
>
> Review-Url: https://codereview.chromium.org/2836913004
> Cr-Commit-Position: refs/heads/master@{#44828}
> Committed: https://chromium.googlesource.com/v8/v8/+/ed573cee5c1d1e42158829dc0b92fb697234e121

TBR=yangguo@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=v8:5267,chromium:715936

Review-Url: https://codereview.chromium.org/2852623002
Cr-Commit-Position: refs/heads/master@{#44958}

When accessing JSArray::length property from GenericPropertyLoad
(i.e. via a megamorphic KEYED_LOAD_IC), we'd always go to the runtime
at this point, because the CallGetterIfAccessor method didn't support
AccessorInfos at all. Now there's initial support for JSArray::length,
which reduces the number of %KeyedGetProperty calls we see in the
Speedometer/EmberJS test by 5000.

Also-By: ishell@chromium.org
BUG=v8:5269
TBR=ishell@chromium.org

Review-Url: https://codereview.chromium.org/2842373005
Cr-Commit-Position: refs/heads/master@{#44957}