There are still spec compliance fixes to be made, but this patch
turns the flag to shipping to make sure we get more canary coverage
and performance data from the bots.

BUG=v8:4602
LOG=y

Review URL: https://codereview.chromium.org/1847103002

Cr-Commit-Position: refs/heads/master@{#35181}

Revert of Remove RegExp.prototype.source getter compat workaround (patchset #2 id:20001 of https://codereview.chromium.org/1837843002/ )

Reason for revert:
TC39 decided that this compatibility fix should be standardized.

Original issue's description:
> Remove RegExp.prototype.source getter compat workaround
>
> The getter RegExp.prototype.source is specified in ES2015 to throw when
> called on a non-RegExp instance, such as RegExp.prototype. We had previously
> put in a compatibility workaround for all RegExp getters to make them
> throw on access specifically with RegExp.prototype as the receiver; however,
> we only have evidence that this is needed for properties other than source.
> This patch removes the compatibility workaround for get RegExp.prototype.source
> and gives it semantics precisely as per the ES2015 specification.
>
> R=adamk
> BUG=chromium:581577,v8:4827
> LOG=Y
>
> Committed: https://crrev.com/80803aa89e31839b8f73959776fa7e1923c6b461
> Cr-Commit-Position: refs/heads/master@{#35086}

R=adamk@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=chromium:581577,v8:4827
LOG=Y

Review URL: https://codereview.chromium.org/1847783003

Cr-Commit-Position: refs/heads/master@{#35180}

Port f2a58593

Original commit message:
    Replace the uses with proper page flag lookups.

R=mlippautz@chromium.org, joransiu@ca.ibm.com, mbrandy@us.ibm.com, michael_dawson@ca.ibm.com
BUG=chromium:581412
LOG=N
TEST=mjsunit/allocation-site-info

Review URL: https://codereview.chromium.org/1848003002

Cr-Commit-Position: refs/heads/master@{#35179}

BUG=

Review URL: https://codereview.chromium.org/1848783003

Cr-Commit-Position: refs/heads/master@{#35178}

Port 53d51c52

Original commit message:
    Removed Frame::needs_frame and the function-wide logic using it in
    favor of FrameAccessState::has_frame, which can be set on a more
    granular level, and driving it block by block.

R=mtrofin@chromium.org, joransiu@ca.ibm.com, mbrandy@us.ibm.com, michael_dawson@ca.ibm.com, rmcilroy@chromium.org
BUG=v8:4533
LOG=N

Review URL: https://codereview.chromium.org/1848623003

Cr-Commit-Position: refs/heads/master@{#35177}

*) For all tests the input validation was incorrect, i.e. some values
were considered invalid although they were valid. The problem was that
values which are outside int range can get in range through truncation.

*) Removed an assertion in the x64 code generation of
TruncateFloat64ToUint32 which trapped on negative inputs.

*) Introduced a new TF operator TruncateFloat32ToUint32 which does
the same as ChangeFloat32ToUint32 but does not trap on negative inputs.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1843983002

Cr-Commit-Position: refs/heads/master@{#35176}

53d51c52 (frame elision).

Turns out it was the cause of the regression in the referenced bug.

BUG=599421
LOG=N

Review URL: https://codereview.chromium.org/1847073002

Cr-Commit-Position: refs/heads/master@{#35175}

This reduces the reserved virtual memory size needed for the store buffer.

BUG=chromium:578883
LOG=NO

Review URL: https://codereview.chromium.org/1851473002

Cr-Commit-Position: refs/heads/master@{#35174}

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1843123002

Cr-Commit-Position: refs/heads/master@{#35173}

Port f2a58593

Original commit message:
    Replace the uses with proper page flag lookups.

R=mlippautz@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=chromium:581412
LOG=N
TEST=mjsunit/allocation-site-info

Review URL: https://codereview.chromium.org/1845753005

Cr-Commit-Position: refs/heads/master@{#35172}

BUG=
LOG=no

Review URL: https://codereview.chromium.org/1845843003

Cr-Commit-Position: refs/heads/master@{#35171}

ARM specific CONFIG_KUSER_HELPERS kernel feature for Linux can be disabled,
and in this case, we shouldn't crash. Use a __sync_synchronize() call
instead for Linux platforms.

BUG=chromium:599051
LOG=Y

Review URL: https://codereview.chromium.org/1840203004

Cr-Commit-Position: refs/heads/master@{#35170}

R=hpayer@chromium.org
LOG=N
BUG=

Review URL: https://codereview.chromium.org/1836283007

Cr-Commit-Position: refs/heads/master@{#35169}

* Add csv output mode for spreadsheet pasting
* Add option to leave out top-level categories
* Deal with unknown categories

R=hpayer@chromium.org
LOG=N
BUG=
NOTRY=true

Review URL: https://codereview.chromium.org/1846983002

Cr-Commit-Position: refs/heads/master@{#35168}

port 40bdbef9

 Original commit message:
     Int64Mul is lowered to a new turbofan operator, Int32MulPair. The new
     operator takes 4 inputs an generates 2 outputs. The inputs are the low
     word of the left input, high word of the left input, the low word of the
     right input, and high word of the right input. The ouputs are the low
     and high word of the result of the multiplication.

R=titzer@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1849543003

Cr-Commit-Position: refs/heads/master@{#35167}

Port 53d51c52

Includes fixes required for embedded constant pools.

Original commit message:
    Removed Frame::needs_frame and the function-wide logic using it in
    favor of FrameAccessState::has_frame, which can be set on a more
    granular level, and driving it block by block.

R=mtrofin@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, rmcilroy@chromium.org
BUG=v8:4533
LOG=N

Review URL: https://codereview.chromium.org/1843273002

Cr-Commit-Position: refs/heads/master@{#35166}

R=machenbach@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1844313003

Cr-Commit-Position: refs/heads/master@{#35165}

Embedders that rely on unmodified wrappers to survive should pass the command-line flag --noscavenge_reclaim_unmodified_objects

BUG=4880
LOG=yes

Review URL: https://codereview.chromium.org/1839243005

Cr-Commit-Position: refs/heads/master@{#35164}

In the earlier implementation of GenerateDoubleToObject the context
is loaded from the parent's frame. rsi is clobbered because it is used
to store kHoleNan constnat. It is not always safe to peek at
the parents frame. Bytecode handlers have TypedFrame and the type of
frame is stored at FP + 1. GenerateDoubleToObject expects context
to be store at that place. In the current implementation rsi is pushed
onto the stack and is popped when exiting this function.

BUG=v8:4280,chromium:597565
LOG=N

Review URL: https://codereview.chromium.org/1848473002

Cr-Commit-Position: refs/heads/master@{#35163}

BUG=468240
LOG=no

Review URL: https://codereview.chromium.org/1815153002

Cr-Commit-Position: refs/heads/master@{#35162}

Fixes a stale DCHECK and a memory leak in tracing output.

LOG=N
BUG=v8:4280
TBR=rmcilroy@chromium.org

Review URL: https://codereview.chromium.org/1844023003

Cr-Commit-Position: refs/heads/master@{#35161}

Change x64 to use the external references like all other platforms.

BUG=chromium:581076
LOG=N

Review URL: https://codereview.chromium.org/1844283002

Cr-Commit-Position: refs/heads/master@{#35160}

R=yangguo@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1845473007

Cr-Commit-Position: refs/heads/master@{#35159}

We only use it to store the Stringify function to format
REPL output. This is overkill and introduces issues with
security tokens.

R=jochen@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1845833002

Cr-Commit-Position: refs/heads/master@{#35158}

BUG=

Review URL: https://codereview.chromium.org/1842743002

Cr-Commit-Position: refs/heads/master@{#35157}

R=ahaas@chromium.org, bradnelson@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1846613002

Cr-Commit-Position: refs/heads/master@{#35156}

BUG=

Review URL: https://codereview.chromium.org/1849613004

Cr-Commit-Position: refs/heads/master@{#35155}

Previously all code stubs (i.e. both platform and Crankshaft code stubs)
preserved the context register for full-codegen (neither Ignition, nor
TurboFan nor Crankshaft require this or would benefit from this), but
the newly introduced TurboFanCodeStubs no longer do this and there's no
need to, so we have to make sure in full-codegen that we restore the
context register after intrinsic calls, which potentially call
TurboFanCodeStubs.

Drive-by-fix: VisitThisFunction can be made platform independent.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/1848553002

Cr-Commit-Position: refs/heads/master@{#35154}

Replace the uses with proper page flag lookups.

BUG=chromium:581412
LOG=N
TEST=mjsunit/allocation-site-info

Review URL: https://codereview.chromium.org/1845463003

Cr-Commit-Position: refs/heads/master@{#35153}

It for now only deals with fast-mode smi and object arrays with smi
keys and internalized strings; and fast-mode named properties with an internalized key or symbol.

BUG=v8:2472
LOG=n

Review URL: https://codereview.chromium.org/1843613002

Cr-Commit-Position: refs/heads/master@{#35152}

Test case objects were sorted without key function, resulting
in random sort order. On sharded builds, the shards are
determined by the sort order and rely on a deterministic
sorting. This led to random cctest and unittest cases being
dropped or executed twice on sharded testers.

TBR=jkummerow@chromium.org, hablich@chromium.org

Review URL: https://codereview.chromium.org/1842673002

Cr-Commit-Position: refs/heads/master@{#35151}

Also protect builtin files with # NOSORT as the order is important here.

BUG=
R=machenbach@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1842043002

Cr-Commit-Position: refs/heads/master@{#35150}

BUG=v8:2999,v8:4751
LOG=n
NOTRY=true
TBR=hablich@chromium.org

Review URL: https://codereview.chromium.org/1850443004

Cr-Commit-Position: refs/heads/master@{#35149}

BUG=v8:4847
LOG=y

Review URL: https://codereview.chromium.org/1811283002

Cr-Commit-Position: refs/heads/master@{#35148}

If a script is unloaded between the collection of an allocation and the
tranlation of an allocation profile, the profiler will segfault. With
this change, we report unloaded scripts as having no line number,column
number, or name.

R=ofrobots@google.com
BUG=

Review URL: https://codereview.chromium.org/1846723002

Cr-Commit-Position: refs/heads/master@{#35147}

  port 40bdbef9 (r35131)

  original commit message:
  Int64Mul is lowered to a new turbofan operator, Int32MulPair. The new
  operator takes 4 inputs an generates 2 outputs. The inputs are the low
  word of the left input, high word of the left input, the low word of the
  right input, and high word of the right input. The ouputs are the low
  and high word of the result of the multiplication.

BUG=

Review URL: https://codereview.chromium.org/1845183002

Cr-Commit-Position: refs/heads/master@{#35146}

R=bmeurer@chromium.org, cbruni@chromium.org, ulan@chromium.org
BUG=chromium:124206,chromium:569811
LOG=N

Review URL: https://codereview.chromium.org/1834633003

Cr-Commit-Position: refs/heads/master@{#35145}

Rolling v8/third_party/android_tools to adfd31794011488cd0fc716b53558b2d8a67af8b

Rolling v8/third_party/icu to 628d39f5b088236d2021bf4388549fd92673ff1a

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1847623003

Cr-Commit-Position: refs/heads/master@{#35144}

Port 40bdbef9

Original commit message:
    Int64Mul is lowered to a new turbofan operator, Int32MulPair. The new
    operator takes 4 inputs an generates 2 outputs. The inputs are the low
    word of the left input, high word of the left input, the low word of the
    right input, and high word of the right input. The ouputs are the low
    and high word of the result of the multiplication.

R=ahaas@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1847563003

Cr-Commit-Position: refs/heads/master@{#35143}

Properly implement Rotate Right sequence for S390, to use the 64-bit
RLLG instruction.

R=jyan@ca.ibm.com,michael_dawson@ca.ibm.com,mbrandy@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1842093003

Cr-Commit-Position: refs/heads/master@{#35142}