BUG=v8:7308

Change-Id: Ib3926bfa22b8639d84374cf423d26d6362e3f46e
Reviewed-on: https://chromium-review.googlesource.com/1019141
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52694}

The heuristic is no longer needed now that we have concurrent marking.

Bug: chromium:834371
Change-Id: I8ca3eaacdab618f690d8007aff66713260ace19f
Reviewed-on: https://chromium-review.googlesource.com/1017123Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52693}

These functions are now unused within V8, as we need tighter control in
mksnapshot for creating embedded.cc.

Embedders should switch to using SnapshotCreator directly.

Bug: v8:6666
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: Id231b3d1fdf50e06c9278f13d095186364264b86
Reviewed-on: https://chromium-review.googlesource.com/1019442Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52692}

The handling of wasm breakpoints was prone to forget previously set
breakpoints when inserting new ones. In particular, adding breakpoints
in reverse order or adding more than 4 breakpoints would fail.

Change-Id: I94f314e86bdf9b53a4170ce1b6b47339b7cb7848
Reviewed-on: https://chromium-review.googlesource.com/1019302Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Stephan Herhut <herhut@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52691}

ScavengeExternalString and ScavengeExternalOneByteString clear GC flags,
which confuses concurrent sweeping that was started from another test.

Tests that mutate flags should not be threaded.

Bug: v8:7671
Change-Id: I08656d06fe85ff45baca685ebe5982528aad774c
Reviewed-on: https://chromium-review.googlesource.com/1019102Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52690}

This is a reland of 6c68efac

Updated Heap::CommittedMemory and related functions to iterate over all
spaces rather than including them manually which can lead to a space
being overlooked. Also adds a test to ensure this the case.

Original change's description:
> Revert "Reland "[heap] Move initial objects into RO_SPACE""
>
> This reverts commit 6c68efac.
>
> Reason for revert: https://bugs.chromium.org/p/v8/issues/detail?id=7668
>
> Original change's description:
> > Reland "[heap] Move initial objects into RO_SPACE"
> >
> > This is a reland of f8ae62fe
> >
> > Original change's description:
> > > [heap] Move initial objects into RO_SPACE
> > >
> > > This moves:
> > > * the main oddballs (null, undefined, hole, true, false) as well as
> > > their supporting maps (also adds hole as an internalized string to make
> > > this work).
> > > * most of the internalized strings
> > > * the struct maps
> > > * empty array
> > > * empty enum cache
> > > * the contents of the initial string table
> > > * the weak_cell_cache for any map in RO_SPACE (and eagerly creates the
> > > value avoid writing to it during run-time)
> > >
> > > The StartupSerializer stats change as follows:
> > >
> > >      RO_SPACE  NEW_SPACE  OLD_SPACE  CODE_SPACE  MAP_SPACE  LO_SPACE
> > > old         0          0     270264       32608      12144         0
> > > new     21776          0     253168       32608       8184         0
> > > Overall memory usage has increased by 720 bytes due to the eager
> > > initialization of the Map weak cell caches.
> > >
> > > Also extends --serialization-statistics to print out separate instance
> > > type stats for objects in RO_SPACE as shown here:
> > >
> > >   Read Only Instance types (count and bytes):
> > >        404      16736  ONE_BYTE_INTERNALIZED_STRING_TYPE
> > >          2         32  HEAP_NUMBER_TYPE
> > >          5        240  ODDBALL_TYPE
> > >         45       3960  MAP_TYPE
> > >          1         16  BYTE_ARRAY_TYPE
> > >          1         24  TUPLE2_TYPE
> > >          1         16  FIXED_ARRAY_TYPE
> > >          1         32  DESCRIPTOR_ARRAY_TYPE
> > >         45        720  WEAK_CELL_TYPE
> > >
> > > Bug: v8:7464
> > > Change-Id: I12981c39c82a7057f68bbbe03f89fb57b0b4c6a6
> > > Reviewed-on: https://chromium-review.googlesource.com/973722
> > > Commit-Queue: Dan Elphick <delphick@chromium.org>
> > > Reviewed-by: Hannes Payer <hpayer@chromium.org>
> > > Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> > > Reviewed-by: Yang Guo <yangguo@chromium.org>
> > > Cr-Commit-Position: refs/heads/master@{#52435}
> >
> > Bug: v8:7464
> > Change-Id: I50427edfeb53ca80ec4cf46566368fb2213ccf7b
> > Reviewed-on: https://chromium-review.googlesource.com/999654
> > Commit-Queue: Dan Elphick <delphick@chromium.org>
> > Reviewed-by: Yang Guo <yangguo@chromium.org>
> > Reviewed-by: Hannes Payer <hpayer@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#52638}
>
> TBR=rmcilroy@chromium.org,yangguo@chromium.org,hpayer@chromium.org,mlippautz@chromium.org,delphick@chromium.org
>
> # Not skipping CQ checks because original CL landed > 1 day ago.
>
> Bug: v8:7464,v8:7668
> Change-Id: I10aa03623b51e997f95a3715ea9f0bf5d29d2cdb
> Reviewed-on: https://chromium-review.googlesource.com/1016600
> Commit-Queue: Peter Marshall <petermarshall@chromium.org>
> Reviewed-by: Peter Marshall <petermarshall@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52667}

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: If4b7490c8c4d31612de8ec132de334955a319b11
Bug: v8:7464, v8:7668
Reviewed-on: https://chromium-review.googlesource.com/1019020Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52689}

This problem was discovered by mvstanton@'s forEach Torque patch. In the absense
of test coverage for Torque, his patch will serve as the regression test case
for this bug when it lands.

Change-Id: Ic77446a8e46168928da221e6eb18753dd6478c87
Reviewed-on: https://chromium-review.googlesource.com/1018763Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Daniel Clifford <danno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52688}

Complete ptest and add vptest
Add Pcmpeqb, Pcmpeqw, Ptest macro

Change-Id: I060aa5228d50f2dca7ed3e24324a08c04ec1a028
Reviewed-on: https://chromium-review.googlesource.com/1013236Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Jing Bao <jing.bao@intel.com>
Cr-Commit-Position: refs/heads/master@{#52687}

Module names in torque are allowed to have underscores but not dashes.
To stay consistent with C++ file naming conventions, the underscores
in module names are replaced by dashes for file names.

Example:

module typed_array {} would now generate:
builtins-typed-array-from-dsl-gen.(cc|h)

instead of:
builtins-typed_array-from-dsl-gen.(cc|h)

R=danno@chromium.org

Change-Id: Iff42d7b9b5f65c378ee30f9d884ab6a3a3cd42a7
Reviewed-on: https://chromium-review.googlesource.com/1016460Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Daniel Clifford <danno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52686}

'ref' builds might not yet have BigInt support. Instead of crashing
when the benchmark file is loaded, the benchmark now fails during
setup.

R=jgruber@chromium.org

Bug: chromium:834654
Change-Id: I2c03aeba4b6af947061504c369b5228d7b344307
Reviewed-on: https://chromium-review.googlesource.com/1019100
Commit-Queue: Simon Zünd <szuend@google.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52685}

This refactoring is a big step towards separating Turbofan-related code
from backend independent code. This will allow us to include way less
headers from "src/compiler" at various places.

The {WasmCompilationUnit} contained information for Turbofan
compilation, and for Liftoff compilation. This CL tears this apart, such
that {WasmCompilationUnit} holds backend-independent information, plus
a pointer to either {LiftoffCompilationUnit} or
{TurbofanWasmCompilationUnit}. These pointers are opaque, so that
{function-compiler.h}, defining {WasmCompilationUnit}, does not need to
include any Turbofan specific or Liftoff specific headers.

R=ahaas@chromium.org, titzer@chromium.org, mstarzinger@chromium.org

Bug: v8:7570, v8:6600
Change-Id: I024c9a23508ee1b4b3cbe1d068c8e785d732daca
Reviewed-on: https://chromium-review.googlesource.com/1016640
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52684}

Since movf and movt instructions were removed in r6, sel_s and
sel_d instructions need to be used instead with some preparations.

Change-Id: Ia6a2fda7d3d79ada1ae1ec4649793efd2466f79b
Reviewed-on: https://chromium-review.googlesource.com/1016910Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Commit-Queue: Sreten Kovacevic <sreten.kovacevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#52683}

This reverts commit 9d0154d6.

Reason for revert: gc stress breakage, prob this commit is broken.

Original change's description:
> [heap] Verify FeedbackVector contents during heap verification.
> 
> Pre-work for in-place weak refs.
> 
> BUG=v8:7308
> 
> Change-Id: I5c7086bded14879f62ab366d0aba59302f0078d3
> Reviewed-on: https://chromium-review.googlesource.com/1010069
> Commit-Queue: Marja Hölttä <marja@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Michael Stanton <mvstanton@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52681}

TBR=marja@chromium.org,yangguo@chromium.org,mvstanton@chromium.org,ishell@chromium.org

Change-Id: I7d95e375e06db186f0e9823cb080ce15d1e1062d
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7308
Reviewed-on: https://chromium-review.googlesource.com/1019180Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52682}

Pre-work for in-place weak refs.

BUG=v8:7308

Change-Id: I5c7086bded14879f62ab366d0aba59302f0078d3
Reviewed-on: https://chromium-review.googlesource.com/1010069
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52681}

This also adds a javascript operator JSCreateObject and an
associated TFS stub that handles Object.create in cases
where only a prototype, but no additional properties are
provided.

Bug: v8:7250
Change-Id: Ib1fd529a10a553c3718222356319bd6ccffbdf30
Reviewed-on: https://chromium-review.googlesource.com/1013576
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52680}

This reverts commit f52b4b3b.

Reason for revert: Makes benchmarks time out:
https://crbug.com/834655

Original change's description:
> [compiler] Temporarily turn some DCHECKs into CHECKs.
> 
> This turns most DCHECKs in the register allocator code into CHECKs,
> which hopefully will tell us more about the crashes in crbug 831822.
> 
> This CL will eventually be reverted again.
> 
> Bug: chromium:831822
> Change-Id: I123ed507949ecab50bb0aaaf9e91978c9c2d8d65
> Reviewed-on: https://chromium-review.googlesource.com/1016762
> Commit-Queue: Georg Neis <neis@chromium.org>
> Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52673}

TBR=neis@chromium.org,sigurds@chromium.org

Change-Id: Ic2b37a3ce04516c5871b801015153ce84e622e90
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:831822
Reviewed-on: https://chromium-review.googlesource.com/1018860Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52679}

This is a reland of 9a19ce25

Original change's description:
> [profiler] Ensure there's a single ProfilerListener per isolate.
> 
> BUG=v8:7662
> 
> Change-Id: I8128ac96bcd2dc01b318c55843c4416bdd17c7ae
> Reviewed-on: https://chromium-review.googlesource.com/1013318
> Commit-Queue: Alexei Filippov <alph@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52653}

Bug: v8:7662
Change-Id: I28c5e693290057ad2bc90161c82419fb109ef1ae
Reviewed-on: https://chromium-review.googlesource.com/1015747Reviewed-by: Alexei Filippov <alph@chromium.org>
Commit-Queue: Alexei Filippov <alph@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52678}

Since external strings are used for things like source strings, we
should tenure them from creation.

Change-Id: I226ab9036836d76d8c17ed168ad97d7f0f824278
Reviewed-on: https://chromium-review.googlesource.com/1006961
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52677}

The Cvtqui2ss and Cvtqui2sd methods did overwrite the {src} register and
the given {tmp} register.
This CL fixes this to avoid the overwrite of the {src} register, and to
use the kScratchRegister instead of an explicitly passed tmp register.
It also adds u32 -> f32/f64 conversions.
All these methods can take either a register or an operand as src. This
sometimes saves a mov operation.

R=neis@chromium.org, ahaas@chromium.org

Change-Id: I912a2a3b9d9c356f04ce51869a01c6fd11c76dd3
Reviewed-on: https://chromium-review.googlesource.com/1017121Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52676}

Bug: v8:7659
Change-Id: Ib4a44eef02398482a969084f5004d6096e1fd979
Reviewed-on: https://chromium-review.googlesource.com/1017100Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52675}

Calls to madvise(MADV_FREE_REUSABLE) [when discarding/decommitting memory]
should be paired with calls to madvise(MADV_FREE_REUSE) [when reusing/committing
memory]. The latter is purely for accounting purposes.

Bug: chromium:823915
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: Ib1758fd72c5ad4dfe731f5d9a6dbaf75b1e0e14b
Reviewed-on: https://chromium-review.googlesource.com/988193
Commit-Queue: Erik Chen <erikchen@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52674}

This turns most DCHECKs in the register allocator code into CHECKs,
which hopefully will tell us more about the crashes in crbug 831822.

This CL will eventually be reverted again.

Bug: chromium:831822
Change-Id: I123ed507949ecab50bb0aaaf9e91978c9c2d8d65
Reviewed-on: https://chromium-review.googlesource.com/1016762
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52673}

BUG=v8:7308

Change-Id: I1976cd7e542a0304f6e14744e634c62dd06a83f5
Reviewed-on: https://chromium-review.googlesource.com/1014090
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52672}

Previously when we put offsets into the SourcePositionTable, we added
the header size of the code object as well. When we pull the positions
out of the table (see ProfileGenerator::RecordTickSample) we already
account for the header size. This means the offsets in the table should
just be the offset of the PC within the actual code, not the offset
within the code object, which is what we currently store.

Currently this bug is probably not very noticeable, as it causes the
reported line numbers to be slightly too low, but still within the same
function. For a sampling profiler, we don't have any way to confirm
which lines were actually sampled, so we don't notice that the results
are wrong. The only way to see this bug is that there are some lines
within a function (towards the end of the function) that we will never
see ticks inside of, because the offset in the position table is not
reachable with valid PC offsets.

This CL removes the header size offset from values put into the source
position table stored by the profiler.

Bug: v8:7018
Change-Id: I00b17cec5f9c81d993d4e64c3c021052745a791e
Reviewed-on: https://chromium-review.googlesource.com/1016560Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52671}

Minidumps could potentially contain sensitive information, so we
shouldn't be serving them to the world.

R=machenbach@chromium.org

Change-Id: Idb7a3c07c160e82d707a4abb857e098363da3345
Reviewed-on: https://chromium-review.googlesource.com/1015802Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52670}

Release 6 FP branch instruction contain branch delay slots
so we can reenable them.

Change-Id: I793b6acbcfd73f92c7e94ba99608616cc8d68199
Reviewed-on: https://chromium-review.googlesource.com/1016282Reviewed-by: Sreten Kovacevic <sreten.kovacevic@mips.com>
Commit-Queue: Sreten Kovacevic <sreten.kovacevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#52669}

This CL adds sort benchmarks for BigUint64Array and BigInt64Array.
They form their own benchmark group separate from the Int and
Float types/element kinds.

R=jgruber@chromium.org

Bug: v8:7382
Change-Id: Id3ce125be36a42c419a2632edc5f930547a1720e
Reviewed-on: https://chromium-review.googlesource.com/1016643Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Simon Zünd <szuend@google.com>
Cr-Commit-Position: refs/heads/master@{#52668}

This reverts commit 6c68efac.

Reason for revert: https://bugs.chromium.org/p/v8/issues/detail?id=7668

Original change's description:
> Reland "[heap] Move initial objects into RO_SPACE"
>
> This is a reland of f8ae62fe
>
> Original change's description:
> > [heap] Move initial objects into RO_SPACE
> >
> > This moves:
> > * the main oddballs (null, undefined, hole, true, false) as well as
> > their supporting maps (also adds hole as an internalized string to make
> > this work).
> > * most of the internalized strings
> > * the struct maps
> > * empty array
> > * empty enum cache
> > * the contents of the initial string table
> > * the weak_cell_cache for any map in RO_SPACE (and eagerly creates the
> > value avoid writing to it during run-time)
> >
> > The StartupSerializer stats change as follows:
> >
> >      RO_SPACE  NEW_SPACE  OLD_SPACE  CODE_SPACE  MAP_SPACE  LO_SPACE
> > old         0          0     270264       32608      12144         0
> > new     21776          0     253168       32608       8184         0
> > Overall memory usage has increased by 720 bytes due to the eager
> > initialization of the Map weak cell caches.
> >
> > Also extends --serialization-statistics to print out separate instance
> > type stats for objects in RO_SPACE as shown here:
> >
> >   Read Only Instance types (count and bytes):
> >        404      16736  ONE_BYTE_INTERNALIZED_STRING_TYPE
> >          2         32  HEAP_NUMBER_TYPE
> >          5        240  ODDBALL_TYPE
> >         45       3960  MAP_TYPE
> >          1         16  BYTE_ARRAY_TYPE
> >          1         24  TUPLE2_TYPE
> >          1         16  FIXED_ARRAY_TYPE
> >          1         32  DESCRIPTOR_ARRAY_TYPE
> >         45        720  WEAK_CELL_TYPE
> >
> > Bug: v8:7464
> > Change-Id: I12981c39c82a7057f68bbbe03f89fb57b0b4c6a6
> > Reviewed-on: https://chromium-review.googlesource.com/973722
> > Commit-Queue: Dan Elphick <delphick@chromium.org>
> > Reviewed-by: Hannes Payer <hpayer@chromium.org>
> > Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> > Reviewed-by: Yang Guo <yangguo@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#52435}
>
> Bug: v8:7464
> Change-Id: I50427edfeb53ca80ec4cf46566368fb2213ccf7b
> Reviewed-on: https://chromium-review.googlesource.com/999654
> Commit-Queue: Dan Elphick <delphick@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Reviewed-by: Hannes Payer <hpayer@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52638}

TBR=rmcilroy@chromium.org,yangguo@chromium.org,hpayer@chromium.org,mlippautz@chromium.org,delphick@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:7464,v8:7668
Change-Id: I10aa03623b51e997f95a3715ea9f0bf5d29d2cdb
Reviewed-on: https://chromium-review.googlesource.com/1016600
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52667}

The escaped double quote is needed for calling CSA macros that expect
const char* (so the double quotes are preserved).

Example:

type MethodName;
const kProtoSort: MethodName = '\"%TypedArray%.prototype.sort\"';
extern macro ValidateTypedArray(Context, Object, MethodName): JSTypedArray;

R=danno@chromium.org

Bug: v8:7382
Change-Id: Ida554f7d2638fda2c9e1ace9975c3744b5d84050
Reviewed-on: https://chromium-review.googlesource.com/1016400Reviewed-by: Daniel Clifford <danno@chromium.org>
Commit-Queue: Simon Zünd <szuend@google.com>
Cr-Commit-Position: refs/heads/master@{#52666}

This is a reland of 4d7ad46d

Original change's description:
> Introduce CodeReference
>
> Add a struct CodeReference that can be stack allocated to pass a
> reference to either an on-heap code object or off-heap WasmCode object
> in a gc safe manner. The struct also provides a common interface such
> that code can be written independently of the kind of code object it
> references.
>
> Change-Id: I5a6f74462e6e141d167c7fd9bac8c21941fd83b1
> Reviewed-on: https://chromium-review.googlesource.com/977905
> Commit-Queue: Stephan Herhut <herhut@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52580}

Change-Id: I40861474fe4a3efd72e6c59e2e7b847ab6772735
Reviewed-on: https://chromium-review.googlesource.com/1013939
Commit-Queue: Stephan Herhut <herhut@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52665}

Change-Id: Ic942391ba5eca97f09bb5f9b89aef0630094c77c
Reviewed-on: https://chromium-review.googlesource.com/1015100Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52664}

The framestate is necessary, because the PerformPromiseThen builtin
calls into the runtime function PromiseRevokeReject, which ultimately
calls back into the embedder. Node may execute JavaScript in the callback,
and the missing framestate can then make our stack frame walker unhappy.

Bug: v8:7659
Change-Id: I47391fd2b9b3c10ef26204a41e58f8082243c702
Reviewed-on: https://chromium-review.googlesource.com/1015361Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52663}

This implement float to i32/u32 conversions on ia32 and x64.

R=ahaas@chromium.org

Bug: v8:6600
Change-Id: I4eb6a74d86fafce3245bf3f37d32ac6ca156550a
Reviewed-on: https://chromium-review.googlesource.com/1014123Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52662}

This change is in preparation for implementing TypedArray builtins
in torque. Torque makes assumptions about naming conventions regarding
file and class names, which are currently inconsistent for TypedArrays.
The class is called TypedArrayBuiltinsAssembler while the current file
name suggests Typedarray... .

R=jgruber@chromium.org

Bug: v8:7382
Change-Id: I3051dacb2bfbb7041482c8aa0a1104776ab4972c
Reviewed-on: https://chromium-review.googlesource.com/1016300Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Simon Zünd <szuend@google.com>
Cr-Commit-Position: refs/heads/master@{#52661}

In ArrayBuiltinsAssembler::VisitAllFastElementsOneKind(), we enumerate
an arrays elements, carefully checking for the "hole" when required.
This code is only called for arrays whose prototype is the initial array
prototype. And the path is only available when the initial array
prototype is free of elements. Since that's the case, we only need to
verify that the initial array prototype remains free of elements during
an iteration with javascript callbacks. We don't need a body of code
that can walk the prototype chain looking for elements visible through
the "hole" value. In practice, this code was never run.

Change-Id: Iba5e275c559d495aa1cf6a4f29d66e2ce475c981
Reviewed-on: https://chromium-review.googlesource.com/1015023
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52660}

NOTRY=true
TBR=sergiyb@chromium.org

Bug: chromium:830557
Change-Id: I61510297e5195eb74425c71e41c4d95f080a280d
Reviewed-on: https://chromium-review.googlesource.com/1016420Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52659}

This is also pre-work for in-place weak refs.

BUG=v8:7308, v8:5988

Change-Id: Ie78b0c59695c1e6af9780fffb363c931e2ee34e2
Reviewed-on: https://chromium-review.googlesource.com/1013583
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52658}

Prepares for: https://crrev.com/c/1015000

NOTRY=true

Bug: chromium:830557
Change-Id: I51c12867d95de19350e0e55aaf097bbb479348dc
Reviewed-on: https://chromium-review.googlesource.com/1015004
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52657}

Each builder now uses a dict to specify tests with a 'tests' key. This
will allow adding other builder-specific keys in follow ups.

Prepared on infra side by:
https://crrev.com/c/1013713

Bug: chromium:830557
Change-Id: I1dd799cdfcc029ab22de813b7869abe982047e0f
Reviewed-on: https://chromium-review.googlesource.com/1013979Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52656}

There are various situations where we explicitly compare a SMI against
another SMI (e.g., BuildIndexedJump). This is also a common pattern for
generated code (e.g., comparing a loop variable with an integer). Instead
of using the generic equality/strict-equality stub for this, which is
expensive, this CL offers a simple comparison stub, repurposing the
TestEqualStrictNoFeedback bytecode to TestReferenceEqual

Bug: v8:5310
Change-Id: Ib2b47cd24d5386cf0d20d3bd794776dc6e3a02a5
Reviewed-on: https://chromium-review.googlesource.com/1007542Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Christian O. Andersson <cricke@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52655}