Instead of iterating the whole map space to find dead transitions,
look in weak cell list and transition array list.

Simple transitions are in the weak cell list.

Full transitions are in the transitions array list.

BUG=chromium:554488
LOG=NO

Review URL: https://codereview.chromium.org/1488593003

Cr-Commit-Position: refs/heads/master@{#32684}

NOTRY=true
TBR=rmcilroy, Hablich

Review URL: https://codereview.chromium.org/1510003002

Cr-Commit-Position: refs/heads/master@{#32683}

BUG=v8:3983
LOG=N
R=wingo@igalia.com, littledan@chromium.org

Review URL: https://codereview.chromium.org/1437803004

Cr-Commit-Position: refs/heads/master@{#32682}

R=jkummerow@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1506953003

Cr-Commit-Position: refs/heads/master@{#32681}

BUG=

Review URL: https://codereview.chromium.org/1501413005

Cr-Commit-Position: refs/heads/master@{#32680}

This was introduced due to a false positive by the linter script. We
have blacklisted the "build/include_what_you_use" linter bucket in our
presubmit.py wrapper for that reason.

R=jochen@chromium.org

Review URL: https://codereview.chromium.org/1509843002

Cr-Commit-Position: refs/heads/master@{#32679}

BUG=v8:4134
R=vogelheim@chromium.org
LOG=n
NOTRY=true
NOPRESUBMIT=true

Review URL: https://codereview.chromium.org/1505173002

Cr-Commit-Position: refs/heads/master@{#32678}

BUG=v8:4134
R=vogelheim@chromium.org
LOG=n
NOTRY=true
NOPRESUBMIT=true

Review URL: https://codereview.chromium.org/1504093003

Cr-Commit-Position: refs/heads/master@{#32677}

BUG=v8:4341
R=vogelheim@chromium.org
LOG=y
NOTRY=true
NOPRESUBMIT=true

Review URL: https://codereview.chromium.org/1502353004

Cr-Commit-Position: refs/heads/master@{#32676}

BUG=v8:1543
LOG=N

Review URL: https://codereview.chromium.org/1499593003

Cr-Commit-Position: refs/heads/master@{#32675}

NOTRY=true
NOTREECHECKS=true
NOPRESUBMIT=true

Review URL: https://codereview.chromium.org/1502143005

Cr-Commit-Position: refs/heads/master@{#32674}

Use %DeleteProperty_Strict instead.

Review URL: https://codereview.chromium.org/1508743002

Cr-Commit-Position: refs/heads/master@{#32673}

Rolling v8/build/gyp to 70ee80e82bacf2d7816a56f792bb33587b04c338

Rolling v8/tools/clang to 247bb6833987bc73051243230a1f3c949a9c9b92

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1509093002

Cr-Commit-Position: refs/heads/master@{#32672}

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1508653002

Cr-Commit-Position: refs/heads/master@{#32671}

The Promise::Chain logic is moved to a helper function to avoid
a violation of deprecated function usage.

R=rossberg,jochen
BUG=v8:3237
LOG=Y

Review URL: https://codereview.chromium.org/1477023002

Cr-Commit-Position: refs/heads/master@{#32670}

ECMAScript dates act as if the Gregorian changeover happened at the
beginning of time. This patch fixes up internationalized date
formatting to set that changeover properly, as opposed to the ICU
default which is in the 16th century.

BUG=chromium:537382
R=adamk,cira
LOG=Y

Review URL: https://codereview.chromium.org/1501113002

Cr-Commit-Position: refs/heads/master@{#32669}

TEST=unittests/InstructionSlectorTest.CombineChangeFloat64ToInt32WithRoundFloat64
BUG=

Review URL: https://codereview.chromium.org/1510493002

Cr-Commit-Position: refs/heads/master@{#32668}

Fix some minor issues that the linter is complaining about

R=jochen

Review URL: https://codereview.chromium.org/1507823002

Cr-Commit-Position: refs/heads/master@{#32667}

Deoptimization expects the context and function marker on the stack.
To let the register allocator control spilling of the live ranges
corresponding to these 2 operands, we need their use to be represented
accurately.

BUG= v8:4533
LOG=N

Review URL: https://codereview.chromium.org/1506903002

Cr-Commit-Position: refs/heads/master@{#32666}

Port 0ed08780

Original commit message:
    There's no reason to limit the CompareIC to (known) JSObject instances,
    as all JSReceivers behave the same wrt. abstract and strict equality.
    So remove this historical limitation and track JSReceivers instead.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1506903003

Cr-Commit-Position: refs/heads/master@{#32665}

Port 95844d94

Original commit message:
The new operator provides a second output which indicates whether the
conversion from float64 to int64 was successful or not. The second
output returns 0 if the conversion fails. If the conversion succeeds,
then the second output is differs from 0.

The second output can be ignored, which means that the operator can be
used the same way as the original operator.

I implemented the new operator on x64 and arm64. @v8-mips-ports and
@v8-ppc-ports, can you please take care of the mips64 and ppc64
implementation of the second output?

BUG=
TEST=cctest/test-run-machops/RunTryTruncateFloat64ToInt64WithCheck

Review URL: https://codereview.chromium.org/1503173002

Cr-Commit-Position: refs/heads/master@{#32664}

BUG=v8:811
LOG=N
R=adamk@chromium.org

Review URL: https://codereview.chromium.org/1504553003

Cr-Commit-Position: refs/heads/master@{#32663}

Error still to be done, since that's not yet available in the bootstrapper.

BUG=v8:3900, v8:3931, v8:1543, v8:3330
LOG=n

Review URL: https://codereview.chromium.org/1499923002

Cr-Commit-Position: refs/heads/master@{#32662}

Fixes code size multiplier of Arm64 based on generated code size of Octane.

Review URL: https://codereview.chromium.org/1504023002

Cr-Commit-Position: refs/heads/master@{#32661}

R=rossberg
BUG=

Review URL: https://codereview.chromium.org/1502983002

Cr-Commit-Position: refs/heads/master@{#32660}

BUG=v8:4134
R=vogelheim@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1502193002

Cr-Commit-Position: refs/heads/master@{#32659}

Reviving/redoing littledan's previous CL.

R=nikolaos@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1504833002

Cr-Commit-Position: refs/heads/master@{#32658}

This adds a runtime flag that controls whether the WASM object is
exposed to JavaScript. While currently guarded by the V8_WASM build-time
flag, after landing in V8 the build-time flag will be removed, leaving
only this new runtime flag.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1507623002

Cr-Commit-Position: refs/heads/master@{#32657}

This patch improves escape analysis and fixes bugs
triggered by clusterfuzz. Impovements include:
* Handling of LoadElement/StoreElement if index is a
  constant
* Handling of JSStoreProperty: invalidate all information,
  as the store could have altered any field.
* Treat phis that use an allocation as escaping
* Improve resolution of replacements

R=mstarzinger@chromium.org
BUG=v8:4586
LOG=n

Review URL: https://codereview.chromium.org/1499143002

Cr-Commit-Position: refs/heads/master@{#32656}

R=adamk@chromium.org, mstarzinger@chromium.org, yangguo@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1477093003

Cr-Commit-Position: refs/heads/master@{#32655}

This makes the strong link from optimized code to code objects for all
inlined functions explicit. It adds direct references to code objects
into deoptimization data as literals. Note that this is not necessarily
the code that will be deoptimized to, because the code on the shared
function info might be replaced by other components (e.g. debugger).
Those replacement code objects however are all non-flushable, marking
explicit strong links for reachability unnecessary.

R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/1490233009

Cr-Commit-Position: refs/heads/master@{#32654}

The new operator provides a second output which indicates whether the
conversion from float64 to int64 was successful or not. The second
output returns 0 if the conversion fails. If the conversion succeeds,
then the second output is differs from 0.

The second output can be ignored, which means that the operator can be
used the same way as the original operator.

I implemented the new operator on x64 and arm64. @v8-mips-ports and
@v8-ppc-ports, can you please take care of the mips64 and ppc64
implementation of the second output?

R=titzer@chromium.org, v8-arm-ports@googlegroups.com

Review URL: https://codereview.chromium.org/1495213003

Cr-Commit-Position: refs/heads/master@{#32653}

The JSInliningHeuristic keeps a list of nodes, which might have been
killed by other reducers before the JSInliningHeuristic looks at it
again, so it has to check whether nodes are dead before trying to
expand them later (this is similar to what the ValueNumberingReducer
needs to do with its internal table).

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1508643002

Cr-Commit-Position: refs/heads/master@{#32652}

- Add JSReceiver::SetIntegrityLevel, with a fast path for regular objects.
- Make Object.{freeze,seal} call this via %Object{Freeze,Seal}, thus no longer
  using broken or deprecated functions from v8natives.js.
- Add JSReceiver::OwnPropertyKeys convenience function.
- Reenable harmony/proxies-hash.js test.

R=rossberg
BUG=v8:1543
LOG=N

Review URL: https://codereview.chromium.org/1489423002

Cr-Commit-Position: refs/heads/master@{#32651}

Also delete a bunch of dead code from src/js/.

Review URL: https://codereview.chromium.org/1502593002

Cr-Commit-Position: refs/heads/master@{#32650}

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1500413002

Cr-Commit-Position: refs/heads/master@{#32649}

  port 086d4598 (r32644)

  original commit message:
  The backing store is only held alive indirectly via the array buffer
  referenced by the holder (typed array), so it's not enough to keep the
  elements alive (or even just the external pointer loaded from the
  elements).

BUG=

Review URL: https://codereview.chromium.org/1503943002

Cr-Commit-Position: refs/heads/master@{#32648}

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1502163002

Cr-Commit-Position: refs/heads/master@{#32647}

This makes the implementations of MacroAssembler::InvokeBuiltin go
through the InvokeFunctionCode helper on all architectures. This helper
knows how to correctly set up all registers (i.e. argument count and the
new target value).

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1488303008

Cr-Commit-Position: refs/heads/master@{#32646}

  port 0ed08780 (r32642)

  original commit message:
  There's no reason to limit the CompareIC to (known) JSObject instances,
  as all JSReceivers behave the same wrt. abstract and strict equality.
  So remove this historical limitation and track JSReceivers instead.

BUG=

Review URL: https://codereview.chromium.org/1501373003

Cr-Commit-Position: refs/heads/master@{#32645}