R=jgruber@chromium.org

Change-Id: I07b748990f3e23cfedb0fd0cf8dce62f21a309bd
Reviewed-on: https://chromium-review.googlesource.com/631722Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47569}

This introduces a {DebugAbort} machine-level operator as well as the
corresponding {ArchDebugAbort} backend instruction. The goal of this is
to speed up snapshot generation due to cheaper "CSA-asserts".

R=jgruber@chromium.org
BUG=v8:6688

Bug: v8:6688
Change-Id: If45f7da0652d4bb920c51ab7a7c41f9670434bbb
Also-By: jgruber@chromium.org
Reviewed-on: https://chromium-review.googlesource.com/628560Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47568}

Bug: v8:6747
Change-Id: If4b9c1ccd23c3ef1ed5e173f0143d2cc85581154
Reviewed-on: https://chromium-review.googlesource.com/631678Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47567}

Since the AST graph builder is gone, no variable should be named osr_ast_id.
This CL replaces it with osr_offset. It designates the offset of the bytecode
where the OSRing was triggered.

Bug: 
Change-Id: Ia53a83b09f917fcd0174da685a18edd3ee3aa01f
Reviewed-on: https://chromium-review.googlesource.com/621008Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47566}

DEBUG builds pull in all sorts of instrumentation infrastructure that
leads to larger heaps. The check for intial size is only useful for
release builds.

Bug: v8:6746
Change-Id: I5ab220d21167e69d7fb32c9db68045368c4ef178
R: ulan@chromium.org
Reviewed-on: https://chromium-review.googlesource.com/631876Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47565}

This reverts commit 8bbc2242.

Reason for revert: On Canary 3195.

Original change's description:
> [heap] Enable concurrent marking for x86 and x64.
> 
> This is an experiment and will be reverted after getting canary
> coverage.
> 
> Bug: chromium:694255
> Change-Id: I40388d8c6db0e46e2ce64e88aba04c5ac8822e94
> Reviewed-on: https://chromium-review.googlesource.com/625959
> Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#47541}

TBR=ulan@chromium.org,mlippautz@chromium.org

Change-Id: I642c1f778267a795bf1e1a6bba863552394ad1d4
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:694255
Reviewed-on: https://chromium-review.googlesource.com/631717Reviewed-by: Michael Hablich <hablich@chromium.org>
Commit-Queue: Michael Hablich <hablich@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47564}

The {WireBytesRef} constructor checks that {offset + length} does not
overflow. Hence we need to check for illegal sizes before constructing
the {WireBytesRef}.

The {consume_bytes} function already does that, so remove the
redundant hand-written checking.

R=titzer@chromium.org

Bug: chromium:752781
Change-Id: If3a2946a62fa38cc668695ed7186b9751a1f356f
Reviewed-on: https://chromium-review.googlesource.com/605894
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47563}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/337452a..a35cf9a

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/810d9d2..92387bc

TBR=machenbach@chromium.org,hablich@chromium.org

Change-Id: I55630210fe41f252dfaf6d1df91c8de98d4cd1df
Reviewed-on: https://chromium-review.googlesource.com/630142Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47562}

API resolves functions to its .prototype property to make possible
queries like queryObjects(Object), queryObjects(HTMLElement), e.t.c.

R=dgozman@chromium.org

Bug: v8:6732
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel
Change-Id: Ie8dc2288fa7e59c69f9b2647a9d5e35f0ac9215f
Reviewed-on: https://chromium-review.googlesource.com/630244
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47561}

Initialize the code table with a valid default (e.g. illegal builtin),
otherwise we're invalidating assumptions when relocating.

Bug: chromium:757217
Change-Id: I77890f1fe0e31534d9844d2e91694df1ec185110
Reviewed-on: https://chromium-review.googlesource.com/630097Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Commit-Queue: Brad Nelson <bradnelson@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47560}

- simplify prototype traversal.
- use V8InspectorClient::isInspectableHeapObject since some embedders
  on JavaScript heap contains not inspectable objects, e.g. wrapper
  boilerplates in blink.
- Runtime.queryObjects takes prototype object as argument for more
  flexibility.

R=alph@chromium.org

Bug: v8:6732
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel
Change-Id: I06f0d5c987150c80c3e9b05e7f6ad195985fc539
Reviewed-on: https://chromium-review.googlesource.com/627577
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47559}

Port 10f73fac

R=bjaideep@ca.ibm.com, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: Ia5b50df98cb26bc332e3e2b114861740bae19d3d
Reviewed-on: https://chromium-review.googlesource.com/629217Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#47558}

BUG=
R=ahaas@chromium.org,mstarzinger@chromium.org

Change-Id: Ida7ac441722d778946b7ac92e8f6c7fe5ea15cdc
Reviewed-on: https://chromium-review.googlesource.com/628821
Commit-Queue: Brad Nelson <bradnelson@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47557}

The testcase was failing on BE, fix to use 32bit load
before calling testbit.

R=joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
Log=N

Bug: 
Change-Id: I075666b47dd90b6341ba7b4031cd4be96e8c1bf9
Reviewed-on: https://chromium-review.googlesource.com/628659Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Jaideep Bajwa <bjaideep@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#47556}

With the removal of Crankshaft, kNumber has become obsolete as
BinaryOperationFeedback. Turbofan uses kNumberOrOddball.

Bug: 
Change-Id: If577f5efcc81d7c08f43908f2764ff0ec6f8747c
Reviewed-on: https://chromium-review.googlesource.com/628376Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47555}

BytecodeGenerator previously assumed that any UNALLOCATED variable
must be a global object property, but that's incorrect for global
lexical variables declared in a different script.

This patch fixes the behavior by always falling back to the runtime
to deal with deleting UNALLOCATED variables. This is sub-optimal,
but should be correct, and it's unclear if speed is important for
this case.

Bug: v8:6733
Change-Id: I83c2a0b6e30e5e5f4c79bfe14ebf196529816c71
Reviewed-on: https://chromium-review.googlesource.com/627636Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47554}

V8 used to erroneously allow ForStatements to contain a function
declaration, but that hasn't been true since we shipped the
"--harmony-restrictive-declarations" flag 1.5 years ago.

Bug: v8:4824
Change-Id: I893b45aed468017f89c0c5964df2091bea030327
Reviewed-on: https://chromium-review.googlesource.com/621871Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47553}

Bug: chromium:694255
Change-Id: Ic21368f68e103ee1278b4e975255c6941f23a2d0
Reviewed-on: https://chromium-review.googlesource.com/629058Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47552}

This enables concurrent marking for x86 and x64 on GYP builds.

Bug: chromium:694255
Change-Id: I371b38e72ce0e8f7ad5b0eed4e29b223b9ed1cf4
Reviewed-on: https://chromium-review.googlesource.com/628836
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47551}

Bug: 
Change-Id: I8db893ac46ad82e52ff2918336107d55600789a5
Reviewed-on: https://chromium-review.googlesource.com/628542Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47550}

Embedders should implement them via the v8::TracingController interface
and return a pointer to an instance of that interface from
v8::Platform::GetTracingController

BUG=v8:6511
R=fmeawad@chromium.org

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: If17b013c7ce4cf540a186767fd6e1b5e00e0dab2
Reviewed-on: https://chromium-review.googlesource.com/554770Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Jochen Eisinger <jochen@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47549}

This fixed IncrementalMarkingStepMakesBigProgressWithLargeObjects
and MapRetaining.

Change-Id: I3a91684fa1f0635e94dc1883b105ce8d3381a7d2
Reviewed-on: https://chromium-review.googlesource.com/628416
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47548}

Now that they contain more than just one member variable, this might make
sense (and at least doesn't do any harm).

BUG=v8:6092

Change-Id: Ibd150bedf542580f69946f62f8aca47bce945499
Reviewed-on: https://chromium-review.googlesource.com/623748
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47547}

- Convert S.p.includes builtin from CPP to TFJ
  - Fast paths S.p.includes(str) and S.p.includes(str, smi)
- Add Runtime kStringIncludes
- Add StringIncludesIndexOfAssembler (Generate is based on
  StringPrototypeIndexOf builtin)
- S.p.includes and S.p.indexOf both use StringIncludesIndexOfAssembler

Quick measurements show 3x improvement for S.p.includes(str).
More about the measurements: https://gist.github.com/peterwmwong/7a2a96f3171a52f16ca8125a089f38e7

Bug: v8:6680
Change-Id: I79cb8dbe2b79e6df15aa734e128eee25c7e6aaf5
Reviewed-on: https://chromium-review.googlesource.com/620150Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47546}

This change prevents constant folding of uninhabited RefenceEqual node
because that could widen a type (from None type to the type of the
boolean constant).

Hopefully, this is a temporary workaround that will be replaced
by a better dead code elimination.

Bug: v8:6631
Change-Id: Ie25e7d710aaf1d37c9adba60f92438570843dd5d
Reviewed-on: https://chromium-review.googlesource.com/627916Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47545}

BUG=chromium:752428

Change-Id: I0d1f3a09ecd2ffb7bfd8120b212e88fd00008fc0
Reviewed-on: https://chromium-review.googlesource.com/608961Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Mostyn Bramley-Moore <mostynb@opera.com>
Cr-Commit-Position: refs/heads/master@{#47544}

Due to shortcuts we take on the RegExp.p[@@split] fast path (we don't allocate
a new instance), we need to send sticky regexps to the slow path.

The problem is a slight impedance mismatch between the spec and our fast-path
implementation.

Spec: Creates a new regexp instance `splitter` that is guaranteed to be sticky,
uses `splitter.lastIndex` to advance the search range, advances by itself using
AdvanceStringIndex if `splitter` did not match at the current position.

Our fast path: Uses the given regexp instance and does not modify stickyness,
uses last_match_info to advance search range, returns (and assumes no more
matches) once RegExpExecInternal fails to match.

This is fine if the given regexp is non-sticky, since 1. the value of lastIndex
is ignored, and 2. non-sticky regexps match if a match is found anywhere in the
string, not just exactly at the current lastIndex.

Sticky regexps though are a problem. If no match is found exactly at the current
position, @@split assumes no more matches and exits.

In a follow-up, we could explore other options, such as allocating a new
instance or saving/restoring flags and lastIndex.

Bug: v8:6706
Change-Id: I6da2266df72b2f80f00c1ce3cd7c8655de91f680
Reviewed-on: https://chromium-review.googlesource.com/626065Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47543}

R=mlippautz@chromium.org
BUG=v8:6409

Change-Id: I0cdba60385c8b481a3fd7b1b5c3b2ba1b0b8367b
Reviewed-on: https://chromium-review.googlesource.com/628059Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47542}

This is an experiment and will be reverted after getting canary
coverage.

Bug: chromium:694255
Change-Id: I40388d8c6db0e46e2ce64e88aba04c5ac8822e94
Reviewed-on: https://chromium-review.googlesource.com/625959
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47541}

This moves Module and other module-related classes and definitions out
of src/objects{.h,-inl.h,.cc} into src/objects/module{.h,-inl.h,.cc}.

Also moves the contents of src/objects/module-info.h there.

R=marja@chromium.org

Bug: v8:1569, v8:5402
Change-Id: I49064bb4a5c5a6f409274c287e06e8dda351d615
Reviewed-on: https://chromium-review.googlesource.com/626818
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47540}

Revert "Reland "[turbofan] Polymorphic inlining - try merge map check dispatch with function call dispatch.""

This reverts commit 4cee9fbc.

Reason for revert: Breaks on clusterfuzz.

Original change's description:
> Reland "[turbofan] Polymorphic inlining - try merge map check dispatch with function call dispatch."
> 
> This reverts commit 57af6811.
> 
> This adds the checkpoint between the call and the polymorphic load.
> I thought that JSCall with constant target cannot cause eager deopt,
> but Canary seems to disagree (http://crbug.com/718019).
> 
> Bug: v8:5267,chromium:718019
> Change-Id: I552b850db6beb93e733b371ad0e7204513da1dc4
> Reviewed-on: https://chromium-review.googlesource.com/622867
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#47521}

TBR=jarin@chromium.org,tebbi@chromium.org,bmeurer@chromium.org

Change-Id: Ib333883fa27b79fcd766c33997cb0ce46547bb94
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:5267, chromium:718019
Reviewed-on: https://chromium-review.googlesource.com/628076Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47539}

Bug: v8:6333
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I50d4357a7e7a0e8f2d04d5d34952cf524c012d5f
Reviewed-on: https://chromium-review.googlesource.com/625740
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47538}

The initialization code of all modules must have been run
before running any module's main code. This should have been
fixed quite a while ago as part of another CL but somehow
wasn't.

In the process of fixing it now, I'm also moving the initialization
phase out of Evaluate into Instantiatiate. This corresponds more
closely to the specification and avoids confusion.

Bug: v8:1569
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I3ea5d6be0f5d371e6a4c641778c51762f1867dc8
Reviewed-on: https://chromium-review.googlesource.com/620653Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47537}

This folds the allocation of the JSRegExpResult (basically a JSArray)
together with its elements fixed array.

Bug: v8:6741
Change-Id: I027c4fce7169c1bd6a17637619fdf3890e3f7f24
Reviewed-on: https://chromium-review.googlesource.com/625877
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47536}

> This reverts commit 42d3d36b.
> 
> Original change's description:
> > [Compiler] Remove code aging support.
> > 
> > Code aging is no longer supported by any remaining compilers now
> > that full codegen has been removed. This CL removes all vestiges of
> > code aging.
> > 
> > BUG=v8:6409
> > 
> > Change-Id: I945ebcc20c7c55120550c8ee36188bfa042ea65e
> > Reviewed-on: https://chromium-review.googlesource.com/619153
> > Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> > Reviewed-by: Yang Guo <yangguo@chromium.org>
> > Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> > Reviewed-by: Marja Hölttä <marja@chromium.org>
> > Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#47501}
> 
> TBR=ulan@chromium.org,rmcilroy@chromium.org,marja@chromium.org,yangguo@chromium.org,mstarzinger@chromium.org,rodolph.perfetta@arm.com
> 
> Change-Id: I9d8b2985e2d472697908270d93a35eb7ef9c88a8
> No-Presubmit: true
> No-Tree-Checks: true
> No-Try: true
> Bug: v8:6409
> Reviewed-on: https://chromium-review.googlesource.com/625998
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#47506}

TBR=ulan@chromium.org,rmcilroy@chromium.org,marja@chromium.org,yangguo@chromium.org,mstarzinger@chromium.org,rodolph.perfetta@arm.com

Change-Id: I68785c6be7686e874b3848103e3a34483eaeb519
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6409
Reviewed-on: https://chromium-review.googlesource.com/625919Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47535}

R=ishell@chromium.org
BUG=v8:6409

Change-Id: Ic01d4f1a8b251bb5480840d4943d9ebec713b9c1
Reviewed-on: https://chromium-review.googlesource.com/626016Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47534}

Add "detailed" flag to Profiler.startPreciseCoverage to specify
granularity (block coverage vs function coverage).

The default value is currently set to FLAG_block_coverage, which
is currently true. This is so that the V8 roll does not break
LayoutTests. I'll set it to false once I made changes to Blink.

R=jgruber@chromium.org, pfeldman@chromium.org

Bug: v8:6738
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel
Change-Id: I7242e897ab02713188a5292ca8c8bb58985e3a9b
Reviewed-on: https://chromium-review.googlesource.com/625616Reviewed-by: Pavel Feldman <pfeldman@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47533}

This is a simple move of CSA::AllocateRegExpResult to
RegExpBuiltinsAssembler. There's no reason for this method to be in CSA,
and this way we save a bit of binary size since code in builtins-*-gen
is not shipped.

Bug: v8:6741
Change-Id: I89507a0bfa4e0e922d92b9fcd0604ce86efea293
Reviewed-on: https://chromium-review.googlesource.com/626078Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47532}

Code size in snapshot can be reduced ~41KB

Contributed by kanghua.yu@intel.com

Bug: None
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Ib73af39fe97cd38728affea40c593236f15bf6e5
Reviewed-on: https://chromium-review.googlesource.com/588751
Commit-Queue: Pan Deng <pan.deng@intel.com>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47531}

This is a reland of 942c61ab
Original change's description:
> [runtime] Rename PropertyArray::kLengthOffset to kLengthAndHashOffset
> 
> LengthAndHashOffset describes the value stored in the offset better.
> 
> Bug: v8:6404
> Change-Id: Ie5ea2a362c54aa03e0a4e314d1adb8b91d74a044
> Reviewed-on: https://chromium-review.googlesource.com/624458
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#47503}

TBR=jkummerow@chromium.org, mstarzinger@chromium.org

Bug: v8:6404
Change-Id: Ied55fa6145ccc788581703db991b2f78d59a7408
Reviewed-on: https://chromium-review.googlesource.com/627075Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47530}