The problem is that tagged slot could become a double slot after migrating of an object to another map with "shifted" fields (for example as a result of generalizing immutable data property to a data field).
This CL also adds useful machinery that helps triggering incremental write barriers.

BUG=chromium:454297
LOG=Y

Review URL: https://codereview.chromium.org/957273002

Cr-Commit-Position: refs/heads/master@{#27054}

Cr-Commit-Position: refs/heads/master@{#27053}

Revert of Revert of Revert of Turn on job based recompilation (patchset #1 id:1 of https://codereview.chromium.org/955723002/)

Reason for revert:
Breaks Octane on Arm64 running on Chrome.

BUG=464538

Original issue's description:
> Revert of Revert of Turn on job based recompilation (patchset #1 id:1 of https://codereview.chromium.org/937263004/)
>
> Reason for revert:
> reland
>
> Original issue's description:
> > Revert of Turn on job based recompilation (patchset #1 id:1 of https://codereview.chromium.org/935243003/)
> >
> > Reason for revert:
> > waterfall disagrees
> >
> > Original issue's description:
> > > Turn on job based recompilation
> > >
> > > BUG=v8:3608
> > > R=yangguo@chromium.org
> > > LOG=y
> > >
> > > Committed: https://crrev.com/4ae82f64b09cdc0182cee3a5cc619a9117ac5fbc
> > > Cr-Commit-Position: refs/heads/master@{#26826}
> >
> > TBR=yangguo@chromium.org
> > NOPRESUBMIT=true
> > NOTREECHECKS=true
> > NOTRY=true
> > BUG=v8:3608
> >
> > Committed: https://crrev.com/35cc692aecdea54fb07479b8d7b71059851e07e8
> > Cr-Commit-Position: refs/heads/master@{#26827}
>
> TBR=yangguo@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=v8:3608
>
> Committed: https://crrev.com/3735a0851a9e2726f8b50a46a3bc770992328264
> Cr-Commit-Position: refs/heads/master@{#26829}

TBR=yangguo@chromium.org,jochen@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3608

Review URL: https://codereview.chromium.org/984463003

Cr-Commit-Position: refs/heads/master@{#27052}

BUG=
LOG=N
R=arv@chromium.org

Review URL: https://codereview.chromium.org/982153003

Cr-Commit-Position: refs/heads/master@{#27051}

TEST=
BUG=

Review URL: https://codereview.chromium.org/987653005

Cr-Commit-Position: refs/heads/master@{#27050}

R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/986463005

Cr-Commit-Position: refs/heads/master@{#27049}

Don't overwrite existing serial numbers on the function template, otherwise instantiating the function for a new context causes the serial number to bump.

Review URL: https://codereview.chromium.org/988693003

Cr-Commit-Position: refs/heads/master@{#27048}

Review URL: https://codereview.chromium.org/981213002

Cr-Commit-Position: refs/heads/master@{#27047}

Now the three intrinsic lists only differ in their compiler
support. Unifying the lists and making the logic what is supported in
which compiler local to the compilers themselves is handled in a
follow-up CL.

BUG=v8:3947
LOG=n

Review URL: https://codereview.chromium.org/983183002

Cr-Commit-Position: refs/heads/master@{#27046}

R=ulan@chromium.org

Review URL: https://codereview.chromium.org/984833003

Cr-Commit-Position: refs/heads/master@{#27045}

Original issue: https://codereview.chromium.org/980573002/

Simple transitions are now stored in a map's "transitions" field (as a WeakCell wrapping the target map); full TransitionArrays are used when that's not sufficient.
To encapsulate these storage format implementation details, functions for manipulating and querying transitions have been refactored to be static functions on the TransitionArray class, and take maps as inputs.

Review URL: https://codereview.chromium.org/988703002

Cr-Commit-Position: refs/heads/master@{#27044}

This involved renaming apart a few more intrinsics. In the long run,
we want to clean up redundant intrinsics which just delegate.

BUG=v8:3947
LOG=n

Review URL: https://codereview.chromium.org/984963002

Cr-Commit-Position: refs/heads/master@{#27043}

This makes now the same simplification as the chromium
release scripts do. For creating branch B from a gnumbd'ed
(aka real) commit X do:
1. Branch Y off the real X
2. Set refs/pending/heads/B to Y
3. Set refs/pending-tags/B to X
4. Set refs/heads/B to X

The old algorithm tried to branch off the pending
correspondent of X. That commit was determined by comparing
tree objects of the real X and commits on pending.
Unfortunately, multiple commits on one branch can refer to
the same tree object, e.g., for commits P, Q, R with R being
the revert of Q, P and R refer to the same tree object.

TBR=tandrii@chromium.org
NOTRY=true
TEST=./script_test.py
TEST=tools/release/create_release.py -a me -r you --dry-run

Review URL: https://codereview.chromium.org/979243004

Cr-Commit-Position: refs/heads/master@{#27042}

BUG=chromium:463028
LOG=n
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/987733003

Cr-Commit-Position: refs/heads/master@{#27041}

This keeps dying maps alive for FLAG_retain_maps_for_n_gc garbage collections
to increase chances of them being reused for new objects in future and
decrease number of deoptimizations.

BUG=v8:3664
LOG=N
TEST=cctest/test-heap/MapRetaining

Review URL: https://codereview.chromium.org/980523004

Cr-Commit-Position: refs/heads/master@{#27040}

BUG=v8:3947
LOG=n

Review URL: https://codereview.chromium.org/978123003

Cr-Commit-Position: refs/heads/master@{#27039}

BUG=v8:3929
LOG=y

Review URL: https://codereview.chromium.org/982123003

Cr-Commit-Position: refs/heads/master@{#27038}

Revert of CpuProfiler: enable tests except four failing tests. (patchset #3 id:100001 of https://codereview.chromium.org/976203003/)

Reason for revert:
Some tests still flaky

Original issue's description:
> CpuProfiler: enable tests except four failing tests.
>
> Four tests are failing due to a problem with no frame ranges.
>
> BUG=
> LOG=n
>
> Committed: https://crrev.com/2be160e726f2be6272b77e53fbd556aded6024f1
> Cr-Commit-Position: refs/heads/master@{#27035}

TBR=yurys@chromium.org,svenpanne@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/987553005

Cr-Commit-Position: refs/heads/master@{#27037}

This makes sure that any pending message is saved before entering
and restored after exiting a finally block. It also makes sure that
operand stacks are kept in sync to full-codegen.

R=bmeurer@chromium.org
TEST=cctest/test-run-jsexceptions/ThrowMessage

Review URL: https://codereview.chromium.org/979173002

Cr-Commit-Position: refs/heads/master@{#27036}

Four tests are failing due to a problem with no frame ranges.

BUG=
LOG=n

Review URL: https://codereview.chromium.org/976203003

Cr-Commit-Position: refs/heads/master@{#27035}

Don't double-allocate mutable heap numbers in the json parser. This removes some stupidity when committing state.

BUG=

Review URL: https://codereview.chromium.org/982793002

Cr-Commit-Position: refs/heads/master@{#27034}

External references are encoded as a tuple of type and ID. This
requires both the external reference encode and the decoder to
create a mapping between the encoding and the external reference
table index.

Instead, we simply use the external reference table index as
encoding.

We now also assume that there are no duplicate entries. Existing
duplicates have been removed in this change.

R=vogelheim@chromium.org

Review URL: https://codereview.chromium.org/982773003

Cr-Commit-Position: refs/heads/master@{#27033}

   This is introduced by 8d2e4566 (r26993)

original commit message:
   First shot at eager deoptimization in Turbofan.

BUG=

Review URL: https://codereview.chromium.org/960973003

Cr-Commit-Position: refs/heads/master@{#27032}

R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/979003003

Cr-Commit-Position: refs/heads/master@{#27031}

Revert of Simplify and compact transitions storage (patchset #4 id:80001 of https://codereview.chromium.org/980573002/)

Reason for revert:
x64 test failures

Original issue's description:
> Simplify and compact transitions storage
>
> Simple transitions are now stored in a map's "transitions" field (as a WeakCell wrapping the target map); full TransitionArrays are used when that's not sufficient.
> To encapsulate these storage format implementation details, functions for manipulating and querying transitions have been refactored to be static functions on the TransitionArray class, and take maps as inputs.
>
> Committed: https://crrev.com/45fbef7f2252fce10634931cb103ccc1fc95ae6a
> Cr-Commit-Position: refs/heads/master@{#27029}

TBR=verwaest@chromium.org,ulan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/982143002

Cr-Commit-Position: refs/heads/master@{#27030}

Simple transitions are now stored in a map's "transitions" field (as a WeakCell wrapping the target map); full TransitionArrays are used when that's not sufficient.
To encapsulate these storage format implementation details, functions for manipulating and querying transitions have been refactored to be static functions on the TransitionArray class, and take maps as inputs.

Review URL: https://codereview.chromium.org/980573002

Cr-Commit-Position: refs/heads/master@{#27029}

Port 4436c264

Original commit message:
This adds support for the double bits intrinsics to TurboFan, and is
a first step towards fast Math functions inlined into TurboFan code
or even compiled by themselves with TurboFan.

BUG=

Review URL: https://codereview.chromium.org/980073003

Cr-Commit-Position: refs/heads/master@{#27028}

Port 1382879f

Original commit message:
This extends the stack unwinding logic to respect optimized frames
and perform a lookup in the handler table to find handlers. It also
contains fixes to the API call stubs to allow a stack walk while
promoting scheduled exceptions.

BUG=

Review URL: https://codereview.chromium.org/988463002

Cr-Commit-Position: refs/heads/master@{#27027}

There are no test cases for this piece of code and it is really hard to test. If this rare case triggers, we are anyway in an OOM situation and would crash probably soon afterwards.

BUG=

Review URL: https://codereview.chromium.org/977013003

Cr-Commit-Position: refs/heads/master@{#27026}

If function.name property has string type then stack frame will contain it otherwise DebugName from shared function info.

BUG=17356
LOG=Y
R=yurys@chromium.org

Review URL: https://codereview.chromium.org/917743002

Cr-Commit-Position: refs/heads/master@{#27025}

TBR=yangguo@chromium.org

BUG=

Review URL: https://codereview.chromium.org/982873002

Cr-Commit-Position: refs/heads/master@{#27024}

Port 2ecdf736

BUG=

Review URL: https://codereview.chromium.org/983693003

Cr-Commit-Position: refs/heads/master@{#27023}

TBR=dcarney@chromium.org

Review URL: https://codereview.chromium.org/980873002

Cr-Commit-Position: refs/heads/master@{#27022}

Using a git range check for checking progress is wrong when
the last rolled revision and the revision candidate are on
different branches. The range A..B will always show the
commits from the merge-base of A and B until B.

Better compare the tags of the last rolled revision and the
candidate. The candidate's version must be strictly greater
than what's in chromium.

TBR=tandrii@chromium.org
NOTRY=true
TEST=./script_test.py

Review URL: https://codereview.chromium.org/979133002

Cr-Commit-Position: refs/heads/master@{#27021}

Internal references are absolute addresses into the instruction
stream. Turn them into relative addresses when serializing and
back when deserializing to keep them valid.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/976623002

Cr-Commit-Position: refs/heads/master@{#27020}

BUG=

Review URL: https://codereview.chromium.org/974353002

Cr-Commit-Position: refs/heads/master@{#27019}

BUG=

Review URL: https://codereview.chromium.org/980173003

Cr-Commit-Position: refs/heads/master@{#27018}

According to Source Map specification [1] source map url can be passed either as a magic comment at the end of script or as SourceMap http header. We already parse the former value and expose it on Script object. This change allows to unify the way we deal with source map urls received in http header by providing api for passing that url into the script being compiled.

source_map_url is intentionally not passed into CompilationCacheScript::Lookup. The cache is anyways disabled when debugger is on.

[1] https://docs.google.com/document/d/1U1RGAehQwRypUTovF1KRlpiOFze0b-_2gc6fAH0KY0k/edit

LOG=Y
BUG=chromium:462572

Review URL: https://codereview.chromium.org/983603003

Cr-Commit-Position: refs/heads/master@{#27017}

This extends the stack unwinding logic to respect optimized frames
and perform a lookup in the handler table to find handlers. It also
contains fixes to the API call stubs to allow a stack walk while
promoting scheduled exceptions.

R=jarin@chromium.org
TEST=cctest/test-run-jsexceptions

Review URL: https://codereview.chromium.org/969533004

Cr-Commit-Position: refs/heads/master@{#27016}

BUG=

Review URL: https://codereview.chromium.org/980843002

Cr-Commit-Position: refs/heads/master@{#27015}