This reverts commit 81756480.

Reason for revert: Breaks several builders, e.g. https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Linux%20-%20builder/37808

Original change's description:
> [objects.h splitting] Move AsyncGeneratorRequest
> 
> BUG=v8:5402,v8:8238
> 
> Change-Id: I988b1e0b7a958d06690820632bc533d9e5338535
> Reviewed-on: https://chromium-review.googlesource.com/c/1349190
> Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Commit-Queue: Marja Hölttä <marja@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#57776}

TBR=marja@chromium.org,clemensh@chromium.org,tebbi@chromium.org

Change-Id: I5b654f5eed5764af764ed6e96e308da75cd28fe0
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:5402, v8:8238
Reviewed-on: https://chromium-review.googlesource.com/c/1349235Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57777}

BUG=v8:5402,v8:8238

Change-Id: I988b1e0b7a958d06690820632bc533d9e5338535
Reviewed-on: https://chromium-review.googlesource.com/c/1349190Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57776}

+ fixing other files which were depending on context-inl.h pulling in the
missing includes.

BUG=v8:7490,v8:8238

Change-Id: I90d37599bdfb69ac8fd7e62b8fb78d9d77c77234
Reviewed-on: https://chromium-review.googlesource.com/c/1349277Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57775}

This changes the split from AssignmentPattern and BindingPattern to Pattern and
BindingPattern. Pattern collects all errors that are invalid in both assignment
and binding pattern contexts. Binding pattern additionally collects errors for
binding pattern contexts (property access isn't a valid target). The
distinction is piggybacked on to distinguish assignment vs binding pattern
errors since binding pattern verification will first throw the binding pattern
error.

Since we don't throw pattern error as binding pattern as well, this can mean
that a later binding pattern syntax error will show up before an early pattern
error. Since that just changes the message to another syntax violation, I think
that's fine.

Change-Id: Ib6a22c8d11c49eacc6667ae8ee5e98bababadd43
Reviewed-on: https://chromium-review.googlesource.com/c/1349273Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57774}

This helper cleans up the callsites of the Symbol.toPrimitive
installations. As a bonus, we can remove an unused CreateFunction
variant now.

Bug: v8:8238
Change-Id: I017acc9464d6179e8bf53767f8bbc953272b46ed
Reviewed-on: https://chromium-review.googlesource.com/c/1349275Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57773}

Bug: v8:7793
Change-Id: I2d5154eabd549c0518ca41dae6ef7bd047f3e1ef
Reviewed-on: https://chromium-review.googlesource.com/c/1348072Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Daniel Clifford <danno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57772}

Bug: v8:3770
Change-Id: I07f48b1ee8814a006e6787ad8261fa8388b4298d
Reviewed-on: https://chromium-review.googlesource.com/c/1345327
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57771}

Add a path into embedder tracing on allocation. This is safe as as Blink
is not allowed to call into V8 during object construction.

This is a reland of caed2cc0.

Bug: chromium:843903
Change-Id: I7faa8413966f6b4d37f19b235d46bb09e4d47235
Bug: chromium:843903
Reviewed-on: https://chromium-review.googlesource.com/c/1349330
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57770}

- Remove an unused param from InstallFunction
- Remove an InstallFunction variant which just rearranges the order of
  the arguments
- Consistently use const char* string literals as property names rather
  than e.g. factory->return_string() just write "return" because it is
  easier for humans to read. All the strings are internalized anyway and
  this happens at mksnapshot time, so there is no performance penalty.
- Remove the maybe_prototype arguments to CreateFunction. We always know
  at the callsite whether we have a prototype or not, so just call the
  variant that takes a prototype or the new CreateFunction variant which
  takes a Builtin::name.
- Rename a SimpleInstallFunction variant which was only used for symbols
  to InstallFunctionAtSymbol. This also makes it clear that this is the
  only case where property_name and function_name differ.

Bug: v8:8238
Change-Id: I2400de90ebe837694e777cff1419858037ee51cc
Reviewed-on: https://chromium-review.googlesource.com/c/1349271Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57769}

This reverts commit e64f7c0a.

Reason for revert: this breaks chromedriver_py_test on Mac and Windows. This blocks the roll.

Details:

- DEPS roll with V8 pointing to this commit fails: https://chromium-review.googlesource.com/c/chromium/src/+/1349251
- DEPS roll with V8 pointing to the parent of this commit succeeds: https://chromium-review.googlesource.com/c/chromium/src/+/1349214

Original change's description:
> Reland "[turbofan] Use feedback when reducing global loads/stores."
> 
> This is a reland of 9c91b687 after
> fixing undefined behavior in numeric conversion that caused trouble
> on arm32.
> 
> Original change's description:
> > [turbofan] Use feedback when reducing global loads/stores.
> >
> > We already record the script context location or the property cell
> > as feedback of the global load/store IC, so Turbofan doesn't need
> > to do the lookups again.
> >
> > Change-Id: I6cbd2937de344729cd8e146b4ff85ddf3de6a56e
> > Reviewed-on: https://chromium-review.googlesource.com/c/1335691
> > Commit-Queue: Georg Neis <neis@chromium.org>
> > Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#57555}
> 
> Change-Id: Ic2d09025de02f92199755ac860bb9e91fa08f4ec
> Reviewed-on: https://chromium-review.googlesource.com/c/1340043
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Commit-Queue: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#57649}

TBR=neis@chromium.org,bmeurer@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Change-Id: I7c9364d6a0bea6681fe9e25b28206cfc2c8557a7
Reviewed-on: https://chromium-review.googlesource.com/c/1349272Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57768}

This implements AssertUnreachable for the arm32 port of Liftoff.

Bug: v8:6600
Change-Id: I9aa5083dc1be175fc5f2f386d8aace021bab3b03
Reviewed-on: https://chromium-review.googlesource.com/c/1346335
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57767}

This implements popcnt, division and remainder on i32 for the arm32 port of Liftoff.

Bug: v8:6600
Change-Id: I2aac78596ef9799bf8fcfc791c0e946a8388f62f
Reviewed-on: https://chromium-review.googlesource.com/c/1346497
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57766}

This implements arithmetic operations on i32, comparisons, and conditional
jumps for the arm32 port of Liftoff.

Bug: v8:6600
Change-Id: Ib8d6e4dd99c725d9c5bff06d31c64e7ba4639297
Reviewed-on: https://chromium-review.googlesource.com/c/1346334
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57765}

Bug: v8:3770
Change-Id: I9a3f289ac6236b88476167150565e8183d6f5461
Reviewed-on: https://chromium-review.googlesource.com/c/1345326
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57764}

This reverts commit 40b448ea.

Reason for revert: https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Win64/27711

Original change's description:
> [heap] Release dead young generation large objects in the Scavenger.
> 
> Bug: chromium:852420
> Change-Id: Ieefbee7bfd625d62e9104950bdfa8e46d5f4270a
> Reviewed-on: https://chromium-review.googlesource.com/c/1348081
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Commit-Queue: Hannes Payer <hpayer@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#57761}

TBR=ulan@chromium.org,hpayer@chromium.org

Change-Id: I6b57dd8ed92d85b5ce012da754611278ceaefe20
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:852420
Reviewed-on: https://chromium-review.googlesource.com/c/1349270Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57763}

R=jgruber@chromium.org

Change-Id: I49c08217d0c8e452afe84ad76ae6d60367802e82
Reviewed-on: https://chromium-review.googlesource.com/c/1348075Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57762}

Bug: chromium:852420
Change-Id: Ieefbee7bfd625d62e9104950bdfa8e46d5f4270a
Reviewed-on: https://chromium-review.googlesource.com/c/1348081Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57761}

This is a reland of a6e3cdd9

Now only changes ObjectTemplate::NewInstance.

Original change's description:
> [cleanup] Move methods to V8_DEPRECATED
>
> Updates ObjectTemplate::NewInstance and FunctionTemplate::GetFunction
> from V8_DEPRECATED_SOON to V8_DEPRECATED, now that they're unused in
> chrome.
>
> Bug: v8:7294, v8:7295, v8:8238
> Change-Id: Ic7cb2c410ff812f73cfd108551f2a1a20722df07
> Reviewed-on: https://chromium-review.googlesource.com/c/1344151
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Commit-Queue: Dan Elphick <delphick@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#57657}

Bug: v8:7294, v8:7295, v8:8238
Change-Id: I52ec021bc92600f67cf27791d5b2df2a4342a4d5
Reviewed-on: https://chromium-review.googlesource.com/c/1348079Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57760}

This reverts commit caed2cc0.

Reason for revert: Breaks layout tests, e.g.

https://test-results.appspot.com/data/layout_results/V8-Blink_Linux_64__dbg_/14924/webkit_layout_tests%20%28with%20patch%29/layout-test-results/results.html

crash log for renderer (pid <unknown>):
STDOUT: <empty>
STDERR: 
STDERR: 
STDERR: #
STDERR: # Fatal error in ../../v8/src/base/platform/elapsed-timer.h, line 24
STDERR: # Debug check failed: !IsStarted().
STDERR: #
STDERR: #
STDERR: #
STDERR: #FailureMessage Object: 0x7ffc46707640#0 0x565409263b6f base::debug::StackTrace::StackTrace()
STDERR: #1 0x56540a8a32fb gin::(anonymous namespace)::PrintStackTrace()
STDERR: #2 0x56540a8980d8 V8_Fatal()
STDERR: #3 0x56540a897e35 v8::base::(anonymous namespace)::DefaultDcheckHandler()
STDERR: #4 0x565407971f02 v8::base::ElapsedTimer::Start()
STDERR: #5 0x565407d08edf v8::internal::TimedHistogram::Start()
STDERR: #6 0x565407e500d5 v8::internal::IncrementalMarking::AdvanceIncrementalMarkingOnAllocation()
STDERR: #7 0x565407e4f977 v8::internal::IncrementalMarking::Observer::Step()
STDERR: #8 0x565407e48092 v8::internal::AllocationObserver::AllocationStep()
STDERR: #9 0x565407eb0751 v8::internal::SpaceWithLinearArea::InlineAllocationStep()
STDERR: #10 0x565407eb3e44 v8::internal::NewSpace::EnsureAllocation()
STDERR: #11 0x565407e258ff v8::internal::NewSpace::AllocateRaw()
STDERR: #12 0x565407e06b2d v8::internal::Heap::AllocateRaw()
STDERR: #13 0x565407e432ef v8::internal::Heap::AllocateRawWithLightRetry()
STDERR: #14 0x565407e433cf v8::internal::Heap::AllocateRawWithRetryOrFail()
STDERR: #15 0x565407e04d48 v8::internal::Factory::NewFixedArrayWithFiller()
STDERR: #16 0x565407fd6339 v8::internal::HashTable<>::New()
STDERR: #17 0x565407fd7be8 v8::internal::HashTable<>::EnsureCapacity()
STDERR: #18 0x565407fc7e95 v8::internal::Dictionary<>::Add()
STDERR: #19 0x565407fcf453 v8::internal::BaseNameDictionary<>::Add()
STDERR: #20 0x565407f89ee4 v8::internal::LookupIterator::ApplyTransitionToDataProperty()
STDERR: #21 0x5654080036e2 v8::internal::Object::AddDataProperty()
STDERR: #22 0x56540793061f v8::internal::(anonymous namespace)::DefineDataProperty()
STDERR: #23 0x56540792da59 v8::internal::(anonymous namespace)::InstantiateObject()
STDERR: #24 0x56540792b75a v8::internal::(anonymous namespace)::InstantiateFunction()
STDERR: #25 0x56540792b4db v8::internal::ApiNatives::InstantiateFunction()
STDERR: #26 0x5654079594bf v8::FunctionTemplate::GetFunction()
STDERR: #27 0x56540a7af74e blink::V8ObjectConstructor::CreateInterfaceObject()
STDERR: #28 0x56540a7afe01 blink::V8PerContextData::ConstructorForTypeSlowCase()
STDERR: #29 0x56540a7afdd6 blink::V8PerContextData::ConstructorForTypeSlowCase()
STDERR: #30 0x56540a7afdd6 blink::V8PerContextData::ConstructorForTypeSlowCase()
STDERR: #31 0x56540a7afcb4 blink::V8PerContextData::CreateWrapperFromCacheSlowCase()
STDERR: #32 0x56540a7aef73 blink::V8DOMWrapper::CreateWrapper()
STDERR: #33 0x56540a7abf6b blink::ScriptWrappable::Wrap()
STDERR: #34 0x56540a677199 blink::V8Document::documentElementAttributeGetterCallback()
STDERR: #35 0x565407a0aec3 v8::internal::FunctionCallbackArguments::Call()
STDERR: #36 0x565407a097be v8::internal::(anonymous namespace)::HandleApiCallHelper<>()
STDERR: #37 0x565407a0877b v8::internal::Builtins::InvokeApiFunction()
STDERR: #38 0x565407fe785a v8::internal::Object::GetPropertyWithAccessor()
STDERR: #39 0x565407fe697e v8::internal::Object::GetProperty()
STDERR: #40 0x565407ec8c71 v8::internal::LoadIC::Load()
STDERR: #41 0x565407ed6401 v8::internal::__RT_impl_Runtime_LoadIC_Miss()
STDERR: #42 0x5654087593f2 <unknown>
STDERR: [16162:16185:1122/143518.356897:WARNING:crash_handler_host_linux.cc(341)] Could not translate tid, attempt = 1 retry ...


Original change's description:
> [heap] Improve embedder tracing during incremental marking
> 
> Add a path into embedder tracing on allocation. This is safe as as Blink
> is not allowed to call into V8 during object construction.
> 
> Bug: chromium:843903
> Change-Id: I5af053c3169f5a33778ebce5d7c5c43e4efb1aa4
> Reviewed-on: https://chromium-review.googlesource.com/c/1348749
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#57757}

TBR=ulan@chromium.org,mlippautz@chromium.org

Change-Id: Ide2c0b284b52bee17573adcc89f14be4e40dab91
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:843903
Reviewed-on: https://chromium-review.googlesource.com/c/1349189Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57759}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/05ea63b..cd7b727

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/aa21a92..4ed4737

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/d66dad7..25c4fce

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: Id8608976646cb19b61698a6bc824977c5d55357a
Reviewed-on: https://chromium-review.googlesource.com/c/1349110
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#57758}

Add a path into embedder tracing on allocation. This is safe as as Blink
is not allowed to call into V8 during object construction.

Bug: chromium:843903
Change-Id: I5af053c3169f5a33778ebce5d7c5c43e4efb1aa4
Reviewed-on: https://chromium-review.googlesource.com/c/1348749
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57757}

Bug: v8:8477, v8:8238
Tbr: bmeurer@chromium.org
Change-Id: I03e6e83bc805c6880318161e00b367df0a3b4003
Reviewed-on: https://chromium-review.googlesource.com/c/1348434
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57756}

Bug: chromium:852420
Change-Id: Ice7548bf9993bc5dd57b301c410c019eb956daa5
Reviewed-on: https://chromium-review.googlesource.com/c/1348077Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57755}

Use the list of keywords to tighten the CannotBeKeyword scan flag to
also exclude lower case letters which are not present in any of the
keywords.

Change-Id: I6a00b5f5ee8f47088539806f15890a7489441fea
Reviewed-on: https://chromium-review.googlesource.com/c/1347475
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57754}

This simplifies the ExpressionClassifier a bit again, making it a little more
understandable.

Change-Id: I57bdd871b10409ea04b33748609160f2b40a498a
Reviewed-on: https://chromium-review.googlesource.com/c/1348431Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57753}

Bug: v8:7793
Change-Id: Iccf60ed192fd91456caa730d5ea98dd3abe3614e
Reviewed-on: https://chromium-review.googlesource.com/c/1348076Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Daniel Clifford <danno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57752}

If we're verifying/accumulating/throwing all possible classifier errors anyway,
we don't need our own classifier.

Change-Id: Ibfbdc4e5151190385598fc50bda9f9921b6aedce
Reviewed-on: https://chromium-review.googlesource.com/c/1348080
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57751}

This CL also makes existence of the optional padding field in JSArrayBuffer
explicit and ensures that the field stays cleared after initialization.

Bug: v8:8477, v8:8238
Change-Id: Ic4c5f6b0066903651f15bea91fbfe32ba62fa0e6
Reviewed-on: https://chromium-review.googlesource.com/c/1347469
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57750}

This API allows the embedder to provide a stack and PC, FP and
SP registers. V8 will then attempt to unwind the stack to the C++ frame
that called into JS. This API is signal-safe, meaning it does not call
any signal-unsafe OS functions or read/write any V8 state.

Bug: v8:8116

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I7e3e73753b711737020b6a5f11946096658afa6f
Reviewed-on: https://chromium-review.googlesource.com/c/1186724
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57749}

Now the accessors do not use the LoadWeakFixedArrayElement function.

Bug: v8:8486
Change-Id: Icccf294c25bbedb118cb2dd7a422dc71d70c727b
Reviewed-on: https://chromium-review.googlesource.com/c/1348071Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57748}

TBR=sergiyb@chromium.org

Bug: chromium:903688
Change-Id: I006e0e47b64edabdafadf030b09864433b9486d6
Reviewed-on: https://chromium-review.googlesource.com/c/1340101
Commit-Queue: Sergiy Belozorov <sergiyb@chromium.org>
Reviewed-by: Sergiy Belozorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57747}

Add a profiler for functions imported to WASM instances. This profiler
is implemented entirely in JavaScript and monkey-patches
WebAssembly.instantiate() and new WebAssembly.Instance() to instrument
the imported functions to each instance in order to count their
invocations and cumulative time.

R=mstarzinger@chromium.org

Bug: v8:8423
Change-Id: If456355aba07dc69c5500bafbe35fc56b31486af
Reviewed-on: https://chromium-review.googlesource.com/c/1347488
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57746}

Port fed7bb50

Original Commit Message:

    This test cases ensures that it is possible to maintain a coherent
    instruction cache by using {Assembler::FlushICache} in any order with
    respect to changing page permissions via {SetPermissions}.

R=mstarzinger@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:6792
LOG=N

Change-Id: I23d5d0828dcbdd527aaa8708fa726a7cb5cbedfe
Reviewed-on: https://chromium-review.googlesource.com/c/1347511Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#57745}

this will allow to add raw fields to the native context in a pointer compression
friendly way.

This CL also adds a microtask_queue field to native context which will be used
in a follow-up CL.

Bug: v8:8238, v8:7703
Change-Id: I5ecf72dbc52e8261b694551cbc8476f967967723
Reviewed-on: https://chromium-review.googlesource.com/c/1348073
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57744}

Instead, simply track it as a valid binding pattern. To do this in the case of
parenthesized formals, we delay throwing the binding pattern error for
parenthesized (and async "calls") until we know it's not an arrow function head
by itself.

This guarantees that if an arrow head is a valid binding pattern, it's either a
valid parenthesized head or a valid identifier, or invalid pattern ("array" or
"object" literal style). We can detect the latter case by checking that the
current token is not a RPAREN and the expression isn't an identifier.
(Alternatively we could check that the curren token is RBRACE or RBRACK...)

Bug: chromium:907575
Change-Id: Ie40cc3235d3188f2620b6c089a0f49d93604dda6
Reviewed-on: https://chromium-review.googlesource.com/c/1348078Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57743}

This adds the function call functionality for the arm32 port of Liftoff.

Bug: v8:6600
Change-Id: I8ca00b370c629157c91fd9a905f34ea41ec53d29
Reviewed-on: https://chromium-review.googlesource.com/c/1346336Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57742}

Add a check to bailout in the case when F32 parameters are used for Arm.

Bug: v8:6600, chromium:904026, chromium:904606
Change-Id: I7f70c0806994a89dca31ef7e0b68f91d68484936
Reviewed-on: https://chromium-review.googlesource.com/c/1346492
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57741}

R=ulan@chromium.org
BUG=chromium:845877

Change-Id: If8a9e2f107bb775494b1d4a83c3fb045bb846b10
Reviewed-on: https://chromium-review.googlesource.com/c/1347482Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57740}

There's no reason to scatter this all over when we have a single choke
point in Isolate::Init.

Drive-by: Remove unused DLH builtin kind.

Bug: v8:8238
Change-Id: I46373a1044e51d90d3a9c3e772f5930d57097937
Reviewed-on: https://chromium-review.googlesource.com/c/1347481Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57739}

Bug: v8:8361, v8:7790
Change-Id: I1d7a8cba1873efff9d49b12994a1561879d200de
Reviewed-on: https://chromium-review.googlesource.com/c/1347487Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57738}