When the main thread terminates, it forcibly terminates all Worker threads.
When this happens, the threads objects were only half-created; they had a
JavaScript Worker object, but not a C++ worker object.

This CL fixes that bug, as well as some other fixes:
* Signatures on Worker methods
* Use SetAlignedPointerFromInternalField instead of using an External.
* Remove state_ from Worker. Simplify to atomic bool running_.

BUG=chromium:511880
R=jarin@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1255563002

Cr-Commit-Position: refs/heads/master@{#29911}

Changes the interpreter to use a BytecodeArray pointer and an offset to avoid
having an inner pointer to a BytecodeArray object in registers during dispatch.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1254293006

Cr-Commit-Position: refs/heads/master@{#29910}

1 << 24 is apparently not large enough for some optimized code.

R=jkummerow@chromium.org
BUG=v8:4272
LOG=N

Review URL: https://codereview.chromium.org/1265663002

Cr-Commit-Position: refs/heads/master@{#29909}

Moves some uncommon type checking from ToNumber and
NonNumberToNumber into DefaultNumber. This should
speed up numeric operations especially as more "value types
are added.

LOG=N
BUG=513196, v8:4124

Review URL: https://codereview.chromium.org/1260273002

Cr-Commit-Position: refs/heads/master@{#29908}

R=dstence@us.ibm.com, michael_dawson@ca.ibm.com
BUG=
NOTREECHECKS=true

Review URL: https://codereview.chromium.org/1259723002

Cr-Commit-Position: refs/heads/master@{#29907}

Port 5dff4bdf

Original commit message:
    No need to pass the name explicitly to the stubs; the runtime can
    extract the name from the ScopeInfo (the extension of the
    ScriptContext) on-demand easily without any performance impact.

R=bmeurer@chromium.org, dstence@us.ibm.com, michael_dawson@ca.ibm.com
BUG=
NOTREECHECKS=true

Review URL: https://codereview.chromium.org/1258273002

Cr-Commit-Position: refs/heads/master@{#29906}

Revert^3 "Enable loads and stores to global vars through property cell shortcuts installed into par… (patchset #1 id:1 of https://codereview.chromium.org/1254723004/)

Reason for revert:
Suspected to cause Canary crashes

Original issue's description:
> Reland^2 "Enable loads and stores to global vars through property cell shortcuts installed into parent script context".
>
> This reverts commit 362b3785.
>
> R=ishell@chromium.org
>
> Committed: https://crrev.com/440ae014e56924b52337c3747221b79283f07b81
> Cr-Commit-Position: refs/heads/master@{#29849}

TBR=ishell@chromium.org,v8-mips-ports@googlegroups.com,plind44@gmail.com,bmeurer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true

Review URL: https://codereview.chromium.org/1260423002

Cr-Commit-Position: refs/heads/master@{#29905}

R=jkummerow@chromium.org
NOTREECHECKS=true

Review URL: https://codereview.chromium.org/1268463002

Cr-Commit-Position: refs/heads/master@{#29904}

Literals should stay together to simplify allocation folding. This CL takes the pretenuring information from the outermost literal and applies it to the inner liberals.

BUG=chromium:514721
LOG=n
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1263773002 .

Cr-Commit-Position: refs/heads/master@{#29903}

Rolling v8/buildtools to f0b8022601cf9c3c1a2f7efcea48e2fe81d3b143

TBR=machenbach@chromium.org
NOTREECHECKS=true

Review URL: https://codereview.chromium.org/1262733002

Cr-Commit-Position: refs/heads/master@{#29902}

BUG=
R=jkummerow@chromium.org
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1259013002

Cr-Commit-Position: refs/heads/master@{#29901}

BUG=chromium:511215
NOTREECHECKS=true
NOTRY=true
LOG=n
TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1262113002

Cr-Commit-Position: refs/heads/master@{#29900}

This allows variants to be named on test failures (follow
up) and then to be used in the test runner for a repro.

This also speeds up variant iteration for test262 and fixes
a bug with variants for benchmarks.

BUG=chromium:511215
NOTREECHECKS=true
LOG=n

Review URL: https://codereview.chromium.org/1245623005

Cr-Commit-Position: refs/heads/master@{#29899}

When a prototype object migrates from a slow to a fast map, where the slow map
was registered as a user of its own prototype, then the registration must be
transferred to the new map (just like MigrateToMap does for all other cases).

BUG=chromium:513602
LOG=y
NOTREECHECKS=true

Review URL: https://codereview.chromium.org/1263543004

Cr-Commit-Position: refs/heads/master@{#29898}

luci-config has been switched to read from
https://chromium.googlesource.com/v8/v8/+/infra/config

R=machenbach@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=513460

Review URL: https://codereview.chromium.org/1258763004

Cr-Commit-Position: refs/heads/master@{#29897}

Scoping rules are different on recompile vis-a-vis global loads.

BUG=chromium:514526
LOG=y
NOTREECHECKS=true

Review URL: https://codereview.chromium.org/1256413005

Cr-Commit-Position: refs/heads/master@{#29896}

BUG=

Review URL: https://codereview.chromium.org/1257583005

Cr-Commit-Position: refs/heads/master@{#29895}

TBR=yangguo@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1264443002

Cr-Commit-Position: refs/heads/master@{#29894}

Original issue's description:
> Remove ExternalArray, derived types, and element kinds
>
> BUG=v8:3996
> R=jarin@chromium.org, mvstanton@chromium.org, bmeurer@chromium.org
> LOG=y
>
> Committed: https://crrev.com/607ef7c6009a24ebf195b4cab7b0b436c5afd21c
> Cr-Commit-Position: refs/heads/master@{#29872}

BUG=v8:3996
R=bmeurer@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/1262583002

Cr-Commit-Position: refs/heads/master@{#29893}

port 5dff4bdf (r29886).

original commit message:

    No need to pass the name explicitly to the stubs; the runtime can
    extract the name from the ScopeInfo (the extension of the
    ScriptContext) on-demand easily without any performance impact.

BUG=

Review URL: https://codereview.chromium.org/1259063004

Cr-Commit-Position: refs/heads/master@{#29892}

port cac64b9f (r29881)

original commit message:

    We don't need the hole check and slow runtime mode for read-only
    properties this way.

BUG=

Review URL: https://codereview.chromium.org/1263473002

Cr-Commit-Position: refs/heads/master@{#29891}

port a913f4bf (r29870).

original commit message:

BUG=

Review URL: https://codereview.chromium.org/1257883003

Cr-Commit-Position: refs/heads/master@{#29890}

Don't use different read/write slots for context globals, but
let them share the same slot, which reduces the number of
initial misses, and also saves some memory for large scripts.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1258213002

Cr-Commit-Position: refs/heads/master@{#29889}

Revert of Activate preserving of optimized code map accross GCs. (patchset #1 id:1 of https://codereview.chromium.org/1217863006/)

Reason for revert:
This CL may be the reason for the spike on memory corruption. Tentatively reverting this CL.

BUG=chromium:512780
LOG=n

Original issue's description:
> Activate preserving of optimized code map accross GCs.
>
> This enables --noflush-optimized-code-cache which allows preserving
> entries in the optimized code map accross GCs. This only applies to
> values being reachable through other paths.
>
> R=hpayer@chromium.org,hablich@chromium.org
>
> Committed: https://crrev.com/1a8776db25b63c4ce718423772d1fd13f58eeab5
> Cr-Commit-Position: refs/heads/master@{#29755}

TBR=hablich@chromium.org,mstarzinger@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1255043003

Cr-Commit-Position: refs/heads/master@{#29888}

We can apply the shortcut used for data properties of the JSGlobalObject
to builtin properties as well. This mostly affects the custom properties
we use for the Math functions (i.e. rngstate for Math.random() and kMath
for sin, cos and friends).

Drive-by-fix: Also mark the internal builtin typed arrays properties
(rngstate, kMath and rempio2result) as READ_ONLY, as they should not be
touched after genesis.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1254143003

Cr-Commit-Position: refs/heads/master@{#29887}

No need to pass the name explicitly to the stubs; the runtime can
extract the name from the ScopeInfo (the extension of the
ScriptContext) on-demand easily without any performance impact.

Review URL: https://codereview.chromium.org/1259963002

Cr-Commit-Position: refs/heads/master@{#29886}

Rolling v8/third_party/android_tools to e17c167589c7cff61a00c4d3674765536ee8d46c

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1255393002

Cr-Commit-Position: refs/heads/master@{#29885}

R=michael_dawson@ca.ibm.com, danno@chromium.org, yangguo@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1255953003

Cr-Commit-Position: refs/heads/master@{#29884}

Revert of Remove ExternalArray, derived types, and element kinds (patchset #5 id:80001 of https://codereview.chromium.org/1254623002/)

Reason for revert:
[Sheriff] Breaks several layout tests, e.g.:
http://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2032/builds/1067

Several output lines change from PASS to FAIL. If the changes are intended, please land a needsmanualrebaseline change in blink first.

Original issue's description:
> Remove ExternalArray, derived types, and element kinds
>
> BUG=v8:3996
> R=jarin@chromium.org, mvstanton@chromium.org, bmeurer@chromium.org
> LOG=y
>
> Committed: https://crrev.com/607ef7c6009a24ebf195b4cab7b0b436c5afd21c
> Cr-Commit-Position: refs/heads/master@{#29872}

TBR=bmeurer@chromium.org,hpayer@chromium.org,jarin@chromium.org,mvstanton@chromium.org,jochen@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3996

Review URL: https://codereview.chromium.org/1257223002

Cr-Commit-Position: refs/heads/master@{#29883}

Port cac64b9f

Original commit message:
    We don't need the hole check and slow runtime mode for read-only
    properties this way.

R=bmeurer@chromium.org, dstence@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1257183003

Cr-Commit-Position: refs/heads/master@{#29882}

We don't need the hole check and slow runtime mode for read-only
properties this way.

R=ishell@chromium.org

Review URL: https://codereview.chromium.org/1255133002

Cr-Commit-Position: refs/heads/master@{#29881}

Port 156042f7

R=ishell@chromium.org, dstence@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1259583003

Cr-Commit-Position: refs/heads/master@{#29880}

R=michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1260663003

Cr-Commit-Position: refs/heads/master@{#29879}

Port a913f4bf

R=mvstanton@chromium.org, dstence@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1261663002

Cr-Commit-Position: refs/heads/master@{#29878}

Per discussion on the bug, the DCHECK'd case actually occurs in normal
operation, outside of V8's control.

BUG=chromium:388244
LOG=n

Review URL: https://codereview.chromium.org/1255043002

Cr-Commit-Position: refs/heads/master@{#29877}

BUG=
R=danno@chromium.org, mbrandy@us.ibm.com

Review URL: https://codereview.chromium.org/1245023003

Cr-Commit-Position: refs/heads/master@{#29876}

BUG=chromium:267773
LOG=n
NOTRY=true

Review URL: https://codereview.chromium.org/1255183002

Cr-Commit-Position: refs/heads/master@{#29875}

This has become possible since we never compile for debugging in the
first compile pass of a script.

R=vogelheim@chromium.org
BUG=chromium:513335
LOG=N

Review URL: https://codereview.chromium.org/1255153002

Cr-Commit-Position: refs/heads/master@{#29874}

Regression test for CL 3eb91e8a.

BUG=chromium:507979
LOG=N

Review URL: https://codereview.chromium.org/1255173002

Cr-Commit-Position: refs/heads/master@{#29873}

BUG=v8:3996
R=jarin@chromium.org, mvstanton@chromium.org, bmeurer@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/1254623002

Cr-Commit-Position: refs/heads/master@{#29872}