R=clemensh@chromium.org
TEST=cctest/test-run-wasm-exceptions
BUG=v8:8729

Change-Id: I3751599bd72aaae1a9816e728437c64daf465f41
Reviewed-on: https://chromium-review.googlesource.com/c/1477733
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59691}

This reverts commit d74840b7.

Reason for revert: breaks stress sampling profiler

Original change's description:
> Reland "[heap] Enable large objects in young generation"
> 
> This is a reland of 932a5ca8
> 
> The GC stress failure was caused by v8:8801
> 
> Original change's description:
> > [heap] Enable large objects in young generation
> >
> > Bug: chromium:852420
> > Change-Id: Id1cde3450c5ca046029b17eee5dbe5132f299c3d
> > Reviewed-on: https://chromium-review.googlesource.com/c/1477212
> > Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> > Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#59669}
> 
> Bug: chromium:852420
> Change-Id: I1fd28869f21715798fe49508efb7f3a622803ffc
> Reviewed-on: https://chromium-review.googlesource.com/c/1477218
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Hannes Payer <hpayer@chromium.org>
> Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#59683}

TBR=ulan@chromium.org,hpayer@chromium.org,mlippautz@chromium.org

Change-Id: Ieb81de35df1ccb9ef5c6d59c13f34ba294b848ed
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:852420
Reviewed-on: https://chromium-review.googlesource.com/c/1477732Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59690}

These are no longer needed now that JS builtins have been fully
removed.

The internal match usage in assert.js has been replaced by a custom
miniparser. The internal replace use in various string builtins was
replaced by manual global string replacement in a runtime function.

Bug: v8:8842,v8:7624
Change-Id: Ieb49c694662a13e84fd9fd2fe5d0412b8e0574da
Reviewed-on: https://chromium-review.googlesource.com/c/1473030Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Peter Wong <peter.wm.wong@gmail.com>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59689}

Bug: chromium:926189
Change-Id: Ibd90f3cfdb37f07f3668f9ad79cff6e4305dc874
Reviewed-on: https://chromium-review.googlesource.com/c/1477674Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59688}

NOTRY=true

Bug: chromium:853202
Change-Id: Ieafb30e2aebedcab3e62c2659e7d093399068fb2
Reviewed-on: https://chromium-review.googlesource.com/c/1477222Reviewed-by: Sergiy Belozorov <sergiyb@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59687}

R=mslekova@chromium.org

Bug: v8:7790
Change-Id: I8866ac4a386d535e7c6c00454d93236340ea4fc3
Reviewed-on: https://chromium-review.googlesource.com/c/1477282Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59686}

Fixes cctest/test-cpu-profiler/DetailedSourcePositionAPI by ensuring
that source positions are available when starting an optimize job when
NeedsDetailedOptimizedCodeLineInfo is set. Also collects source
positions when inlining functions and adds a new test for this.

Bug: v8:8510
Change-Id: I9d84e37f3c8b638db080f6ec4b6633cdd7e3ee2f
Reviewed-on: https://chromium-review.googlesource.com/c/1472634Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59685}

The histogram is not used anymore. Remove to safe resources.

Bug: chromium:926072
Change-Id: I929f34f7ab0613431eaf9740f3342b6b2cec6cbd
Reviewed-on: https://chromium-review.googlesource.com/c/1477672Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59684}

This is a reland of 932a5ca8

The GC stress failure was caused by v8:8801

Original change's description:
> [heap] Enable large objects in young generation
>
> Bug: chromium:852420
> Change-Id: Id1cde3450c5ca046029b17eee5dbe5132f299c3d
> Reviewed-on: https://chromium-review.googlesource.com/c/1477212
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#59669}

Bug: chromium:852420
Change-Id: I1fd28869f21715798fe49508efb7f3a622803ffc
Reviewed-on: https://chromium-review.googlesource.com/c/1477218Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59683}

Updates CloneIC builtin to take the CloneIC_slow path when there is no
feedback vector. Also fixes the CloneIC_Slow to handle proxies correctly.

StoreInArrayLiteralIC doesn't change the behaviour but just makes it
consistent with other ICs.

Bug: v8:8293
Change-Id: Ib824b3ef06db1595ce06f04669857bb957cbe072
Reviewed-on: https://chromium-review.googlesource.com/c/1475750
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59682}

to kTaggedSize or kSystemPointerSize.

Like X64's CLs, but combined:
https://chromium-review.googlesource.com/c/v8/v8/+/1384092
https://chromium-review.googlesource.com/c/v8/v8/+/1384309 and
https://chromium-review.googlesource.com/c/v8/v8/+/1473291

Bug: v8:8477, v8:8834
Change-Id: I832999996a0b56bd34ec6aa4fd86d9a5476e1065
Reviewed-on: https://chromium-review.googlesource.com/c/1477215
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59681}

This reverts commit 1a3a2bc3.

Reason for revert: Only CL in a reverted roll (https://chromium-review.googlesource.com/c/chromium/src/+/1477147)

Original change's description:
> Fix accessor update of non-extensible maps.
> 
> When installing getter/setter of non-extensible map with existing
> setter/getter of the same name, we introduce a new transition
> (so we have two transitions with the same name!). This triggers
> an assertion in map updater.
> 
> This fix carefully checks that on the back-pointer path from
> non-extensible map to the extensible map there are only
> integrity level transitions. Otherwise, we just bail out.
> 
> Bug: chromium:932953
> Change-Id: I02e91c3b652428a84a9f5c58b6691ea9b1fc44d6
> Reviewed-on: https://chromium-review.googlesource.com/c/1477067
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#59667}

TBR=jarin@chromium.org,ishell@chromium.org

Change-Id: I9264423c605cebef87beb6c0f066e90b59faae48
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:932953
Reviewed-on: https://chromium-review.googlesource.com/c/1477219Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59680}

There are now less that 400 days until the end of life
of Python 2(aka _legacy_ Python) https://pythonclock.org/ .
The code compatibility check for python2 and python3
used the following tools: futurize, flake8
You can see the reports here: https://travis-ci.com/bmsdave/v8/builds

This CL was uploaded by git cl split.

Bug: v8:8594
Change-Id: Idbf467daf629a4e808345a6a88036c2a3f259138
Reviewed-on: https://chromium-review.googlesource.com/c/1470121
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Sergiy Belozorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59679}

There are now less that 400 days until the end of life
of Python 2(aka _legacy_ Python) https://pythonclock.org/ .
The code compatibility check for python2 and python3
used the following tools: futurize, flake8
You can see the reports here: https://travis-ci.com/bmsdave/v8/builds

This CL was uploaded by git cl split.

Bug: v8:8594
Change-Id: I2a90aaecb270f03aed1c0fc92da1a0e2621b0eb2
Reviewed-on: https://chromium-review.googlesource.com/c/1470101
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Sergiy Belozorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59678}

There are now less that 400 days until the end of life
of Python 2(aka _legacy_ Python) https://pythonclock.org/ .
The code compatibility check for python2 and python3
used the following tools: futurize, flake8
You can see the reports here: https://travis-ci.com/bmsdave/v8/builds

This CL was uploaded by git cl split.

Bug: v8:8594
Change-Id: Id7e2f3d5751d9f0428d28f92106748d71db0042e
Reviewed-on: https://chromium-review.googlesource.com/c/1470122Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Sergiy Belozorov <sergiyb@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59677}

This restores assertion scope marking in the bta command making it
obvious which frames disallowed heap allocation for instance.

Change-Id: Ie99ff06df95b6ab6820e53798b12b1cd1bd97338
Reviewed-on: https://chromium-review.googlesource.com/c/1477213Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59676}

There are now less that 400 days until the end of life
of Python 2(aka _legacy_ Python) https://pythonclock.org/ .
The code compatibility check for python2 and python3
used the following tools: futurize, flake8
You can see the reports here: https://travis-ci.com/bmsdave/v8/builds

This CL was uploaded by git cl split.

Bug: v8:8594
Change-Id: I661c52a70527e8ddde841fee6d4dcba282b4a938
Reviewed-on: https://chromium-review.googlesource.com/c/1470123
Commit-Queue: Sergiy Belozorov <sergiyb@chromium.org>
Reviewed-by: Sergiy Belozorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59675}

The test is sensitive to bytecode flushing.

Bug: v8:8801
Change-Id: I2e290246681c014838be7411cc0ff68fd44c3590
Reviewed-on: https://chromium-review.googlesource.com/c/1477217Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59674}

The access made unsafe were chosen according what's hot in
JSTests/Regexp and Octane/regexp.

Bug: chromium:932919
Change-Id: I8229370f2dd7d0937e9d561f6957fb9dba6d6a25
Reviewed-on: https://chromium-review.googlesource.com/c/1477270Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59673}

This reverts commit 932a5ca8.

Reason for revert: breaks GC stress

Original change's description:
> [heap] Enable large objects in young generation
> 
> Bug: chromium:852420
> Change-Id: Id1cde3450c5ca046029b17eee5dbe5132f299c3d
> Reviewed-on: https://chromium-review.googlesource.com/c/1477212
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#59669}

TBR=ulan@chromium.org,hpayer@chromium.org,mlippautz@chromium.org

Change-Id: I16f0705cf37fdc1708c605abd76d79dac3f1e825
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:852420
Reviewed-on: https://chromium-review.googlesource.com/c/1477278Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59672}

This reverts commit 49de5875.

Reason for revert: breaks TSAN

Original change's description:
> [heap] Perform more embedder tracing in incremental marking step
> 
> This should fix GC latency regressions introduced in 4c6598.
> 
> Bug: chromium:926189, chromium:930844, chromium:930693,chromium:931629
> Change-Id: I81c91829badbeea82d6e44670d07794632869424
> Reviewed-on: https://chromium-review.googlesource.com/c/1477216
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#59668}

TBR=ulan@chromium.org,mlippautz@chromium.org

Change-Id: Iac914fe695740558f0fac3ad0172f48114b57312
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:926189, chromium:930844, chromium:930693, chromium:931629
Reviewed-on: https://chromium-review.googlesource.com/c/1477277Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59671}

When setting up the initial map for a (class or function) constructor,
we always over-allocate a bunch of in-object properties, in case not
all property assignments happen as `this.prop = val` assignments in
the constructor. However this over-allocation was a bit too aggressive
and added a slack of 8 to each class constructor (plus a minimum of
two, when there was no `this.prop = val` assignment). So in total this
would yield an object with initially 40 in-object property slots in
case of a simple class hierarchy like this:

```js
class A {};
class B extends A {};
class C extends B {};
class D extends C {};
new D;
```

While the slack tracking takes care of eventually shrinking the objects
to appropriate sizes, this aggressive over-allocation is still going to
hurt performance quite a bit in the beginning, and will also lead to
more traffic on the minor GC for now good reason.

Instead of the above, we now allocate a minimum of 2 in-object
properties per class (in a hierarchy) and then add a slack of 8 in the
end. Meaning for the example above we end up with 16 initial in-object
property slots, which seems sensible.

Bug: v8:8853
Change-Id: I4a11e35a8612ceef1d776ca2f0543a26c8c2a2bf
Reviewed-on: https://chromium-review.googlesource.com/c/1477276Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59670}

Bug: chromium:852420
Change-Id: Id1cde3450c5ca046029b17eee5dbe5132f299c3d
Reviewed-on: https://chromium-review.googlesource.com/c/1477212Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59669}

This should fix GC latency regressions introduced in 4c6598.

Bug: chromium:926189, chromium:930844, chromium:930693,chromium:931629
Change-Id: I81c91829badbeea82d6e44670d07794632869424
Reviewed-on: https://chromium-review.googlesource.com/c/1477216Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59668}

When installing getter/setter of non-extensible map with existing
setter/getter of the same name, we introduce a new transition
(so we have two transitions with the same name!). This triggers
an assertion in map updater.

This fix carefully checks that on the back-pointer path from
non-extensible map to the extensible map there are only
integrity level transitions. Otherwise, we just bail out.

Bug: chromium:932953
Change-Id: I02e91c3b652428a84a9f5c58b6691ea9b1fc44d6
Reviewed-on: https://chromium-review.googlesource.com/c/1477067Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59667}

Googletest is (at last) converging with industry-standard terminology
[1]. We previously called test suites "test cases", which was rather
confusing for folks coming from any other testing framework.

Chrome now has a googletest version that supports _TEST_SUITE_ macros
instead of _TEST_CASE_, so this CL cleans up some of the outdated usage.

[1] https://github.com/google/googletest/blob/master/googletest/docs/primer.md#beware-of-the-nomenclature

Bug: chromium:925652
Change-Id: I3cd02b9fa6dbece1594bbfd50a21ad7503c2aab9
Reviewed-on: https://chromium-review.googlesource.com/c/1475654Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Victor Costan <pwnall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59666}

FromTopOrLimit was both created and renamed to FromAllocationAreaAddress
as part of https://codereview.chromium.org/1900423002/

Bug: v8:8562
Change-Id: I117cc566ed3a420c4419f0f0645c2e200be57def
Reviewed-on: https://chromium-review.googlesource.com/c/1477214Reviewed-by: Dan Elphick <delphick@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Maciej Goszczycki <goszczycki@google.com>
Cr-Commit-Position: refs/heads/master@{#59665}

This addresses the JSTests/Array/OptFastForEach regression,
which ends up spending a lot of time in the ToString builtin.

Bug: chromium:932919
Change-Id: I53cfdc61841bf10a669e54c3fdc009ead295782b
Reviewed-on: https://chromium-review.googlesource.com/c/1477068Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59664}

This should recover the microbenchmark performance-regressions.

Bug: chromium:932919
Change-Id: I00e2345428c8730035dc1164278006d687364de7
Reviewed-on: https://chromium-review.googlesource.com/c/1477063Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59663}

Change-Id: Ic1f112ff47040024bc416a43867ddff08d51246c
Reviewed-on: https://chromium-review.googlesource.com/c/1475333Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#59662}

Several parameter names of PromiseBuiltinsAssembler methods do not match
to its definition, which confuses readers of the code.

Change-Id: I8a43dd71b5a8d203cd040d754f8e650ecb203b82
Reviewed-on: https://chromium-review.googlesource.com/c/1476880Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Taiju Tsuiki <tzik@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59661}

Progress indicator calculates the percentage using the estimated amount of
tests.

When base tests produce more tests or when testrunner filters some tests, the
percentage terminates over 100% or under it.

This CL adds an informative message about how the percentage behaves.

R=machenbach@chromium.org
CC=yangguo@chromium.org,sergiyb@chromium.org

Bug: v8:8728
Change-Id: I91cafd2579ea1894ac347ff7483c307cd46c545d
Reviewed-on: https://chromium-review.googlesource.com/c/1477056Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Tamer Tas <tmrts@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59660}

Change-Id: I25a2299e5e261cc125c7ff0e1acdeddbd7f664ff
Reviewed-on: https://chromium-review.googlesource.com/c/1475753Reviewed-by: Dan Elphick <delphick@chromium.org>
Commit-Queue: Maciej Goszczycki <goszczycki@google.com>
Cr-Commit-Position: refs/heads/master@{#59659}

Bug: chromium:933107
Change-Id: Ie3a485447f96228d5c8d7fc169c9aabf8ccf6599
Reviewed-on: https://chromium-review.googlesource.com/c/1477057Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59658}

Reason for revert/reland: UBSan complained of unaligned reads.

To improve the Torque debugging experience, we can add source positions
for each line. This information is carried through the generated
CSA code (in <output directory>/gen/torque-generated/*.cc) and
embedded as SourcePositions in the Code object.

At snapshot time, these SourcePositions are stripped from the Code
object and turned into platform-appropriate line number debug
information.

At this time on Linux, you'll need to build with "is_clang=false"
in order to use GCC, because crucial steps are missing in Clang's
ability to convey the information into the binary successfully.

This CL also introduces a flag to control the existing source
information in CSA code. --enable-source-at-csa-bind is now set
to false by default because it's a bit confusing to "hop" between
source lines in .TQ files and in .CC files. I expect to continue
making adjustments there, as I want to provide helpful
debugging aids at the CSA level as well as the Torque level.
The current configuration prioritizes Torque.

TBR=tebbi@chromium.org

Bug: v8:8418
Change-Id: Idb80467d3679ec2361386fe9b67597b93d7f72cf
Reviewed-on: https://chromium-review.googlesource.com/c/1475763Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59657}

To recover the performance regressions of FixedArray bounds-checks by
default, disable bounds checks in the hot loops of ArrayIndexOf.

Bug: chromium:932919
Change-Id: I977f063f6cb200a342e72a6361d56f945c442aec
Reviewed-on: https://chromium-review.googlesource.com/c/1477059Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59656}

Also adding LoadTaggedPointerField and LoadAnyTaggedField that were
missed on previous CLs.

Similar to X64's CL:
https://chromium-review.googlesource.com/c/v8/v8/+/1460953

Bug: v8:7703
Change-Id: I9c917aadace65d45204c3360aeeb7e9ece296e70
Reviewed-on: https://chromium-review.googlesource.com/c/1475474Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59655}

Correctness fuzzers need the global object to have a consistent shape
across build configs.

Bug: chromium:932877,chromium:932656,v8:7777
Change-Id: Id4e1251e50965b822bc4ef36c5ae2777864273d5
Reviewed-on: https://chromium-review.googlesource.com/c/1475768Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59654}

This CL changes Array#sort to work roughly like:
    1) Call [[Get]] on the receiver in [0, length) and store to FA
    2) Use the existing TimSort to sort that FA
    3) Call [[Set]] on the receiver in [0, length) using the result

This has the advantage that we no longer need different fast-paths
for the sorting algorithm itself, only for step 1 and 3. This results
in a code size reduction of ~2650 bytes.

This CL does not include optimizations that elides step 1 or 3.

Change-Id: I7f2e35067a6ec356add8b0c50b160d76813c536d
Reviewed-on: https://chromium-review.googlesource.com/c/1458237
Commit-Queue: Simon Zünd <szuend@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59653}

These tests were timing out because we used to miss to runtime when
storing keyed properties in lite mode. Now, the store ICs are updated to
use fast path when possible even with lite mode. So, these should no longer
timeout

Bug: v8:8293
Change-Id: I63481768cc7d12c25c7f1a20ed1fa097979f2c50
Reviewed-on: https://chromium-review.googlesource.com/c/1475754Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59652}