This reverts commit c32f6614.

Reason for revert:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20TSAN/builds/20563

Original change's description:
> [logging] Remove unused code
> 
> This removes unused mutex, headers from log.(h|cc).
> 
> Change-Id: Ie4dc69a7efa9494b21ff6e2b19828bd740e3a47c
> Reviewed-on: https://chromium-review.googlesource.com/1041967
> Reviewed-by: Camillo Bruni <cbruni@chromium.org>
> Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52946}

TBR=jarin@chromium.org,cbruni@chromium.org

Change-Id: I48b63c7fc6a10e118b735f708db37d353ba6c0f7
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/1041969Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52950}

This reverts commit a0c57368.

Reason for revert: Speculative revert due to failures with custom
snapshot:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/builds/19061

Local bisect also points to this change:
http://shortn/_IhVxU2FKLu

Original change's description:
> [wasm] Maintain link from Instance to Module.
> 
> This moves the link from a {WasmInstanceObject} to its corresponding
> {WasmModuleObject} into the right place and also makes it strong. This
> ensures that an instance always keeps the underlying module alive and
> hence removes the situation of an "orphaned instance".
> 
> R=​clemensh@chromium.org
> 
> Change-Id: Id59f6a49740af8ef0248679c3d2c696bb9776944
> Reviewed-on: https://chromium-review.googlesource.com/1041691
> Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52942}

TBR=mstarzinger@chromium.org,clemensh@chromium.org

Change-Id: I1830e6ce14314f06f918a0c428182bfd68354ad9
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/1041968Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52949}

Bug: chromium:999634
Change-Id: Ia7a0dd6ddc2477a7656a26548e9a247470d9143f
Reviewed-on: https://chromium-review.googlesource.com/1041688
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52948}

This is a preparatory step for implementing generics. Along the way, clean up
and encapsulate a bunch of code, including:

* Fully encapsulate Scope by adding the new class ScopeChain that provide an
  abstraction for creating and activating scopes.
* Untangle Modules and Scopes.
* Unify scope activation so that it is always associated with an AST node
  and triggered by a RAII helper class.
* Unify (somewhat) how builtins and macros are created, fixing a few
  inconsistencies with when and how parameters and their types are declared.
* Create a new Declarations class that brokers between the visitor classes and
  the ScopeChain. This moves handling of declaration-related errors out of the
  visitors but also makes it possible to do so without polluting Scope and
  ScopeChain with details about resolving SourcePositions in error cases.

Change-Id: I180017d4cf39ccf5ef1d20b84f53284c252f8d87
Reviewed-on: https://chromium-review.googlesource.com/1038504
Commit-Queue: Daniel Clifford <danno@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52947}

This removes unused mutex, headers from log.(h|cc).

Change-Id: Ie4dc69a7efa9494b21ff6e2b19828bd740e3a47c
Reviewed-on: https://chromium-review.googlesource.com/1041967Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52946}

TBR=santa
NOTREECHECKS=true

Change-Id: Ia141585c57407b98140ca49cb75f0bc966da8c8c
Reviewed-on: https://chromium-review.googlesource.com/1041966
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52945}

This reverts commit 40f1aaf3.

Reason for revert:
https://luci-milo.appspot.com/buildbot/client.v8/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/21000

Original change's description:
> [heap] Mark RO_SPACE as read-only after deserialization
> 
> Adds MarkAsReadOnly and MarkAsReadWrite to ReadOnlySpace. The latter
> is only usable with ReadOnlySpace::WritableScope to avoid the space
> being left writable). MarkAsReadOnly updates the high water mark and
> makes several previously mutating methods into no-ops.
> 
> Moves some writes to immutable objects out of the bootstrapper to
> setup-heap-internal so they don't write to a read-only page.
> 
> Also avoid writing hashes to strings that already have the value set as
> that invariably means writing to the "0" and "1" constant strings in
> RO_SPACE.
> 
> Before serialization, it makes RO_SPACE writable again so that any
> padding can be cleared before writing it.
> 
> Bug: v8:7464
> Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
> Change-Id: I22edc20dba7dde8943991a8fcaf87244af4490a3
> Reviewed-on: https://chromium-review.googlesource.com/1014128
> Commit-Queue: Dan Elphick <delphick@chromium.org>
> Reviewed-by: Hannes Payer <hpayer@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52943}

TBR=yangguo@chromium.org,hpayer@chromium.org,mlippautz@chromium.org,delphick@chromium.org

Change-Id: Id4770c0fdb21cd9eea2f62a019f44a6bdea8f0a7
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7464
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/1041948Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52944}

Adds MarkAsReadOnly and MarkAsReadWrite to ReadOnlySpace. The latter
is only usable with ReadOnlySpace::WritableScope to avoid the space
being left writable). MarkAsReadOnly updates the high water mark and
makes several previously mutating methods into no-ops.

Moves some writes to immutable objects out of the bootstrapper to
setup-heap-internal so they don't write to a read-only page.

Also avoid writing hashes to strings that already have the value set as
that invariably means writing to the "0" and "1" constant strings in
RO_SPACE.

Before serialization, it makes RO_SPACE writable again so that any
padding can be cleared before writing it.

Bug: v8:7464
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I22edc20dba7dde8943991a8fcaf87244af4490a3
Reviewed-on: https://chromium-review.googlesource.com/1014128
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52943}

This moves the link from a {WasmInstanceObject} to its corresponding
{WasmModuleObject} into the right place and also makes it strong. This
ensures that an instance always keeps the underlying module alive and
hence removes the situation of an "orphaned instance".

R=clemensh@chromium.org

Change-Id: Id59f6a49740af8ef0248679c3d2c696bb9776944
Reviewed-on: https://chromium-review.googlesource.com/1041691Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52942}

Restores some sensemaking properties, such as making src/machine-type.h (lower
level header) independent of src/zone/zone.h (higher level header).

BUG=v8:7490

Change-Id: Ibc6e5c7a75e4aaf917d086cf70267abc7ee9a9b0
Reviewed-on: https://chromium-review.googlesource.com/1039586Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52941}

R=mstarzinger@chromium.org

Change-Id: I57ff09601a9e84cc5b53ff06a446b7dfc3c026b2
Reviewed-on: https://chromium-review.googlesource.com/1032742Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52940}

Now that wasm-linkage.h is split off, we can easily implement
{MoveToReturnRegister} in platform independent code.

R=titzer@chromium.org

Bug: v8:6600
Change-Id: I072a0ee48d58ed29e0df489016f838915c3f2cb2
Reviewed-on: https://chromium-review.googlesource.com/1041690
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52939}

NOTRY=true

Bug: chromium:830557
Change-Id: Iccd9a6e586d388c55382dd0fbb51d2b62922b8c5
Reviewed-on: https://chromium-review.googlesource.com/1041689
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52938}

This CL changes how TypedArray.p.sort is implemented in Torque, mainly
to address the binary memory size of the builtin.

With this CL the memory comes down from 53611 to 4215 (as reported
by --print-builtin-size on a x64.release build).
With the following performance impact
on the relevant benchmarks:

Benchmark  Original (JS)   Torque (initial)    This CL

IntTypes            83.9              263.7      202.3
BigIntTypes         32.1               54.6       47.2
FloatTypes          99.3              138.7      109.3

This is achieved by pushing the Load/Store dispatch based on
the elements kind into separate builtins that are executed
for each load/store. This results in only one version of the
sorting algorithm instead of one version per elements kind.

R=jgruber@chromium.org

Bug: chromium:837282
Change-Id: I7fe2da3cbfd01531d070128126a0d56d3dd6bdcc
Reviewed-on: https://chromium-review.googlesource.com/1033744
Commit-Queue: Simon Zünd <szuend@google.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52937}

Removes unused parameter from CommitBlock and CommitMemory functions.

Change-Id: I4b79c1802060f1f70e06fd39532758fcdae2bead
Reviewed-on: https://chromium-review.googlesource.com/1039830Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52936}

With the exception of the InterpreterEntryTrampoline, all builtins are
now isolate-independent and can be embedded into the binary.

This CL updates the corresponding list and also contains a few smallish
tweaks to support having these builtins off the heap:

* wasm: copy the off-heap builtin, not its trampoline.
* Code::contains: support off-heap builtins.
* JSFunction::is_compiled: compare builtin index instead of identity
  (this is relevant during mksnapshot when we transition from the
  on-heap builtin to its off-heap representation + the trampoline).
* Remove old DCHECKs.
* A few tweaks in macro-assembler ports that have snuck in recently.

Bug: v8:6666
Change-Id: Iabf5b47ade3826a4da35b6b75a4e61614f0158b0
Reviewed-on: https://chromium-review.googlesource.com/1032777
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52935}

Add an include of stdlib.h for the abort function. Compilation fails
on FreeBSD without it. See Node.js issue:
https://github.com/nodejs/node-v8/issues/56

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I67ac21fdc9bc1072d5aaf4f7180dcf4000a938c9
Reviewed-on: https://chromium-review.googlesource.com/1039705Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Michaël Zasso <mic.besace@gmail.com>
Cr-Commit-Position: refs/heads/master@{#52934}

R=leszeks@chromium.org, ulan@chromium.org

Bug: chromium:835973
Change-Id: I35600e1da60bb6cd3b87cd1573791355e310aa9c
Reviewed-on: https://chromium-review.googlesource.com/1032430
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52933}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/b5eb49a..34746fc

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/5b642ef..978be74

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: Ifac38f68b8a735a54a596ed872f5e2fa2b5307e0
Reviewed-on: https://chromium-review.googlesource.com/1041407Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52932}

If there is more then one agent accepts current pause, we should resume
only when last agent is disabled.

R=dgozman@chromium.org

Bug: chromium:834056
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel
Change-Id: I2904b3f4ab76117511e16450dd575ebf3e20a068
Reviewed-on: https://chromium-review.googlesource.com/1041207Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52931}

TBR: hpayer@chromium.org
Bug: v8:6443, v8:7569
Change-Id: Idd952ed0a832c469b76f1cbc919f700e09dc975d
Reviewed-on: https://chromium-review.googlesource.com/1031559
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52930}

Bug: None
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: Ie8a0db70a2f29567718fbacfd33fcd412109d069
Reviewed-on: https://chromium-review.googlesource.com/1034282
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52929}

SetPermissions causes memory that was previously reserved but uncommitted to be
committed. This could put us over the committed memory limit for the process,
causing SetPermissions to fail. In this case, we should report this as an out of
memory error rather than a crash.

Bug: chromium:838880
Change-Id: I2785aa9f5608fa04196fee2b280e0c6df2f56ca8
Reviewed-on: https://chromium-review.googlesource.com/1040657Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Eric Holk <eholk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52928}

This reverts commit 77aba17a.

Reason for revert: broke gc stress bot
https://ci.chromium.org/buildbot/client.v8/V8%20Mac64%20GC%20Stress/743

Original change's description:
> [heap] Verify that newly allocated MemoryChunks are pre-initialzed with 0.
> 
> Bug: chromium:829771
> Change-Id: I78eab59fded3f41c93ecb3d5d8a30e1bddc4576e
> Reviewed-on: https://chromium-review.googlesource.com/1039747
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Commit-Queue: Hannes Payer <hpayer@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52925}

TBR=hpayer@chromium.org,mlippautz@chromium.org

Change-Id: I3053cb9d052e520dd6a41f54a6c7e1654fa4d1f3
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:829771
Reviewed-on: https://chromium-review.googlesource.com/1041245Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52927}

Bug: v8:6532, v8:7570
Change-Id: Ieca502a6a13449ea65e47fb43f0e3d7cb5a09a7d
Reviewed-on: https://chromium-review.googlesource.com/1031176
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52926}

Bug: chromium:829771
Change-Id: I78eab59fded3f41c93ecb3d5d8a30e1bddc4576e
Reviewed-on: https://chromium-review.googlesource.com/1039747Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52925}

Bug:v8:7510

R=ahaas@chromium.org

Change-Id: Id3c6b4ebcb89300c4b886c79f4c688bc18648b06
Reviewed-on: https://chromium-review.googlesource.com/1036650
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52924}

The tracker needs to maintain the byte length as there is no order guarantee
when sweeping pages and the byte length may be a HeapNumber that is stored on a
different page.

The abstraction for ArrayBuffers is left untouched. We distinguish between the
following cases:
1. Regular AB (backing_store and bye_length should be used)
2. AB allocated using kReservation but not part of wasm
3. AB allocated using kReservation and part of wasm

In practice, 2. does not exist, but we still maintain "allocation_base" and
"allocation_length" which fall back to backing_store and byte_length in this
case. The problematic part is that they look like innocent getters on the
object but actually refer to different data structures or on-heap objects.

Since 2. does not exist, and 3. looks up the bounds in its own tracker, it is
fine for ArrayBufferTracker to pass backing_store and tracked byte_length.

Bug: v8:7701
Change-Id: Ib89d5fe94fce5cef8e5d8343a5415a3b9ad0deba
Reviewed-on: https://chromium-review.googlesource.com/1039385Reviewed-by: Ben Titzer <titzer@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52923}

Change-Id: I3cc0dd01d5e33ca7579a4c0dc8f5e65e6b7c76f4
Reviewed-on: https://chromium-review.googlesource.com/924507Reviewed-by: Fadi Meawad <fmeawad@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Ali Ijaz Sheikh <ofrobots@google.com>
Cr-Commit-Position: refs/heads/master@{#52922}

This is a reland of ad221d14

Original change's description:
> [wasm] Always enable guard regions on 64-bit platforms
> 
> This change makes full 8 GiB guard regions always enabled on 64-bit
> platforms.
> 
> Additionally, since all Wasm memory allocation paths have some form of
> guard regions, this removes and simplifies most of the logic around
> whether to enable guard regions.
> 
> This is a reland of https://crrev.com/c/985142.
> 
> Bug: v8:7619
> Change-Id: I8bf1f86d6f89fd0bb2144431c7628f15a6b00ba0
> Reviewed-on: https://chromium-review.googlesource.com/996466
> Reviewed-by: Brad Nelson <bradnelson@chromium.org>
> Commit-Queue: Eric Holk <eholk@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52412}

Bug: v8:7619
Change-Id: I0f311305472ca2305ad2fa9163560ff54c1422c2
Reviewed-on: https://chromium-review.googlesource.com/999872
Commit-Queue: Eric Holk <eholk@chromium.org>
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52921}

These DCHECKs involve reading and comparing two variables that may be modified
on a separate thread. Thus, there is no way to ensure these comparisons happen
atomically. This leads to runtime failures that are otherwise benign.

The other option would be to take the memory tracker mutex, but this seems
unnecessary given that two atomic counters is sufficient and these checks are
only used during debug builds.

Bug: chromium:838043
Change-Id: I1b87698c46c550bd2d58bfef956b5a07cb2ec52c
Reviewed-on: https://chromium-review.googlesource.com/1038886Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Eric Holk <eholk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52920}

This reverts commit 2df5e7a7.

Reason for revert: Mystery crashes https://bugs.chromium.org/p/chromium/issues/detail?id=838805

Original change's description:
> [parser] Slice the source string where possible
> 
> When internalizing string literals (for quoted strings or property names),
> try to create a sliced string of the source string rather than allocating
> a copy of the bytes.
> 
> This will not work for string literals that contain escapes (e.g. unicode
> escapes), and currently does not support two-byte strings.
> 
> Bug: chromium:818642
> Change-Id: I686e5ad36baecd1a84ce5e124118431249b6c980
> Reviewed-on: https://chromium-review.googlesource.com/1010282
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Reviewed-by: Marja Hölttä <marja@chromium.org>
> Commit-Queue: Leszek Swirski <leszeks@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52898}

TBR=marja@chromium.org,yangguo@chromium.org,jarin@chromium.org,mlippautz@chromium.org,leszeks@chromium.org,verwaest@chromium.org

Change-Id: I598b6668c43a3e843e2dd8e60852b2b2f3461954
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:818642
Reviewed-on: https://chromium-review.googlesource.com/1039885
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52919}

test-serialize/SerializationMemoryStats does not actually create a new
Isolate from scratch. Instead, it deserializes from the snapshot and
we can simply piggy-back off existing output to measure
deserialization time.

Bug: v8:6666,v8:7693
Change-Id: I8f709ea834ff7f5e46f7ebfa9b0c35d96095bf26
Reviewed-on: https://chromium-review.googlesource.com/1039585Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52918}

The first element of a given iterable argument can be a hole. Thus,
normalize the first element so that we can correctly format the
exception message with "undefined" for a hole element, instead of "NaN".

Bug: v8:7715
Change-Id: I62edd09e361ebeebab642bb82db29b73a2c7b193
Reviewed-on: https://chromium-review.googlesource.com/1038951Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52917}

Original CL: https://crrev.com/c/1018468

During code generation, we generate self-references (i.e. references to
the Code object currently being generated) as references to a temporary
handle. When the final Code object has been allocated, the handle's
location is fixed up and RelocInfo iteration fixes up all references
embedded in the generated code.

This adds support for this mechanism to the builtins constants table
builder. CodeObject() is now a new handle pointing to a dedicated
self-reference marker in order to distinguish between self-references
and references to undefined. In Factory::NewCode, we patch up
the constants table.

TBR=yangguo@chromium.org,mlippautz@chromium.org

Bug: v8:6666
Change-Id: I3fa422c57de99c9851dc7a86394a8387c7c2b397
Reviewed-on: https://chromium-review.googlesource.com/1039366
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52916}

Bug: chromium:830557
Change-Id: If06a39b5c26c9c736d313c2c06950b800f241423
Reviewed-on: https://chromium-review.googlesource.com/1032750
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52915}

We incorrectly used a TurboFan typer check for {0,10,undefined} on the
radix argument on Number.parseInt, which was internally widened to the
checking whether radix is in range 0-10 or undefined. This CL introduces
two separate checks.

Bug: chromium:838766
Change-Id: I5ebfc1c82bad5b9794b4f844e79e4df01f541a83
Reviewed-on: https://chromium-review.googlesource.com/1039197Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52914}

Bug: chromium:837939
Change-Id: Iaca2bc5b52f47d8add13ed9b82497a53cb522933
Reviewed-on: https://chromium-review.googlesource.com/1034043Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52913}

R=titzer@chromium.org

Bug: v8:6600
Change-Id: I2eb914e7558c01d924cb9d39f18e1c3a5f5c72e5
Reviewed-on: https://chromium-review.googlesource.com/1035123Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52912}

BUG=v8:7490

Change-Id: I2a597eda708b2ea34c9e32e39556159b48591b61
Reviewed-on: https://chromium-review.googlesource.com/1039196Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52911}