This adds proper poisoning/unpoisoning to segments put into the segment
pool of an accounting allocator, and also marks a segment uninitialized
when returning it from the pool. This gives ASan a better chance at
catching use-after-free and others.

Drive-by: Fix type check in ASAN_POISON_MEMORY_REGION

R=mstarzinger@chromium.org

Change-Id: Iadbdd7c0a0c80da8e7b9bb8f3399209715436073
Reviewed-on: https://chromium-review.googlesource.com/c/1489086
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59932}

This makes the output a lot smaller and thus makes it easier to see the
relevant part of the command.

R=machenbach@chromium.org

Change-Id: I62ac7218be4a02f0270a2d88a2f69b6ced45a041
Reviewed-on: https://chromium-review.googlesource.com/c/1491597
Commit-Queue: Tamer Tas <tmrts@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Tamer Tas <tmrts@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59931}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/7cd7119..325e95d

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/f610057..827da84

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/be28670..fe34723

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/987f14b..a287525

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: I1f645eb9c6d13cefaca46ad5f93f2712fd4a2728
Reviewed-on: https://chromium-review.googlesource.com/c/1493047Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#59930}

One of the early (no-op) returns forgot to check whether the
number of existing digits equals the number of required digits.

Bug: chromium:936506
Change-Id: Ic9a5b927306de3cd6b26662785ac11d866e12026
Reviewed-on: https://chromium-review.googlesource.com/c/1493133Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59929}

Mentioned by ICU guru during design review. Bug in theory, but
cannot find a locale has 'b' and 'B' in the 12 date/time style
canned pattern.

Bug: v8:8877
Change-Id: I126fdf979e8ea5b97773c8fd974359a7e52f18e9
Reviewed-on: https://chromium-review.googlesource.com/c/1480922Reviewed-by: Frank Tang <ftang@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59928}

https://chromium.googlesource.com/v8/v8/+/ee3f62fb0dd872841c589a6e61d9c6a97d169939

1. On Android, Skips mjsunit tests depending on setting LC_ALL env var.
2. With the cherrypick from ICU, locale "C" will no longer be
   canonicalized into "en-US-POSIX" since that is not part of a
   registered canonicalization. So on OS which there are no LANG,
   LC_CTYPE or LC_MESSAGE env vars, we need to also map that
   fallback locale "C" to "en-US".

Bug: v8:8242, v8:8260, v8:8903
Change-Id: I63e5db10e0a7453394787421f4d55418f286f67d
Reviewed-on: https://chromium-review.googlesource.com/c/1479030Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59927}

Change-Id: I1863f9d93ed36956f0c66540df4f44ecd809b5e8
Reviewed-on: https://chromium-review.googlesource.com/c/1492516Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
Commit-Queue: Alexei Filippov <alph@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59926}

Implement the ReturnCall functionality for the interpreter.

Note that some tests have had to be deferred to the implementation
of ReturnCall for TurboFan.

This a reland of https://chromium-review.googlesource.com/c/v8/v8/+/1467343

Bug: v8:7431
Change-Id: Iac9392a6a81995e30009dac74035e4d728ac3dbb
Cq-Include-Trybots: luci.v8.try:v8_linux64_ubsan_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/c/1484905
Commit-Queue: Francis McCabe <fgm@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59925}

This merges the check if a protector is intact with the recording of
the dependency on it, at least in many cases.

Also introduce convenience functions to avoid the heap broker clutter.

Change-Id: I35508c4685a2f0df77819bf81075dd14a30e7e4f
Reviewed-on: https://chromium-review.googlesource.com/c/1487491
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59924}

This was an oversight in my previous CL.

Bug: chromium:936077, v8:7790
Change-Id: Ic1034c1754d10c72df8f61d1e2c34333e1565e3e
Reviewed-on: https://chromium-review.googlesource.com/c/1491222Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59923}

Port f70bb59b

Original Commit Message:

    Includes various fixes and cleanups here and there.

R=ishell@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com, miladfar@ca.ibm.com

LOG=N

Bug: v8:7703, v8:8852
Change-Id: I1e25c6da6677aab64dabc052aee555f534386df7
Reviewed-on: https://chromium-review.googlesource.com/c/1491698Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#59922}

Creates Torque classes for JSProxy, JSAccessorPropertyDescriptor, JSCollection, JSProxyRevocableResult, JSValue

Change-Id: I01eec27b158b4beb778cb5efce44f241c09ef0f7
Reviewed-on: https://chromium-review.googlesource.com/c/1489184
Commit-Queue: Irina Yatsenko <irinayat@microsoft.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59921}

This will allow the devtools UI to display private fields on the scope
panel.

Instead of extending GetInternalProperties, we expose a separate
GetPrivateFields method on the debug interface. This allows us to do
better type checking, for example, we can directly cast to a
v8::Private as this can only contain private fields.

This also allows us to have better constraints on the input type --
v8::Object, as opposed to a v8::Value.

The KeyAccumulator is extended to collect private names for the
PRIVATE_NAMES_ONLY PropertyFilter.

Bug: v8:8773
Change-Id: Id47c551186c59dae9a06721074ef78144f25892f
Reviewed-on: https://chromium-review.googlesource.com/c/1475664
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
Reviewed-by: Daniel Ehrenberg <littledan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59920}

WebAssembly's specification tests use a timeout annotation.
This change allows the shared testrunner to use it to calculate
the testcase timeout.

Currently, the allowed timeout values are: long. Other values will
emit a warning.

Change-Id: Id7f453f5fd49854c8f53ff86ef2ec58aa0ae8748
Reviewed-on: https://chromium-review.googlesource.com/c/1480376Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Sven Sauleau <ssauleau@igalia.com>
Cr-Commit-Position: refs/heads/master@{#59919}

This is a port of the improvements to the ArgumentsAdaptorTrampoline
that previously landed for x64. It skips the arguments adaptor frame
creation if the callee cannot observe the actual arguments (as indicated
by the "is_safe_to_skip_arguments_adaptor" bit on the SharedFunctionInfo),
and instead just massages the current stack frame appropriately (either
by pushing more undefineds in case of under application, or by removing
the superfluous arguments in case of over application).

Bug: v8:8895
Doc: http://bit.ly/v8-faster-calls-with-arguments-mismatch
Change-Id: I96a0425d390f041001df0356d4bfd71ad1e98b5a
Reviewed-on: https://chromium-review.googlesource.com/c/1491592Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59918}

Constructors have been removed. Initialization syntax with {}
for structs and classes is now limited to the initialization
expressions for the fields, so "constructors" deviating from
that explicit and complete list of field initialization
values must be declared as separate macros.

Bug: v8:7793
Change-Id: Ibc26e685c0c8a182732df90b1631eae9371309cb
Reviewed-on: https://chromium-review.googlesource.com/c/1489080
Commit-Queue: Daniel Clifford <danno@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59917}

This is a reland of 71d29f78

Original change's description:
> [nojit] Don't flush the icache in jitless mode
> 
> We don't allocate executable memory in jitless mode hence there's no
> need to flush the icache.
> 
> Bug: v8:7777
> Change-Id: I70a1884e6c9f11405465f5741f2eccd4f7a273fb
> Reviewed-on: https://chromium-review.googlesource.com/c/1488765
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#59887}

Bug: v8:7777
Change-Id: Id48455cf4e6d28ad2a0b753580ca51cbe0e983d3
Reviewed-on: https://chromium-review.googlesource.com/c/1491601Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59916}

That way we don't need to internalize kValue property names on object literals
(both STRING and identifier tokens). This speeds up object literal preparsing
by quite a bit (15% on a microbenchmark; 7-8% on actual object literals looking
like json from FB).

Change-Id: I9d7baeb94f1a8e4f7e3b7cd6406a826ba37017f3
Reviewed-on: https://chromium-review.googlesource.com/c/1491605Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59915}

Bytecode flushing can make tests using assertOptimized flaky if the bytecode is
flushed between marking and optimization. It can also be flaky if the feedback vector
is collected before optimization. To prevent this, a new %PrepareForOptimization
runtime-test function is added that hold onto the bytecode strongly until it is
optimized after being explicitly marked for optimization by %OptimizeFunctionOnNextCall.

BUG=v8:8801,v8:8395

Change-Id: Idbd962a3a2044b915903f9c5e92d1789942b5b41
Reviewed-on: https://chromium-review.googlesource.com/c/1463525
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59914}

Instead of using our own atomic utils, use std::atomic.

R=mstarzinger@chromium.org

Bug: v8:8916, v8:8834
Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_rel
Change-Id: I663d7f28dbaaa476a62407cf42dca1927c69f68b
Reviewed-on: https://chromium-review.googlesource.com/c/1491631
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59913}

This CL also unifies CopyWords() and CopyBytes() implementations.

Bug: v8:7703
Change-Id: I0b2e2f35c0c651e46231c4e4286c705634dce02b
Reviewed-on: https://chromium-review.googlesource.com/c/1491602Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59912}

This reverts commit 9215ac2c.

Reason for revert: Turns out it fails on windows too: https://logs.chromium.org/logs/v8/buildbucket/cr-buildbucket.appspot.com/8920360960120786848/+/steps/Check_-_extra__flakes_/0/logs/SampleWhenFrameIsNotS../0

Original change's description:
> [cpu-profiler] Disable failing tests on arm simulator only
> 
> These tests still fail on arm simulators and don't appear easily fixable
> but are low priority. Let's still run them on other build configs.
> 
> Bug: v8:8917
> Change-Id: If0a2f44b746eff5e82eb750103304e788dfbbfb5
> Reviewed-on: https://chromium-review.googlesource.com/c/1491593
> Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
> Commit-Queue: Peter Marshall <petermarshall@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#59903}

TBR=sigurds@chromium.org,petermarshall@chromium.org

Change-Id: Ic77791ddfd37e67307af6ec7b064e31e2db92039
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:8917
Reviewed-on: https://chromium-review.googlesource.com/c/1491604Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59911}

This avoids having occurrences of both 0x000012345678 and
0x12345678 in the log.

Change-Id: Id3603993362d1dd327aad567ef3448d00ce3a8fd
Reviewed-on: https://chromium-review.googlesource.com/c/1491514Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59910}

Includes various fixes and cleanups here and there.

Bug: v8:7703, v8:8852
Change-Id: I603eb0212cab3fecabfa15dceb70ee23b81cdb5a
Reviewed-on: https://chromium-review.googlesource.com/c/1491595Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59909}

This reverts commit 71d29f78.

Reason for revert: Needs test skips https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Arm/9744

Original change's description:
> [nojit] Don't flush the icache in jitless mode
> 
> We don't allocate executable memory in jitless mode hence there's no
> need to flush the icache.
> 
> Bug: v8:7777
> Change-Id: I70a1884e6c9f11405465f5741f2eccd4f7a273fb
> Reviewed-on: https://chromium-review.googlesource.com/c/1488765
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#59887}

TBR=sigurds@chromium.org,jgruber@chromium.org

Change-Id: I548bcbbd5c6df542dd647b8bbb8accae62e197e6
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7777
Reviewed-on: https://chromium-review.googlesource.com/c/1491600Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59908}

A small refactoring to reduce complexity. It also moves the call to
{RegisterTrapHandlerData} out of the mutex to reduce the time in this
critical section.

R=mstarzinger@chromium.org

Bug: v8:8916
Change-Id: I644f03db6099ebef22b2e33b607a2dc038b36423
Reviewed-on: https://chromium-review.googlesource.com/c/1478196
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59907}

Also enable test runner to differentiate between clang and gcc.

Bug: v8:8919
Change-Id: Icdcae0aba3644a1b1b9ddc6c037eabde27d717f7
Reviewed-on: https://chromium-review.googlesource.com/c/1491634Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Sergiy Belozorov <sergiyb@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59906}

This fixes the libstdc++ build after commit 4b6b8cf6 ("[cleanup] Start
cleaning up utils.h"), as string-util.cc was including <cmath> indirectly
via src/conversions.h.

Bug: chromium:819294
Change-Id: I5be7eac355d0c316a432eab4c50ae66d885b03d7
Reviewed-on: https://chromium-review.googlesource.com/c/1491591Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59905}

Change-Id: I73532f4cba643032c5fad6e9bca70c901bf71f85
Reviewed-on: https://chromium-review.googlesource.com/c/1491513
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59904}

These tests still fail on arm simulators and don't appear easily fixable
but are low priority. Let's still run them on other build configs.

Bug: v8:8917
Change-Id: If0a2f44b746eff5e82eb750103304e788dfbbfb5
Reviewed-on: https://chromium-review.googlesource.com/c/1491593Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59903}

Happily, with the port of Array.prototype.find and findIndex, we can
remove a large set of library functions from array-builtins-gen.cc.

BUG: v8:7672
Change-Id: I74e07fe00162b34b2246c868386d4551ba4dc032
Reviewed-on: https://chromium-review.googlesource.com/c/1484296
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59902}

This is a reland of 19291bfc

Same as original, but with ThrowTypeError/ThrowRange updated to use an implicit context.

Original change's description:
> [typedarray] Port TA#subarray and TypedArraySpeciesCreate to Torque
>
> Reduces TypedArrayPrototypeSubArray builtin size by 392 bytes:
>   - TFJ Builtin, TypedArrayPrototypeSubArray, 2448 -> 2056
>
> Small 3-4% perf increase on JSTests/TypedArrays/SubarrayNoSpecies benchmark
>
> Bug: v8:7161, v8:8906
> Change-Id: Ia2b906a93db7199ca4592c46c40638cca0a33eec
> Reviewed-on: https://chromium-review.googlesource.com/c/1485241
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Peter Marshall <petermarshall@chromium.org>
> Reviewed-by: Simon Zünd <szuend@chromium.org>
> Commit-Queue: Peter Wong <peter.wm.wong@gmail.com>
> Cr-Commit-Position: refs/heads/master@{#59894}

Bug: v8:7161, v8:8906
Change-Id: Ic3784e2d4db262b1968ba467b7b46b98203f11d4
Reviewed-on: https://chromium-review.googlesource.com/c/1491533Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Peter Wong <peter.wm.wong@gmail.com>
Cr-Commit-Position: refs/heads/master@{#59901}

Keeping the {owned_code_} vector sorted might add unnecessary work
executed during compilation and under a mutex.
This CL moves the sort operation into {Lookup()}, such that it can be
executed in bulks and at later stages.

R=mstarzinger@chromium.org

Bug: v8:8916
Change-Id: I8d5f4520e4ce087234c0a1e3d97e7e98229206eb
Reviewed-on: https://chromium-review.googlesource.com/c/1476994
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59900}

This CL changes a few AST nodes and one internal structure to use "Identifier"
instead of a simple std::string, allowing the use of the exact source position
of such a name.

Drive-by change: Add new constructor to Binding that allows creation from
an Identifier. It sets the declaration_position to the source position of
the name instead of using "CurrentSourcePosition".

R=tebbi@chromium.org

Bug: v8:7793
Change-Id: I456d20822b6528d2e96400c28ebfebea3ca80613
Reviewed-on: https://chromium-review.googlesource.com/c/1491223
Commit-Queue: Simon Zünd <szuend@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59899}

This roughly takes 40% less time.

Change-Id: I7886bd85cd33c9b2d2225e0f207a3e3bf89f1ef3
Reviewed-on: https://chromium-review.googlesource.com/c/1491511
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59898}

AdvanceUntil always starts at the character after c0_. This means that we
needed to handle first, causing some duplication. Instead of doing that, we can
also just not Advance() before AdvanceUntil, making c0_ a character that's
already handled.

Change-Id: I3e23f62a617b5d607579641fc19b12de4f179e8e
Reviewed-on: https://chromium-review.googlesource.com/c/1491512
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59897}

This reverts commit 19291bfc.

Reason for revert: https://logs.chromium.org/logs/v8/buildbucket/cr-buildbucket.appspot.com/8920369361383698384/+/steps/build/0/steps/compile/0/stdout

ThrowTypeError's method signature changed this morning


Original change's description:
> [typedarray] Port TA#subarray and TypedArraySpeciesCreate to Torque
> 
> Reduces TypedArrayPrototypeSubArray builtin size by 392 bytes:
>   - TFJ Builtin, TypedArrayPrototypeSubArray, 2448 -> 2056
> 
> Small 3-4% perf increase on JSTests/TypedArrays/SubarrayNoSpecies benchmark
> 
> Bug: v8:7161, v8:8906
> Change-Id: Ia2b906a93db7199ca4592c46c40638cca0a33eec
> Reviewed-on: https://chromium-review.googlesource.com/c/1485241
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Peter Marshall <petermarshall@chromium.org>
> Reviewed-by: Simon Zünd <szuend@chromium.org>
> Commit-Queue: Peter Wong <peter.wm.wong@gmail.com>
> Cr-Commit-Position: refs/heads/master@{#59894}

TBR=peter.wm.wong@gmail.com,jgruber@chromium.org,petermarshall@chromium.org,szuend@chromium.org

Change-Id: Ic0eaa07e57df3c365b52fb3c5de8eb7c3d9f71e9
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7161, v8:8906
Reviewed-on: https://chromium-review.googlesource.com/c/1491532Reviewed-by: Peter Wong <peter.wm.wong@gmail.com>
Commit-Queue: Peter Wong <peter.wm.wong@gmail.com>
Cr-Commit-Position: refs/heads/master@{#59896}

TBR=sergiyb@chromium.org
NOTRY=true

Bug: chromium:933093
Change-Id: I7728b81a48da401d65f63b0450df4119bd04d0f8
Reviewed-on: https://chromium-review.googlesource.com/c/1491515Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59895}

Reduces TypedArrayPrototypeSubArray builtin size by 392 bytes:
  - TFJ Builtin, TypedArrayPrototypeSubArray, 2448 -> 2056

Small 3-4% perf increase on JSTests/TypedArrays/SubarrayNoSpecies benchmark

Bug: v8:7161, v8:8906
Change-Id: Ia2b906a93db7199ca4592c46c40638cca0a33eec
Reviewed-on: https://chromium-review.googlesource.com/c/1485241Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Commit-Queue: Peter Wong <peter.wm.wong@gmail.com>
Cr-Commit-Position: refs/heads/master@{#59894}

Change-Id: I7e73b1f9cd81c91b5399f1cd01eb3bd6766025d5
Reviewed-on: https://chromium-review.googlesource.com/c/1490601Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Nathan Rogers <nathanrogers@google.com>
Cr-Commit-Position: refs/heads/master@{#59893}