Track based on JSArrayBuffer addresses on pages instead of the attached
backing store.

Details of tracking:
- Scavenge: New space pages are processes in bulk on the main thread
- MC: Unswept pages are processed in bulk in parallel. All other pages
  are processed by the sweeper concurrently.

BUG=chromium:614730, chromium:611688
LOG=N
CQ_EXTRA_TRYBOTS=tryserver.v8:v8_linux_arm64_gc_stress_dbg,v8_linux_gc_stress_dbg,v8_mac_gc_stress_dbg,v8_linux64_tsan_rel,v8_mac64_asan_rel

Review-Url: https://codereview.chromium.org/2026463002
Cr-Commit-Position: refs/heads/master@{#36592}

it's referenced from isolate.gypi which in turn is used in
non-standalone builds as well.

BUG=chromium:609107
R=machenbach@chromium.org

Review-Url: https://codereview.chromium.org/2023783003
Cr-Commit-Position: refs/heads/master@{#36591}

Fix failure in RunWasmInterpreted_LoadMemI32_const_oob_misaligned on architecures that don't support unaligned access

BUG=cctest/test-run-wasm/RunWasmInterpreted_LoadMemI32_const_oob_misaligned

Review-Url: https://codereview.chromium.org/2026553002
Cr-Commit-Position: refs/heads/master@{#36590}

Jaideep has been regularly contributing PPC and S390 changes recently.
Adding him as owner/reviewer to PPC / S390 specific directories.

R=joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com
BUG=

Review-Url: https://codereview.chromium.org/2024533003
Cr-Commit-Position: refs/heads/master@{#36589}

R=rossberg@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2026543002
Cr-Commit-Position: refs/heads/master@{#36588}

BUG=chromium:615489

Review-Url: https://codereview.chromium.org/2020743002
Cr-Commit-Position: refs/heads/master@{#36587}

BUG=chromium:474921
NOTRY=true

Committed: https://crrev.com/52a6fced896e3f64ac56eb57bcdea78393642e0c
Cr-Commit-Position: refs/heads/master@{#36517}

Review-Url: https://codereview.chromium.org/2007143003
Cr-Commit-Position: refs/heads/master@{#36586}

Utilize the previously introduced construct call counts in the
JSInliningHeuristic to also handle constructor calls properly.

R=mvstanton@chromium.org

Review-Url: https://codereview.chromium.org/2026513003
Cr-Commit-Position: refs/heads/master@{#36585}

The NumberIsHoleNaN operator used to test the lower word of the double
input which is obviously wrong.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2022753002
Cr-Commit-Position: refs/heads/master@{#36584}

BUG=v8:4907

Review-Url: https://codereview.chromium.org/2026503002
Cr-Commit-Position: refs/heads/master@{#36583}

BUG=chromium:474921
NOTRY=true

Committed: https://crrev.com/67e549ec5b34ad02506abb2720c6a0851ae31f5e
Cr-Commit-Position: refs/heads/master@{#36510}

Review-Url: https://codereview.chromium.org/2011853002
Cr-Commit-Position: refs/heads/master@{#36582}

BUG=
NOTRY=true

Review-Url: https://codereview.chromium.org/2020983002
Cr-Commit-Position: refs/heads/master@{#36581}

R=ulan@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2021823002
Cr-Commit-Position: refs/heads/master@{#36580}

BUG=chromium:615770
LOG=N

Review-Url: https://codereview.chromium.org/2022743002
Cr-Commit-Position: refs/heads/master@{#36579}

Before, it was possible to construct invalid CallSite objects, which
would trigger a runtime assert when any function is called on it.
This check ensures to throw a TypeError when invalid information is
passed to the CallSite constructor.

This reverts part of this CL: https://codereview.chromium.org/2006603002

R=ishell@chromium.org, titzer@chromium.org, yangguo@chromium.org
BUG=chromium:614295

Review-Url: https://codereview.chromium.org/2010493002
Cr-Commit-Position: refs/heads/master@{#36578}

R=binji@chromium.org,ahaas@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2014373003
Cr-Commit-Position: refs/heads/master@{#36577}

The in-operator has recently been optimized making our smart macros obsolete.
This should give up to 10% speedup on forEach and friends.

BUG=v8:5041

Review-Url: https://codereview.chromium.org/2013873002
Cr-Commit-Position: refs/heads/master@{#36576}

BUG=

Review URL: https://codereview.chromium.org/2024623002 .

Cr-Commit-Position: refs/heads/master@{#36575}

An additional slide offset is exported into `shared-library`, which is used to
symbolize C++ stack on systems with ASLR (OS X).

This patch adds slide offset support in dumpcpp script.

BUG=v8:5048

Review-Url: https://codereview.chromium.org/2006813002
Cr-Commit-Position: refs/heads/master@{#36574}

This fixes data-flow tracking of sub-word (i.e. int8 or int16) element
accesses withing the escape analysis. In essense this makes sure that
we only ever consider the offset for loads and stores on tracked objects
and avoid mangling the offset on untracked ones.

R=jarin@chromium.org
TEST=cctest/test-api/Fixed[U]Int[8,16]Array

Review-Url: https://codereview.chromium.org/2008883002
Cr-Commit-Position: refs/heads/master@{#36573}

Revert of [builtins] Also migrate String.prototype.toLowerCase/toUpperCase to C++. (patchset #2 id:20001 of https://codereview.chromium.org/2018983002/ )

Reason for revert:
Please rebase blink first (if intended):
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/7092

Original issue's description:
> [builtins] Also migrate String.prototype.toLowerCase/toUpperCase to C++.
>
> These builtins always call into C++ anyways and so there's no point in
> having the JavaScript wrapper around them, but instead they can be
> implemented as C++ builtins directly.
>
> R=franzih@chromium.org
> BUG=v8:5049
>
> Committed: https://crrev.com/4e66888869bf04c73b41e5747e4595747a7b20df
> Cr-Commit-Position: refs/heads/master@{#36569}

TBR=franzih@chromium.org,bmeurer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5049

Review-Url: https://codereview.chromium.org/2023753002
Cr-Commit-Position: refs/heads/master@{#36572}

BUG=v8:5053
TBR=bmeurer@chromium.org
NOTRY=true

Review-Url: https://codereview.chromium.org/2024583002
Cr-Commit-Position: refs/heads/master@{#36571}

  port 91c88644 (r36539)

  original commit message:
  We get less "pollution" of type feedback if we have one vector per native
  context, rather than one for the whole system. This CL moves the vector
  appropriately.

BUG=

Review-Url: https://codereview.chromium.org/2019263002
Cr-Commit-Position: refs/heads/master@{#36570}

These builtins always call into C++ anyways and so there's no point in
having the JavaScript wrapper around them, but instead they can be
implemented as C++ builtins directly.

R=franzih@chromium.org
BUG=v8:5049

Review-Url: https://codereview.chromium.org/2018983002
Cr-Commit-Position: refs/heads/master@{#36569}

Rolling v8/build to 0671aae0bf5e388dc2a7d2610cbeab6b31ef7bb4

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2019253002
Cr-Commit-Position: refs/heads/master@{#36568}

Rolling v8/build to dd69258f1644517e9577f64ab72586fe097d681c

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2025533002
Cr-Commit-Position: refs/heads/master@{#36567}

Rolling v8/build to 10d3723f73a8bfb0bcbee33f368d92dea8ad1bd7

Rolling v8/tools/clang to ef8e028ea0f0fdf3be7be6e817e5c26c8ba7aebe

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2021623002
Cr-Commit-Position: refs/heads/master@{#36566}

One of the top runtime calls in many workloads is Runtime_Call. Add an
intrinsic for the interpreter to inline this runtime call.

BUG=v8:4280
LOG=N

Review-Url: https://codereview.chromium.org/2019433003
Cr-Commit-Position: refs/heads/master@{#36565}

Port 91c88644

Original commit message:

    We get less "pollution" of type feedback if we have one vector per native
    context, rather than one for the whole system. This CL moves the vector
    appropriately.

R=mvstanton@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com
BUG=

Review-Url: https://codereview.chromium.org/2011183005
Cr-Commit-Position: refs/heads/master@{#36564}

The busted logic caused us to go down the SCRIPT path internally,
causing us to fail the test262 tests that attempt to induce parse
errors at the top level.

R=littledan@chromium.org
BUG=v8:4985

Review-Url: https://codereview.chromium.org/2008743002
Cr-Commit-Position: refs/heads/master@{#36563}

We now have data that 0.011% of websites use the pattern
  for (var i = 0 in j) { ... }
This pattern was banned by ES2015, with the idea to revisit if
it presents a web compatibility problem. Informally, after
the May 2016 TC39 meeting, the new data was discussed, and there
was interest in reversing the decision. Although the specification
is not yet updated, it seems likely to come soon.

This patch turns off the flag which bans that construct, reenabling
it. The change should prevent websites from breaking.

BUG=v8:4942

Review-Url: https://codereview.chromium.org/2011223003
Cr-Commit-Position: refs/heads/master@{#36562}

Some tests, e.g. in test262, want to create a new same-origin
realm. This patch exposes a new function,
Realm.createAllowCrossRealmAccess(), which vends a new realm with
the same security token as the currently executing one.

Review-Url: https://codereview.chromium.org/1973363004
Cr-Commit-Position: refs/heads/master@{#36561}

Port 91c88644

Original commit message:

    We get less "pollution" of type feedback if we have one vector per native
    context, rather than one for the whole system. This CL moves the vector
    appropriately.

R=mvstanton@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2017983002
Cr-Commit-Position: refs/heads/master@{#36560}

R=littledan@chromium.org
BUG=v8:4628

Review-Url: https://codereview.chromium.org/2017753002
Cr-Commit-Position: refs/heads/master@{#36559}

- Renames UnallocatedOperandenum values to reflect the fact that there are
multiple FP machine representations.
- Renames enum values for RegisterAllocatorVerifier enum.
- Template-izes DefineAsFixed and UseFixed methods to handle multiple FP
register types.

BUG=v8:4124

Review-Url: https://codereview.chromium.org/2017733002
Cr-Commit-Position: refs/heads/master@{#36558}

Annex B 3.3 applies only for ordinary FunctionDeclarations, not
GeneratorDeclarations or AsyncFunctionDeclarations. This patch
- Skips applying Annex B 3.3 to async functions
- Adds a flag to refrain from applying it to generators
- UseCounter for how often duplicate function in block occurs
  with generators (unclear how to measure need for hoisting from block)

BUG=v8:4806

Review-Url: https://codereview.chromium.org/1995863002
Cr-Commit-Position: refs/heads/master@{#36557}

This got left behind from the changes in
https://codereview.chromium.org/2007803002/

PromiseSet only takes 3 arguments.

BUG=v8:5046

Review-Url: https://codereview.chromium.org/2016183002
Cr-Commit-Position: refs/heads/master@{#36556}

intl/number-format/parse-percent.js
intl/date-format/parse-mdyhms.js
intl/number-format/parse-decimal.js
intl/date-format/parse-MMMdy.js

Also added a few more test cases.

BUG=v8:3454
TEST=The tests listed above.

Review-Url: https://codereview.chromium.org/1988073003
Cr-Commit-Position: refs/heads/master@{#36555}

This is a temporary band-aid to turn an uncontrolled segfault into
a safe crash. The proper fix will probably be to abort compilation.

BUG=chromium:582702

Review-Url: https://codereview.chromium.org/2021433003
Cr-Commit-Position: refs/heads/master@{#36554}

These builtins do call into C++ anyways, so there's no point in keeping
the JavaScript wrappers for them.

R=franzih@chromium.org
BUG=v8:5049

Review-Url: https://codereview.chromium.org/2018963002
Cr-Commit-Position: refs/heads/master@{#36553}