see spec change in
https://github.com/tc39/ecma402/pull/278/

Bug: v8:8398
Change-Id: If5582f96d6dc3debdccb466d3d239efa52bbbf06
Reviewed-on: https://chromium-review.googlesource.com/c/1404436
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58717}

This reverts commit 8f83fd0a.

Reason for revert: Seems to break older intel chips:
https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Linux%20-%20debug/23954

Original change's description:
> [wasm] Fix SIMD boolean reductions on Intel
> 
>  - Both AllTrue/AnyTrue values should return boolean 0/1
>    instead of 0xffffffff to match Spec/Toolchain
>  - Fix AllTrue implementation to be correct
>  - Add unit tests to spot check return values as the
>    cumulative test can coerce some return values to True/False
> 
> Change-Id: I84eb73c915414c9ec290e73f1306404ceff729f0
> Bug: v8:8636
> Reviewed-on: https://chromium-review.googlesource.com/c/1404197
> Reviewed-by: Bill Budge <bbudge@chromium.org>
> Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#58715}

TBR=bbudge@chromium.org,gdeepti@chromium.org

Change-Id: I0eba24e0fe5215c1f8f377776692db245239e134
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:8636
Reviewed-on: https://chromium-review.googlesource.com/c/1405321Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58716}

 - Both AllTrue/AnyTrue values should return boolean 0/1
   instead of 0xffffffff to match Spec/Toolchain
 - Fix AllTrue implementation to be correct
 - Add unit tests to spot check return values as the
   cumulative test can coerce some return values to True/False

Change-Id: I84eb73c915414c9ec290e73f1306404ceff729f0
Bug: v8:8636
Reviewed-on: https://chromium-review.googlesource.com/c/1404197Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58715}

If feedback for call site frequency is 0, then the combined frequency
is still 0, even if the current function invocation count is infinity.

Bug: chromium:919754
Change-Id: I97be096b6b38f934fb13f01b2b22e148c539e1c0
Reviewed-on: https://chromium-review.googlesource.com/c/1404445Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58714}

If a species constructor is installed, filter() needs to loop over
the elements of the array in the "slow" way, because it doesn't
know the ElementsKind of the output array. The code failed to
bail out to the slow case for the loop right away on discovering this.

Bug: chromium:920184, chromium:920491
Change-Id: I74496db20a90807b631c1bebe7604d85b199df67
Reviewed-on: https://chromium-review.googlesource.com/c/1405035Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58713}

The concurrent marker can now process all objects.
This patch also eagerly visits the objects that undergo layout
changes. This is because previously such objects were pushed
onto the bailout worklist, which is gone now.
To preserve the incremental step accounting, the patch introduces
a new GC tracer scope called MC_INCREMENTAL_LAYOUT_CHANGE.

Bug: v8:8486
Change-Id: Ic1c2f0d4e2ac0602fc945f3258af9624247bd65f
Reviewed-on: https://chromium-review.googlesource.com/c/1386486
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58712}

Use the right register type for the temporary register.

R=titzer@chromium.org

Bug: v8:6600, chromium:917588
Change-Id: Ia2617f6b406924ca7f496608fd495faf04dff25b
Reviewed-on: https://chromium-review.googlesource.com/c/1403127Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58711}

This changes WebAssembly runtime stub compilation to no longer require
an Isolate parameter. Such stubs are shared between Isolates and hence
must be independent of the concrete Isolate anyways. Also we will soon
generate such stubs from background tasks, where we should not pass an
Isolate parameter either.

R=clemensh@chromium.org
CC=jkummerow@chromium.org

Change-Id: Id9de46cae3fb77946d745a4aeadccac50f6e8350
Reviewed-on: https://chromium-review.googlesource.com/c/1405039Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58710}

Removed the static field and made it an instance field on the
BundleBuilder.

Change-Id: I58a9f4a744654b262a3e47e6873baffb537eb21b
Reviewed-on: https://chromium-review.googlesource.com/c/1404444Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Stephan Herhut <herhut@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58709}

Using a single bit in the inner function description preparse data of the
parent function we can avoid storing many NULL values for empty inner function
data.

This saves roughly 40KB out of 140KB PreparseScopeData on cnn.com.

Change-Id: Ib6019a8ceb99e772b398198074e171f635c0556e
Reviewed-on: https://chromium-review.googlesource.com/c/1405038
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58708}

Keep track of loop nesting depth on FunctionState and use that to decide
whether to mark var as assigned. That also fixes the weird cornercase where a
loop body can have multiple expressions due to multiple declarations with
independent initializers in a single var-statement.

Change-Id: Ia24affde29e22e9464448fd390062f6dd983faf2
Reviewed-on: https://chromium-review.googlesource.com/c/1405037Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58707}

For desrtucturing assignments from null/undefined, we throw an error
that references the destructuring object literal's property name, e.g.
for
  var { x } = null;
we report that we cannot destructure 'x' from null.

Rather than calculating this property during bytecode generation (and
including it in the bytecode as an argument to the type error
constructor), we can calculate it at exception throwing time, by
re-parsing the source in a similar way to the existing call site
rendering.

This slightly decreases bytecode size and slightly decreases the amount
of work the bytecode compiler needs to do. In the future, it could also
allow us to give more detailed error messages, as we now have access to
the entire AST and are on the slow path anyway.

Bug: v8:6499
Change-Id: Icdbd4667db548b4e5e62ef97797a3771b5c1bf72
Reviewed-on: https://chromium-review.googlesource.com/c/1396080Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58706}

Change-Id: I3acb492f1b9930e574bfbad063f54b20eab26bf1
Reviewed-on: https://chromium-review.googlesource.com/c/1405033Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58705}

Class declarations support structured heap data that is a subtype of
HeapObject. Only fields of Object subtypes (both strong and weak)
are currently supported (no scalar fields yet).

With this CL, both the field list macro used with the C++
DEFINE_FIELD_OFFSET_CONSTANTS macro (to make field offset constants) as
well as the Torque "operator '.field'" macros are generated for the
classes declared in Torque. This is a first step to removing the
substantial amount of duplication and boilerplate code
needed to declare heap object classes.

As a proof of concept, and handful of class field definitions,
including those for non trivial classes like JSFunction, have been
moved to Torque.

Bug: v8:7793
Change-Id: I2fa0b53db65fa6f5fe078fb94e1db3418f908753
Reviewed-on: https://chromium-review.googlesource.com/c/1373971
Commit-Queue: Daniel Clifford <danno@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58704}

Originally, the NativeModule and the WasmModuleObject were created
together, and the streaming decoder was notified after the
WasmModuleObject was created. A recent CL (https://crrev.com/c/1402544),
however, changed that.  The NativeModule gets created before compilation
starts, the WasmModuleObject, however, gets created after compilation.

The streaming decoder only needs the NativeModule to register a callback
before compilation. Therefore this CL we change the notification of the
streaming decoder to receive only the NativeModule, not the
WasmModuleObject, before starting compilation.

R=clemensh@chromium.org
CC=bbudge@chromium.org

Bug: chromium:719172
Change-Id: I4ad879e4ebd2d88174d7e2a0c6359f2836926763
Reviewed-on: https://chromium-review.googlesource.com/c/1404442
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58703}

Bug: v8:3770
Change-Id: I59d73ef672e64fd722317c84afc6bc5cb387f5b1
Reviewed-on: https://chromium-review.googlesource.com/c/1404448Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58702}

Mostly signed integer overflows, and a few cases of double
division by zero (which is defined by IEEE-754 to return
Infinity (or NaN for 0/0) but is UB in C++).
In base/ieee754.cc, use constants for NaN and Infinity instead
of computing these values.
In spaces-unittest.cc, ensure that a large enough allocation
is used.

Bug: v8:3770
Change-Id: I50d9a77dc860ef9993b7b269a5f8c117b0f62f9d
Reviewed-on: https://chromium-review.googlesource.com/c/1403454
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58701}

Pipeline::GenerateCodeForWasmNativeStub() currently does not pass
an Isolate to the PipelineData it creates, to ensure that compiled
code does not accidentally depend on a given Isolate. However, this
prevents the assembler from converting ExternalReference accesses to
RootArray offsets. This patch sets the corresponding AssemblerOption.

Bug: v8:3770
Change-Id: Ia4d5269e2e884a0af8abc6d122734f47db045ac0
Reviewed-on: https://chromium-review.googlesource.com/c/1404447Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58700}

Since all categories are now statically defined, there's no need to warm
any of them up explicitly in order for the categories to show up in the
tracing UI.

Depends on https://chromium-review.googlesource.com/c/chromium/src/+/1401273.

Bug: chromium:914579
Change-Id: I8ae8977130ae89d6ee3351194ad258d13f3c14f4
Reviewed-on: https://chromium-review.googlesource.com/c/1402779Reviewed-by: Alexei Filippov <alph@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Sami Kyöstilä <skyostil@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58699}

This will make it easier to separate out parameter declaration from other other
parameter scope information tracking.

Change-Id: I8712dd7fc589c84bc1e1a1eab9038af6047b21cd
Reviewed-on: https://chromium-review.googlesource.com/c/1403118
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58698}

This reverts commit 5dee355f.

Reason for revert: https://ci.chromium.org/p/v8-internal/builders/luci.v8-internal.ci/v8_linux64_perf_1/4282

Original change's description:
> [test] add perf tests for String.p.startsWith
> 
> Add performance tests for String.prototype.startsWith ahead of port to
> torque in order to keep track of how performance is affected.
> 
> Bug: v8:8400
> Change-Id: Ifc753a6f13da20c1760e545a99fd693717e3acc6
> Reviewed-on: https://chromium-review.googlesource.com/c/1402934
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#58685}

TBR=jgruber@chromium.org,usharma1998@gmail.com

Change-Id: I5855b08fa5e55ab8594185a0a84a26f567e2b9d3
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:8400
Reviewed-on: https://chromium-review.googlesource.com/c/1404446Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58697}

Mostly signed integer overflows, and a few cases of double
division by zero (which is defined by IEEE-754 to return
Infinity (or NaN for 0/0) but is UB in C++).

Bug: v8:3770
Change-Id: Id92725b0ac57cb357978124a3dc6f477430bc97d
Reviewed-on: https://chromium-review.googlesource.com/c/1403133
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58696}

The 'done' setting dance in BuildFillArrayWithIterator turned out to
not be useful, as the StoreInArrayLiteral call could not ever throw an
exception. Since iterator exceptions count as done, we are guarnteed to
be done as soon as we enter the loop.

Change-Id: Ibe2ba1fcbe383bfcfedb185169890b6931cc7884
Reviewed-on: https://chromium-review.googlesource.com/c/1402792
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58695}

The IteratorClose spec specifies that exceptions in
%GetMethod(iterator.return) are not suppressed by exceptions in the
given continuation (body of a loop, assignments in destructuring),
while exceptions in the execution of iterator.return() are.

This means that we have to split out the property access + a typeof
check to be outside the try-catch, and keep the call inside of it.

The non-split version is only for cases when there is no 'throws'
continuation (as is the case for yield* calling IteratorClose), so
the existing BuildIteratorClose can be renamed to reflect this.

Change-Id: Id71aea4fddd6ffb986bd9aaa09d29615a8800f71
Reviewed-on: https://chromium-review.googlesource.com/c/1402789Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58694}

Mostly signed integer overflows, and a few cases of double
division by zero (which is defined by IEEE-754 to return
Infinity (or NaN for 0/0) but is UB in C++).

Bug: v8:3770
Change-Id: I8007987594ff534ca697c1c3247215a72a001343
Reviewed-on: https://chromium-review.googlesource.com/c/1403132
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58693}

This CL disables RX (read and execute) permissions for Code memory
when in jitless mode. All memory that was previously allocated RX
is now read-only.

Bug: v8:7777
Cq-Include-Trybots: luci.v8.try:v8_linux_arm_lite_rel_ng
Change-Id: I52d6ed785d244ec33168a02293c5506d26f36fe8
Reviewed-on: https://chromium-review.googlesource.com/c/1390122
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58692}

As a follow up of https://crrev.com/c/1372857, this merges Windows
cases into others by using Move() and arg_reg_{1,2,3,4}.

Bug: v8:8124
Change-Id: Iff015089fd2bfce29565ab213c8e41c8ef1cd68f
Reviewed-on: https://chromium-review.googlesource.com/c/1404774
Commit-Queue: Taiju Tsuiki <tzik@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58691}

This reverts commit d024b9a1.

Reason for revert: Left-over static counter in the code.

Original change's description:
> [regalloc] Introduce LiveRangeBundles
> 
> The idea behind this change is to restore some information about
> pre-ssa values to aid register allocation in sharing spill slots and
> reusing registers for connected live ranges.
> 
> By itself, this change does not improve much but it allows upcoming
> changes to freely spill and reload ranges without worrying about
> keeping the assignment stable.
> 
> Change-Id: I9320522592546655cc8fd0236d45fe075276a49e
> Reviewed-on: https://chromium-review.googlesource.com/c/1375665
> Commit-Queue: Stephan Herhut <herhut@chromium.org>
> Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#58688}

TBR=sigurds@chromium.org,herhut@chromium.org

Change-Id: Id4f84a0e418e17729a301c848a7b9694f0eb9931
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/1404439Reviewed-by: Stephan Herhut <herhut@chromium.org>
Commit-Queue: Stephan Herhut <herhut@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58690}

The flag has been enabled by default since June 2018, see
https://crrev.com/c/1095650.

R=binji@chromium.org

Bug: v8:7625
Change-Id: I7cb4874db7f632b593f912e084b9fb7b8d568afe
Reviewed-on: https://chromium-review.googlesource.com/c/1402546Reviewed-by: Ben Smith <binji@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58689}

The idea behind this change is to restore some information about
pre-ssa values to aid register allocation in sharing spill slots and
reusing registers for connected live ranges.

By itself, this change does not improve much but it allows upcoming
changes to freely spill and reload ranges without worrying about
keeping the assignment stable.

Change-Id: I9320522592546655cc8fd0236d45fe075276a49e
Reviewed-on: https://chromium-review.googlesource.com/c/1375665
Commit-Queue: Stephan Herhut <herhut@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58688}

Minor refactoring to introduce kMaxRegisters instead of relying on
the fact that kMaxGpRegisters <= kMaxFpRegisters.

Bug: v8:8562
Change-Id: If8221a799199c62d5262cfad762489a5088351c7
Reviewed-on: https://chromium-review.googlesource.com/c/1403120Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Stephan Herhut <herhut@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58687}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/117f6f1..7b20546

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/3511bed..79517a0

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/da90c53..b1be378

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: Iaa79e20f0600877618f2da249690b0ab54255de4
Reviewed-on: https://chromium-review.googlesource.com/c/1404196Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#58686}

Add performance tests for String.prototype.startsWith ahead of port to
torque in order to keep track of how performance is affected.

Bug: v8:8400
Change-Id: Ifc753a6f13da20c1760e545a99fd693717e3acc6
Reviewed-on: https://chromium-review.googlesource.com/c/1402934
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58685}

TBR=yangguo@chromium.org
NOTRY=true

Change-Id: I5fa467a37d654c6e7254f429b7b2f662a77b2901
Reviewed-on: https://chromium-review.googlesource.com/c/1403017Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Alexei Filippov <alph@chromium.org>
Commit-Queue: Alexei Filippov <alph@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58684}

This moves |root_register_value| parameter of JSEntryFunction to the
first. I.e. the type of entry function will be changed from
 Object*(Object* new_target, Object* target, Object* receiver,
         int argc, Object*** args,
         Address root_register_value)
to
 Object*(Address root_register_value,
         Object* new_target, Object* target, Object* receiver,
         int argc, Object*** args),
and moves all parameter handling except for |root_register_value| from
JSEntryVariant to JSEntryTrampolineHelper.

This is a preparation to add another JS entry point for RunMicrotasks,
whose type will be
 Object*(Address root_register_value, MicrotaskQueue*).
The new entry point requires |root_register_value| to be the first to
share the implementation of the EntryFrame setup with existing ones.

Bug: v8:8124
Change-Id: I675376a2ccd240f61cf04eea6fe9a91031e06ede
Reviewed-on: https://chromium-review.googlesource.com/c/1372857
Commit-Queue: Taiju Tsuiki <tzik@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58683}

If the key of the u-ext has no value it will return error so
we should just return undefined for that case.

Bug: v8:8663
Change-Id: I7446ad74c8d0609ad268385b6f4d986060424ce9
Reviewed-on: https://chromium-review.googlesource.com/c/1404194
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58682}

Change-Id: Iffd68156515948254e4ce38021c511596acc5788
Notry: true
Bug: v8:7327
Reviewed-on: https://chromium-review.googlesource.com/c/1400849
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58681}

This is the analogue to CanInlineArrayIteratingBuiltin.

Change-Id: Ic96a8e230f50493d2482d5990d190ac2e7483fe9
Reviewed-on: https://chromium-review.googlesource.com/c/1400405
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58680}

Change-Id: I5b2ec3e8b0d2882465b33fedf62a6eac8f952f93
Reviewed-on: https://chromium-review.googlesource.com/c/1387965Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58679}

Now that we no longer have ObjectPtr and Object* return types,
one way to load the slot's contents is enough.

Bug: v8:3770
Change-Id: I5acaeed22e68595b0e0ba036fcc4ac3d15c57462
Reviewed-on: https://chromium-review.googlesource.com/c/1400416
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58678}