This avoids multiple ToFastProperties runtime calls and additional stack
pushes in strong mode.

BUG=

Review URL: https://codereview.chromium.org/1266573003

Cr-Commit-Position: refs/heads/master@{#29925}

When a Property or a VariableProxy is used as the left hand side of an
assignment statement, there is no need to allocate a LOAD_IC feedback
vector slot for it. Alter the numbering phase to support this.

BUG=

Review URL: https://codereview.chromium.org/1262803002

Cr-Commit-Position: refs/heads/master@{#29924}

All runtime function get a context anyway, which is the same as the
explicit one in case of DeclareGlobals and DeclareLookupSlot. So
we can remove the additional parameter there.

As an additional bonus, improve the runtime interface to DeclareLookupSlot.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1261863002

Cr-Commit-Position: refs/heads/master@{#29923}

R=mvstanton@chromium.org
BUG=v8:4333
LOG=N

Review URL: https://codereview.chromium.org/1264603002

Cr-Commit-Position: refs/heads/master@{#29922}

Adapted disassembler for J and JAL instructions.

TEST=cctest/test-disasm-mips/Type0,
     cctest/test-disasm-mips64/Type3
BUG=

Review URL: https://codereview.chromium.org/1258743004

Cr-Commit-Position: refs/heads/master@{#29921}

Replaces the 64-bit div instruction with 32-bit division in DivI.
Also fixes the Ddiv implementation in the simulator.

TEST=mjsunit/asm/int32div
BUG=

Review URL: https://codereview.chromium.org/1265603002

Cr-Commit-Position: refs/heads/master@{#29920}

A Parameter operator contains a ParameterInfo payload, not an int
payload, so the OpParameter<int> cast is invalid (and only worked by
coincidence currently).

BUG=chromium:515215
LOG=n
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1266743002

Cr-Commit-Position: refs/heads/master@{#29919}

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1262613002

Cr-Commit-Position: refs/heads/master@{#29918}

This fixes several bugs related to float64 pool constants.

Note that float64 pool constants are still disabled by default, and are
only used if --enable-vldr-imm is provided.

BUG=

Review URL: https://codereview.chromium.org/1260953002

Cr-Commit-Position: refs/heads/master@{#29917}

This has become possible since we moved a few experimental
Javascript features to default.

R=hpayer@chromium.org
BUG=chromium:506044
LOG=N

Review URL: https://codereview.chromium.org/1262833002

Cr-Commit-Position: refs/heads/master@{#29916}

Reland^3 "Enable loads and stores to global vars through property cell shortcuts installed into par… (patchset #1 id:1 of https://codereview.chromium.org/1254723004/)"

This reverts commit 2c16d81b.

R=hablich@chromium.org

Review URL: https://codereview.chromium.org/1261533004 .

Cr-Commit-Position: refs/heads/master@{#29915}

TBR=jkummerow@chromium.org, hablich@chromium.org
NOTRY=true
NOTREECHECKS=true

Review URL: https://codereview.chromium.org/1258193003

Cr-Commit-Position: refs/heads/master@{#29914}

Moves some uncommon type checking from ToString and
NonStringToString into DefaultString. This should
speed up string operations.

LOG=N
BUG=none

Review URL: https://codereview.chromium.org/1256323004

Cr-Commit-Position: refs/heads/master@{#29913}

script_executed and last_run are read/written by multiple threads. Also
externalized_shared_contents_ is modified by multiple threads.

BUG=4306
R=jarin@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1252623003

Cr-Commit-Position: refs/heads/master@{#29912}

When the main thread terminates, it forcibly terminates all Worker threads.
When this happens, the threads objects were only half-created; they had a
JavaScript Worker object, but not a C++ worker object.

This CL fixes that bug, as well as some other fixes:
* Signatures on Worker methods
* Use SetAlignedPointerFromInternalField instead of using an External.
* Remove state_ from Worker. Simplify to atomic bool running_.

BUG=chromium:511880
R=jarin@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1255563002

Cr-Commit-Position: refs/heads/master@{#29911}

Changes the interpreter to use a BytecodeArray pointer and an offset to avoid
having an inner pointer to a BytecodeArray object in registers during dispatch.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1254293006

Cr-Commit-Position: refs/heads/master@{#29910}

1 << 24 is apparently not large enough for some optimized code.

R=jkummerow@chromium.org
BUG=v8:4272
LOG=N

Review URL: https://codereview.chromium.org/1265663002

Cr-Commit-Position: refs/heads/master@{#29909}

Moves some uncommon type checking from ToNumber and
NonNumberToNumber into DefaultNumber. This should
speed up numeric operations especially as more "value types
are added.

LOG=N
BUG=513196, v8:4124

Review URL: https://codereview.chromium.org/1260273002

Cr-Commit-Position: refs/heads/master@{#29908}

R=dstence@us.ibm.com, michael_dawson@ca.ibm.com
BUG=
NOTREECHECKS=true

Review URL: https://codereview.chromium.org/1259723002

Cr-Commit-Position: refs/heads/master@{#29907}

Port 5dff4bdf

Original commit message:
    No need to pass the name explicitly to the stubs; the runtime can
    extract the name from the ScopeInfo (the extension of the
    ScriptContext) on-demand easily without any performance impact.

R=bmeurer@chromium.org, dstence@us.ibm.com, michael_dawson@ca.ibm.com
BUG=
NOTREECHECKS=true

Review URL: https://codereview.chromium.org/1258273002

Cr-Commit-Position: refs/heads/master@{#29906}

Revert^3 "Enable loads and stores to global vars through property cell shortcuts installed into par… (patchset #1 id:1 of https://codereview.chromium.org/1254723004/)

Reason for revert:
Suspected to cause Canary crashes

Original issue's description:
> Reland^2 "Enable loads and stores to global vars through property cell shortcuts installed into parent script context".
>
> This reverts commit 362b3785.
>
> R=ishell@chromium.org
>
> Committed: https://crrev.com/440ae014e56924b52337c3747221b79283f07b81
> Cr-Commit-Position: refs/heads/master@{#29849}

TBR=ishell@chromium.org,v8-mips-ports@googlegroups.com,plind44@gmail.com,bmeurer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true

Review URL: https://codereview.chromium.org/1260423002

Cr-Commit-Position: refs/heads/master@{#29905}

R=jkummerow@chromium.org
NOTREECHECKS=true

Review URL: https://codereview.chromium.org/1268463002

Cr-Commit-Position: refs/heads/master@{#29904}

Literals should stay together to simplify allocation folding. This CL takes the pretenuring information from the outermost literal and applies it to the inner liberals.

BUG=chromium:514721
LOG=n
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1263773002 .

Cr-Commit-Position: refs/heads/master@{#29903}

Rolling v8/buildtools to f0b8022601cf9c3c1a2f7efcea48e2fe81d3b143

TBR=machenbach@chromium.org
NOTREECHECKS=true

Review URL: https://codereview.chromium.org/1262733002

Cr-Commit-Position: refs/heads/master@{#29902}

BUG=
R=jkummerow@chromium.org
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1259013002

Cr-Commit-Position: refs/heads/master@{#29901}

BUG=chromium:511215
NOTREECHECKS=true
NOTRY=true
LOG=n
TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1262113002

Cr-Commit-Position: refs/heads/master@{#29900}

This allows variants to be named on test failures (follow
up) and then to be used in the test runner for a repro.

This also speeds up variant iteration for test262 and fixes
a bug with variants for benchmarks.

BUG=chromium:511215
NOTREECHECKS=true
LOG=n

Review URL: https://codereview.chromium.org/1245623005

Cr-Commit-Position: refs/heads/master@{#29899}

When a prototype object migrates from a slow to a fast map, where the slow map
was registered as a user of its own prototype, then the registration must be
transferred to the new map (just like MigrateToMap does for all other cases).

BUG=chromium:513602
LOG=y
NOTREECHECKS=true

Review URL: https://codereview.chromium.org/1263543004

Cr-Commit-Position: refs/heads/master@{#29898}

luci-config has been switched to read from
https://chromium.googlesource.com/v8/v8/+/infra/config

R=machenbach@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=513460

Review URL: https://codereview.chromium.org/1258763004

Cr-Commit-Position: refs/heads/master@{#29897}

Scoping rules are different on recompile vis-a-vis global loads.

BUG=chromium:514526
LOG=y
NOTREECHECKS=true

Review URL: https://codereview.chromium.org/1256413005

Cr-Commit-Position: refs/heads/master@{#29896}

BUG=

Review URL: https://codereview.chromium.org/1257583005

Cr-Commit-Position: refs/heads/master@{#29895}

TBR=yangguo@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1264443002

Cr-Commit-Position: refs/heads/master@{#29894}

Original issue's description:
> Remove ExternalArray, derived types, and element kinds
>
> BUG=v8:3996
> R=jarin@chromium.org, mvstanton@chromium.org, bmeurer@chromium.org
> LOG=y
>
> Committed: https://crrev.com/607ef7c6009a24ebf195b4cab7b0b436c5afd21c
> Cr-Commit-Position: refs/heads/master@{#29872}

BUG=v8:3996
R=bmeurer@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/1262583002

Cr-Commit-Position: refs/heads/master@{#29893}

port 5dff4bdf (r29886).

original commit message:

    No need to pass the name explicitly to the stubs; the runtime can
    extract the name from the ScopeInfo (the extension of the
    ScriptContext) on-demand easily without any performance impact.

BUG=

Review URL: https://codereview.chromium.org/1259063004

Cr-Commit-Position: refs/heads/master@{#29892}

port cac64b9f (r29881)

original commit message:

    We don't need the hole check and slow runtime mode for read-only
    properties this way.

BUG=

Review URL: https://codereview.chromium.org/1263473002

Cr-Commit-Position: refs/heads/master@{#29891}

port a913f4bf (r29870).

original commit message:

BUG=

Review URL: https://codereview.chromium.org/1257883003

Cr-Commit-Position: refs/heads/master@{#29890}

Don't use different read/write slots for context globals, but
let them share the same slot, which reduces the number of
initial misses, and also saves some memory for large scripts.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1258213002

Cr-Commit-Position: refs/heads/master@{#29889}

Revert of Activate preserving of optimized code map accross GCs. (patchset #1 id:1 of https://codereview.chromium.org/1217863006/)

Reason for revert:
This CL may be the reason for the spike on memory corruption. Tentatively reverting this CL.

BUG=chromium:512780
LOG=n

Original issue's description:
> Activate preserving of optimized code map accross GCs.
>
> This enables --noflush-optimized-code-cache which allows preserving
> entries in the optimized code map accross GCs. This only applies to
> values being reachable through other paths.
>
> R=hpayer@chromium.org,hablich@chromium.org
>
> Committed: https://crrev.com/1a8776db25b63c4ce718423772d1fd13f58eeab5
> Cr-Commit-Position: refs/heads/master@{#29755}

TBR=hablich@chromium.org,mstarzinger@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1255043003

Cr-Commit-Position: refs/heads/master@{#29888}

We can apply the shortcut used for data properties of the JSGlobalObject
to builtin properties as well. This mostly affects the custom properties
we use for the Math functions (i.e. rngstate for Math.random() and kMath
for sin, cos and friends).

Drive-by-fix: Also mark the internal builtin typed arrays properties
(rngstate, kMath and rempio2result) as READ_ONLY, as they should not be
touched after genesis.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1254143003

Cr-Commit-Position: refs/heads/master@{#29887}

No need to pass the name explicitly to the stubs; the runtime can
extract the name from the ScopeInfo (the extension of the
ScriptContext) on-demand easily without any performance impact.

Review URL: https://codereview.chromium.org/1259963002

Cr-Commit-Position: refs/heads/master@{#29886}