This reverts commit fc48a228.

Reason for revert: fails tsan: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20TSAN%20-%20concurrent%20marking/13871

Original change's description:
> Reland "[heap] Move start of incremental marking in allocation"
> 
> This is a reland of d6a14abe
> 
> Test wasn't written with incremental/concurrent marking in mind, so
> simply disabling it for this particular unittest.
> 
> Original change's description:
> > [heap] Move start of incremental marking in allocation
> >
> > Move start of incremental marking out of
> > RefillLinearAllocationAreaFromFreeList. This avoids a potential
> > safepoint while holding allocation_mutex_.
> >
> > Bug: v8:10315
> > Change-Id: Ieb60ac68f26199eea7b6b7ad6d874851382f3d69
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2287496
> > Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
> > Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#68751}
> 
> Bug: v8:10315
> Change-Id: I2a665400d9a784b1557474a051839d5c8b45e9e2
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2292241
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#68818}

TBR=ulan@chromium.org,dinfuehr@chromium.org

Change-Id: I9063a942c050b79cd3b66226dc25651ccf9fa60a
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10315
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2295361Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68826}

Also make ScopedList class Zone-agnostic and move it to src/utils.

Bug: v8:10506
Change-Id: Ibf0869566caa767809bdf95cb03c01e599613938
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2292234Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68825}

This adds a new Code section to the compilation cache (aka isolate
cache), and inserts generated native context independent code into it.

Cache consumption will be implemented in a following CL.

Bug: v8:8888
Change-Id: I997c13da0fe547f395627a48f1cb7e5f19dfc3ba
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2288851Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68824}

Currently the compilation may fail with the following error:

loop will run at most once (loop increment never executed)

Change-Id: I79dd1c5212475647c42e803858fe589cd9a05b7e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2294916Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#68823}

Instead of completely finishing sweeping in the slow path of allocation,
just sweep all pages for the current PagedSpace. This will help
in making main thread allocation concurrent, since there is no need
anymore to lock the allocation mutexes of other PagedSpaces.

Bug: v8:10315
Change-Id: I1cf76d94fa7a22e726fc71f49c2d5669e4a0598c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2292306
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68822}

If WASM code is profiled with Intel VTune Profiler then the user sees 
incomplete function name - a function name is cut when a space is met.
This patch fixes the issue to show a complete function name including 
arguments.

Change-Id: I0e550e921acb703ec14fe83d67e7bb47035f739d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2246575
Commit-Queue: Bill Budge <bbudge@chromium.org>
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68821}

Bug: v8:7703
Change-Id: Ia4df2637873df5dc7b4beb6aaa781c7b4d32a54c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2292249Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68820}

... by migrating old-style code
  MyObject* obj = new (zone) MyObject(...)

to the new style
  MyObject* obj = zone->New<MyObject>(...)

Bug: v8:10689
Change-Id: I08e513911a6b4e5d564cab42720a197d1244dd2e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2292238Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68819}

This is a reland of d6a14abe

Test wasn't written with incremental/concurrent marking in mind, so
simply disabling it for this particular unittest.

Original change's description:
> [heap] Move start of incremental marking in allocation
>
> Move start of incremental marking out of
> RefillLinearAllocationAreaFromFreeList. This avoids a potential
> safepoint while holding allocation_mutex_.
>
> Bug: v8:10315
> Change-Id: Ieb60ac68f26199eea7b6b7ad6d874851382f3d69
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2287496
> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#68751}

Bug: v8:10315
Change-Id: I2a665400d9a784b1557474a051839d5c8b45e9e2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2292241Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68818}

This CL adapts the builtin for architectures ia32, x64 and arm.

Change-Id: Ib191e66a75eaddaee505e30b8cafb0c5e5bf42ce
Bug: v8:10201
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2292246
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68817}

This CL adds instructions for easier navigation in the app.

Change-Id: I4c5332d400d51f2c7664a45efb7fbf700041c4eb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2292244Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Zeynep Cankara <zcankara@google.com>
Cr-Commit-Position: refs/heads/master@{#68816}

In order to support conservative stack scanning, we need to be able to
pin pages if they're pointed to by an ambiguous pointer. This CL lets us
do this by providing an IS_PINNED flag which, when enabled, prevents a
page from being selected as an evacuation candidate during compaction.

Bug: v8:10614
Change-Id: I45d1c74b83aad1b56e078cc270749a0aee804716
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2278465
Commit-Queue: Jake Hughes <jakehughes@google.com>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68815}

test262 has updated the tests in question.

Bug: v8:9808
Change-Id: Ia4d257f230d7ae5412acab133f43ebe3467c21d3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2292242Reviewed-by: Mathias Bynens <mathias@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68814}

Adds support for main-thread handling of JSMember during the
atomic pause.

Follow-ups for later:
- Copy/Move/Heterogenous assignment
- Write barrier
- Atomic handling for concurrent processing.

Bug: chromium:1056170
Change-Id: Ia9ac4599ca85cf7cc2d67066e89485744d7d56b6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2289781
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68813}

Bug: v8:10619
Change-Id: I644c3421085b029aaf9b4de3b262ca8a4734539e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2292916Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68812}

Bug: v8:7748
Change-Id: I925be7942f4825aeac7364bc7c899b6bef8001c3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2284985
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68811}

This was pointed out in https://crrev.com/c/2290623 but was missed.

Change-Id: I1f0206d1dbc067ee57061f1b5e7085ebe1643906
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2292738
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68810}

- was missing an import sys
- check for long
- check for xrange

This file is now flake8 warning free, and should work on both Py2 and
Py3.

$ flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics

Bug: v8:8594
Change-Id: Iae857f4686bcad509fa700954b7f30f86150739f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2288177Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68809}

... by migrating old-style code
  MyObject* obj = new (zone) MyObject(...)

to the new style
  MyObject* obj = zone->New<MyObject>(...)

Bug: v8:10689
Change-Id: I55c686bbedfa1fd1955a5927df3f72b366312fd4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2288867
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68808}

Rather than marking deleted GlobalDictionary entries with a "The Hole"
valued PropertyCell, we now remove those PropertyCells entirely and
use the standard HashTable deleted item marker (also the Hole).

This comes with several simplifications:

  1) We no longer need a customizable IsKey method on HastTable shapes,
     which was only used by GlobalDictionary to mark "The Hole" cells
     as not real keys,
  2) We can get rid of IsLive/IsKey from the Shape entirely, and define
     it directly in the HashTable, which will also allow us (in the
     future) to encourage caching of "undefined" and "Hole" where used
     for IsKey checks,
  3) PropertyCell invalidation doesn't necessarily have to allocate a
     new replacement cell (specifically, on deletion), nor does it have
     to deal with cells that contain the Hole,
  4) kNeedsHoleCheck is renamed to kMatchNeedsHoleCheck (to be explicit
     that this is only needed to guard IsMatch, which may do an
     indentity comparison and thus not need the HoleCheck guard). It's
     also moved out of BaseShape and into the various shapes that
     define IsMatch, to make them more explicitly think about the
     value,
  5) Modified some while loops into for loops to allow clearer use of
     "continue" on successful hole checks.

Change-Id: If591cbb6b49d59726bdc615413aba4f78fd64632
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2292230
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68807}

This implements v128.const for ia32, x64, arm, and arm64.

Moves one of the test case under the correct header.

Bug: v8:9909
Change-Id: I93eb179ac5fd0bc22e3dd5277f7d73699ac8b452
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2290623
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68806}

The map of the HashTable is more a property of the HashTable than part
of its shape, so we can move its static map getter (for construction)
to to HashTable class itself.

Change-Id: I73f4aa7260d6ce749ef51961767fd37d1ab520e4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2289782
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68805}

Bug: v8:7748
Change-Id: I43384d10805b62745a4bc19fa0a4174e6ee94f0f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2289777
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68804}

... by migrating old-style code
  MyObject* obj = new (zone) MyObject(...)

to the new style
  MyObject* obj = zone->New<MyObject>(...)

Bug: v8:10689
Change-Id: Iec2b3102bd35ad7e50b90882ade78d27999a71f2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2288866Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68803}

The CallWithSpread builtin actually receives a variable number of arguments. This is necessary when running with the arguments reversed in the stack (v8_enable_reverse_jsargs).

Change-Id: I57f67cbef4f2eb7dbb7c245b9a070c3b44d1bfce
Bug: v8:10201
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2292233
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68802}

This allows `new (Pretenured) X{}` to force a pretenured allocation.

Bug: v8:7793
Change-Id: Ib09f186b3b503b9b23291c39c1390f120d25eebe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2288409
Commit-Queue: Gus Caplan <me@gus.host>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68801}

This removes a loop that runs exactly one or two times by straight-line
code for the two cases. This should make it more readable and easier to
maintain.

R=thibaudm@chromium.org

Bug: v8:10576
Change-Id: I242bc4a7f7333b04ec39e79dc530625fb5e2305f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2287505Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68800}

We often want to pass a list of moves of fixed length. Instead of
constructing an array on the caller's stack and passing it via
{ArrayVector}, we should just pass it via {std::initializer_list}. This
also avoids to spell out the internal name
{LiftoffAssembler::ParallelRegisterMoveTuple}.

R=thibaudm@chromium.org

Bug: v8:10576
Change-Id: Ibe7ac5a5a02686533333cb45652cbb2b99ad9c60
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2287498
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68799}

This change has no impact. It only changes the order of the arguments when using v8_enable_reverse_jsargs.

Change-Id: I6063da3703f0fa4a2b790e4291727dd7ff460dfa
Bug: v8:10201
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2292232Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68798}

Since we are not using CodeAssemblerVariables anymore, we can properly
scope the class so that the only way to instance one is through the
typed version (i.e TypedCodeAssemblerVariable).

Bug: v8:6949
Change-Id: I3ee99bcbb9421aadd0944af57f6452e832719758
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2290858
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68797}

This will be needed later for concurrent marking

Bug: chromium:1056170
Change-Id: Iab7812d7ac8a30e3a54bd7c4b739077b293db775
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2287869
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68796}

This CL attempts to change change content and change
format to increase accessibility.

Bug: v8:10664

Change-Id: Ic80e00310884ac64dc99fe053354250671cabfdd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2290859Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Zeynep Cankara <zcankara@google.com>
Cr-Commit-Position: refs/heads/master@{#68795}

This CL attempts to encapsulate Statistics gathered
to a separate custom web component.

Screenshots: https://imgur.com/a/xlffxDE
Bug: v8:10667

Change-Id: I37816a4fe3d37f2b042d05a7110eda04af303fbb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2287506Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Zeynep Cankara <zcankara@google.com>
Cr-Commit-Position: refs/heads/master@{#68794}

Port 34871edd

Original Commit Message:

    Partial implementation of v128.const, only the optimized case for all 0s
    and all 1s. The other cases bailout to TurboFan for now, and will be
    added in subsequent patches.

R=zhin@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I948380f0859b49bcc5a55d239b24a93b1cd5fd04
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2292113Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#68793}

... by migrating old-style code
  MyObject* obj = new (zone) MyObject(...)

to the new style
  MyObject* obj = zone->New<MyObject>(...)

Bug: v8:10689
Change-Id: I79fc4f9793a0c7a3bd38230ca4e23d33344fc1b2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2288863Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68792}

... by migrating old-style code
  MyObject* obj = new (zone) MyObject(...)

to the new style
  MyObject* obj = zone->New<MyObject>(...)

Bug: v8:10689
Change-Id: I8293cc1854e39726eb9e4e5f9d2a34d38fa54859
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2288861Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68791}

Bug: v8:6949
Change-Id: I8bd989ffce16b05e7cc37a35da9c2912090f60ec
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2290857Reviewed-by: Dan Elphick <delphick@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68790}

... by migrating old-style code
  MyObject* obj = new (zone) MyObject(...)

to the new style
  MyObject* obj = zone->New<MyObject>(...)

Bug: v8:10689
Change-Id: I2fc4a44ea05e4d087565811f343893f0e97dc660
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2288857
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68789}

... by migrating old-style code
  MyObject* obj = new (zone) MyObject(...)

to the new style
  MyObject* obj = zone->New<MyObject>(...)

Bug: v8:10689
Change-Id: Iea6c1225ee672035763d8141292a40874658d270
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2288864
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68788}

This CL removes the GetTraceDescriptor virtual call from garbage
collected mixins and replaces it with querying the object start
bitmap.

The CL also removes the mixin macros which are now no longer needed.

Bug: chromium:1056170
Change-Id: I27ed299f93025d09a3bb3f0d17b14bed3c200565
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2287508Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68787}