Mechanical move simplifying a follow up that removes the recursive
locking strategy by properly partitioning pages.

Bug: v8:6923
Change-Id: I688e61131731e2b9dc9c311b0b43f0902c149359
Reviewed-on: https://chromium-review.googlesource.com/723020Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48640}

So far the inlining of Function#bind into TurboFan optimized code was
limited to cases where TurboFan could infer the constant JSFunction that
was bound. However we can easily extend that to cover JSBoundFunction as
well, and obviously also take the LOAD_IC feedback if we don't have a
known JSFunction or JSBoundFunction.

This adds a new operator JSCreateBoundFunction that contains the logic
for the creation of the bound function object and the arguments.

On the micro-benchmarks we go from

  functionBindParameter0: 1239 ms.
  functionBindConstant0: 478 ms.
  functionBindBoundConstant0: 1256 ms.
  functionBindParameter1: 1278 ms.
  functionBindConstant1: 475 ms.
  functionBindBoundConstant1: 1253 ms.
  functionBindParameter2: 1431 ms.
  functionBindConstant2: 616 ms.
  functionBindBoundConstant2: 1437 ms.

to

  functionBindParameter0: 462 ms.
  functionBindConstant0: 485 ms.
  functionBindBoundConstant0: 474 ms.
  functionBindParameter1: 478 ms.
  functionBindConstant1: 474 ms.
  functionBindBoundConstant1: 474 ms.
  functionBindParameter2: 617 ms.
  functionBindConstant2: 614 ms.
  functionBindBoundConstant2: 616 ms.

which is a ~2.5x improvement. On the jshint benchmark in the
web-tooling-benchmark we observe a 2-3% improvement, which corresponds
to the time we had seen it running in the generic version.

Bug: v8:6936, v8:6946
Change-Id: I940d13220ff35ae602dbaa33349ba4bbe0c9a9d3
Reviewed-on: https://chromium-review.googlesource.com/723080Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48639}

Encapsulates special reservation / allocation behavior for builtin
deserialization.

Bug: v8:6624
Change-Id: Ic784ed43b607c881b356c6e535c9dbe185e1d4cd
Reviewed-on: https://chromium-review.googlesource.com/716229
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48638}

Bug: 
Change-Id: I28d6905a0c527a171deae89374ef54c2b4b97d3d
Reviewed-on: https://chromium-review.googlesource.com/722960Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48637}

This removes the builtins area from the startup snapshot. It's now
completely contained in the separate builtins blob area.

Bug: v8:6624
Change-Id: Id3c43a177c7e1ed418eec59cf620fa461eb6df81
Reviewed-on: https://chromium-review.googlesource.com/715759
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48636}

R=clemensh@chromium.org

Bug: chromium:766003,chromium:772332,chromium:771243
Change-Id: I1e2df014f31a87fd94154277d1a415ec359d42df
Reviewed-on: https://chromium-review.googlesource.com/721666Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48635}

A continuation of the work in 59e4b751, this extracts logic around
memory reservation and allocations out of the Deserializer class.

Follow-up work is planned to create a specialized allocator for
builtin deserialization.

Bug: v8:6624
Change-Id: I7081cdc557ab8fb2571aadb816399e136ea2cdbb
Reviewed-on: https://chromium-review.googlesource.com/716036
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48634}

R=bmeurer@chromium.org
BUG=v8:6792

Change-Id: I8ed3e6ec06bfba117781efc63d79bc7641b7ec24
Reviewed-on: https://chromium-review.googlesource.com/722641Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48633}

R=rossberg@chromium.org

Bug: 
Change-Id: Icac33dc87dd660173e5a45d02b31be46f7d1cb2d
Reviewed-on: https://chromium-review.googlesource.com/721550
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Andreas Rossberg <rossberg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48632}

OSR for functions which use arguments no longer needs to be disabled, since
TurboFan handles the case.

Bug: 
Change-Id: I121f1190a142c18f113bd5f875e258812645c43f
Reviewed-on: https://chromium-review.googlesource.com/721661Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48631}

Bug: chromium:774860
Change-Id: I180ca7e9e8d8603e0d61deb0eb71d758895d0f74
Reviewed-on: https://chromium-review.googlesource.com/721551Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48630}

BUG=v8:5402,v8:6921

Change-Id: Iab2509554718a6beca73217f80cafedf650bd066
Reviewed-on: https://chromium-review.googlesource.com/718741Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48629}

This reverts commit 972d460f.

Reason for revert: This CL is not the right solution, and it makes back-merging the right solution more difficult.

Original change's description:
> [wasm] Use 64-bit comparison for bounds checks on 64-bit platforms
> 
> By using 64-bit comparison we make sure that there will be no out of
> memory accesses even if there are stale values in the high word of a
> register.
> 
> R=​titzer@chromium.org
> 
> Change-Id: I2627b15e1598f35cc480d7028031e8de405164ea
> Reviewed-on: https://chromium-review.googlesource.com/721323
> Reviewed-by: Ben Titzer <titzer@chromium.org>
> Commit-Queue: Andreas Haas <ahaas@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#48604}

TBR=titzer@chromium.org,ahaas@chromium.org

Change-Id: I0c15e9d8ac72def2e22543a17366126d90a17918
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/721702Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48628}

The simulator currently does not handle signalling NaNs correctly on
the vabs and vneg instructions.
Temporarily disable the tests until we have a fix.

R=ahaas@chromium.org

Bug: v8:6947
Change-Id: I281cb8213cdcc73c91768a82c44f90f009f7c8eb
Reviewed-on: https://chromium-review.googlesource.com/721663Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48627}

Disabling only for stress mode did not help, the test uses 10GB
in other modes too.

Bug: v8:6924
Change-Id: I0e1348f8a43e41612d3a94e75396f0a26a82ece2
Reviewed-on: https://chromium-review.googlesource.com/721662Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48626}

Remove unused macros, and move macro definitions used only in a single
file into the file itself.

Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng
Change-Id: If62107816ad1e6addf58705a075d3eba4f23bf08
Reviewed-on: https://chromium-review.googlesource.com/721381Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48625}

This adds a single bottleneck that properly handles the copying of empty, COW
and FixedDoubleArray arrays under the control of flags. This is in preparation
of adding new CSA-based array builtins on Array.prototype.

Drive by: Fix SmiConstant handling when ENABLE_VERIFY_CSA is not active and 
make the use of constant detection/folding consistent in the CSA depending
on ParameterMode.

Change-Id: If1889ab8cbff1805286b7b4344c29ffbe7191b39
Reviewed-on: https://chromium-review.googlesource.com/715798
Commit-Queue: Daniel Clifford <danno@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48624}

This code is never used, and we don't right trim TypedArrays.

Bug: 
Change-Id: Ic3e32b194fb10ecd067449c755b1982c87c98257
Reviewed-on: https://chromium-review.googlesource.com/721541Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48623}

This reverts commit 2857e783.

Reason for revert:
https://build.chromium.org/p/client.v8/builders/V8%20Linux/builds/20965

Original change's description:
> [ia32][wasm] Add I32x4AddHoriz and I16x8AddHoriz
> 
> Add phaddd, phaddw and AVX version
> Add vmovdqu and Movdqu macro
> 
> Bug: 
> Change-Id: I4f5c0cf96ab481fc18f0a0d554101a996a16c954
> Reviewed-on: https://chromium-review.googlesource.com/715677
> Commit-Queue: Jing Bao <jing.bao@intel.com>
> Reviewed-by: Bill Budge <bbudge@chromium.org>
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#48621}

TBR=bbudge@chromium.org,mtrofin@chromium.org,bmeurer@chromium.org,jing.bao@intel.com

Change-Id: Icaf36b46134e77e46180fc1671d0c6569b729a89
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/722679Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48622}

Add phaddd, phaddw and AVX version
Add vmovdqu and Movdqu macro

Bug: 
Change-Id: I4f5c0cf96ab481fc18f0a0d554101a996a16c954
Reviewed-on: https://chromium-review.googlesource.com/715677
Commit-Queue: Jing Bao <jing.bao@intel.com>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48621}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/0db5732..b6fbb0d

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/buildtools/+log/f6d165d..e043d81

Rolling v8/third_party/android_tools: https://chromium.googlesource.com/android_tools/+log/ca9dc72..110e5f6

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/c0f385b..733ecb1

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/d1283a8..af65d54

TBR=machenbach@chromium.org,hablich@chromium.org

Change-Id: Iac5e37f0f49ddf33182e1742e97e81ad1c5e1b52
Reviewed-on: https://chromium-review.googlesource.com/721505Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48620}

Inner functions which called eval, and were the kind of functions
that can use `super`, were erroneously not marked as "uses_super_property",
leading to downstream crashes when the runtime tried to load the
[[HomeObject]] from them.

This patch eliminates the public Scope::uses_super_property()
API and ensures that callers always call Scope::NeedsHomeObject()
instead.

This is a minimal fix designed for easy merging; it's likely that
in the long run we should remove most mentions of "uses super property"
and replace them with "needs home object" for clarity.

Bug: v8:5516, chromium:774994
Change-Id: Id269dd33e35bd40f6b59a3d3e19330687afa64f8
Reviewed-on: https://chromium-review.googlesource.com/721879Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48619}

The method returns names for all available top-level scope variables
in giving context.

R=dgozman@chromium.org,jgruber@chromium.org

Bug: chromium:681333
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel
Change-Id: I2d0b600e1afbfef9087f53ea9c26abe1e112047c
Reviewed-on: https://chromium-review.googlesource.com/719409
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48618}

R=dgozman@chromium.org

Bug: chromium:696798
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel
Change-Id: Ida60ee5fb3e3e42d15bf6d4bad84dfcfb521b74f
Reviewed-on: https://chromium-review.googlesource.com/722073Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48617}

Change-Id: I77b6eb5e949f8b37fa76d2a161d1ec2c1117ab04
Reviewed-on: https://chromium-review.googlesource.com/722078Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Ben Smith <binji@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48616}

This is a reland of 61292f0b
Original change's description:
> [inspector] breakpoint after last break position should not jump to first line
> 
> R=jgruber@chromium.org
> 
> Bug: chromium:730177
> Change-Id: I0f3666a333604cb80bb51410c5edf2aceb0c6ef5
> Reviewed-on: https://chromium-review.googlesource.com/717717
> Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#48556}

TBR=jgruber@chromium.org

Bug: chromium:730177
Change-Id: I564cc5d7778f9d79780eae9dbe2d9aafaad4f466
Reviewed-on: https://chromium-review.googlesource.com/721468
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48615}

This reverts commit d0e3fb4f.

Reason for revert: Failures on all GPU bots:
https://build.chromium.org/p/client.v8.fyi/builders/Win%20Release%20%28NVIDIA%29/builds/3171
https://build.chromium.org/p/client.v8.fyi/builders/Linux%20Release%20%28NVIDIA%29/builds/3730

Original change's description:
> Reland: [heap] Add missing steps for Add/Remove observers
> 
> This is a reland of https://chromium-review.googlesource.com/c/v8/v8/+/715118.
> The UI doesn't allow me to reland this automatically due to merge conflicts
> so I ended up doing this manually.
> 
> Change-Id: Ic013b61f459cb1e91e24203fb31ae7c14f3754f8
> Reviewed-on: https://chromium-review.googlesource.com/720136
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Commit-Queue: Ali Ijaz Sheikh <ofrobots@google.com>
> Cr-Commit-Position: refs/heads/master@{#48606}

TBR=ulan@chromium.org,mlippautz@chromium.org,ofrobots@google.com

Change-Id: I80f63ac0cc54471b3ecaa7b6d85b1805ea599dd4
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/721440Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48614}

Because the typeof operator may lower to a builtin call (which is
effectful in turbofan parlance after effect control linearization),
it really should be encoded as a simplified operator, which can
be optimized with respect for the effect chain in linearization.

No new functionality here, rather a furniture rearrangement in
the TurboFan node structure.

BUG=v8:6929

Change-Id: I38593e10956ebd57cecdd606c35f3f73efb1327e
Reviewed-on: https://chromium-review.googlesource.com/718745Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48613}

This supports {valueOf() { return BigInt(...) }} objects as
operands in binary and unary operations.

Bug: v8:6791
Change-Id: I30ec9983ff611477742f9ea0bc6d04972fe21d3c
Reviewed-on: https://chromium-review.googlesource.com/716863
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48612}

We can use member initializers instead of the OTHER_CONSTANTS macro to
handle the declaration of oddball AstValue members in AstValueFactory.

Bug: v8:6921
Change-Id: I701e2fd36f854cfc0d835981d060622070b5bfba
Reviewed-on: https://chromium-review.googlesource.com/719395Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48611}

This is a reland of af49af00
Original change's description:
> PPC/s390: Fix arguement handling
> 
> 1. in AssembleMove and AssembleSwap, we need to distinguish Double and Float
> 2. in 32-bit mode, double needs to be counted as 2 slots in stack
> 
> R=joransiu@ca.ibm.com, jbarboza@ca.ibm.com, michael_dawson@ca.ibm.com, mmallick@ca.ibm.com
> 
> Bug: 
> Change-Id: Iffe1844aa72e9d4c9492034c3df9a994e1304a27
> Reviewed-on: https://chromium-review.googlesource.com/720676
> Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
> Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
> Cr-Commit-Position: refs/heads/master@{#48593}

Change-Id: If91125e71b82c92f54f537345e4c213bd185e786
Reviewed-on: https://chromium-review.googlesource.com/721419Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#48610}

This is only enabled when --experimental-wasm-threads is enabled.

In addition, only shared WebAssembly.Memory may be sent, as specified
here: https://github.com/WebAssembly/design/pull/1074/files#diff-8e85308ab5cc1e83e91ef59233648be2R227

Bug: v8:6895
Change-Id: Id009a7f890d15fa6c98e93f03806f7e7eff30c2a
Reviewed-on: https://chromium-review.googlesource.com/719417
Commit-Queue: Brad Nelson <bradnelson@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48609}

Port the baseline version of Reflect.has to the CodeStubAssembler and
reuse the existing logic for HasProperty (i.e. the HasProperty builtin).
Also inline the Reflect.has builtin into TurboFan, by adding a check
on the target in front of a use of the JSHasProperty operator.
Technically this additional check is not necessary, because the
JSHasProperty operator already throws if the target is not a JSReceiver,
but the exception message is confusing then.

This improves the performance of the micro-benchmark from

  reflectHasPresent: 337 ms.
  reflectHasAbsent: 472 ms.

to

  reflectHasPresent: 121 ms.
  reflectHasAbsent: 216 ms.

which is a nice 2.8x improvement in the best case. It also improves the
chai test on the web-tooling-benchmark by around 1-2%, which is roughly
the expected win (since Reflect.has overall accounts for around 3-4%).

Bug: v8:5996, v8:6936, v8:6937
Change-Id: I856183229677a71c19936f06f2a4fc7a794a9a4a
Reviewed-on: https://chromium-review.googlesource.com/720959
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48608}

Calls like read_leb<int32_t, true, true, true>(...) can be hard to read
and understand. This CL replaces the three boolean template parameters
with enums so that the call is read_leb<int32_t, kChecked, kAdvancePC, kTrace>(...)
now.

R=clemensh@chromium.org

Bug: v8:6921
Change-Id: Id876a727d5e17df721444e7e5a117ad5395071aa
Reviewed-on: https://chromium-review.googlesource.com/718204
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48607}

This is a reland of https://chromium-review.googlesource.com/c/v8/v8/+/715118.
The UI doesn't allow me to reland this automatically due to merge conflicts
so I ended up doing this manually.

Change-Id: Ic013b61f459cb1e91e24203fb31ae7c14f3754f8
Reviewed-on: https://chromium-review.googlesource.com/720136Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ali Ijaz Sheikh <ofrobots@google.com>
Cr-Commit-Position: refs/heads/master@{#48606}

This is a reland of 56da97bb
Original change's description:
> [snapshot] Ship lazy TFJ builtins
> 
> Design doc: goo.gl/dxkYDZ
> 
> Bug: v8:6624
> Change-Id: I8813f79e415843ffe8d33a605a2662dbfc0c9764
> Reviewed-on: https://chromium-review.googlesource.com/674883
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Reviewed-by: Michael Hablich <hablich@chromium.org>
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#48590}

TBR=yangguo@chromium.org,hablich@chromium.org

Bug: v8:6624, v8:6942
Change-Id: I1af6b0982f7e129127f2714c27a74b7e39207065
Reviewed-on: https://chromium-review.googlesource.com/721179
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48605}

By using 64-bit comparison we make sure that there will be no out of
memory accesses even if there are stale values in the high word of a
register.

R=titzer@chromium.org

Change-Id: I2627b15e1598f35cc480d7028031e8de405164ea
Reviewed-on: https://chromium-review.googlesource.com/721323Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48604}

Pause sweeper tasks when entering the Scavenger. In future CLs this
enables removing the page lock for the Scavenger.

CQ_INCLUDE_TRYBOTS=master.tryserver.v8:v8_linux64_tsan_rel;master.tryserver.v8:v8_linux64_tsan_concurrent_marking_rel_ng;master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel;master.tryserver.chromium.android:android_optional_gpu_tests_rel

Bug: v8:6923, chromium:774108
Change-Id: Idcb7e14b94704dead70c33a49e67047b88bb6c4c
Reviewed-on: https://chromium-review.googlesource.com/718200
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48603}

Instead of modifying this flag in compiled wasm code, we can just
change it in the caller / called code. This saves code space and
compilation time and fixes the referenced bug.

R=titzer@chromium.org, eholk@chromium.org

Bug: chromium:773631, v8:5277
Change-Id: I095158ac01eecd21a92649a3990e8d7c593db912
Reviewed-on: https://chromium-review.googlesource.com/712597Reviewed-by: Ben Titzer <titzer@chromium.org>
Reviewed-by: Eric Holk <eholk@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48602}

R=joransiu@ca.ibm.com, jbarboza@ca.ibm.com, michael_dawson@ca.ibm.com

Bug: 
Change-Id: I30c5bba9380d71d1ea2fc0391aa90adca9330eb2
Reviewed-on: https://chromium-review.googlesource.com/721339Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#48601}