The named LoadIC code was missing a check for "names" that
convert to TypedArray indices. This was flushed out by the
recent bump of the max TypedArray size from 2^32-1 to 2^32.
Named StoreICs had the same bug; fixed here as well.

Bug: v8:4153
Fixed: chromium:1104608
Change-Id: I6bd2552d6ccc238104f92e7b95d19970d4a75dae
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2295606Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68840}

This is a reland of fc48a228

Original change's description:
> Reland "[heap] Move start of incremental marking in allocation"
>
> This is a reland of d6a14abe
>
> Test wasn't written with incremental/concurrent marking in mind, so
> simply disabling it for this particular unittest.
>
> Original change's description:
> > [heap] Move start of incremental marking in allocation
> >
> > Move start of incremental marking out of
> > RefillLinearAllocationAreaFromFreeList. This avoids a potential
> > safepoint while holding allocation_mutex_.
> >
> > Bug: v8:10315
> > Change-Id: Ieb60ac68f26199eea7b6b7ad6d874851382f3d69
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2287496
> > Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
> > Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#68751}
>
> Bug: v8:10315
> Change-Id: I2a665400d9a784b1557474a051839d5c8b45e9e2
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2292241
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#68818}

Bug: v8:10315
Change-Id: I7873c6c20e39d6636bd95a26d0c1cfc8f89366bd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2295363Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68839}

For the first test, we just test that we can search on two threads at
the same time. This CL sets the base for the future tests for more
complicated cases.

Bug: v8:7790
Change-Id: I1becf4493897b55e7ee0a7f37ab5bf1203bf14eb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2241530
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68838}

... on Code objects.

Refactors: create a dedicated WasmCode constructor, hide the internal
constructor, constify members, and let SafepointTable handle
out-of-line tables.

Expose a new Code::SafepointTableAddress() helper as the source of
truth. Some safepoint tables may move out-of-line in the near future.

Bug: v8:7777,v8:10707
Change-Id: I4e2d954ed2d157235e9dfa3e7a5ca08800896683
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2297459Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68837}

This CL adds functionality to read the source positions directly
from the JS heap rather than from serialized data.

In order to do this, we create a PersistentHandles container in the
OptimizedCompilationInfo which gets passed onto the JSHeapBroker. This
allows us to create the handles in the main thread and pass them safely
to the background thread.

In order to read safely from the background thread, we need a LocalHeap
which blocks the GC from running and potentially moving the handles.
This LocalHeap is created only when the JSHeapBroker has finalized
serializing and destroyed when retiring it.

Bug: v8:7790
Change-Id: I19f8b08d12e5be0a3df34d6af2043310c0c7b6fe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2277802Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68836}

Handler tables (and other inlined Code metadata) will have to move
outside the .text section. This CL creates Code::HandlerTableAddress()
as a single chokepoint for accessing the handler table of a Code
object.

Drive-by: Create a dedicated constructor for WasmCode handler tables.

Bug: v8:7777
Change-Id: I01c5157b732ba509b2c76f2744fde271c2ba1411
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2295605
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68835}

The Sw/Sd in FillStackSlotsWithZero should't use kSystemPointerSize as
address offset, because the start address should be inclusive, and
the end address should be exclusive.

The skip-stack-guard-page test case failed due to this bug, and besides,
it also needs larger stack size on mips simulator.

Change-Id: Ieff55fe2c5a13e6dad1c5d073e1c0d22fe789d41
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2282663
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68834}

This CL changes color of the timeline
and map panel to decrease eye strain and follow
material design guidelines.

Material design guidelines ensures to enhance
accessibility and conserve energy.

Bug: v8:10673, v8:10672
Change-Id: Iea8f487fa5b73437888e88d6e1d694d5bfaf830c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2292239Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Zeynep Cankara <zcankara@google.com>
Cr-Commit-Position: refs/heads/master@{#68833}

.. and move all SharedFunctionInfo implementations from objects.cc to
the dedicated shared-function-info.cc.

Drive-by: Also move remaining JSRegExp impls.

Bug: v8:8888
Change-Id: I59adc3928f379eeb8b70f26d7e51d01c889c9a47
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2292240
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68832}

https://chromium.googlesource.com/external/github.com/tc39/test262/+log/281eb10..8575a6e
Fix for https://crbug.com/v8/10623 is in
https://chromium-review.googlesource.com/c/v8/v8/+/2291617

Bug: v8:7834
Change-Id: Ia6f6f36b99719ca873702b78ac7aa8284e8ce040
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2295636Reviewed-by: Mathias Bynens <mathias@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68831}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/3fd005e..b8f14c0

Rolling v8/third_party/aemu-linux-x64: s9pb0zCLuc3Aj9A3n8IG3qBVpc2wOmQ1A32bDtG1idwC..sruBLlVcbmt9F1gAt88JIykKImWZUcWy2HLp9bT1IBYC

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/e4221b4..09e01d1

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/9af33fa..6897807

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/21dcb28..d027d75

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I55262afcfef2a5328d2bd4fdeffd94b582900ba4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2295663Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#68830}

Change-Id: I0eb2046d4bbb4305873866e99053d520d5e402f6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2295882Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#68829}

Rename functions for main thread allocation to indicate that they are
used for main thread allocation.

Bug: v8:10315
Change-Id: Idd359a7a439ec2e93f0bdc2f1bed987755790bbe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2292308Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68828}

Sync the implementation with the latest version of https://github.com/tc39/ecma402/pull/347

Bug: v8:10692
Change-Id: I4e2144da9f770607b4d79e7ce32f079dd2eef54c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2290627Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68827}

This reverts commit fc48a228.

Reason for revert: fails tsan: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20TSAN%20-%20concurrent%20marking/13871

Original change's description:
> Reland "[heap] Move start of incremental marking in allocation"
> 
> This is a reland of d6a14abe
> 
> Test wasn't written with incremental/concurrent marking in mind, so
> simply disabling it for this particular unittest.
> 
> Original change's description:
> > [heap] Move start of incremental marking in allocation
> >
> > Move start of incremental marking out of
> > RefillLinearAllocationAreaFromFreeList. This avoids a potential
> > safepoint while holding allocation_mutex_.
> >
> > Bug: v8:10315
> > Change-Id: Ieb60ac68f26199eea7b6b7ad6d874851382f3d69
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2287496
> > Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
> > Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#68751}
> 
> Bug: v8:10315
> Change-Id: I2a665400d9a784b1557474a051839d5c8b45e9e2
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2292241
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#68818}

TBR=ulan@chromium.org,dinfuehr@chromium.org

Change-Id: I9063a942c050b79cd3b66226dc25651ccf9fa60a
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10315
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2295361Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68826}

Also make ScopedList class Zone-agnostic and move it to src/utils.

Bug: v8:10506
Change-Id: Ibf0869566caa767809bdf95cb03c01e599613938
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2292234Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68825}

This adds a new Code section to the compilation cache (aka isolate
cache), and inserts generated native context independent code into it.

Cache consumption will be implemented in a following CL.

Bug: v8:8888
Change-Id: I997c13da0fe547f395627a48f1cb7e5f19dfc3ba
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2288851Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68824}

Currently the compilation may fail with the following error:

loop will run at most once (loop increment never executed)

Change-Id: I79dd1c5212475647c42e803858fe589cd9a05b7e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2294916Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#68823}

Instead of completely finishing sweeping in the slow path of allocation,
just sweep all pages for the current PagedSpace. This will help
in making main thread allocation concurrent, since there is no need
anymore to lock the allocation mutexes of other PagedSpaces.

Bug: v8:10315
Change-Id: I1cf76d94fa7a22e726fc71f49c2d5669e4a0598c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2292306
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68822}

If WASM code is profiled with Intel VTune Profiler then the user sees 
incomplete function name - a function name is cut when a space is met.
This patch fixes the issue to show a complete function name including 
arguments.

Change-Id: I0e550e921acb703ec14fe83d67e7bb47035f739d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2246575
Commit-Queue: Bill Budge <bbudge@chromium.org>
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68821}

Bug: v8:7703
Change-Id: Ia4df2637873df5dc7b4beb6aaa781c7b4d32a54c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2292249Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68820}

... by migrating old-style code
  MyObject* obj = new (zone) MyObject(...)

to the new style
  MyObject* obj = zone->New<MyObject>(...)

Bug: v8:10689
Change-Id: I08e513911a6b4e5d564cab42720a197d1244dd2e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2292238Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68819}

This is a reland of d6a14abe

Test wasn't written with incremental/concurrent marking in mind, so
simply disabling it for this particular unittest.

Original change's description:
> [heap] Move start of incremental marking in allocation
>
> Move start of incremental marking out of
> RefillLinearAllocationAreaFromFreeList. This avoids a potential
> safepoint while holding allocation_mutex_.
>
> Bug: v8:10315
> Change-Id: Ieb60ac68f26199eea7b6b7ad6d874851382f3d69
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2287496
> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#68751}

Bug: v8:10315
Change-Id: I2a665400d9a784b1557474a051839d5c8b45e9e2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2292241Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68818}

This CL adapts the builtin for architectures ia32, x64 and arm.

Change-Id: Ib191e66a75eaddaee505e30b8cafb0c5e5bf42ce
Bug: v8:10201
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2292246
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68817}

This CL adds instructions for easier navigation in the app.

Change-Id: I4c5332d400d51f2c7664a45efb7fbf700041c4eb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2292244Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Zeynep Cankara <zcankara@google.com>
Cr-Commit-Position: refs/heads/master@{#68816}

In order to support conservative stack scanning, we need to be able to
pin pages if they're pointed to by an ambiguous pointer. This CL lets us
do this by providing an IS_PINNED flag which, when enabled, prevents a
page from being selected as an evacuation candidate during compaction.

Bug: v8:10614
Change-Id: I45d1c74b83aad1b56e078cc270749a0aee804716
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2278465
Commit-Queue: Jake Hughes <jakehughes@google.com>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68815}

test262 has updated the tests in question.

Bug: v8:9808
Change-Id: Ia4d257f230d7ae5412acab133f43ebe3467c21d3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2292242Reviewed-by: Mathias Bynens <mathias@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68814}

Adds support for main-thread handling of JSMember during the
atomic pause.

Follow-ups for later:
- Copy/Move/Heterogenous assignment
- Write barrier
- Atomic handling for concurrent processing.

Bug: chromium:1056170
Change-Id: Ia9ac4599ca85cf7cc2d67066e89485744d7d56b6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2289781
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68813}

Bug: v8:10619
Change-Id: I644c3421085b029aaf9b4de3b262ca8a4734539e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2292916Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68812}

Bug: v8:7748
Change-Id: I925be7942f4825aeac7364bc7c899b6bef8001c3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2284985
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68811}

This was pointed out in https://crrev.com/c/2290623 but was missed.

Change-Id: I1f0206d1dbc067ee57061f1b5e7085ebe1643906
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2292738
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68810}

- was missing an import sys
- check for long
- check for xrange

This file is now flake8 warning free, and should work on both Py2 and
Py3.

$ flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics

Bug: v8:8594
Change-Id: Iae857f4686bcad509fa700954b7f30f86150739f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2288177Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68809}

... by migrating old-style code
  MyObject* obj = new (zone) MyObject(...)

to the new style
  MyObject* obj = zone->New<MyObject>(...)

Bug: v8:10689
Change-Id: I55c686bbedfa1fd1955a5927df3f72b366312fd4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2288867
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68808}

Rather than marking deleted GlobalDictionary entries with a "The Hole"
valued PropertyCell, we now remove those PropertyCells entirely and
use the standard HashTable deleted item marker (also the Hole).

This comes with several simplifications:

  1) We no longer need a customizable IsKey method on HastTable shapes,
     which was only used by GlobalDictionary to mark "The Hole" cells
     as not real keys,
  2) We can get rid of IsLive/IsKey from the Shape entirely, and define
     it directly in the HashTable, which will also allow us (in the
     future) to encourage caching of "undefined" and "Hole" where used
     for IsKey checks,
  3) PropertyCell invalidation doesn't necessarily have to allocate a
     new replacement cell (specifically, on deletion), nor does it have
     to deal with cells that contain the Hole,
  4) kNeedsHoleCheck is renamed to kMatchNeedsHoleCheck (to be explicit
     that this is only needed to guard IsMatch, which may do an
     indentity comparison and thus not need the HoleCheck guard). It's
     also moved out of BaseShape and into the various shapes that
     define IsMatch, to make them more explicitly think about the
     value,
  5) Modified some while loops into for loops to allow clearer use of
     "continue" on successful hole checks.

Change-Id: If591cbb6b49d59726bdc615413aba4f78fd64632
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2292230
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68807}

This implements v128.const for ia32, x64, arm, and arm64.

Moves one of the test case under the correct header.

Bug: v8:9909
Change-Id: I93eb179ac5fd0bc22e3dd5277f7d73699ac8b452
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2290623
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68806}

The map of the HashTable is more a property of the HashTable than part
of its shape, so we can move its static map getter (for construction)
to to HashTable class itself.

Change-Id: I73f4aa7260d6ce749ef51961767fd37d1ab520e4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2289782
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68805}

Bug: v8:7748
Change-Id: I43384d10805b62745a4bc19fa0a4174e6ee94f0f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2289777
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68804}

... by migrating old-style code
  MyObject* obj = new (zone) MyObject(...)

to the new style
  MyObject* obj = zone->New<MyObject>(...)

Bug: v8:10689
Change-Id: Iec2b3102bd35ad7e50b90882ade78d27999a71f2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2288866Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68803}

The CallWithSpread builtin actually receives a variable number of arguments. This is necessary when running with the arguments reversed in the stack (v8_enable_reverse_jsargs).

Change-Id: I57f67cbef4f2eb7dbb7c245b9a070c3b44d1bfce
Bug: v8:10201
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2292233
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68802}

This allows `new (Pretenured) X{}` to force a pretenured allocation.

Bug: v8:7793
Change-Id: Ib09f186b3b503b9b23291c39c1390f120d25eebe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2288409
Commit-Queue: Gus Caplan <me@gus.host>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68801}