This reverts commit fac6f63e.

Reason for revert: https://bugs.chromium.org/p/chromium/issues/detail?id=907479

Original change's description:
> Use CopyElements (which uses memcpy) to copy FixedDoubleArray.
> 
> This improves the performance of ExtractFixedArray and
> CloneFastJSArray for double arrays, which in turn improve the
> performance of cloning double arrays with slice() or spreading.
> 
> This, however, does not improve performance of spreading holey
> double arrays, because spreading needs extra work to convert
> holes to undefined.
> 
> Bug: v8:7980
> Change-Id: Ib8aed74abbb0b06982a3b754e134fa415cb7de2d
> Reviewed-on: https://chromium-review.googlesource.com/c/1280308
> Reviewed-by: Michael Stanton <mvstanton@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
> Commit-Queue: Hai Dang <dhai@google.com>
> Cr-Commit-Position: refs/heads/master@{#56680}

TBR=mvstanton@chromium.org,neis@chromium.org,sigurds@chromium.org,dhai@google.com

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:7980, chromium:907479
Change-Id: Iacf37fa3276345fe8e264fe976d296b015ed6790
Reviewed-on: https://chromium-review.googlesource.com/c/1351003Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57864}

Moves ReturnValue::Set from V8_DEPRECATE_SOON to V8_DEPRECATED now that
chromium no longer uses it.

Bug: v8:7289, v8:8238
Change-Id: Ib705f62dcaa508a8b42a67ed7eaafe7860e3e848
Reviewed-on: https://chromium-review.googlesource.com/c/1351020Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57863}

Now the parser rejects dates outside the [-8640e12ms, 8640e12ms] range
as specified by ES6 section 20.3.1.1.

Bug: chromium:908248, v8:7781
Change-Id: I3391ce7398c971d54794e5011564a0527794667a
Reviewed-on: https://chromium-review.googlesource.com/c/1350996
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57862}

This reverts commit 4644b32e.

Reason for revert: Link errors on win64: https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Win64%20-%20debug/25950

Original change's description:
> [wasm] Add more unit tests for trap handler
> 
> The unittests test if the trap handler only handles those traps it
> is supposed to handle:
> * Only handle traps when the thread-in-wasm flag is set.
> * Only handle traps of the right type, i.e. memory access violations.
> * Only handle traps at recorded instructions.
> 
> The tests also test the consistency of the thread-in-wasm flag. I made
> one change in the trap handler where that consistency could be
> violated.
> 
> All tests are executed with the default trap handler provided by V8,
> and with the trap handler callback installed in a test signal/exception
> handler.
> 
> Change-Id: I03904bb6effd2e8694d3f4d1fbf62bc38002646e
> Reviewed-on: https://chromium-review.googlesource.com/c/1340246
> Commit-Queue: Andreas Haas <ahaas@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#57858}

TBR=mstarzinger@chromium.org,ahaas@chromium.org,mark@chromium.org

Change-Id: Iac2f20c73744226885ea1810813863a21c5faf8c
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/1351021Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57861}

The {setTableLength} method is redundant and has a single user. Remove
it, use {setTableBounds} instead.

Drive-by: Add default to the table max, to document that this can
actually be {undefined}, in which case the table has no maximum.

R=binji@chromium.org

Bug: v8:8238
Change-Id: I0d7a2f4d49d083f7adadbb4b6cd4933bcb1dc174
Reviewed-on: https://chromium-review.googlesource.com/c/1350126Reviewed-by: Ben Smith <binji@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57860}

These functions have been marked V8_DEPRECATE_SOON for a long time,
now all uses have been removed from Chrome, mark them as deprecated.

BUG=v8:7290,v8:8238

Change-Id: If39a971a32b06ad3c32ce121db2effa23fce45fe
Reviewed-on: https://chromium-review.googlesource.com/c/1350124Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57859}

The unittests test if the trap handler only handles those traps it
is supposed to handle:
* Only handle traps when the thread-in-wasm flag is set.
* Only handle traps of the right type, i.e. memory access violations.
* Only handle traps at recorded instructions.

The tests also test the consistency of the thread-in-wasm flag. I made
one change in the trap handler where that consistency could be
violated.

All tests are executed with the default trap handler provided by V8,
and with the trap handler callback installed in a test signal/exception
handler.

Change-Id: I03904bb6effd2e8694d3f4d1fbf62bc38002646e
Reviewed-on: https://chromium-review.googlesource.com/c/1340246
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57858}

See:
https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20NumFuzz%20-%20TSAN/3778

TBR=mslekova@chromium.org
NOTRY=true

Change-Id: I655a251a8c2364d0bc69b9b2e612967c29d49541
Reviewed-on: https://chromium-review.googlesource.com/c/1350999Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57857}

NOTRY=true
TBR=sergiyb@chromium.org

Change-Id: I61597a265e5d98479cb88f5c8e01fed317044dd6
Reviewed-on: https://chromium-review.googlesource.com/c/1350998Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57856}

Change-Id: I57e21c5bc754ca07f52032f85ec8aeff96448dd0
Reviewed-on: https://chromium-review.googlesource.com/c/1342929
Commit-Queue: Daniel Clifford <danno@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57855}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/2339062..076d347

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: Id8a3dca4c41f178d2e267bc4f0e066a22886de18
Reviewed-on: https://chromium-review.googlesource.com/c/1351247
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#57854}

Bug: v8:3770
Change-Id: I4da6404aa968adca1fbb49029fc304622101d6c3
Reviewed-on: https://chromium-review.googlesource.com/c/1349112
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57853}

and Relaxed_Store(int, ...) by migrating the only call site
to using slot increment/decrement instead of offset calculations.
Also use SlotBase::location() more consistently.

Bug: v8:8238
Change-Id: I3099884a2a9e05041114205e7fb81691261afe19
Reviewed-on: https://chromium-review.googlesource.com/c/1349731Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57852}

The style guide says that only `int` should be used of the builtin
integer types. Instead, we should use the stdint types.

See https://google.github.io/styleguide/cppguide.html#Integer_Types

Change-Id: I1af53a3bceefbfed85589b74a602c8ebe1c7ee25
Reviewed-on: https://chromium-review.googlesource.com/c/1342663Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Ben Smith <binji@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57851}

This reverts commit 33713b5b.

Bug: chromium:852420
Change-Id: I45f447b690af8534aeec8630a717abe92f4099f8
Reviewed-on: https://chromium-review.googlesource.com/c/1350997Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57850}

[heap] Flip between large object and new large object allocation mode based on --young_generation_large_objects.

Bug: chromium:852420
Change-Id: I5bb03c6ab14b4e42988e917f7ca7d449d53723d8
Reviewed-on: https://chromium-review.googlesource.com/c/1350995Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57849}

This CL makes it easier to organize the Context classes hierarchy and
simplifies Context class definition.

Bug: v8:8238
Change-Id: I65b8255daf255649c597dc195edf436d9471e3ea
Reviewed-on: https://chromium-review.googlesource.com/c/1350109
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57848}

Add a path into embedder tracing on allocation. This is safe as as Blink
is not allowed to call into V8 during object construction.

This is a reland of caed2cc0.

Also relands the cleanups of ce02d86b.

Bug: chromium:843903
Change-Id: Ic89792fe68337c540a1a93629aee2e92b8774ab2
Reviewed-on: https://chromium-review.googlesource.com/c/1350992Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57847}

TBR=machenbach@chromium.org

No-Try: true
No-Tree-Checks: true
Bug: chromium:868202
Change-Id: I0cfbd995d83733b30e58246b2faccc51379957a6
Reviewed-on: https://chromium-review.googlesource.com/c/1351017Reviewed-by: Sergiy Belozorov <sergiyb@chromium.org>
Commit-Queue: Sergiy Belozorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57846}

This patch gives DescriptorArray its own visitor id and its
own layout that is independent from the layout of WeakFixedArray.
This allows us to use raw 16-bit integers for keeping track of
the number of descriptors (total, non-slack, and marked).

As a side-effect, we save one word per descriptor array on 64-bit.

v8:8486

Change-Id: If8389dde446319e5b3491abc948b52539dba235c
Reviewed-on: https://chromium-review.googlesource.com/c/1349245
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57845}

Flag flip to enable this feature.

R=mstarzinger@chromium.org

Bug: v8:8423
Change-Id: I59ee8c49c2f0323a32e8c7e6c9cf8d929b4a8bb4
Reviewed-on: https://chromium-review.googlesource.com/c/1349239
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57844}

This implements copy sign for both the arm32 and arm64 port of Liftoff.

Bug: v8:6600
Change-Id: Ic822e75417c6b911a03e8e9a2d6d59a98fbc3d18
Reviewed-on: https://chromium-review.googlesource.com/c/1348430
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57843}

Bug: chromium:852420
Change-Id: I920c4ac8e66a7f29c28fcc62a0b1ea62370bdf5d
Reviewed-on: https://chromium-review.googlesource.com/c/1350993Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57842}

This implements arithmetic operations on f64, as well as
conditional set for the arm32 port of Liftoff.

Bug: v8:6600
Change-Id: Ia060652e5292ed94da8a0ba656bddbcc13d9f610
Reviewed-on: https://chromium-review.googlesource.com/c/1348349
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57841}

In the process, use the correct ArrayPrototype* naming convention for
the slice and splice builtins.

Change-Id: I1f85e5512dbde8f92e7c764aef9f137d0a6693e0
Reviewed-on: https://chromium-review.googlesource.com/c/1350869Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Daniel Clifford <danno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57840}

CL "[Cleanup] String::GetChars() should assert against heap allocation"
was missing one DisallowHeapAllocation declaration.

(I had Michi look over the change, as the callstack actually comes from
 the garbage collector. Marja, I put you on TBR).

Thanks all..


TBR=marja@chromium.org

No-tree-checks: true
No-try: true
Bug: v8:8238
Change-Id: I71333124bc4bcef945430fc5242a516b6ed277ff
Reviewed-on: https://chromium-review.googlesource.com/c/1351013
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57839}

For indirect calls, we need to set up the tables correctly. This CL
adds this to the test case generation logic.

R=ahaas@chromium.org

Change-Id: I18a5a8e0659c46daec00d46d02fe50d5d94638d6
Reviewed-on: https://chromium-review.googlesource.com/c/1349985Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57838}

Indirect calls rely on fixed signature indexes. Thus make test case
generation output the signatures exactly like they appear in the module.

R=ahaas@chromium.org

Change-Id: I80b088024da759ec87695363aeefb28685e1d704
Reviewed-on: https://chromium-review.googlesource.com/c/1350831Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57837}

BUG=v8:5402,v8:8238

Change-Id: Idd00fc664da8173612266ba7a976b383bb1f728e
Reviewed-on: https://chromium-review.googlesource.com/c/1349329
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57836}

This CL adds new Wasm import call kinds that correspond to various
math functions that can be imported from JavaScript, such as trigonometry.
Instead of calling a special import wrapper that converts arguments
to tagged values by boxing, we can now generate calls to little WASM
stubs that contain a single WASM bytecode each.

R=mstarzinger@chromium.org
BUG=v8:8423

Change-Id: I59b1be2dd36d190a8b6c98b88c86cecc0ca7f4a2
Reviewed-on: https://chromium-review.googlesource.com/c/1349279
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57835}

This reverts commit 41ad531f.

Reason for revert: https://crbug.com/907498

Original change's description:
> [turbofan] in-block scheduling: schedule non-effect-chain nodes late
> 
> By giving higher priority to processing non-effect-chain nodes, this
> changes the scheduling inside of basic blocks to place nodes before the
> latest possible effect chain node.
> 
> Change-Id: I8b130904a1bb2360b995eb9de4f471a911a4e388
> Reviewed-on: https://chromium-review.googlesource.com/c/1337743
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#57656}

TBR=mstarzinger@chromium.org,tebbi@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Change-Id: I76e57a25c157beed364455b0f1b55380305ef6c0
Reviewed-on: https://chromium-review.googlesource.com/c/1350989Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57834}

No-tree-checks: true
No-try: true
Change-Id: I7f2d5806a94f381849e395f590f943eb8b1a0196
Reviewed-on: https://chromium-review.googlesource.com/c/1350994
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57833}

R=leszeks@chromium.org
TEST=cctest/test-icache

No-Tree-Checks: true
Change-Id: Ied26bb04d844a7585444a8bb48e12865133a4e81
Reviewed-on: https://chromium-review.googlesource.com/c/1350990
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57832}

This is a reland of ca086a49

Original change's description:
> [parser] Perfect hash for keywords
> 
> Use gperf to generate a perfect hash table for keyword lookup. Adds a
> python script which munges the output of gperf and adds additional
> cleanup and optimisations.
> 
> Change-Id: I3656a7287dbd0688917893de3a671faef9e4578a
> Reviewed-on: https://chromium-review.googlesource.com/c/1349240
> Commit-Queue: Leszek Swirski <leszeks@chromium.org>
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Reviewed-by: Marja Hölttä <marja@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#57790}

Change-Id: Ifb53527ba3d0652ea4f5d03740f7c856ad5d91da
Reviewed-on: https://chromium-review.googlesource.com/c/1350121Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57831}

Bug: v8:8238
Change-Id: I0f3b8336a63bb4e1859997b7b9f150f1e7b2d988
Reviewed-on: https://chromium-review.googlesource.com/c/1346338
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57830}

The flag is only available in d8 and should therefore not be in
flag-definitions.h.

R=clemensh@chromium.org

Bug: v8:8238
Change-Id: Idd69914cea03e736cf3b156b5961d583a7b5352c
Reviewed-on: https://chromium-review.googlesource.com/c/1349244
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57829}

We cannot assign a meaningful type to Promise#catch() or
Promise#finally(), since they both return whatever the invocation of
'then' on the receiver returns, and that is monkeypatchable by arbitrary
user JavaScript.

Bug: chromium:908309, v8:7253
Change-Id: Ib15f81c366938a1b1f10be6c6af85c1f3374b898
Reviewed-on: https://chromium-review.googlesource.com/c/1350789Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57828}

Change-Id: Ib584fa4fa38d1f042dc7220f516e35c0619ace45
Reviewed-on: https://chromium-review.googlesource.com/c/1350127Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57827}

R=ulan@chromium.org
BUG=v8:6792,v8:8157

Change-Id: Idf43b4dc74ad7ba89142f2480ed8632adf75f8ec
Reviewed-on: https://chromium-review.googlesource.com/c/1348069
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57826}

Addition to d0562944.

Bug: chromium:896326
Change-Id: Ie76f6be778e963ad5205a99853f491b164dddf9a
Reviewed-on: https://chromium-review.googlesource.com/c/1349269Reviewed-by: Predrag Rudic <prudic@wavecomp.com>
Reviewed-by: Sreten Kovacevic <skovacevic@wavecomp.com>
Commit-Queue: Sreten Kovacevic <skovacevic@wavecomp.com>
Cr-Commit-Position: refs/heads/master@{#57825}