This reverts commit 83786cb4.

Reason for revert:
https://ci.chromium.org/p/v8/builders/ci/V8%20Blink%20Linux%20Debug/2037

Original change's description:
> Delay setting up deserialized JSArrayBuffer
> 
> Setting up JSArrayBuffer may trigger GC. Delay this until we
> are done with deserialization.
> 
> R=​ulan@chromium.org
> 
> Bug: chromium:1033395
> Change-Id: I6c79bc47421bc2662dc1906534fc8e820c351ced
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1965580
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Commit-Queue: Yang Guo <yangguo@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#65441}

TBR=ulan@chromium.org,yangguo@chromium.org,petermarshall@chromium.org

Change-Id: I77b8ae836e9003eaaccef440dfaf3ae840c112cb
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:1033395
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1967327Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65450}

This improves documentation about some things that came up
in conversation and things that I noticed while working on
those other things. :)

Change-Id: I4f47cec6594f7b331259bea8ed506f5de908d438
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1954386
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65449}

New revision: 726836d7317a4031f48af9960bab51d7a2ab2867

The gist is that serialization is direct from
protocol objects to CBOR, no more detour via
protocol::Value.

Upstream PRs:
https://chromium-review.googlesource.com/c/deps/inspector_protocol/+/1956388
https://chromium-review.googlesource.com/c/deps/inspector_protocol/+/1966418

Also:
https://chromium-review.googlesource.com/c/deps/inspector_protocol/+/1941035

Change-Id: I89f742a4fd47b5eb8ebd98ce6e10ecba0501cf66
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1958956Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Johannes Henkel <johannes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65448}

This reverts commit 5f8e95c1.

Reason for revert: crbug.com/1033418. TypedArrays are not, by default, concat-spreadable; the existing code is inconsistent and this CL didn't update/fix enough of it.

Original change's description:
> Fix ArrayConcat length estimation for TypedArrays
>
> TypedArrays cannot be handled on the JSArray path.
> This patch should provide a minor performance improvement while
> being functionally non-observable.
>
> Change-Id: I05259517b9079aa715b3cf4be9b0cf6bb47236ac
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1948712
> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#65419}

TBR=jkummerow@chromium.org,ishell@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: chromium:1033418
Change-Id: I345c8ebc38be6df42d5bdbecd0d06d19967ad6f1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1967324
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65447}

Bug: v8:9838
Change-Id: I770133cdf719efeee8de9415bda0586d0f5ac8d9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1954329Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Joshua Litt <joshualitt@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65446}

Maximum semispace size was capped at kMaxSemiSpaceSize. Also allow
non-power-of-2 sizes.

Change-Id: I3385674a13455b47802a3f6e62ac5b9ed3987264
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1962863Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65445}

This new testing allocator for ArrayBuffers uses a small real allocation
that is repeatedly mapped into the requested allocation size. Its purpose
is to allow testing of huge TypedArrays without actually consuming a huge
amount of memory, at the expense of correct behavior (elements will alias
each other). It is only supported on Linux for now, and of course off by
default.

Bug: v8:4153
Change-Id: I4917a78b6190dc075dc4614ebe2696e63addc8c2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1962270
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65444}

R=hpayer@chromium.org

Change-Id: I2b9a77317cd4dcf8502c237b7f8f167b80859859
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1962866Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65443}

Not best to rely on /proc presence basically when
the linux compatibily layer is enabled so
going through more programmatically.

Change-Id: Ida4973f9da6dec6e9caa6e419f3612ec5ef95048
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1710664Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65442}

Setting up JSArrayBuffer may trigger GC. Delay this until we
are done with deserialization.

R=ulan@chromium.org

Bug: chromium:1033395
Change-Id: I6c79bc47421bc2662dc1906534fc8e820c351ced
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1965580Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65441}

Moves the TailCall instruction codes to the start of the enum, and
changes the test for IsTailCall from 4 equality tests to a single
inequality.

Bug: v8:10051
Change-Id: I679d6377161bd4f9a05f6202763d52c0a67b7900
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1964075Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65440}

R=clemensb@chromium.org

Change-Id: Ibd6790a222590fd4dce9f918219a19f01c2e1e0f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1960293Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65439}

The OutputRegister shouldn't be overwritten, because it may be the same register
as InputRegister(1), which will be used later.

And remove the useless if-else in And32, Or32, Xor32.

Change-Id: I1f944b5b6acd5c183cef537524827b47a8cb0186
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1967092
Auto-Submit: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65438}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/dfe5662..1c5a738

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/4082c91..b34e896

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/8b34eb4..f1ad6e4

Rolling v8/third_party/zlib: https://chromium.googlesource.com/chromium/src/third_party/zlib/+log/f262c1b..d7f3ca9

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: I8b0e66842ceb08f8c8158f832e375cc5da64b956
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1966133Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#65437}

Add Exported::AppendSerialized (consistency with Serialized interface).
Deprecate Exported::writeBinary.

Upstream PRs:
https://chromium-review.googlesource.com/c/deps/inspector_protocol/+/1958506
https://chromium-review.googlesource.com/c/deps/inspector_protocol/+/1941035

Change-Id: I50d6db05ea7c1336022b0b63e5ec2c69488ab525
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1958575Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Johannes Henkel <johannes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65436}

Bug: v8:9838
Change-Id: Iae406457754c66c8e03843bdfc42b6defd76e3ad
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1955756
Commit-Queue: Joshua Litt <joshualitt@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65435}

Bug: chromium:1029530
Change-Id: I12aa4c238387f6a47bf149fd1a136ea83c385f4b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1962278
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65434}

Bug: chromium:1021444, chromium:1033196
Change-Id: Ic0468bce60577ad238581f17c4510a23ab63882a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1964390
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65433}

Part of the GetObjectProperties test case is for verifying the human-
readable brief object description string that GetObjectProperties
returns. That string might look something like this:

"xy" (0x28f038d5 <v8::internal::SeqOneByteString>)

GetObjectProperties also tries to detect known immortal objects by
recognizing their addresses, which is useful in crash dumps with limited
memory. The recognized object name, if it exists, is prepended to the
description string. In order to provide this data accurately (in builds
without pointer compression), GetObjectProperties relies on the caller
to provide the addresses of the first pages in read-only space, map
space, and old space. If the caller doesn't provide those addresses,
then GetObjectProperties does the best it can with limited information
and reports possible matches based on an object's offset within the heap
page that contains it. So the result string might look like this, if the
object happened to get allocated at a lucky offset within its page:

maybe LoadHandler3Map "xy" (0x28f038d5 <v8::internal::SeqOneByteString>)

As a result, when testing these descriptions, we should generally check
that they contain the interesting data rather than that they start with
it, because some incorrect "maybe" match with a known object might be
included at the beginning.

Bug: v8:10034
Change-Id: I0cf5afd67793a239614aba3665ef57cd2d663a47
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1950233Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#65432}

With bytecode flushing and the current OSR triggering mechanism which
stores OSR nesting level on bytecode array it is possible to trigger
OSR on a closure that doesn't have feedback vector.

Bug: chromium:1031479
Change-Id: I4c62486f6b0eb6d6f9c96f98c1c1b275f3e6d6d5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1962850
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65431}

Bug: v8:8906
Change-Id: I3187f702c270781e48c434c6f6bd7803569988d4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1964391Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65430}

Factors out the group regexes from callstats.py so the two tools can
share them. When --group is specified, the stats are grouped together
using the callstats.py groupings. Also adds --filter (can be supplied
multiple times) to only show certain groups.

Under the hood, this converts the simple arrays and dictionaries to use
classes to simplify the code somewhat.

Change-Id: If6b548e109212adfdf46fa04e7b21638f84a0e26
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1962864Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65429}

R=machenbach@chromium.org, tmrts@chromium.org

Change-Id: Ibdc4a17fbe145e621144815eaa0bda7c492be6f1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1962852
Auto-Submit: Sergiy Belozorov <sergiyb@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65428}

This allows arbitrary expressions to specify the length of an array.
These expressions get access to globally declared things and the
preceding fields of the current object.
Unfortunately, this breaks generated C++ runtime code, so as a
workaround, I special-case expressions that are just an identifier
and handle them as before. We might want to support more cases there
in the future, probably also with special-casing since having a full
C++ back-end for Torque is infeasible.

Bug: v8:10004 v8:7793

Change-Id: I0d5d1200c0e727766beed7bfb2d43a8abb9cacf0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1942610
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65427}

operations.

Some 32-bit operations like kMips64And32, kMips64Or32 and kMips64Shr
overwrite the input registers' value by truncates the 64-bit value to
32 bits and sign-extends it,which may conflicts with later operatons
that need the input register's 64-bit value.

Change-Id: I29a5116999f7e851f38bdbcc5b066141a0617589
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1928503Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Auto-Submit: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/master@{#65426}

This cl: https://chromium-review.googlesource.com/c/v8/v8/+/1924439 has
renamed the optimize passed happening on the background to
OptimizeBackground instead of OptimizeConcurrent or RecompileConcurrent.
Concurrent optimization has main thread phases so using
OptimizeConcurrent for background computations only was a bit confusing.

Bug: chromium:1029456
Change-Id: I8f4a485831851d5a43ab87b3a5d74857559fd679
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1944157
Commit-Queue: Mythri Alle <mythria@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Auto-Submit: Mythri Alle <mythria@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65425}

This reverts commit fa621404.

Reason for revert: Still breaks GPU bots like https://ci.chromium.org/p/v8/builders/ci/Linux%20V8%20FYI%20Release%20(NVIDIA)/7658

Original change's description:
> Reland "[turbofan][ptr-compr] Remove redundant ChangeTaggedToCompressed"
> 
> This is a reland of c924f54e
> 
> Will split the CL into parts since debugging is really hard for the
> combination of tests + bots that caused the failure.
> 
> Relanding the safest part on this first CL.
> 
> The difference between the original commit and this one can be seen in
> patchsets 1..2.
> 
> Original change's description:
> > [turbofan][ptr-compr] Remove redundant ChangeTaggedToCompressed
> >
> > The final goal is to eliminate it altogether. This CL just
> > eliminate the redundant ones.
> >
> > Bug: v8:7703
> > Change-Id: If6e718c373fca7c65ce46c347533ec4550fbc444
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1950968
> > Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> > Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#65398}
> 
> Bug: v8:7703
> Change-Id: I5ff513a53eebcee6e2412f7ea8b801789476d50f
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1962277
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#65423}

TBR=tebbi@chromium.org,solanes@chromium.org

Change-Id: I60bbf7061a733325e350d749c4adae65305b518c
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7703
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1962862Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65424}

This is a reland of c924f54e

Will split the CL into parts since debugging is really hard for the
combination of tests + bots that caused the failure.

Relanding the safest part on this first CL.

The difference between the original commit and this one can be seen in
patchsets 1..2.

Original change's description:
> [turbofan][ptr-compr] Remove redundant ChangeTaggedToCompressed
>
> The final goal is to eliminate it altogether. This CL just
> eliminate the redundant ones.
>
> Bug: v8:7703
> Change-Id: If6e718c373fca7c65ce46c347533ec4550fbc444
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1950968
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#65398}

Bug: v8:7703
Change-Id: I5ff513a53eebcee6e2412f7ea8b801789476d50f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1962277Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65423}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/c80cf17..dfe5662

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/129810e..4082c91

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/ee67b97..8b34eb4

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/ed95c84..a9190d6

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: I0e8757967a2165e4a31aa1da0eeded7bab3ed3bf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1961998Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#65422}

This unifies marking worklists handling by the main thread marker and
by the concurrent markers. A new class called MarkingWorklistsHolder
owns all marking worklists: the default worklist, the on-hold worklist,
and the embedder worklist. Each thread creates a local view of the
marking worklists by creating an instance of MarkingWorklists.

Additionally, marking visitors now work on MarkingWorklists instead of
accessing each worklist individually.

Besides cleaning the code up, this CL provides a bottleneck for
implementing per-context worklists.

Bug: chromium:973627
Change-Id: I52ad65c94bc0695287ba7bf4d8a814a9035e2888
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1941947Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65421}

In CodeStubAssembler::TryToIntptr(), code inside an Is64() block is
compiled on 32-bit, but |kMaxSafeIntegerUint64| cannot fit in an
intptr_t. To avoid this error, guard the Is64() block with
V8_TARGET_ARCH_64_BIT.

Change-Id: I5d82e4f649172e6054a767cc263a42bc02f89e58
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1960906Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65420}

TypedArrays cannot be handled on the JSArray path.
This patch should provide a minor performance improvement while
being functionally non-observable.

Change-Id: I05259517b9079aa715b3cf4be9b0cf6bb47236ac
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1948712
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65419}

This reverts commit 3b753563.

Reason for revert: breaks in multiple places:
https://bugs.chromium.org/p/chromium/issues/detail?id=1029368
https://bugs.chromium.org/p/chromium/issues/detail?id=1029361


Original change's description:
> Reland "[runtime] Cache prototype chain enumerable keys in PrototypeInfo"
> 
> This is a reland of 5253d7bf
> 
> Original change's description:
> > [runtime] Cache prototype chain enumerable keys in PrototypeInfo
> > 
> > This CL adds a prototype_chain_enum_cache to cache the enumeration of a
> > prototype and its entire chain on the PrototypeInfo. It can improve for-in
> > performance via simply merging the receiver enumeration with this cache.
> > 
> > It improves the score of JetStream2-tagcloud-SP case by ~9% on IA Chromebook.
> > 
> > Contributed by tao.pan@intel.com
> > 
> > Change-Id: Ib40bfe41e772672337155584672f06fa1ba1e70d
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1870844
> > Commit-Queue: Shiyu Zhang <shiyu.zhang@intel.com>
> > Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#65224}
> 
> Change-Id: I93b74727c46abbaab163324c50fbd977fcc9bb36
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1955232
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Commit-Queue: Shiyu Zhang <shiyu.zhang@intel.com>
> Cr-Commit-Position: refs/heads/master@{#65377}

TBR=verwaest@chromium.org,shiyu.zhang@intel.com

# Not skipping CQ checks because original CL landed > 1 day ago.

Change-Id: I5b0d544e802ffda6a6804931087f37cb112805ef
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1962273Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65418}

Found by combining dcheck_always_on with is_ubsan on x64.

Change-Id: Ie9bcf2402693aa3752be17421dd485533656df08
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1962271Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65417}

Change-Id: I2733dbbe77ac731a61c9a8dfcf6ed52a9ace4eaf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1946687Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Reviewed-by: Milad Farazmand <miladfar@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#65416}

Bug: chromium:1027441
Change-Id: Ieac67e06aebf57a11327cbd34dd31f62cbe540b1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1957847
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65415}

This reverts commit 7e632f57.

Reason for revert: clusterfuzzed
Bug: chromium:1032906

Original change's description:
> Reland "[replaceAll] Stage String.prototype.replaceAll."
> 
> This reverts commit 3114000a.
> 
> Reason for revert: Clusterfuzz issue should be fixed.
> 
> Original change's description:
> > Revert "[replaceAll] Stage String.prototype.replaceAll."
> > 
> > This reverts commit 825f65d3.
> > 
> > Reason for revert: Clusterfuzzed
> > Bug: chromium:1028475
> > 
> > Original change's description:
> > > [replaceAll] Stage String.prototype.replaceAll.
> > > 
> > > Intent to ship thread:
> > > https://groups.google.com/a/chromium.org/forum/#!topic/blink-dev/raep1X9R_SE
> > > 
> > > Bug: v8:9801
> > > Change-Id: I61c559b82b4119084420ffb0a14a27774e37c760
> > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1930608
> > > Reviewed-by: Adam Klein <adamk@chromium.org>
> > > Commit-Queue: Joshua Litt <joshualitt@chromium.org>
> > > Cr-Commit-Position: refs/heads/master@{#65161}
> > 
> > TBR=adamk@chromium.org,joshualitt@chromium.org
> > 
> > Change-Id: I7fa44eda475b8f421f74491e60a3131d381eb789
> > No-Presubmit: true
> > No-Tree-Checks: true
> > No-Try: true
> > Bug: v8:9801
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1935024
> > Reviewed-by: Joshua Litt <joshualitt@chromium.org>
> > Commit-Queue: Joshua Litt <joshualitt@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#65175}
> 
> TBR=adamk@chromium.org,joshualitt@chromium.org
> 
> # Not skipping CQ checks because original CL landed > 1 day ago.
> 
> Bug: chromium:1028475, v8:9801
> Change-Id: Idb5fbd1ec38084222357aeb2d9ff05d703f10eb5
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1946737
> Reviewed-by: Joshua Litt <joshualitt@chromium.org>
> Reviewed-by: Adam Klein <adamk@chromium.org>
> Commit-Queue: Joshua Litt <joshualitt@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#65308}

TBR=adamk@chromium.org,joshualitt@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: chromium:1028475, v8:9801
Change-Id: I17dd634cac7b11d4db8d24ec30be10c06dea757b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1961941Reviewed-by: Joshua Litt <joshualitt@chromium.org>
Commit-Queue: Joshua Litt <joshualitt@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65414}

Found by MSVC. Cast the std::numeric_limits() result to size_t to make
the two sides of the comparison match.

Change-Id: Id480b973aad927315ae174003bf2e9ae182cd585
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1960905
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65413}

Check aliased FP registers when constructing the {to_be_live} set from
multiple predecessors.

R=sigurds@chromium.org

Bug: chromium:1029642
Change-Id: I3db7b705ad5689bd8321aebc5e9c5f364951870b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1958054Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65412}

This is a reland of 0f4c29dc

Original change's description:
> Update V8 DEPS.
> 
> Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/b1050d1..c80cf17
> 
> Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/8953fbe..129810e
> 
> Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/6b52dc2..ee67b97
> 
> Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/57e481c..ed95c84
> 
> TBR=machenbach@chromium.org,tmrts@chromium.org
> 
> Change-Id: I5d3841c1a02e708ba7adadc2f08effe6bea2a7d9
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1958750
> Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
> Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
> Cr-Commit-Position: refs/heads/master@{#65407}

Change-Id: I4ab6519d892ad51db53ad8ddcb5310da31c7df7e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1960290Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65411}