- This won't save a bit, since the enum is not a flags enum and there is
  still room for another value.
- While it may be possible to eliminate this value, the code to init
  and check for invalid becomes much more complex. Unallocated operands
  are currently created with invalid vreg code, so we also have to check
  the policy.

BUG=v8:6325

Review-Url: https://codereview.chromium.org/2904603004
Cr-Commit-Position: refs/heads/master@{#45534}

- Removes set_virtual_register method. InstructionOperands are immutable.
- Adds a new ctor to copy an UnallocatedOperand with a new vreg.
- Removes some DCHECKs in UnallocatedOperand that are always true. To
  make sure, make UnallocatedOperand final.
- Cleans up some comments on UnallocatedOperand Lifetime enum.

BUG=v8:6325

Review-Url: https://codereview.chromium.org/2897203002
Cr-Commit-Position: refs/heads/master@{#45533}

R=joransiu@ca.ibm.com, bjaideep@ca.ibm.com

Bug: 
Change-Id: I73c44a0dd93e3925dbe895a477175d255edbed56
Reviewed-on: https://chromium-review.googlesource.com/514123Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#45532}

Fix 233b6926

With the introduction of upfront deopt table generation, case where
deoptimization tables have more than 8000 entries become much more common
and bugs started to appear.

This CL fixes the issue, but it is far from perfect. We had to
increase number of instruction per table entry from 2 to 3 in
order to accommodate larger tables.

TEST=mjsunit/array-sort,mjsunit/json,mjsunit/md5
BUG=

Review-Url: https://codereview.chromium.org/2901393003
Cr-Commit-Position: refs/heads/master@{#45531}

This CL improves break locations for expressions like 'var a = <expr>'. Without CL we use <expr> position as break location for initialization statement, with this CL we use position of first character after '=' as position.
Benefits (see test for details):
- only one break in expressions which includes mix of property lookup and calls, e.g. var p = Promise.resolve().then(x => x * 2),
- removed redundant break location for expressions like: let { x, y } = { x: 1, y: 2}.

Bug: v8:5909
Change-Id: I039d911903a2826c9859710a63ab0462c992e11b
Reviewed-on: https://chromium-review.googlesource.com/513926
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45530}

- Increase FPUregisters_[] element size to 128b in order to support MSA regs
- Add skeleton for MSA instr. decoding in mips32 and mips64 simulator
- Add support for fill.df, copy_u.df and copy_s.df MSA instructions
- Assembler test for fill.df, copy_u.df and copy_s.df

BUG=

Review-Url: https://codereview.chromium.org/2799923002
Cr-Commit-Position: refs/heads/master@{#45529}

This reverts commit 92cfe00c.

Reason for revert: Breaking all the clusterfuzz builders with error message:
group @"./mksnapshot.rsp" ./libv8_libbase.so ./libv8_libplatform.so ./libicui18n.so ./libicuuc.so ./libc++.so -Wl,--end-group   -ldl -lrt 
../../buildtools/third_party/libc++/trunk/include/string:1831: error: undefined reference to 'std::__1::__basic_string_common<true>::__throw_length_error() const'
../../buildtools/third_party/libc++/trunk/include/vector:930: error: ...

e.g.: https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20ASAN%20-%20debug%20builder/builds/16157/steps/compile/logs/stdio

Original change's description:
> Update V8 DEPS.
> 
> Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/5488ca8..3532f27
> 
> Rolling v8/buildtools: https://chromium.googlesource.com/chromium/buildtools/+log/98f00fa..57c9408
> 
> Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/51b3178..518df53
> 
> Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/05f3060..f294e27
> 
> TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org
> 
> Change-Id: I8e154bcc89d8cdc292409a15dc4081666941c959
> Reviewed-on: https://chromium-review.googlesource.com/514762
> Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
> Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#45527}

TBR=v8-autoroll@chromium.org,machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Change-Id: I2c06ebf13219c92b4fa8891743c9dd9f23e91fcf
Reviewed-on: https://chromium-review.googlesource.com/515462Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45528}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/5488ca8..3532f27

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/buildtools/+log/98f00fa..57c9408

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/51b3178..518df53

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/05f3060..f294e27

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: I8e154bcc89d8cdc292409a15dc4081666941c959
Reviewed-on: https://chromium-review.googlesource.com/514762Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45527}

Creates a new class StatsCounterThreadSafe to be used by counters that
can be updated when compiling/decoding etc. are done using workers.

Does this by using a mutex on all opreations.

Also updates the StatsCounterThreadSafe constructor to force counter
initialization, as well as method Reset(). In addition, whenever the
method StatsTable::SetCounterFunction() is called (from the main
thread), it forces counter initialization for all thread safe stats
counters.

BUG=v8:6361

Review-Url: https://codereview.chromium.org/2887193002
Cr-Commit-Position: refs/heads/master@{#45526}

Compilation failure is result to overloaded-virtual warning
treated as error.

BUG=

Review-Url: https://codereview.chromium.org/2895923002
Cr-Commit-Position: refs/heads/master@{#45525}

A few tests that would be good to have to verify that the known manifestations
of this bug are resolved.

Previously, the async generator and async function tests would crash. The other
ones never did, but still resulted in the register overwite bug.

BUG=v8:6322
R=adamk@chromium.org

Change-Id: Ic2238227629077de5671d67d18b3bfe018dd23f4
Reviewed-on: https://chromium-review.googlesource.com/514230Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Cr-Commit-Position: refs/heads/master@{#45524}

R=joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2905683002
Cr-Commit-Position: refs/heads/master@{#45523}

Rather than trying to pre-calculate the number of contexts required during
scope analysis, instead just allocate context registers in the register
allocator. This reduces frame size a bit due to reusing of registers when
the context isn't pushed.

 BUG=v8:6322, chromium:716265

Change-Id: I145e38fcb3797a3b86c91e90ea9326a6e55b9b89
Reviewed-on: https://chromium-review.googlesource.com/514087Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45522}

Revert of [turbofan] Speculatively optimize string character access. (patchset #1 id:1 of https://codereview.chromium.org/2905623003/ )

Reason for revert:
Changes layout tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/15867

See:
https://github.com/v8/v8/wiki/Blink-layout-tests

Original issue's description:
> [turbofan] Speculatively optimize string character access.
>
> Add a protector cell for string bounds checks that is being used to
> protect speculative bounds for String.prototype.charCodeAt and
> String.prototype.charAt in TurboFan (and Crankshaft). This way we don't
> have the diamond in optimized code, which stands in the way of other
> optimizations for charCodeAt that are currently being worked on by
> petermarshall@.
>
> BUG=v8:6391
> TBR=mlippautz@chromium.org
> R=petermarshall@chromium.org
>
> Review-Url: https://codereview.chromium.org/2905623003
> Cr-Commit-Position: refs/heads/master@{#45514}
> Committed: https://chromium.googlesource.com/v8/v8/+/9d8bd0551657d60c66b2f96544eecedfba1cba8a

TBR=petermarshall@chromium.org,mlippautz@chromium.org,bmeurer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:6391

Review-Url: https://codereview.chromium.org/2900333002
Cr-Commit-Position: refs/heads/master@{#45521}

TBR=machenbach@chromium.org

Bug: 
Change-Id: I916d52297bd81c5015fcd3185105dcb0d0a3d78f
Reviewed-on: https://chromium-review.googlesource.com/513906Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Commit-Queue: Daniel Vogelheim <vogelheim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45520}

This reverts commit ee3729d2.

Reason for revert: The initial commit required https://chromium-review.googlesource.com/c/510021/ also land on the Blink side. I mistakenly thought it did.

Original change's description:
> Revert "[wasm] Remove override-ability from async compile and instantiate."
> 
> This reverts commit 2869dd55.
> 
> Reason for revert: Breaks:
> https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/15850
> 
> See also:
> https://github.com/v8/v8/wiki/Blink-layout-tests
> 
> Original change's description:
> > [wasm] Remove override-ability from async compile and instantiate.
> > 
> > We're now using explicit APIs.
> > 
> > Bug: 
> > Change-Id: I4a4248e44543f6e7dfcbdc66456e610fb98ff5ee
> > Reviewed-on: https://chromium-review.googlesource.com/513406
> > Commit-Queue: Brad Nelson <bradnelson@chromium.org>
> > Reviewed-by: Brad Nelson <bradnelson@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#45500}
> 
> TBR=bradnelson@chromium.org,mtrofin@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> 
> Bug: 
> Change-Id: Ie7c2db40279bd07c535c20afaa1cea51b680fe65
> Reviewed-on: https://chromium-review.googlesource.com/513862
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#45502}

TBR=bradnelson@chromium.org,machenbach@chromium.org,mtrofin@chromium.org,v8-reviews@googlegroups.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Bug: 
Change-Id: Ib826b590b5d362d005460fcebdc6800c8d6c5f63
Reviewed-on: https://chromium-review.googlesource.com/513496Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
Commit-Queue: Mircea Trofin <mtrofin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45519}

Bug: chromium:725201
Change-Id: Ic75f4080b8ef28e64b471887871c526c0bac316b
Reviewed-on: https://chromium-review.googlesource.com/514004Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45518}

Change-Id: I5e725f984178c2c9d48ba48c1270faea1b63ff3e
Reviewed-on: https://chromium-review.googlesource.com/513943Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45517}

Missing parentheses are causing compilation failures, added them.

BUG=

Review-Url: https://codereview.chromium.org/2906433002
Cr-Commit-Position: refs/heads/master@{#45516}

In particular, local variables should be allocated on stack (in bytecode register), and stored/loaded to the generator object on generator suspend/resume.

The CL is based on @adamk's change to scoping/parsers (https://chromium-review.googlesource.com/c/498538/), I only made the debugger cope with this change.

I should note that the CL changes the scope type of suspended generators from ScopeType.Closure to ScopeType.Local. In the future we might want to introduce ScopeType.SuspendedGenerator to make the distinction explicit.

Some of the changes in the tests have been made because the debugger functions do not return scopes of closed generators anymore. Generators should be allowed to throw away their internal state when they finish.

BUG=v8:6368

Review-Url: https://codereview.chromium.org/2898163002
Cr-Commit-Position: refs/heads/master@{#45515}

Add a protector cell for string bounds checks that is being used to
protect speculative bounds for String.prototype.charCodeAt and
String.prototype.charAt in TurboFan (and Crankshaft). This way we don't
have the diamond in optimized code, which stands in the way of other
optimizations for charCodeAt that are currently being worked on by
petermarshall@.

BUG=v8:6391
TBR=mlippautz@chromium.org
R=petermarshall@chromium.org

Review-Url: https://codereview.chromium.org/2905623003
Cr-Commit-Position: refs/heads/master@{#45514}

- Create getters for number of tasks for all parallel stages
- Count slots for the minor MC and limit tasks by the overall number of slots.
- Cleanup existing getters.

Bug: chromium:651354
Change-Id: I9f67cca4474cbe1800faff4a549fbec019b096ce
Reviewed-on: https://chromium-review.googlesource.com/512862
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45513}

Add support for I8x16Add, I8x16AddSaturateS, I8x16Sub, I8x16SubSaturateS,
I8x16Mul, I8x16MaxS, I8x16MinS, I8x16Eq, I8x16Ne, I8x16LtS,
I8x16LeS, I8x16ShrU, I8x16AddSaturateU, I8x16SubSaturateU, I8x16MaxU,
I8x16MinU, I8x16LtU, I8x16LeU, S128And, S128Or, S128Xor, S128Not for
mips32 and mips64 architectures.

BUG=

Review-Url: https://codereview.chromium.org/2798853003
Cr-Commit-Position: refs/heads/master@{#45512}

This removes the need for certain context scopes to skip popping the
context register. For the {incoming_context} the flag was already
obsolete, because its destructor would only run once the basic block
ended with a return. For {local_function_context} the same holds now
by moving handling of implicit returns into the body visitor.

R=rmcilroy@chromium.org

Change-Id: Icceaab1b30d7223b2b2f87a092a6580be7d7d675
Reviewed-on: https://chromium-review.googlesource.com/513963Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45511}

This is safe since we already take the page lock.

Bug: 
Change-Id: Id7797ef66c387be150064cda1213c1f2b75d31d3
Reviewed-on: https://chromium-review.googlesource.com/514003Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45510}

There are two break locations at the same source location by desugaring:
- call iterator.next,
- before variable assignment.

Additionally location for for..of loops is moved from before "of" to before each variable expression.

We should not report first implicit call to avoid user confusion. User still able to go into .next function with both scenarios:
- when this call is reached by stepOver or stepInto from previous line,
- when this call is reached because of breakpoint at current line.

BUG=v8:6425
R=dgozman@chromium.org,jgruber@chromium.org

Review-Url: https://codereview.chromium.org/2893313002
Cr-Commit-Position: refs/heads/master@{#45509}

Add a sequential string type to the compiler, and transform
charCodeAt on SeqString into SeqStringCharCodeAt.

SeqStringCharCodeAt can handle one and two byte strings.

Bug: v8:6391
Change-Id: I2785257522c28f3b268c9833f5313e9630cb982a
Reviewed-on: https://chromium-review.googlesource.com/509573Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45508}

This avoids emitting redundant {PopContext} bytecode instructions when
non-local control-flow leaves the method body. It also folds multiple
such {PopContext} instructions into one, in case several scoping levels
are crossed at one. Only the expected context of the target of a local
control-flow transfer matters.

R=rmcilroy@chromium.org
TEST=debugger/regress/regress-crbug-724858
BUG=chromium:724858

Change-Id: Id4a47ae9fea25e75ae1af13619720b16a3975edf
Reviewed-on: https://chromium-review.googlesource.com/512545Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45507}

This reverts commit 589a4d1d.

Reason for revert: Breaks webkit:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20predictable/builds/11714

Original change's description:
> [test] Don't hide crashes in predictable mode
> 
> Bug: v8:6426
> Change-Id: I278dda0d628732bb9c539c2648d2b27bcbc89bf0
> Reviewed-on: https://chromium-review.googlesource.com/512643
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#45504}

TBR=jkummerow@chromium.org,machenbach@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
Bug: v8:6426

Change-Id: I85c573fa332f436bb57f2747ad98c26e1c1f23bd
Reviewed-on: https://chromium-review.googlesource.com/513866Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45506}

NOTRY=true
TBR=hpayer@chromium.org

Bug: chromium:651354
Change-Id: Ibff438d987b07907b2c4463a42bef685864c1602
Reviewed-on: https://chromium-review.googlesource.com/513903Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45505}

Bug: v8:6426
Change-Id: I278dda0d628732bb9c539c2648d2b27bcbc89bf0
Reviewed-on: https://chromium-review.googlesource.com/512643Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45504}

There are only two users of hidden prototypes left and they both only have 1 level. This slightly simplifies the handcrafted code.

Bug: v8:5561
Change-Id: I674e72f1465ccbe75c0bb63f7eea3525830145cb
Reviewed-on: https://chromium-review.googlesource.com/512745Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45503}

This reverts commit 2869dd55.

Reason for revert: Breaks:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/15850

See also:
https://github.com/v8/v8/wiki/Blink-layout-tests

Original change's description:
> [wasm] Remove override-ability from async compile and instantiate.
> 
> We're now using explicit APIs.
> 
> Bug: 
> Change-Id: I4a4248e44543f6e7dfcbdc66456e610fb98ff5ee
> Reviewed-on: https://chromium-review.googlesource.com/513406
> Commit-Queue: Brad Nelson <bradnelson@chromium.org>
> Reviewed-by: Brad Nelson <bradnelson@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#45500}

TBR=bradnelson@chromium.org,mtrofin@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Bug: 
Change-Id: Ie7c2db40279bd07c535c20afaa1cea51b680fe65
Reviewed-on: https://chromium-review.googlesource.com/513862Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45502}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/b19d8a0..5488ca8

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/08a6e0a..51b3178

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: Ic07c2cd8459688129791ac27e185e2e1308d5a48
Reviewed-on: https://chromium-review.googlesource.com/513445Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45501}

We're now using explicit APIs.

Bug: 
Change-Id: I4a4248e44543f6e7dfcbdc66456e610fb98ff5ee
Reviewed-on: https://chromium-review.googlesource.com/513406
Commit-Queue: Brad Nelson <bradnelson@chromium.org>
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45500}

This doesn't fix the bug, just avoids it.

Bug: v8:6436
Change-Id: I06305a9baf892e4039f2aaf353fa7edf7b7e325d
Reviewed-on: https://chromium-review.googlesource.com/513242Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Commit-Queue: Brad Nelson <bradnelson@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45499}

Drive-by: Add some comments.

R=jarin@chromium.org, mtrofin@chromium.org
BUG=v8:6434

Change-Id: If4ee8dfc68685429a91885a1c831709a4e31619c
Reviewed-on: https://chromium-review.googlesource.com/513202
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45498}

This patch also adds sharing of code target entries, which requires
sharing the RelocInfo for those entries as well. The disassembler
is also modified in order to print comments for the RelocInfo that
is now shared.

This improves the snapshot size for arm by about 4%.

BUG=

Review-Url: https://codereview.chromium.org/2869683004
Cr-Commit-Position: refs/heads/master@{#45497}

Asynchronous context tracking mechanisms in Node.js need to store some
state on all promise objects. This change will allow embedders to
configure the number of internal fields on promises as is already done
for ArrayBuffers.

BUG=v8:6435

Review-Url: https://codereview.chromium.org/2889863002
Cr-Commit-Position: refs/heads/master@{#45496}

Perf Sheriffs: This CL may change performance on various benchmarks.

BUG=chromium:716032

Review-Url: https://codereview.chromium.org/2895473003
Cr-Commit-Position: refs/heads/master@{#45495}