There are 2 possible states for the deferred symbol --
1) UNDEFINED -- This is the zero state, no deferred object is attached
   to this symbol. When we want to add a new deferred we directly
   attach it to this symbol.
2) symbol with attached deferred object -- New deferred objects are
   not attached to this symbol, but instead they are directly attached
   to the resolve, reject callback arrays. At this point, the deferred
   symbol's state is stale, and the deferreds should be read from the
   reject, resolve callbacks.

BUG=v8:5046

Review-Url: https://codereview.chromium.org/2018913004
Cr-Commit-Position: refs/heads/master@{#36623}

Revert of [heap] Do not invoke GC to make heap iterable. (patchset #3 id:40001 of https://codereview.chromium.org/1992913004/ )

Reason for revert:
[Sheriff] Speculative revert for some flakes on the waterfall:
https://build.chromium.org/p/client.v8/builders/V8%20Mac%20-%20debug/builds/7409
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20avx2/builds/7983
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20internal%20snapshot/builds/4901

Original issue's description:
> [heap] Do not invoke GC to make heap iterable.
>
> This reverts commit 0aa3707d.
>
> And removes the UnreachableObjectsFilter.
>
> BUG=chromium:580959
> LOG=n
>
> Committed: https://crrev.com/132f89800f560190b4d655adcb4e0eeedd17fd82
> Cr-Commit-Position: refs/heads/master@{#36617}

TBR=yangguo@chromium.org,ulan@chromium.org,hpayer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:580959

Review-Url: https://codereview.chromium.org/2020363002
Cr-Commit-Position: refs/heads/master@{#36622}

Async functions are built out of generators, but the
SharedFunctionInfo returns false for is_generator. is_resumable is
the broader query. This patch fixes many parts of V8 to refer
to is_resumable as appropriate.

One incidental change is to remove a check for generators extending
classes. This is part of a general check for constructors being the
only thing which can extend classes, so it is removed here and the
error message for the general case is made more accurate.

BUG=v8:4483

Review-Url: https://codereview.chromium.org/1996943002
Cr-Commit-Position: refs/heads/master@{#36621}

Port 56d90782

Original commit message:

    In Crankshaft, we would install special ICs that didn't need a vector and slot
    in the MEGAMORPHIC case. This optimization limits our hand against future
    improvements.

R=mvstanton@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com, bjaideep@ca.ibm.com
BUG=

Review-Url: https://codereview.chromium.org/2028663002
Cr-Commit-Position: refs/heads/master@{#36620}

How to trigger (stress bots do all steps):
1. Enable in gyp/gn: v8_enable_verify_heap
2. Start with --stress-compaction and non-zero --random-seed

R=ulan@chromium.org, hpayer@chromium.org
BUG=
CQ_EXTRA_TRYBOTS=tryserver.v8:v8_linux_arm64_gc_stress_dbg,v8_linux_gc_stress_dbg,v8_mac_gc_stress_dbg

Review-Url: https://codereview.chromium.org/2019343002
Cr-Commit-Position: refs/heads/master@{#36619}

This CLprepares the terrain for serialization/deserialization. It sets up
the instantiation stages such that we have a point wereh we can split off
obtaining the code from a snapshot, or snapshot. That point is after we
compile and produce the code table, but before we attach the
deoptimization info we use for stack tracing.

Opportunistically, performed more cleanup to improve maintainability:
- clarified sequential vs parallel compilation stages. FinishCompilation
was somewhat ambiguous in that it performed a few responsibilities:
compiling functions in the sequential case, and then populating the
linker and code tables.
- removed the "results" set, which is unnecessary. The linker simply
shares the function_code vector, and so do the compilation stages.
- populate the code table fixed array separately from compilation. This
falls out of the decisions above.

BUG=

Review-Url: https://codereview.chromium.org/2008043006
Cr-Commit-Position: refs/heads/master@{#36618}

This reverts commit 0aa3707d.

And removes the UnreachableObjectsFilter.

BUG=chromium:580959
LOG=n

Review-Url: https://codereview.chromium.org/1992913004
Cr-Commit-Position: refs/heads/master@{#36617}

Revert of [gn] Add unittests (patchset #7 id:120001 of https://codereview.chromium.org/2011853002/ )

Reason for revert:
Still http://crbug.com/615890

Original issue's description:
> [gn] Add unittests
>
> BUG=chromium:474921
> NOTRY=true
>
> Committed: https://crrev.com/67e549ec5b34ad02506abb2720c6a0851ae31f5e
> Cr-Commit-Position: refs/heads/master@{#36510}
>
> Committed: https://crrev.com/143b3d167d7014525d049d3ab53c73cf2592243c
> Cr-Commit-Position: refs/heads/master@{#36582}
>
> Committed: https://crrev.com/378a26c03efc74bda401daa5accda223cb266177
> Cr-Commit-Position: refs/heads/master@{#36606}

TBR=vogelheim@chromium.org,bmeurer@chromium.org,jochen@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:474921

Review-Url: https://codereview.chromium.org/2026713002
Cr-Commit-Position: refs/heads/master@{#36616}

Reason for revert:
Still http://crbug.com/615890

Original issue's description:
> [gn] Add cctest
>
> BUG=chromium:474921
>
> Committed: https://crrev.com/52a6fced896e3f64ac56eb57bcdea78393642e0c
> Cr-Commit-Position: refs/heads/master@{#36517}
>
> Committed: https://crrev.com/65678bc67fc48dfe4dcab7fdd2c4b7e1d6e918f4
> Cr-Commit-Position: refs/heads/master@{#36586}
>
> TBR=jochen@chromium.org
>
> Committed: https://crrev.com/eea9fbe1858df23dd832ed8ddd284f98120d9e21
> Cr-Commit-Position: refs/heads/master@{#36607}

TBR=jochen@chromium.org,vogelheim@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:474921

Review-Url: https://codereview.chromium.org/2026703002
Cr-Commit-Position: refs/heads/master@{#36615}

BUG=v8:4483
R=littledan@chromium.org, yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2010693003
Cr-Commit-Position: refs/heads/master@{#36614}

This prevents the compiler from optimizing
  f64-to-tagged(tagged-to-f64(x)) ==> x
for non-number x (such as undefined).

Review-Url: https://codereview.chromium.org/2027593002
Cr-Commit-Position: refs/heads/master@{#36613}

For values with canonical representation (i.e. not Number, Simd128Value
or Number) we can turn a strict equality comparison to a direct pointer
comparison. This removes the weird performance cliff when using a null
or undefined constant instead of the literals.

R=jarin@chromium.org
BUG=v8:5042

Review-Url: https://codereview.chromium.org/2027603002
Cr-Commit-Position: refs/heads/master@{#36612}

When we moved the String.fromCharCode builtin to C++, we slightly
regressed the fast single character code argument case. Recovered some
of the performance by implementing the builtin using the TurboFan
CodeStubAssembler.

Drive-by-fix: Make sure the stack trace from the implicit ToNumber
conversion in String.fromCharCode includes the builtin by adding a
regression test for that.

R=yangguo@chromium.org
BUG=chromium:609831,chromium:613947,v8:5049

Review-Url: https://codereview.chromium.org/2021143003
Cr-Commit-Position: refs/heads/master@{#36611}

R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2026643003
Cr-Commit-Position: refs/heads/master@{#36610}

Revert of Reland "[heap] Fine-grained JSArrayBuffer tracking" (patchset #2 id:20001 of https://codereview.chromium.org/2024063002/ )

Reason for revert:
Breaking
  http://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20avx2/builds/7972

Original issue's description:
> Track based on JSArrayBuffer addresses on pages instead of the attached
> backing store.
>
> Details of tracking:
> - Scavenge: New space pages are processes in bulk on the main thread
> - MC: Unswept pages are processed in bulk in parallel. All other pages
>   are processed by the sweeper concurrently.
>
> BUG=chromium:611688
> LOG=N
> TEST=cctest/test-array-buffer-tracker/*
> CQ_EXTRA_TRYBOTS=tryserver.v8:v8_linux_arm64_gc_stress_dbg,v8_linux_gc_stress_dbg,v8_mac_gc_stress_dbg,v8_linux64_tsan_rel,v8_mac64_asan_rel
>
> Committed: https://crrev.com/089da007bb990b5b29aab257aa836fdd3f3b8ce0
> Cr-Commit-Position: refs/heads/master@{#36608}

TBR=hpayer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:611688

Review-Url: https://codereview.chromium.org/2028503003
Cr-Commit-Position: refs/heads/master@{#36609}

backing store.

Details of tracking:
- Scavenge: New space pages are processes in bulk on the main thread
- MC: Unswept pages are processed in bulk in parallel. All other pages
  are processed by the sweeper concurrently.

BUG=chromium:611688
LOG=N
TEST=cctest/test-array-buffer-tracker/*
CQ_EXTRA_TRYBOTS=tryserver.v8:v8_linux_arm64_gc_stress_dbg,v8_linux_gc_stress_dbg,v8_mac_gc_stress_dbg,v8_linux64_tsan_rel,v8_mac64_asan_rel

Review-Url: https://codereview.chromium.org/2024063002
Cr-Commit-Position: refs/heads/master@{#36608}

BUG=chromium:474921

Committed: https://crrev.com/52a6fced896e3f64ac56eb57bcdea78393642e0c
Cr-Commit-Position: refs/heads/master@{#36517}

Committed: https://crrev.com/65678bc67fc48dfe4dcab7fdd2c4b7e1d6e918f4
Cr-Commit-Position: refs/heads/master@{#36586}

TBR=jochen@chromium.org

Review-Url: https://codereview.chromium.org/2007143003
Cr-Commit-Position: refs/heads/master@{#36607}

BUG=chromium:474921
NOTRY=true

Committed: https://crrev.com/67e549ec5b34ad02506abb2720c6a0851ae31f5e
Cr-Commit-Position: refs/heads/master@{#36510}

Committed: https://crrev.com/143b3d167d7014525d049d3ab53c73cf2592243c
Cr-Commit-Position: refs/heads/master@{#36582}

Review-Url: https://codereview.chromium.org/2011853002
Cr-Commit-Position: refs/heads/master@{#36606}

Revert of [gn] Add unittests (patchset #6 id:100001 of https://codereview.chromium.org/2011853002/ )

Reason for revert:
http://crbug.com/615890

Original issue's description:
> [gn] Add unittests
>
> BUG=chromium:474921
> NOTRY=true
>
> Committed: https://crrev.com/67e549ec5b34ad02506abb2720c6a0851ae31f5e
> Cr-Commit-Position: refs/heads/master@{#36510}
>
> Committed: https://crrev.com/143b3d167d7014525d049d3ab53c73cf2592243c
> Cr-Commit-Position: refs/heads/master@{#36582}

TBR=vogelheim@chromium.org,bmeurer@chromium.org,jochen@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:474921

Review-Url: https://codereview.chromium.org/2022893002
Cr-Commit-Position: refs/heads/master@{#36605}

R=cbruni@chromium.org

Review-Url: https://codereview.chromium.org/2026563002
Cr-Commit-Position: refs/heads/master@{#36604}

Reason for revert:
Blocks Roll https://bugs.chromium.org/p/chromium/issues/detail?id=615890

Original issue's description:
> [gn] Add cctest
>
> BUG=chromium:474921
> NOTRY=true
>
> Committed: https://crrev.com/52a6fced896e3f64ac56eb57bcdea78393642e0c
> Cr-Commit-Position: refs/heads/master@{#36517}
>
> Committed: https://crrev.com/65678bc67fc48dfe4dcab7fdd2c4b7e1d6e918f4
> Cr-Commit-Position: refs/heads/master@{#36586}

TBR=vogelheim@chromium.org,jochen@chromium.org,machenbach@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:474921

Review-Url: https://codereview.chromium.org/2021213002
Cr-Commit-Position: refs/heads/master@{#36603}

Rolling v8/build to 25d5f7b68ce4be271df55c6d4f1e492ec9e0c369

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2021183002
Cr-Commit-Position: refs/heads/master@{#36602}

Port 63ea3a50

Original commit message:

    Previously, we used the lowest bit for something else.

R=mvstanton@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2021133002
Cr-Commit-Position: refs/heads/master@{#36601}

Port 56d90782

Original commit message:

    In Crankshaft, we would install special ICs that didn't need a vector and slot
    in the MEGAMORPHIC case. This optimization limits our hand against future
    improvements.

R=mvstanton@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2023983002
Cr-Commit-Position: refs/heads/master@{#36600}

Previously, we used the lowest bit for something else.

R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2019393002
Cr-Commit-Position: refs/heads/master@{#36599}

R=littledan@chromium.org

Review-Url: https://codereview.chromium.org/2021053002
Cr-Commit-Position: refs/heads/master@{#36598}

In Crankshaft, we would install special ICs that didn't need a vector and slot
in the MEGAMORPHIC case. This optimization limits our hand against future
improvements.

BUG=

Review-Url: https://codereview.chromium.org/2019313003
Cr-Commit-Position: refs/heads/master@{#36597}

  - Move the samplers related part out of SignalHandler class (remove friendship).
  - Make the SamplerManager class a singleton.
  - Minor tweaks.

BUG=v8:4789

Review-Url: https://codereview.chromium.org/2018773002
Cr-Commit-Position: refs/heads/master@{#36596}

Expose more or less the full functionality of the KeyAccumulator in the API:
- use the PropertyFilter introduced for GetOwnPropertyNames
- use KeyCollectionLimit for OWN_ONLY or INLCUDE_PROTOS
- use IndexFilter to eithe SKIP_INDICES or INCLUDE_INDICES

Rewire Object::GetOwnPropertyNames to use GetPropertyNames.

BUG=chromium:148757

Review-Url: https://codereview.chromium.org/2002203002
Cr-Commit-Position: refs/heads/master@{#36595}

Users of this api should use a combination of |RequestInterrupt| and
|GCCallback| (see |AddGCPrologueCallback| and friends) to keep track allocated
memory.

BUG=v8:4813
LOG=Y
R=jochen@chromium.org

Review-Url: https://codereview.chromium.org/1991293002
Cr-Commit-Position: refs/heads/master@{#36594}

Revert of Reland "[heap] Fine-grained JSArrayBuffer tracking" (patchset #3 id:60001 of https://codereview.chromium.org/2026463002/ )

Reason for revert:
Investigating new arm simulator failure:
  https://build.chromium.org/p/client.v8.ports/builders/V8%20Linux%20-%20arm%20-%20sim/builds/851/steps/Check%20-%20novfp3/logs/box2d

Original issue's description:
> Reland "[heap] Fine-grained JSArrayBuffer tracking"
>
> Track based on JSArrayBuffer addresses on pages instead of the attached
> backing store.
>
> Details of tracking:
> - Scavenge: New space pages are processes in bulk on the main thread
> - MC: Unswept pages are processed in bulk in parallel. All other pages
>   are processed by the sweeper concurrently.
>
> BUG=chromium:614730, chromium:611688
> LOG=N
> CQ_EXTRA_TRYBOTS=tryserver.v8:v8_linux_arm64_gc_stress_dbg,v8_linux_gc_stress_dbg,v8_mac_gc_stress_dbg,v8_linux64_tsan_rel,v8_mac64_asan_rel
>
> Committed: https://crrev.com/bc0fb6e83eb7351f52bfd6f780bb6c12bd87c58c
> Cr-Commit-Position: refs/heads/master@{#36592}

TBR=hpayer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:614730, chromium:611688

Review-Url: https://codereview.chromium.org/2021893002
Cr-Commit-Position: refs/heads/master@{#36593}

Track based on JSArrayBuffer addresses on pages instead of the attached
backing store.

Details of tracking:
- Scavenge: New space pages are processes in bulk on the main thread
- MC: Unswept pages are processed in bulk in parallel. All other pages
  are processed by the sweeper concurrently.

BUG=chromium:614730, chromium:611688
LOG=N
CQ_EXTRA_TRYBOTS=tryserver.v8:v8_linux_arm64_gc_stress_dbg,v8_linux_gc_stress_dbg,v8_mac_gc_stress_dbg,v8_linux64_tsan_rel,v8_mac64_asan_rel

Review-Url: https://codereview.chromium.org/2026463002
Cr-Commit-Position: refs/heads/master@{#36592}

it's referenced from isolate.gypi which in turn is used in
non-standalone builds as well.

BUG=chromium:609107
R=machenbach@chromium.org

Review-Url: https://codereview.chromium.org/2023783003
Cr-Commit-Position: refs/heads/master@{#36591}

Fix failure in RunWasmInterpreted_LoadMemI32_const_oob_misaligned on architecures that don't support unaligned access

BUG=cctest/test-run-wasm/RunWasmInterpreted_LoadMemI32_const_oob_misaligned

Review-Url: https://codereview.chromium.org/2026553002
Cr-Commit-Position: refs/heads/master@{#36590}

Jaideep has been regularly contributing PPC and S390 changes recently.
Adding him as owner/reviewer to PPC / S390 specific directories.

R=joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com
BUG=

Review-Url: https://codereview.chromium.org/2024533003
Cr-Commit-Position: refs/heads/master@{#36589}

R=rossberg@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2026543002
Cr-Commit-Position: refs/heads/master@{#36588}

BUG=chromium:615489

Review-Url: https://codereview.chromium.org/2020743002
Cr-Commit-Position: refs/heads/master@{#36587}

BUG=chromium:474921
NOTRY=true

Committed: https://crrev.com/52a6fced896e3f64ac56eb57bcdea78393642e0c
Cr-Commit-Position: refs/heads/master@{#36517}

Review-Url: https://codereview.chromium.org/2007143003
Cr-Commit-Position: refs/heads/master@{#36586}

Utilize the previously introduced construct call counts in the
JSInliningHeuristic to also handle constructor calls properly.

R=mvstanton@chromium.org

Review-Url: https://codereview.chromium.org/2026513003
Cr-Commit-Position: refs/heads/master@{#36585}

The NumberIsHoleNaN operator used to test the lower word of the double
input which is obviously wrong.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2022753002
Cr-Commit-Position: refs/heads/master@{#36584}