This reverts commit ecd3a2ea.

Reason for revert: Bug 779509, a crash with chrome.

Original change's description:
> [TurboFan] Remove maximum inlining levels check from inlining heuristics
> 
> We have a check on maximum number of levels that can be inlined. This
> in some cases causes performance cliffs, when we cannot inline a small
> function because it has exceeded the number of levels. This cl removes
> that check. The intuition is that, having gone down several levels in
> a particular line stopping inlining that chain and exploring a new
> call site may not be beneficial.
> 
> Bug: v8:6871
> Change-Id: I120056db38e78ce48dff010b6cf994259238582a
> Reviewed-on: https://chromium-review.googlesource.com/741705
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#49009}

TBR=mythria@chromium.org,bmeurer@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:6871
Change-Id: I4766f911cb326c224af110be5c0dd7a44362a880
Reviewed-on: https://chromium-review.googlesource.com/743785Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49037}

- Add WeakMapPrototypeSet and WeakSetPrototypeAdd TFJ builtins
  - Fast paths for...
    1) existing key
    2) new key when ObjectHashTable has a "sufficient capacity"
- Create WeakCollectionsBuiltinsAssembler to consolidate common WeakMap/WeakSet code generation
- Convert existing WeakMapLookupHashIndex to use WeakCollectionsBuiltinsAssembler

Some quick benchmarks shows performance gains of...
- 1.56x - 1.98x for WeakMap constructor
- 1.66x - 2.06x for WeakSet constructor
- 1.50x - 2.11x for WeakMap.p.set
- 1.54x - 2.26x for WeakSet.p.add

https: //github.com/peterwmwong/v8-perf/blob/master/weakcollection-set/README.md
Bug: v8:5049, v8:6604
Change-Id: I3499d46be6b2b3b1d8d46720ebe86cc5142ee542
Reviewed-on: https://chromium-review.googlesource.com/737935
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49036}

Test that console.time/End/Stamp properly show up in the log file.

Change-Id: I99904e20fc98811ed3e3b5e5a9d186b459b8d4be
Reviewed-on: https://chromium-review.googlesource.com/743020
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49035}

This proceeds the experiment using the legacy bots, since luci bots
are blocked on https://crbug.com/776734.

NOTRY=true

Bug: chromium:772816, chromium:776734
Change-Id: I7532e04e98a96d69dbeefcd6edf66fb0cddbe111
Reviewed-on: https://chromium-review.googlesource.com/743365Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49034}

This reverts commit f259ec2d.

Reason for revert: Breaks tree

Original change's description:
> [build] Include deopt-fuzzer isolates on fuzzer builders
> 
> TBR=sergiyb@chromium.org
> NOTRY=true
> NOTREECHECKS=true
> 
> Bug: v8:7012
> Change-Id: I1d0b0488cd9b7bf6a30edc0b010f32fb0914ed0b
> Reviewed-on: https://chromium-review.googlesource.com/743783
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#49032}

TBR=machenbach@chromium.org,sergiyb@chromium.org

Change-Id: If1846d2a711edeb44f031e536f84cc4b71a107e5
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7012
Reviewed-on: https://chromium-review.googlesource.com/743784Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49033}

TBR=sergiyb@chromium.org
NOTRY=true
NOTREECHECKS=true

Bug: v8:7012
Change-Id: I1d0b0488cd9b7bf6a30edc0b010f32fb0914ed0b
Reviewed-on: https://chromium-review.googlesource.com/743783
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49032}

Change-Id: Ib7254e7239169ec7148cdd02208eb363465c5db6
Reviewed-on: https://chromium-review.googlesource.com/743725Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49031}

This prepares for:
https://chromium-review.googlesource.com/c/chromium/tools/build/+/743381

NOTRY=true

Bug: v8:7012
Change-Id: Ic40aa08cbc7b68b2a1b55924536a319f729a557a
Reviewed-on: https://chromium-review.googlesource.com/743363Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49030}

Following up on adding n-ary nodes, this extends the parser and
interpreter to support n-ary logical operations.

Bug: v8:6964
Bug: chromium:731861
Change-Id: Ife2141c389b9abccd917ab2aaddf399c436ef777
Reviewed-on: https://chromium-review.googlesource.com/735497Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49029}

Change-Id: Ic3e6db16678f513d8bb8eaea2695ae78e383b448
Reviewed-on: https://chromium-review.googlesource.com/736034
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49028}

The bytecode interpreter nor TF rely on the explicit return value of store ICs anymore, so we can just return whatever is in the result slot. It won't be visible to JS anyway.

Bug: 
Change-Id: I389615d1d77c5b050832f23a08e3d3bc07d9cbc6
Reviewed-on: https://chromium-review.googlesource.com/743366Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49027}

This is preparation for supporting OOB loads from strings, which
requires the KeyedLoadIC to track this information.

Bug: v8:6936, v8:7014
Change-Id: Ide132244ee523397dd418d21fe3377976f6633fd
Reviewed-on: https://chromium-review.googlesource.com/743481Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49026}

This reverts commit 32141e93.

Reason for revert: Got merged to stable end of last week.

Original change's description:
> Disable --turbo-inline-array-builtins by default.
> 
> Current chrome stable has a high number of crashes due to bugs in
> this feature. These bugs are already fixed but the fixes are hard
> to merge back. Therefore we decided to disable the feature in stable.
> This CL is intended to be merged to stable and then reverted in tot.
> 
> Bug: chromium:762020
> Change-Id: Ibd5a08e3b303a204fb84a408271a1c0f97cc5b7b
> Reviewed-on: https://chromium-review.googlesource.com/738176
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Commit-Queue: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#48931}

TBR=jarin@chromium.org,neis@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: chromium:762020
Change-Id: Id1fe2f417e09a7b451484fc16710b09469cdb74d
Reviewed-on: https://chromium-review.googlesource.com/743321Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49025}

Remove distinction between lazy and non-lazy CallApiCallback, always explicitly set up target context

Bug: 
Change-Id: I0cb751a0415433fdfec21451e2fac3e0726bf26e
Reviewed-on: https://chromium-review.googlesource.com/743019
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49024}

The CheckSeqString operator unnecessarily materialized two bits for the
separate conditions, but we can actually check for SeqString with just a
single mask instead, which saves the intermediate computations and two
registers.

Bug: v8:5267
Change-Id: Ib937a5a4eebdc271a2bbbc6f074f5992e06b2fa9
Reviewed-on: https://chromium-review.googlesource.com/741702Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49023}

Change-Id: I721a014262641ccc2b7dde97eaf0cadbb8d0b649
Reviewed-on: https://chromium-review.googlesource.com/743016Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49022}

This was discovered on the babel test of the web-tooling-benchmark,
which suffers from a high %KeyedGetProperty overhead, and most of
these calls come from the fact that the KeyedLoadIC_Megamorphic bails
out to the runtime call for all String instance types. Just handling
in-bound accesses to characters reduces the overhead incurred by
%KeyedGetProperty from roughly 9% to roughly 2% only.

This reduces the number of runs per second on the babel test by around
7-8% on average.

Bug: v8:6936, v8:7014
Change-Id: I0dc247d7d6457c7032636d2852cb54cef1b24979
Reviewed-on: https://chromium-review.googlesource.com/743012Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49021}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/824d0c1..c5d82db

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: I7c4bbc126a7d3322a836562684e466bf2a667747
Reviewed-on: https://chromium-review.googlesource.com/742805Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49020}

Interpreter entries may be called from wasm functions, when debugging.
That means that, when moving on the native heap, interpreter entries
need to be native, too. That means they cannot reference movable GC
objects.

The only such reference was to the instance object, which is needed
in the WasmRunInterpreter runtime function. We can fetch the instance
using GetWasmInstanceOnTop() instead.

Bug: v8:6876
Change-Id: I7198a849cc0e441b057537a570a3dfa6f3197149
Reviewed-on: https://chromium-review.googlesource.com/742391
Commit-Queue: Mircea Trofin <mtrofin@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49019}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/626232b..824d0c1

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: I87554731f13dc5bf1137816c4a6b4cb43d27bf8f
Reviewed-on: https://chromium-review.googlesource.com/742803Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49018}

Change-Id: I3262744d08629d23e792e2c247fffb48cdd42876
Reviewed-on: https://chromium-review.googlesource.com/742921Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49017}

Change-Id: Ie62dbd8f7759f66d4b6361fbe3e5bdbad705bb82
Reviewed-on: https://chromium-review.googlesource.com/742881Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49016}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/e1ba03b..626232b

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: Ic327a6f9d8198eb7754065919c54e4c5bf6d75d3
Reviewed-on: https://chromium-review.googlesource.com/742782Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49015}

Bug: v8:6791
Change-Id: Id85bd701eaa574eea1335cdc916323810616cef9
Reviewed-on: https://chromium-review.googlesource.com/738936
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49014}

This eliminates the AstValue class, effectively moving its
implementation into the Literal AstNode. This should cause
no difference in behavior, but it does signal some shifts
in the underlying system. Biggest changes include:

  - Reduction in AST memory usage
  - No duplicate HeapNumbers in Ignition constant pools
  - Non-String values are allocated either at constant pool
    creation time (or at boilerplate creation time for literals),
    rather than at AstValueFactory::Internalize() time.

There are a variety of test-only/debug-only changes due to these
switches as well.

Bug: v8:6984
Change-Id: I5f178040ce2796d4e7370c24d1063419e1c843a1
Reviewed-on: https://chromium-review.googlesource.com/731111
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49013}

- Moves platform-specific platform tests to test-platform.cc.
- Moves all tests into v8::internal namespace.

Bug: chromium:756050
Change-Id: Ic67d6b84dda07a9d5f6a0cc6489bfae90c52c0f2
Reviewed-on: https://chromium-review.googlesource.com/739983
Commit-Queue: Bill Budge <bbudge@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49012}

This is a reland of 0b0bfc4b
Original change's description:
> [Memory] Unify POSIX memory management calls.
> 
> - Moves base::OS memory management calls into platform-posix.cc,
>   using preprocessor to adjust for each platform.
> 
> Bug: chromium:756050
> Change-Id: I2af4dce4379ad1fe9e22e5ab5c6d6a7faa3655b3
> Reviewed-on: https://chromium-review.googlesource.com/738890
> Commit-Queue: Bill Budge <bbudge@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Hannes Payer <hpayer@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#48981}

Bug: chromium:756050
Change-Id: Id644d12ee117cdb2eb9d4bf0b4a2c8e3c43ae7be
Reviewed-on: https://chromium-review.googlesource.com/741485Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49011}

This happens when RCS are enabled dynamically and the callsite is inside
the background parser.

BUG=chromium:760649

Change-Id: I216b955ed91d9c663ce3027aaa8ffb515bfe13ab
Reviewed-on: https://chromium-review.googlesource.com/740911Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Alexei Filippov <alph@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49010}

We have a check on maximum number of levels that can be inlined. This
in some cases causes performance cliffs, when we cannot inline a small
function because it has exceeded the number of levels. This cl removes
that check. The intuition is that, having gone down several levels in
a particular line stopping inlining that chain and exploring a new
call site may not be beneficial.

Bug: v8:6871
Change-Id: I120056db38e78ce48dff010b6cf994259238582a
Reviewed-on: https://chromium-review.googlesource.com/741705Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49009}

Instead of creating a runtime call for the static class field
initializer in the AST, we do it in the bytecode generator.

This adds the initializer function to the ClassLiteral AST node.

Bug: v8:5367
Change-Id: Iffaa6531511023812011ee19fc96cea9e5c9d3f3
Reviewed-on: https://chromium-review.googlesource.com/736315Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49008}

To avoid accessing the heap during asm.js compilation, use the pending
error handler to store the pending warnings such that they can be reported
later during finalization.

As part of this change, refactor PendingCompilationErrorHandler to have a
MessageDetails class holding details of either error or warning messages.

BUG=v8:5203

Change-Id: I5b09254f8899b8dc57d94f1986c7183da847eae3
Reviewed-on: https://chromium-review.googlesource.com/735607
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49007}

Bug: 
Change-Id: I41ce841cd20bab26de29437d4365f011c98ad53e
Reviewed-on: https://chromium-review.googlesource.com/739392Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Georgia Kouveli <georgia.kouveli@arm.com>
Cr-Commit-Position: refs/heads/master@{#49006}

This moves the handling of the receiver and the final spread argument
into Generate_InterpreterPushArgs and merges the stack allocation to a
single claim operation for the whole argument setup. When we start
padding arguments in TF, we will simply need to claim one extra slot
and store padreg to it in Generate_InterpreterPushArgs (hence the
remaining TODO).

This also replaces the single use of Generate_CheckStackOverflow with
Generate_StackOverflowCheck and removes the former. This change is also
done for arm, ia32 and x64.

Bug: v8:6644
Change-Id: I8d06dda96dbc4a6f219b73c711f894320c2f6cdf
Reviewed-on: https://chromium-review.googlesource.com/738031
Commit-Queue: Georgia Kouveli <georgia.kouveli@arm.com>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49005}

This especially simplifies arm64 CallApiCallbackStub alignemnt handling.

Bug: 
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I26e9c075702161a3f1c70f94ec83d149d2d8f33a
Reviewed-on: https://chromium-review.googlesource.com/741600Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49004}

This reverts commit 0b0bfc4b.

Reason for revert: Breaks Chromium, see https://crrev.com/c/741484. Already reverted https://crrev.com/c/740083 before this.

Original change's description:
> [Memory] Unify POSIX memory management calls.
> 
> - Moves base::OS memory management calls into platform-posix.cc,
>   using preprocessor to adjust for each platform.
> 
> Bug: chromium:756050
> Change-Id: I2af4dce4379ad1fe9e22e5ab5c6d6a7faa3655b3
> Reviewed-on: https://chromium-review.googlesource.com/738890
> Commit-Queue: Bill Budge <bbudge@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Hannes Payer <hpayer@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#48981}

TBR=bbudge@chromium.org,ulan@chromium.org,hpayer@chromium.org,mlippautz@chromium.org

Change-Id: If4f62beec765e93c3618bd4824e2c1d4f6c0af4c
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:756050
Reviewed-on: https://chromium-review.googlesource.com/741762Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49003}

This reverts commit 9ae967fe.

Reason for revert: Breaks Chromium, see https://crrev.com/c/741484. Will also revert https://crrev.com/c/738890 after this.

Original change's description:
> Fix fuschia build.
> 
> Bug:chromium:756050
> Change-Id: Ib65c9c4c19266eb1c6119367397be0769cfcc7a1
> 
> TBR=ulan@chromium.org
> 
> Change-Id: Ib65c9c4c19266eb1c6119367397be0769cfcc7a1
> Reviewed-on: https://chromium-review.googlesource.com/740083
> Reviewed-by: Bill Budge <bbudge@chromium.org>
> Commit-Queue: Bill Budge <bbudge@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#48984}

TBR=bbudge@chromium.org,ulan@chromium.org,mlippautz@chromium.org,scottmg@chromium.org

Change-Id: Ie4db6aeb231fe919969a19bbe51589e108127378
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:756050
Reviewed-on: https://chromium-review.googlesource.com/741761Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49002}

The status-file flags and the flags from the test case's source code
must always overwrite extra flags set by bots.

Bug: v8:6924
Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng
Change-Id: I0e2aabb69da7cfb8ba6c1c79bd3851462071a6ac
Reviewed-on: https://chromium-review.googlesource.com/732656
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49001}

R=titzer@chromium.org

Change-Id: Ie8c361efb48b56dc65719f09dfc79d505e0f3459
Reviewed-on: https://chromium-review.googlesource.com/735610
Commit-Queue: Andreas Rossberg <rossberg@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49000}

(This is a reland of cb84b6f6)

This works in the ICs since compiled handlers are not shared anymore.

Bug: chromium:759734
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I3b7d6ae34bb4cfa213f679354fac56fb51bfd5ed
Reviewed-on: https://chromium-review.googlesource.com/739822Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48999}

Because this test uses heap verification, it is quite slow. Split it
into 4 smaller tests to avoid test timeout and allow them to be run
in parallel.

R=ahaas@chromium.org

Bug: 
Change-Id: Ie4ac841d1d8215019bb5cfcc335daea6b10ab789
Reviewed-on: https://chromium-review.googlesource.com/738146Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48998}