This reverts commit b19d123f.

Reason for revert: It breaks the more important change: https://chromium-review.googlesource.com/c/v8/v8/+/1042145
(Because it adds mutable objects to RO_SPACE).

Original change's description:
> [heap] Move even more objects into RO_SPACE
> 
> Moves all Oddballs, empty_feedback_metadata, lots of symbols and
> immortal heap numbers and several other empty collection objects.
> 
>       RO_SPACE  NEW_SPACE  OLD_SPACE  CODE_SPACE  MAP_SPACE  LO_SPACE
> old      31592          0     221160       33280        176         0
> new      35016          0     217736       33280        176         0
> diff     +3424                 -3424
> 
> Bug: v8:7464
> Change-Id: Ic99411bcbcb9c9a48b33c59dddb68359278fb0b3
> Reviewed-on: https://chromium-review.googlesource.com/1025996
> Commit-Queue: Dan Elphick <delphick@chromium.org>
> Reviewed-by: Hannes Payer <hpayer@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#53053}

TBR=hpayer@chromium.org,mlippautz@chromium.org,delphick@chromium.org

Change-Id: Ieb81f88fe348fcffb67c153c0b116670318814f5
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7464
Reviewed-on: https://chromium-review.googlesource.com/1049555Reviewed-by: Dan Elphick <delphick@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53056}

at register is used a lot in macro-assembler-mips[64].cc and
we should not use it as temporary register in other parts of code

Change-Id: I7ef038cdf4f8c57aa76823e7ee0ffb40b62731cd
Reviewed-on: https://chromium-review.googlesource.com/1027816
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Reviewed-by: Sreten Kovacevic <sreten.kovacevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#53055}

R=mvstanton@chromium.org
CC=mstarzinger@chromium.org

Bug: v8:7721
Change-Id: I8baf4c8d52d0a5bd4a3b8d832624438f465f9390
Reviewed-on: https://chromium-review.googlesource.com/1047609Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53054}

Moves all Oddballs, empty_feedback_metadata, lots of symbols and
immortal heap numbers and several other empty collection objects.

      RO_SPACE  NEW_SPACE  OLD_SPACE  CODE_SPACE  MAP_SPACE  LO_SPACE
old      31592          0     221160       33280        176         0
new      35016          0     217736       33280        176         0
diff     +3424                 -3424

Bug: v8:7464
Change-Id: Ic99411bcbcb9c9a48b33c59dddb68359278fb0b3
Reviewed-on: https://chromium-review.googlesource.com/1025996
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53053}

Bug: v8:6890
Change-Id: I4002326cb79165ce6edb79a943d66de156b90116
Reviewed-on: https://chromium-review.googlesource.com/1046053Reviewed-by: Peter Wong <peter.wm.wong@gmail.com>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53052}

- Make FeedbackVector backing store a WeakFixedArray.
- "feedback" is always strong but "extra" might be weak.
- Whenever the handler stored in FeedbackVector is a WeakCell to a transition
  Map, replace it with an in-place weak reference.
For a more detailed description of the changes, see the design doc

https://docs.google.com/document/d/1P8cIme2wKszdYt64ObAiuh6pXgLnrrn80Hpl1ejJbOU/edit#heading=h.ijx1oculrikp

BUG=v8:7308

Change-Id: I72c5cf6597ef24d4c22a1fe8e25b67ca196d4ec8
Reviewed-on: https://chromium-review.googlesource.com/1027855
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53051}

Change-Id: I61a594e194082577135dbc82b2673bf477105ef3
Reviewed-on: https://chromium-review.googlesource.com/1046949
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Daniel Clifford <danno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53050}

R=ahaas@chromium.org

Bug: v8:7733
Change-Id: Ib3133e882c0a798f76478492a6663356267a1578
Reviewed-on: https://chromium-review.googlesource.com/1049546
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53049}

This CL introduces type narrowing and constant folding reducers
to constant fold code that comes out of inlined destructuring
of arrays. In particular, array iterator introduces code that
contains a phi of a temporary array that blocks escape analysis.
The phi comes from conditional that can be evaluated statically
(i.e., constant folded), so with better constant folding we
allow escape analysis to get rid of the temporary array.

On a quick micro-benchmark below, we see more than 6x improvement.
This is close to the hand-optimized version - if we replace
body of f with 'return b + a', we get 220ms (versus 218ms with
destructuring).

function f(a, b) {
  [b, a] = [a, b];
  return a + b;
}

function sum(count) {
  let s = 0;
  for (let i = 0; i < count; i++) {
    s += f(1, 2);
  }
  return s;
}

// Warm up
sum(1e5); sum(1e5);
console.time("destructure array");
sum(1e8);
console.timeEnd("destructure array");

console.timeEnd: destructure array, 213.526000

console.timeEnd: destructure array, 1503.537000

Bug: v8:7728
Change-Id: Ib7aec1d5897989e6adb1af1eddd516d8b3866db5
Reviewed-on: https://chromium-review.googlesource.com/1047672Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53048}

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;master.tryserver.blink:linux_trusty_blink_rel
Change-Id: I6390806935ada277db965718a804ab090b3be5dd
Reviewed-on: https://chromium-review.googlesource.com/1041157Reviewed-by: Pavel Feldman <pfeldman@chromium.org>
Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Commit-Queue: Hidy Han <hidyhan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53047}

We had four files in git which used CRLF. After adding a .gitattributes
file with "* text=auto", we should not get any new ones. This CL
converts the four existing files to LF.

R=mathias@chromium.org

Bug: v8:7570
Change-Id: Ia9c92f4bed14c6669de7d60390627a11de6450b8
Reviewed-on: https://chromium-review.googlesource.com/1047611
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Reviewed-by: Eric Holk <eholk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53046}

Bug: v8:7716
Change-Id: I9cf71c1e9431ee751db595b6c94c09dab5f1610b
Reviewed-on: https://chromium-review.googlesource.com/1047612Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53045}

This attribute will apply to newly added file only. If they contain
CRLF, this will be converted to LF automatically.

R=mathias@chromium.org

Bug: v8:7570
Change-Id: Idbf1f15d55dda18f623f9b3c7be8bba686569af0
Reviewed-on: https://chromium-review.googlesource.com/1047608
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53044}

If trap handlers cannot be installed, we printed two lines to stdout
and stderr, both not terminated by a newline. This CL adds a newline to
one output and uses the FATAL macro for the other, highlighting the
error better and showing the location where it happens.

R=eholk@chromium.org

Bug: v8:7570
Change-Id: Ic24f48f92b87528e0fd5889badf2c90d765e451a
Reviewed-on: https://chromium-review.googlesource.com/1047606Reviewed-by: Eric Holk <eholk@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53043}

R=mstarzinger@chromium.org

Bug: v8:7721
Change-Id: I8fd2c532c36bfd5faec2947d3154a2984c13ed46
Reviewed-on: https://chromium-review.googlesource.com/1047668Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53042}

This API will be used by Node.js to provide output compatible with
Chrome devtools.

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I265495f8af39bfc78d7fdbe43ac308f0920e817d
Reviewed-on: https://chromium-review.googlesource.com/1044491Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Eugene Ostroukhov <eostroukhov@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53041}

This moves the internal fields on {WasmExportedFunction} objects from
being properties with private symbols to a separate structure instead.
The new {WasmExportedFunctionData} structure can hang off the underlying
shared function info which is created for each exported function. This
reduces the number of transitions, speeds up instantiation, and makes it
easier to reach them from generated code (in the future).

R=titzer@chromium.org
BUG=v8:7424

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: Iaa733b6c9f7bea96246d6680756aa7101669a1a9
Reviewed-on: https://chromium-review.googlesource.com/1047025
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53040}

The RareData objects contain fields that often absent in CodeEntry'es.
They are created as needed when a corresponding field is added.
This reduces CodeEntry size on x64 by 40% from 136 to 80 bytes.

BUG=v8:7719

Change-Id: I1f3c6255aa2f228895e835b536c743396131db31
Reviewed-on: https://chromium-review.googlesource.com/1045885Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Alexei Filippov <alph@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53039}

We lost the print functionality for stub schedules somewhere on the
way. This re-adds the appropriate call to TraceSchedule to get it
going again.

Bug: v8:7327
Change-Id: I245823b440542708410d2253f9f4e78b2e22f3c9
Reviewed-on: https://chromium-review.googlesource.com/1047270Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53038}

In preparation for cleaning up PipelineData to use a MachineGraph
where appropriate, move the dead node up to MachineGraph.

R=ahaas@chromium.org

Bug: v8:7721
Change-Id: I3f9d456aef7cf4d80adbc93ae938636ffcc3712d
Reviewed-on: https://chromium-review.googlesource.com/1046828
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53037}

Retpolines were never used for off-heap wasm code. This CL adds them.

R=titzer@chromium.org

Bug: chromium:840376, chromium:798964
Change-Id: I9f1b2150cce484f831a83663d1fb06555e7eac82
Reviewed-on: https://chromium-review.googlesource.com/1047385
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53036}

R=clemensh@chromium.org

Change-Id: Ib1a0105e3347a5ccafdb72dadd9aa144ab77732c
Reviewed-on: https://chromium-review.googlesource.com/1046970Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53035}

Bug: v8:4247
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: Ibf5e7dd39cb81ac47af871edbe079d73839f9c1c
Reviewed-on: https://chromium-review.googlesource.com/1045184Reviewed-by: Michael Hablich <hablich@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53034}

Trying to reduce use of our self-baked data structures.

Bug: v8:7570
Change-Id: I419a932b6b8904810844d40a5636e423df832197
Reviewed-on: https://chromium-review.googlesource.com/1032739
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53033}

The hard-coded timeout in the test is so near, that e.g., adding DCHECKs pushes
the test over the limit. The test is ran with dcheck_always_on=true.

We shouldn't do any performance testing with dcheck_always_on=true; this creates
the wrong incentive to not add DCHECKs (or in this case, CLs which add more
DCHECKs or cause more DCHECKs to be hit cannot land at all).

Change-Id: Ia4d1b2b17ce5a5330b929f984253c89ba273f661
Reviewed-on: https://chromium-review.googlesource.com/1046548Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53032}

BUG=v8:7308

Change-Id: Ic69665c8a2606ec40ab06881e0501e33ee0621a0
Reviewed-on: https://chromium-review.googlesource.com/1046653Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53031}

The DCHECK was incorrect. This new API method can be called from any
debug mode since the embedder does not know which mode we are in.

It should only apply the side effect logic when the mode is
kSideEffects.

Bug: chromium:829571
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I11b0e5194b151a2b88171d6be21c3ccbba9cd408
Reviewed-on: https://chromium-review.googlesource.com/1046162Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Erik Luo <luoe@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53030}

Bug: chromium:840106
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: I0090cdecaf9194f3ed2d716c6f5f698e33cbdf0d
Reviewed-on: https://chromium-review.googlesource.com/1046827
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53029}

Change-Id: If1aefb00299ac0c88bdc84b5b77b58582dd8b9b4
Reviewed-on: https://chromium-review.googlesource.com/1047105Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53028}

Stubs and builtins are very similar. The main differences are that
stubs can be parameterized and may be generated at runtime, whereas
builtins are generated at mksnapshot-time and shipped with the snapshot
(or embedded into the binary).

My main motivation for these conversions is that we can generate
faster calls and jumps to (embedded) builtins callees from (embedded)
builtin callers. Instead of going through the builtins constants table
indirection, we can simply do a pc-relative call/jump.

This also unlocks other refactorings, e.g. removal of
CallRuntimeDelayed.

TBR=mlippautz@chromium.org

Bug: v8:6666
Change-Id: I4cd63477f19a330ec70bbf20e2af8a42fb05fabb
Reviewed-on: https://chromium-review.googlesource.com/1044245Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53027}

In the process, rename Boolean constants (i.e. JavaScript constants),
to 'True' and 'False'. This uncovered a bug in the internal handling
of True/False labels was fixed (they shouldn't be Values and Torque
shouldn't conflate Labels with other Declarables, throwing exceptions
when they're improperly used in the wrong context). Furthermore,
the internal labels used for True and False for if statements
have been renamed so that they can't be aliased from user Torque code.

Change-Id: I09dbd2241d2bc2f1daff53862dee1b601810060c
Reviewed-on: https://chromium-review.googlesource.com/1044370Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53026}

Bug: chromium:840329
Change-Id: If45a98c7f8a97f2482ac1bed7f7dda7d6e62b6b9
Reviewed-on: https://chromium-review.googlesource.com/1046658Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53025}

Define simple accessors in the header and give them lower case names.

R=mstarzinger@chromium.org

Bug: v8:7570
Change-Id: I2914013fdea2218189275bbaa9f98ea5de0ccd7c
Reviewed-on: https://chromium-review.googlesource.com/1046546
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53024}

These tests can be unskipped now that off-heap trampolines are packed
into the binary.

Bug: v8:6666
Change-Id: Ib8d55064a42da3b12fd940441298e5273181c601
Reviewed-on: https://chromium-review.googlesource.com/1047165Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53023}

Change-Id: Iccc86d0116f5d23f523e25ff02696a9fb8312223
Reviewed-on: https://chromium-review.googlesource.com/1044545
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53022}

This eliminates one instruction for following pattern:
  movl rX, rY       // TruncateInt64ToInt32
  subl rX, imm32
==>
  leal rX, [rY - imm32]

R=bmeurer@chromium.org

Change-Id: I4164e1407f5953302051e905555da14d3ca6680a
Reviewed-on: https://chromium-review.googlesource.com/1046381Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Kanghua Yu <kanghua.yu@intel.com>
Cr-Commit-Position: refs/heads/master@{#53021}

R=clemensh@chromium.org
CC=​titzer@chromium.org

Change-Id: I4951bf7ffc8baf51225e7bef60349186811b9f76
Reviewed-on: https://chromium-review.googlesource.com/1024037
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53020}

This reverts commit 96186c4f.

Reason for revert: All gc stress bots time out:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20gc%20stress/builds/16361

Original change's description:
> [in-place weak refs] Fix: allow weak array types in large object space.
> 
> BUG=v8:7308,chromium:839953
> 
> Change-Id: I3738dc8169730763a587a2452421a54aff11e38e
> Reviewed-on: https://chromium-review.googlesource.com/1046645
> Commit-Queue: Marja Hölttä <marja@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#53016}

TBR=ulan@chromium.org,marja@chromium.org

Change-Id: I030638c27fd8990b9dab3d25a582039fb893bf78
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7308, chromium:839953
Reviewed-on: https://chromium-review.googlesource.com/1046549Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53019}

Bug: chromium:840220
Change-Id: I37404902e99a83d029aab36411b199fad60497b0
Reviewed-on: https://chromium-review.googlesource.com/1046066Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53018}

This merges all test specs into one master-independent
builders.pyl file, which will unblock deprecating the master name as
a property on infra side.

Bug: chromium:830557
Change-Id: I0592505e77ede725ed43a26cabfd057bb0b911bd
Reviewed-on: https://chromium-review.googlesource.com/1046671Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53017}