This is a reland of 9e48a24f

Original change's description:
> Reland "[array] Move Array.p.sort to Torque and use TimSort instead of QuickSort"
>
> The CL was reverted because it broke some tests in ChromeOS.
>
> > [array] Move Array.p.sort to Torque and use TimSort instead of QuickSort
> >
> > This CL changes the sorting algorithm used in Array.p.sort from
> > QuickSort to TimSort (implemented in Torque).
> >
> > Detailed performance results can be found here: https://goo.gl/4E733J
> >
> > To save on code space, fast-paths are implemented as sets of
> > function pointers instead of specializing generics.
> >
> > R=cbruni@chromium.org, jgruber@chromium.org
> >
> > Bug: v8:7382, v8:7624
> > Change-Id: I7cd4287e4562d84ab7c79c58ae30780630f976de
> > Reviewed-on: https://chromium-review.googlesource.com/1151199
> > Commit-Queue: Simon Zünd <szuend@google.com>
> > Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> > Reviewed-by: Camillo Bruni <cbruni@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#55003}
>
> Bug: v8:7382, v8:7624
> Change-Id: Ic7a3230f3708177774b0760f08b7659d83ec5505
> Reviewed-on: https://chromium-review.googlesource.com/1184901
> Commit-Queue: Simon Zünd <szuend@google.com>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#55325}

Bug: v8:7382, v8:7624
Change-Id: I297611f45c09967e0f6961156b0c9ebdebc7053f
Reviewed-on: https://chromium-review.googlesource.com/1186801
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55360}

Change-Id: I0870a13fd257e014a3b6dca8ee7ccb3aa5485066
Reviewed-on: https://chromium-review.googlesource.com/1183525Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55359}

The WasmCompilationData was a struct that served as an input/output
mechanism for communicating with the code generator. In particular,
it contained a flag for enabling runtime exception for WASM in the code
generator and it also gathered the protected instruction info from
the code generator to be communicated to the WasmCodeManager.

This CL inlines the exception support flag into OptimizedCompilationInfo
and the protected instruction information into the code generator,
along the lines of other flags and data structures created by the
code generator.

R=mstarzinger@chromium.org

Change-Id: If436636067f1a829a095310a73045fe3301cb694
Reviewed-on: https://chromium-review.googlesource.com/1186409
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55358}

Note that this splits off counters added in
https://chromium-review.googlesource.com/c/v8/v8/+/1186343

R=ahaas@chromium.org

Bug: chromium:868844
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I263c63a51d8ce3418eacabb6beb11fa1b3dfaa96
Reviewed-on: https://chromium-review.googlesource.com/1186721Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55357}

This CL removed padding from Abort on ARM, which is no longer needed.

Bug: v8:8054
Change-Id: I7ff0b88ba90e10d15b67b5ae8ca80f2cf7460498
Reviewed-on: https://chromium-review.googlesource.com/1183664
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55356}

This reverts commit 9e48a24f.

Reason for revert: Possibly breaking the V8-Blink Mac bot - https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8-Blink%20Mac/15097

Original change's description:
> Reland "[array] Move Array.p.sort to Torque and use TimSort instead of QuickSort"
> 
> The CL was reverted because it broke some tests in ChromeOS.
> 
> > [array] Move Array.p.sort to Torque and use TimSort instead of QuickSort
> >
> > This CL changes the sorting algorithm used in Array.p.sort from
> > QuickSort to TimSort (implemented in Torque).
> >
> > Detailed performance results can be found here: https://goo.gl/4E733J
> >
> > To save on code space, fast-paths are implemented as sets of
> > function pointers instead of specializing generics.
> >
> > R=cbruni@chromium.org, jgruber@chromium.org
> >
> > Bug: v8:7382, v8:7624
> > Change-Id: I7cd4287e4562d84ab7c79c58ae30780630f976de
> > Reviewed-on: https://chromium-review.googlesource.com/1151199
> > Commit-Queue: Simon Zünd <szuend@google.com>
> > Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> > Reviewed-by: Camillo Bruni <cbruni@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#55003}
> 
> Bug: v8:7382, v8:7624
> Change-Id: Ic7a3230f3708177774b0760f08b7659d83ec5505
> Reviewed-on: https://chromium-review.googlesource.com/1184901
> Commit-Queue: Simon Zünd <szuend@google.com>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#55325}

TBR=jgruber@chromium.org,szuend@google.com

Change-Id: Ie7e2af57a6480aa0504ba21ec98ee825d7ac74fe
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7382, v8:7624
Reviewed-on: https://chromium-review.googlesource.com/1186601Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55355}

The test is timing out on the Arm simulator when TimSort is disabled.

NOTRY=true
TBR=sigurds@chromium.org

Bug: v8:7783
Change-Id: I51e159822d0010253a458f0c380c52f27f7fe972
Reviewed-on: https://chromium-review.googlesource.com/1186583
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55354}

This change writes a magic number into the root register,
and checks that we have the number still in at StackChecks.

Change-Id: Ib00d2a7ede651997ae9459cf4bdcc6be3952353b
Bug: v8:6666
Reviewed-on: https://chromium-review.googlesource.com/1186402
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55353}

Removing bitfields because they regressed code-load performance on arm.

Bug: v8:7926
Change-Id: Id7f8b26b76203c6a45ba408945abb1a2d1ad9d5b
Reviewed-on: https://chromium-review.googlesource.com/1186419Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Florian Sattler <sattlerf@google.com>
Cr-Commit-Position: refs/heads/master@{#55352}

R=sigurds@chromium.org

Change-Id: Ib024d099946d4351bfce9de8eb61be1dba5e1ce5
Reviewed-on: https://chromium-review.googlesource.com/1186415
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55351}

R=titzer@chromium.org
BUG=v8:6408

Change-Id: I277beafaace334883ddbe63b9615e3f18085ce5e
Reviewed-on: https://chromium-review.googlesource.com/1186411
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55350}

No need to create allocation site for array literals in oneshot code since
they are executed only once. The interpreter emits a runtime call to
CreateArrayLiteralWithoutAllocationSite for creating literals in
oneshot code instead.

Change-Id: I285879c84759ff9e2ce281e9548112f52ce5e7d1
Reviewed-on: https://chromium-review.googlesource.com/1167843Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Chandan Reddy <chandanreddy@google.com>
Cr-Commit-Position: refs/heads/master@{#55349}

The constructor that accepts a size for vector default initializes the
elements. Using reserve() instead avoids this but still ensures the
capacity.

Change-Id: I8effb62ba1f9598a0081c2c959b2f7a5d6c587e6
Reviewed-on: https://chromium-review.googlesource.com/1186407Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55348}

Currently, we use an AllocationKind to signal to the embedder how v8
has allocated the backingstore of an array buffer. The embedder then has
to implement matching logic to free an exernalized buffer. By Using
custom deleters v8 can communicate how to free an externalized array
buffer without requiring all embedders to implement corresponding
freeing logic.

Bug: v8:8073
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I553dec31ba167d6a7b342ded50d685be7dffd1c5
Reviewed-on: https://chromium-review.googlesource.com/1183484
Commit-Queue: Stephan Herhut <herhut@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55347}

Use CheckBounds and reduce the number of checks required to sanitize the
indices for DataView accesses in optimized code. Also constant-fold the
[[ByteLength]] if the DataView is a known compile-time constant (similar
to what we do for TypedArrays already). This further improves performance
of DataViews by 2-7% depending on the exact test case.

With this change DataView and TypedArray accesses themselves are mostly
on par performance wise.

Since this CL introduces proper CheckBounds for the DataViews, instead
of the hand-craftet bounds checks, it is expected to regress performance
when untrusted code mitigations are on, since DataViews are also guarded
in optimized now. Without untrusted code mitigations, there's no negative
performance impact.

Tbr: sigurds@chromium.org
Bug: chromium:225811, chromium:876005
Change-Id: I4a69f81124635c9ba2c7e4c2dc912e2fd601061a
Reviewed-on: https://chromium-review.googlesource.com/1186408Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55346}

This reverts commit f4ca3fc5.

Reason for revert: Since TF (js-call-reducer) calls into the C++ builtin, it is easier (cleaner for now) to implement the baseline version in C++ instead of Torque.

Original change's description:
> [array] Prepare Array.p.shift for removal of the JavaScript fall-back
> 
> This CL changes the ArrayPrototypeShift builtin to a CSA macro which
> is used in a newly created Torque builtin.
> 
> This is in preparation for removing the JavaScript fall-back, which
> will be replaced by a baseline Torque implementation.
> 
> R=​cbruni@chromium.org, jgruber@chromium.org
> 
> Bug: v8:7624
> Change-Id: I9b7898beea2802cc02d394e040a1e500387cf108
> Reviewed-on: https://chromium-review.googlesource.com/1169172
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Commit-Queue: Simon Zünd <szuend@google.com>
> Cr-Commit-Position: refs/heads/master@{#55036}

TBR=cbruni@chromium.org,jgruber@chromium.org,szuend@google.com

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:7624
Change-Id: I4929eefaa90ff8681bc8ae20e3ea3fe84ee7f1e8
Reviewed-on: https://chromium-review.googlesource.com/1186342Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Simon Zünd <szuend@google.com>
Cr-Commit-Position: refs/heads/master@{#55345}

Changes the alignment so we don't have to pad after the first int.

Bug: v8:7926
Change-Id: I8fba9b415ef85118c6abf19902fb857584535a6e
Reviewed-on: https://chromium-review.googlesource.com/1186321Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Florian Sattler <sattlerf@google.com>
Cr-Commit-Position: refs/heads/master@{#55344}

This reverts commit d16bce9d.

Reason for revert: Investigating what caused the redness here:
https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8-Blink%20Mac/15097

Original change's description:
> [parser] Removed unnecessary copies
> 
> Bug: v8:8015
> Change-Id: I2ee074559484b9865dc1a27e6ea697ca311ee7ee
> Reviewed-on: https://chromium-review.googlesource.com/1185198
> Reviewed-by: Marja Hölttä <marja@chromium.org>
> Commit-Queue: Florian Sattler <sattlerf@google.com>
> Cr-Commit-Position: refs/heads/master@{#55327}

TBR=marja@chromium.org,sattlerf@google.com

Change-Id: I0344b11c2538a2755315dae7dd1f1ab62b8e069c
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:8015
Reviewed-on: https://chromium-review.googlesource.com/1186441Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55343}

Removes some unused functions in ParseInfo and makes the associated fields unique_ptr instead
of shared_ptr. Also removes an unused zone in Compiler.

Change-Id: Idf1fbfb523cfc2b9a265d2855b1167770203cfd5
Reviewed-on: https://chromium-review.googlesource.com/1185193
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55342}

With the previous changes the builtin would take the slow path for
JSArray's when the iterator was already exhausted (i.e. the internal
[[ArrayIteratorNextIndex]] field contains 2^32-1 as HeapNumber), even
though that could also be handled in the fast path. This changes the
handling such that the three distinct cases (if_array, if_other and
if_typedarray) are really distinct, and all JSArray's are always
handled by the if_array case.

Bug: v8:7510, v8:7514, v8:8070, chromium:876654
Change-Id: I1636b0616645f9e99f34f851df410992653cb380
Reviewed-on: https://chromium-review.googlesource.com/1186403Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55341}

This reverts commit b10a967f.

Reason for revert: Breaks a TSAN bot - https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Linux64%20TSAN/22122

Original change's description:
> [wasm] Add feature counter for threads and shared memory
> 
> This adds a feature counter for WASM shared memory (i.e. the presence
> of the "shared" bit in a WASM module's memory section) and the usage
> of WASM threads opcodes (i.e. wake/wait and atomics).
> 
> This CL also plumbs the WasmFeatures through the compilation pipeline
> to detect features as functions are being compiled.
> 
> R=​ahaas@chromium.org, ulan@chromium.org
> BUG=chromium:868844
> 
> Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
> Change-Id: I854f932d3adb16e4fd87196fe2a193950295b856
> Reviewed-on: https://chromium-review.googlesource.com/1186329
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Commit-Queue: Ben Titzer <titzer@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#55337}

TBR=ulan@chromium.org,titzer@chromium.org,ahaas@chromium.org

Change-Id: Id011b6707b3359598621b315b87171644132b0ab
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:868844
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/1186421Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55340}

When switching log files, if a function was selected the timeline would
attempt to draw its ticks and would usually crash. It would also
preserve the selected section of the timeline.

This patch wipes out the current state when loading a new log file,
with the exception of the current mode (Summary, Bottom up, etc). As a
consequence, the timeline size is now calculated in TimelineView.render
so it will always be drawn at the right size.

Bug: v8:6240
Change-Id: Ie15dd9b225901c8f4df614444458ae2aeaf74ccc
Reviewed-on: https://chromium-review.googlesource.com/1186340Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Bret Sepulveda <bsep@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55339}

This is another step towards a kRootRegister on ia32 and removes
kRootRegister from generic interface descriptors.

Drive-by: Better error message for type mismatches in machine graph
verification.
Drive-by: Use PreserveRootIA32 register config for all builtins.

Bug: v8:6666
Change-Id: I920d4d6f3085da9734f6aa3bd3ee020abbc289fc
Reviewed-on: https://chromium-review.googlesource.com/1186330Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55338}

This adds a feature counter for WASM shared memory (i.e. the presence
of the "shared" bit in a WASM module's memory section) and the usage
of WASM threads opcodes (i.e. wake/wait and atomics).

This CL also plumbs the WasmFeatures through the compilation pipeline
to detect features as functions are being compiled.

R=ahaas@chromium.org, ulan@chromium.org
BUG=chromium:868844

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I854f932d3adb16e4fd87196fe2a193950295b856
Reviewed-on: https://chromium-review.googlesource.com/1186329Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55337}

This CL fixes wrong parentheses that caused the sort-length benchmark
to generate "random" arrays that only contained zeroes.

R=ishell@chromium.org

Change-Id: Ie2a564da037425a4ef9c2417597cdc13b497e32b
Reviewed-on: https://chromium-review.googlesource.com/1186332Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Simon Zünd <szuend@google.com>
Cr-Commit-Position: refs/heads/master@{#55336}

Changing reported_errors_ from a ZoneList to a ZoneVector caused
regressions in Octane/CodeLoad and some other parsing benchmarks. This
could be because we don't give the vector an initial size.

Change-Id: I42c6ae063681dc3490dbab260085e801e24ac569
Reviewed-on: https://chromium-review.googlesource.com/1186328Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55335}

This patch inlines some functions that improve parse time on code-load
an jquery.

Bug: v8:7926
Change-Id: Ida98b5d63fae9205282c23037aebb4ab2d38a7e2
Reviewed-on: https://chromium-review.googlesource.com/1184917Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Florian Sattler <sattlerf@google.com>
Cr-Commit-Position: refs/heads/master@{#55334}

This reverts commit bf1e47e6.

Reason for revert: chromium:876631

Original change's description:
> [ptr-compr] Switch Smis to 31-bit on 64-bit platforms.
> 
> This is prerequisite for V8 heap pointer compression.
> 
> Bug: v8:7703
> Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
> Change-Id: I2cdf02bd4cd535beb78a5db5b7cbdf67433a6d16
> Reviewed-on: https://chromium-review.googlesource.com/1181136
> Commit-Queue: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#55269}

TBR=ulan@chromium.org,ishell@chromium.org,verwaest@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:7703
Change-Id: I6d8662a6ff0b352e4975d31330d63a705ed55cd5
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/1186341Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55333}

A first baby-step towards embedded builtins on ia32. This adds the
initial implementation for indirect load functionality (they still
depend on embedded external references to get the roots pointer).

External reference operands still directly embed external references.
We can change these sites to be root-relative once the root register
exists.

Drive-by: replace raw jmp(HeapObject), call(HeapObject),
mov(HeapObject) uses by their macro-assembler counterparts and add
sanity-checks to ensure we're not calling them by accident when
generating isolate-independent code.

Bug: v8:6666
Change-Id: Ide11273721bcdaaee06934eedeca9f39346d1d50
Reviewed-on: https://chromium-review.googlesource.com/1170687
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55332}

Removed redundant parameters and Converted stack of bools to bitfield

Bug: v8:8015
Change-Id: Ieaf144994b6d5c40bdb264ae57c0d7520d4a9148
Reviewed-on: https://chromium-review.googlesource.com/1185196Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Florian Sattler <sattlerf@google.com>
Cr-Commit-Position: refs/heads/master@{#55331}

NOTRY=true
TBR=mslekova@chromium.org,sigurds@chromium.org

Bug: v8:7783
Change-Id: I87be7e03b11365eb958fcdb3f031195ada3e57d8
Reviewed-on: https://chromium-review.googlesource.com/1186324Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55330}

This reverts commit 7f3f7e8a.

Reason for revert: performance

Original change's description:
> [heap] Use std::atomic for page flags.
> 
> Bug: chromium:852420,chromium:852420
> Change-Id: I873666df415c6b4919f8b3385494c9a08f105188
> Reviewed-on: https://chromium-review.googlesource.com/1170700
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Commit-Queue: Hannes Payer <hpayer@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#55055}

TBR=ulan@chromium.org,hpayer@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: chromium:852420
Change-Id: I89fcd085395fa372ae9fb254e55954ff3b7ca4d7
Reviewed-on: https://chromium-review.googlesource.com/1184982Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55329}

And other related cleanups (additional asserts, use named register
constants instead of the raw register name where appropriate).

Drive-by: Unset kOffHeapTrampolineRegister (it's unused on ia32).

Bug: v8:6666
Change-Id: Id2b94e0b9dbfa5d3bbacc80ec7424d38c4145658
Reviewed-on: https://chromium-review.googlesource.com/1185011
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55328}

Bug: v8:8015
Change-Id: I2ee074559484b9865dc1a27e6ea697ca311ee7ee
Reviewed-on: https://chromium-review.googlesource.com/1185198Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Florian Sattler <sattlerf@google.com>
Cr-Commit-Position: refs/heads/master@{#55327}

Change-Id: I461810a3f531de8d094a56f75d8d8bdcb2ccd418
Reviewed-on: https://chromium-review.googlesource.com/1185194Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55326}

The CL was reverted because it broke some tests in ChromeOS.

> [array] Move Array.p.sort to Torque and use TimSort instead of QuickSort
>
> This CL changes the sorting algorithm used in Array.p.sort from
> QuickSort to TimSort (implemented in Torque).
>
> Detailed performance results can be found here: https://goo.gl/4E733J
>
> To save on code space, fast-paths are implemented as sets of
> function pointers instead of specializing generics.
>
> R=cbruni@chromium.org, jgruber@chromium.org
>
> Bug: v8:7382, v8:7624
> Change-Id: I7cd4287e4562d84ab7c79c58ae30780630f976de
> Reviewed-on: https://chromium-review.googlesource.com/1151199
> Commit-Queue: Simon Zünd <szuend@google.com>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Camillo Bruni <cbruni@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#55003}

Bug: v8:7382, v8:7624
Change-Id: Ic7a3230f3708177774b0760f08b7659d83ec5505
Reviewed-on: https://chromium-review.googlesource.com/1184901
Commit-Queue: Simon Zünd <szuend@google.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55325}

R=jarin@chromium.org

Bug: v8:7790
Change-Id: Id057b31fca7db4c63ae3dd6bb111f8a7e5a1f78b
Reviewed-on: https://chromium-review.googlesource.com/1184925
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55324}

This reverts commit 41b3955f.

Bug: v8:7961
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: I1755c5d53f8ea26982b6b9f8e18ede86c1d27aa7
Reviewed-on: https://chromium-review.googlesource.com/1183951Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55323}

Bug: v8:8030, v8:8031
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: Iaac58cc3a692ea9d7c986b24414403b57d00b904
Reviewed-on: https://chromium-review.googlesource.com/1180084Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55322}

This adds the missing support for HOLEY_DOUBLE_ELEMENTS to both
`Array#find()` and `Array#findIndex()`. The implementation just deopts
whenever it hits a double hole. In order to prevent deoptimization
loops we add feedback to the CheckFloat64Hole operator, which also
addresses the TODO in the `%ArrayIteratorPrototype%.next()` lowering.

This provides a speed-up of up to 8x in microbenchmarks when using
`Array#find()` or `Array#findIndex()` on HOLEY_DOUBLE_ELEMENTS arrays.

Bug: chromium:791045, v8:1956, v8:6587, v8:7165, v8:8015
Change-Id: I1be22d3fcba56c676a81dc31a9042f8123ef3a55
Reviewed-on: https://chromium-review.googlesource.com/1183906Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55321}