Port 63ea3a50

Original commit message:

    Previously, we used the lowest bit for something else.

R=mvstanton@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2021133002
Cr-Commit-Position: refs/heads/master@{#36601}

Port 56d90782

Original commit message:

    In Crankshaft, we would install special ICs that didn't need a vector and slot
    in the MEGAMORPHIC case. This optimization limits our hand against future
    improvements.

R=mvstanton@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2023983002
Cr-Commit-Position: refs/heads/master@{#36600}

Previously, we used the lowest bit for something else.

R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2019393002
Cr-Commit-Position: refs/heads/master@{#36599}

R=littledan@chromium.org

Review-Url: https://codereview.chromium.org/2021053002
Cr-Commit-Position: refs/heads/master@{#36598}

In Crankshaft, we would install special ICs that didn't need a vector and slot
in the MEGAMORPHIC case. This optimization limits our hand against future
improvements.

BUG=

Review-Url: https://codereview.chromium.org/2019313003
Cr-Commit-Position: refs/heads/master@{#36597}

  - Move the samplers related part out of SignalHandler class (remove friendship).
  - Make the SamplerManager class a singleton.
  - Minor tweaks.

BUG=v8:4789

Review-Url: https://codereview.chromium.org/2018773002
Cr-Commit-Position: refs/heads/master@{#36596}

Expose more or less the full functionality of the KeyAccumulator in the API:
- use the PropertyFilter introduced for GetOwnPropertyNames
- use KeyCollectionLimit for OWN_ONLY or INLCUDE_PROTOS
- use IndexFilter to eithe SKIP_INDICES or INCLUDE_INDICES

Rewire Object::GetOwnPropertyNames to use GetPropertyNames.

BUG=chromium:148757

Review-Url: https://codereview.chromium.org/2002203002
Cr-Commit-Position: refs/heads/master@{#36595}

Users of this api should use a combination of |RequestInterrupt| and
|GCCallback| (see |AddGCPrologueCallback| and friends) to keep track allocated
memory.

BUG=v8:4813
LOG=Y
R=jochen@chromium.org

Review-Url: https://codereview.chromium.org/1991293002
Cr-Commit-Position: refs/heads/master@{#36594}

Revert of Reland "[heap] Fine-grained JSArrayBuffer tracking" (patchset #3 id:60001 of https://codereview.chromium.org/2026463002/ )

Reason for revert:
Investigating new arm simulator failure:
  https://build.chromium.org/p/client.v8.ports/builders/V8%20Linux%20-%20arm%20-%20sim/builds/851/steps/Check%20-%20novfp3/logs/box2d

Original issue's description:
> Reland "[heap] Fine-grained JSArrayBuffer tracking"
>
> Track based on JSArrayBuffer addresses on pages instead of the attached
> backing store.
>
> Details of tracking:
> - Scavenge: New space pages are processes in bulk on the main thread
> - MC: Unswept pages are processed in bulk in parallel. All other pages
>   are processed by the sweeper concurrently.
>
> BUG=chromium:614730, chromium:611688
> LOG=N
> CQ_EXTRA_TRYBOTS=tryserver.v8:v8_linux_arm64_gc_stress_dbg,v8_linux_gc_stress_dbg,v8_mac_gc_stress_dbg,v8_linux64_tsan_rel,v8_mac64_asan_rel
>
> Committed: https://crrev.com/bc0fb6e83eb7351f52bfd6f780bb6c12bd87c58c
> Cr-Commit-Position: refs/heads/master@{#36592}

TBR=hpayer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:614730, chromium:611688

Review-Url: https://codereview.chromium.org/2021893002
Cr-Commit-Position: refs/heads/master@{#36593}

Track based on JSArrayBuffer addresses on pages instead of the attached
backing store.

Details of tracking:
- Scavenge: New space pages are processes in bulk on the main thread
- MC: Unswept pages are processed in bulk in parallel. All other pages
  are processed by the sweeper concurrently.

BUG=chromium:614730, chromium:611688
LOG=N
CQ_EXTRA_TRYBOTS=tryserver.v8:v8_linux_arm64_gc_stress_dbg,v8_linux_gc_stress_dbg,v8_mac_gc_stress_dbg,v8_linux64_tsan_rel,v8_mac64_asan_rel

Review-Url: https://codereview.chromium.org/2026463002
Cr-Commit-Position: refs/heads/master@{#36592}

it's referenced from isolate.gypi which in turn is used in
non-standalone builds as well.

BUG=chromium:609107
R=machenbach@chromium.org

Review-Url: https://codereview.chromium.org/2023783003
Cr-Commit-Position: refs/heads/master@{#36591}

Fix failure in RunWasmInterpreted_LoadMemI32_const_oob_misaligned on architecures that don't support unaligned access

BUG=cctest/test-run-wasm/RunWasmInterpreted_LoadMemI32_const_oob_misaligned

Review-Url: https://codereview.chromium.org/2026553002
Cr-Commit-Position: refs/heads/master@{#36590}

Jaideep has been regularly contributing PPC and S390 changes recently.
Adding him as owner/reviewer to PPC / S390 specific directories.

R=joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com
BUG=

Review-Url: https://codereview.chromium.org/2024533003
Cr-Commit-Position: refs/heads/master@{#36589}

R=rossberg@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2026543002
Cr-Commit-Position: refs/heads/master@{#36588}

BUG=chromium:615489

Review-Url: https://codereview.chromium.org/2020743002
Cr-Commit-Position: refs/heads/master@{#36587}

BUG=chromium:474921
NOTRY=true

Committed: https://crrev.com/52a6fced896e3f64ac56eb57bcdea78393642e0c
Cr-Commit-Position: refs/heads/master@{#36517}

Review-Url: https://codereview.chromium.org/2007143003
Cr-Commit-Position: refs/heads/master@{#36586}

Utilize the previously introduced construct call counts in the
JSInliningHeuristic to also handle constructor calls properly.

R=mvstanton@chromium.org

Review-Url: https://codereview.chromium.org/2026513003
Cr-Commit-Position: refs/heads/master@{#36585}

The NumberIsHoleNaN operator used to test the lower word of the double
input which is obviously wrong.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2022753002
Cr-Commit-Position: refs/heads/master@{#36584}

BUG=v8:4907

Review-Url: https://codereview.chromium.org/2026503002
Cr-Commit-Position: refs/heads/master@{#36583}

BUG=chromium:474921
NOTRY=true

Committed: https://crrev.com/67e549ec5b34ad02506abb2720c6a0851ae31f5e
Cr-Commit-Position: refs/heads/master@{#36510}

Review-Url: https://codereview.chromium.org/2011853002
Cr-Commit-Position: refs/heads/master@{#36582}

BUG=
NOTRY=true

Review-Url: https://codereview.chromium.org/2020983002
Cr-Commit-Position: refs/heads/master@{#36581}

R=ulan@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2021823002
Cr-Commit-Position: refs/heads/master@{#36580}

BUG=chromium:615770
LOG=N

Review-Url: https://codereview.chromium.org/2022743002
Cr-Commit-Position: refs/heads/master@{#36579}

Before, it was possible to construct invalid CallSite objects, which
would trigger a runtime assert when any function is called on it.
This check ensures to throw a TypeError when invalid information is
passed to the CallSite constructor.

This reverts part of this CL: https://codereview.chromium.org/2006603002

R=ishell@chromium.org, titzer@chromium.org, yangguo@chromium.org
BUG=chromium:614295

Review-Url: https://codereview.chromium.org/2010493002
Cr-Commit-Position: refs/heads/master@{#36578}

R=binji@chromium.org,ahaas@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2014373003
Cr-Commit-Position: refs/heads/master@{#36577}

The in-operator has recently been optimized making our smart macros obsolete.
This should give up to 10% speedup on forEach and friends.

BUG=v8:5041

Review-Url: https://codereview.chromium.org/2013873002
Cr-Commit-Position: refs/heads/master@{#36576}

BUG=

Review URL: https://codereview.chromium.org/2024623002 .

Cr-Commit-Position: refs/heads/master@{#36575}

An additional slide offset is exported into `shared-library`, which is used to
symbolize C++ stack on systems with ASLR (OS X).

This patch adds slide offset support in dumpcpp script.

BUG=v8:5048

Review-Url: https://codereview.chromium.org/2006813002
Cr-Commit-Position: refs/heads/master@{#36574}

This fixes data-flow tracking of sub-word (i.e. int8 or int16) element
accesses withing the escape analysis. In essense this makes sure that
we only ever consider the offset for loads and stores on tracked objects
and avoid mangling the offset on untracked ones.

R=jarin@chromium.org
TEST=cctest/test-api/Fixed[U]Int[8,16]Array

Review-Url: https://codereview.chromium.org/2008883002
Cr-Commit-Position: refs/heads/master@{#36573}

Revert of [builtins] Also migrate String.prototype.toLowerCase/toUpperCase to C++. (patchset #2 id:20001 of https://codereview.chromium.org/2018983002/ )

Reason for revert:
Please rebase blink first (if intended):
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/7092

Original issue's description:
> [builtins] Also migrate String.prototype.toLowerCase/toUpperCase to C++.
>
> These builtins always call into C++ anyways and so there's no point in
> having the JavaScript wrapper around them, but instead they can be
> implemented as C++ builtins directly.
>
> R=franzih@chromium.org
> BUG=v8:5049
>
> Committed: https://crrev.com/4e66888869bf04c73b41e5747e4595747a7b20df
> Cr-Commit-Position: refs/heads/master@{#36569}

TBR=franzih@chromium.org,bmeurer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5049

Review-Url: https://codereview.chromium.org/2023753002
Cr-Commit-Position: refs/heads/master@{#36572}

BUG=v8:5053
TBR=bmeurer@chromium.org
NOTRY=true

Review-Url: https://codereview.chromium.org/2024583002
Cr-Commit-Position: refs/heads/master@{#36571}

  port 91c88644 (r36539)

  original commit message:
  We get less "pollution" of type feedback if we have one vector per native
  context, rather than one for the whole system. This CL moves the vector
  appropriately.

BUG=

Review-Url: https://codereview.chromium.org/2019263002
Cr-Commit-Position: refs/heads/master@{#36570}

These builtins always call into C++ anyways and so there's no point in
having the JavaScript wrapper around them, but instead they can be
implemented as C++ builtins directly.

R=franzih@chromium.org
BUG=v8:5049

Review-Url: https://codereview.chromium.org/2018983002
Cr-Commit-Position: refs/heads/master@{#36569}

Rolling v8/build to 0671aae0bf5e388dc2a7d2610cbeab6b31ef7bb4

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2019253002
Cr-Commit-Position: refs/heads/master@{#36568}

Rolling v8/build to dd69258f1644517e9577f64ab72586fe097d681c

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2025533002
Cr-Commit-Position: refs/heads/master@{#36567}

Rolling v8/build to 10d3723f73a8bfb0bcbee33f368d92dea8ad1bd7

Rolling v8/tools/clang to ef8e028ea0f0fdf3be7be6e817e5c26c8ba7aebe

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2021623002
Cr-Commit-Position: refs/heads/master@{#36566}

One of the top runtime calls in many workloads is Runtime_Call. Add an
intrinsic for the interpreter to inline this runtime call.

BUG=v8:4280
LOG=N

Review-Url: https://codereview.chromium.org/2019433003
Cr-Commit-Position: refs/heads/master@{#36565}

Port 91c88644

Original commit message:

    We get less "pollution" of type feedback if we have one vector per native
    context, rather than one for the whole system. This CL moves the vector
    appropriately.

R=mvstanton@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com
BUG=

Review-Url: https://codereview.chromium.org/2011183005
Cr-Commit-Position: refs/heads/master@{#36564}

The busted logic caused us to go down the SCRIPT path internally,
causing us to fail the test262 tests that attempt to induce parse
errors at the top level.

R=littledan@chromium.org
BUG=v8:4985

Review-Url: https://codereview.chromium.org/2008743002
Cr-Commit-Position: refs/heads/master@{#36563}

We now have data that 0.011% of websites use the pattern
  for (var i = 0 in j) { ... }
This pattern was banned by ES2015, with the idea to revisit if
it presents a web compatibility problem. Informally, after
the May 2016 TC39 meeting, the new data was discussed, and there
was interest in reversing the decision. Although the specification
is not yet updated, it seems likely to come soon.

This patch turns off the flag which bans that construct, reenabling
it. The change should prevent websites from breaking.

BUG=v8:4942

Review-Url: https://codereview.chromium.org/2011223003
Cr-Commit-Position: refs/heads/master@{#36562}