Reland "[weakrefs] Ship WeakRef and FinalizationRegistry."

This is a reland of 30c6bd45

Original change's description:
> [weakrefs] Ship WeakRef and FinalizationRegistry.
> 
> I2S: https://groups.google.com/a/chromium.org/g/blink-dev/c/L04PqDk9eMU
> Bug: v8:8179
> Change-Id: I52aaa62cdab981b802fa4a986d60421ef6efcfbb
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2158371
> Commit-Queue: Shu-yu Guo <syg@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#67295}

Bug: v8:8179
Change-Id: If132d88b5a8dbe06ba7a8f80f19f33d9553ca62f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2160017Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67324}

src/flags/flag-definitions.h

@@ -217,7 +217,6 @@ DEFINE_IMPLICATION(harmony_weak_refs_with_cleanup_some, harmony_weak_refs)
   V(harmony_promise_any, "harmony Promise.any")                                \
   V(harmony_string_replaceall, "harmony String.prototype.replaceAll")          \
   V(harmony_regexp_sequence, "RegExp Unicode sequence properties")             \
-  V(harmony_weak_refs, "harmony weak references")                              \
   V(harmony_weak_refs_with_cleanup_some,                                       \
     "harmony weak references with FinalizationRegistry.prototype.cleanupSome") \
   V(harmony_regexp_match_indices, "harmony regexp match indices")              \
@@ -247,14 +246,15 @@ DEFINE_IMPLICATION(harmony_weak_refs_with_cleanup_some, harmony_weak_refs)
 #endif
 
 // Features that are shipping (turned on by default, but internal flag remains).
-#define HARMONY_SHIPPING_BASE(V)                                   \
-  V(harmony_namespace_exports,                                     \
-    "harmony namespace exports (export * as foo from 'bar')")      \
-  V(harmony_sharedarraybuffer, "harmony sharedarraybuffer")        \
-  V(harmony_import_meta, "harmony import.meta property")           \
-  V(harmony_dynamic_import, "harmony dynamic import")              \
-  V(harmony_promise_all_settled, "harmony Promise.allSettled")     \
-  V(harmony_private_methods, "harmony private methods in class literals")
+#define HARMONY_SHIPPING_BASE(V)                                          \
+  V(harmony_namespace_exports,                                            \
+    "harmony namespace exports (export * as foo from 'bar')")             \
+  V(harmony_sharedarraybuffer, "harmony sharedarraybuffer")               \
+  V(harmony_import_meta, "harmony import.meta property")                  \
+  V(harmony_dynamic_import, "harmony dynamic import")                     \
+  V(harmony_promise_all_settled, "harmony Promise.allSettled")            \
+  V(harmony_private_methods, "harmony private methods in class literals") \
+  V(harmony_weak_refs, "harmony weak references")
 
 #ifdef V8_INTL_SUPPORT
 #define HARMONY_SHIPPING(V)                               \

src/init/bootstrapper.cc

@@ -3944,9 +3944,12 @@ Handle<JSFunction> Genesis::InstallTypedArray(const char* name,
 void Genesis::InitializeExperimentalGlobal() {
 #define FEATURE_INITIALIZE_GLOBAL(id, descr) InitializeGlobal_##id();
 
-  HARMONY_INPROGRESS(FEATURE_INITIALIZE_GLOBAL)
-  HARMONY_STAGED(FEATURE_INITIALIZE_GLOBAL)
+  // Initialize features from more mature to less mature, because less mature
+  // features may depend on more mature features having been initialized
+  // already.
   HARMONY_SHIPPING(FEATURE_INITIALIZE_GLOBAL)
+  HARMONY_STAGED(FEATURE_INITIALIZE_GLOBAL)
+  HARMONY_INPROGRESS(FEATURE_INITIALIZE_GLOBAL)
 #undef FEATURE_INITIALIZE_GLOBAL
 }
 

test/mjsunit/compiler/abstract-equal-symbol.js

@@ -47,6 +47,9 @@
   assertFalse(foo(a));
   %OptimizeFunctionOnNextCall(foo);
   assertTrue(foo(b));
+  // Re-prepare the function immediately to make sure type feedback isn't
+  // cleared by untimely gc, as re-optimization on new feedback is tested below
+  %PrepareFunctionForOptimization(foo);
   assertFalse(foo(a));
   assertOptimized(foo);
 
@@ -55,7 +58,6 @@
   assertUnoptimized(foo);
 
   // Make sure TurboFan learns the new feedback
-  %PrepareFunctionForOptimization(foo);
   %OptimizeFunctionOnNextCall(foo);
   assertFalse(foo("a"));
   assertOptimized(foo);

test/mjsunit/compiler/bigint-add-no-deopt-loop.js

@@ -18,12 +18,14 @@ testAdd(3n, 7n);
 testAdd(17n, -54n);
 %OptimizeFunctionOnNextCall(testAdd);
 assertEquals(testAdd(6n, 2n), 8n);
+// Re-prepare the function immediately to make sure type feedback isn't cleared
+// by an untimely gc, as re-optimization on new feedback is tested below
+%PrepareFunctionForOptimization(testAdd);
 assertOptimized(testAdd);
 
 assertThrows(() => testAdd(big, big), RangeError);
 assertUnoptimized(testAdd);
 
-%PrepareFunctionForOptimization(testAdd);
 testAdd(30n, -50n);
 testAdd(23n, 5n);
 %OptimizeFunctionOnNextCall(testAdd);