Bug: chromium:1196683
Change-Id: Ib4ea738b47b64edc81450583be4c80a41698c3d1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2820971
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73903}

Several spots in arm codegen require 24-bit integers; since getting
this wrong is usually a security problem, let's change these DCHECKs
into CHECKs.

Bug: chromium:1197363
Change-Id: I277dc8fe4771adae89375adbe19a33d2c9f6783c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2820972
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73902}

Bug: chromium:1193459
Change-Id: I6d9dace9341e96f2586a469d7e16bfa38bf68029
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2810845Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73901}

The de-duplication happens when
1) we have a JSFunction for an outer function and a JSFunction for its
inner function in the snapshot and
2) we call the outer function again after deserializing

Expectation: the created JSFunction for the inner function uses the
SFI which was created when deserializing.

Bug: v8:11525
Change-Id: I80933514873e857452585317248fa34913d8d8e7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2794438Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73900}

This is a reland of 2b94e567

Original change's description:
> [inspector] Report [[Prototype]] as internal property.
>
> Previously the inspector was trying to add a special `__proto__`
> property to every JSObject, which looked and behaved like a real
> data property on the object. But this is confusing to developers
> since `__proto__` is not a real data property, but usually an
> accessor property on the `Object.prototype`.
>
> Additionally all other internal properties are reported using the
> [[Name]] notation, with the [[Prototype]] having been the strange
> outlier.
>
> Drive-by-cleanup: Use an ArrayList to collect the name/value pairs
> inside Runtime::GetInternalProperties(), which makes this function
> more readable and easier to add things.
>
> Bug: chromuium:1162229
> Fixed: chromium:1197019
> Screenshot: https://imgur.com/a/b7TZ32s.png
> Change-Id: Ic4c1e35e2e65f90619fcc12bf3a72806cadb0794
> Doc: http://doc/1Xetnc9s6r0yy4LnPbqeCwsnsOtBlvJsV4OCdXMZ1wCM
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2814565
> Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#73881}

Bug: chromuium:1162229, chromium:1197019
Screenshot: https://imgur.com/a/b7TZ32s.png
Doc: http://doc/1Xetnc9s6r0yy4LnPbqeCwsnsOtBlvJsV4OCdXMZ1wCM
Change-Id: Ie1e2276b385b18a5f865fdae583d1ce0101157c0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2820970
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73899}

Defence in depth patch to prevent JavaScript from executing
from within IterateElements.

R=ishell@chromium.org
R=cbruni@chromium.org

Bug: chromium:1195977
Change-Id: Ie59d468b73b94818cea986a3ded0804f6dddd10b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2819941Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73898}

Change-Id: Ia88e43711d54e1aa651757f6a2bac7005b4274aa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2814129Reviewed-by: Brice Dobry <brice.dobry@futurewei.com>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73897}

Fuzz tests could mess with some library methods used by stubs for
NaN-pattern problems in typed arrays. This change makes the stubs
more robust.

Bug: chromium:1197627
Change-Id: I84975f798d616fd5e82fd9ab84ad01fc35336a04
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2820968
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73896}

This CL enables the fast-api-calls mjsunit test again on gc_stress
with a fix for --stress-flush-bytecode.

Change-Id: I3a65f8cb4ec319945319d533ed92241b14f624c7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2817604
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73895}

Port pc-relative builtin-to-builtin calls.

Port: ccc068d5
Change-Id: I1d11dd1e77ca578f7714864e4e090493fa8bca0a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2814722
Commit-Queue: Yahan Lu <yahan@iscas.ac.cn>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Brice Dobry <brice.dobry@futurewei.com>
Cr-Commit-Position: refs/heads/master@{#73894}

Changes:
- Rename Uint32ToUintptr() -> BuildChangeUint32ToUintPtr() for
  consistency.
- Simplify smi conversions.
- Remove an unneeded TruncateInt64ToInt32() conversion.

Change-Id: I6f3213fc57e03019d2cb26592ecd4db396bd01d5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2817600Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73893}

https://chromestatus.com/feature/6520669959356416

I2S: https://groups.google.com/a/chromium.org/g/blink-dev/c/7zqShg05D3c/m/-cNsk73FAQAJ
I2P: https://groups.google.com/a/chromium.org/g/blink-dev/c/wn5zah2EYXg/m/Ca401_sqBgAJ

LGTM by API Owners: yoavweiss@chromium.org, rego@igalia.com, bratell.d@gmail.com

Explainer
https://docs.google.com/document/d/10l10gpw5hBdZ1OuYVqZPU72-61yyOaTUQllIVRyQoFM/edit#

Specification
https://tc39.es/ecma402/#table-datetimeformat-components

Link to entry on the Chrome Platform Status
https://chromestatus.com/feature/6520669959356416

Bug: v8:9283
Change-Id: Ie6fd03cf8230acc4d287e8bd8a84995cbf035080
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2816305Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73892}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/8e70b68..563f147

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/6e92ef6..006bc90

TBR=v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I3b0bf312abacc6b6867db2c288973082964f7a8d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2819593Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#73891}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/2ae82a1..8e70b68

Rolling v8/tools/luci-go: git_revision:b1ba7603f4b71ab63a1df050e03137463309f348..git_revision:f784260b204b2d93c7bd6d1a619f09c6822e5926

Rolling v8/tools/luci-go: git_revision:b1ba7603f4b71ab63a1df050e03137463309f348..git_revision:f784260b204b2d93c7bd6d1a619f09c6822e5926

Rolling v8/tools/luci-go: git_revision:b1ba7603f4b71ab63a1df050e03137463309f348..git_revision:f784260b204b2d93c7bd6d1a619f09c6822e5926

TBR=v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I26d2f2a8ed568dc38dafbf0ee69aad286d8b69f8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2819589Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#73890}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/0006b44..2ae82a1

Rolling v8/third_party/aemu-linux-x64: SCU6888HuyC5TF12MrqnyC2eTRFiqzg1KUCITYThpxIC.._EJXYI9PIL6jmQi9nGYfsMiQZf2CFqi_hE7uUCqpScAC

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/868d5d0..ab687ea

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/1cabb17..057831e

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/3b0c35b..6e92ef6

Rolling v8/tools/luci-go: git_revision:0f11e003d56071a19f4403570ebfdb8f197c2f87..git_revision:b1ba7603f4b71ab63a1df050e03137463309f348

Rolling v8/tools/luci-go: git_revision:0f11e003d56071a19f4403570ebfdb8f197c2f87..git_revision:b1ba7603f4b71ab63a1df050e03137463309f348

Rolling v8/tools/luci-go: git_revision:0f11e003d56071a19f4403570ebfdb8f197c2f87..git_revision:b1ba7603f4b71ab63a1df050e03137463309f348

TBR=v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I7fc14996e10ac3d1e725af863ae6df9483bf6aa5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2819207Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#73889}

This command is broken, no testing and no clear demand for it.

Change-Id: Ic86ab346ab29a5d6804f74a3d4458bb3332a7718
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2814131Reviewed-by: Seth Brenith <seth.brenith@microsoft.com>
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#73888}

This removes the heap sandbox's dependency on being able to reconstruct
an Isolate from the pointer cage base address.

Bug: v8:11460
Change-Id: I501ace5b83a2cefdf717de0d7387fd816edfb3f1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2783673
Auto-Submit: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73887}

This reverts commit 2b94e567.

Reason for revert: Speculative based on layout test failures on
win and mac which could block the roll:
https://ci.chromium.org/p/v8/builders/ci/V8%20Blink%20Win/5294
https://ci.chromium.org/p/v8/builders/ci/V8%20Blink%20Mac/4955

Original change's description:
> [inspector] Report [[Prototype]] as internal property.
>
> Previously the inspector was trying to add a special `__proto__`
> property to every JSObject, which looked and behaved like a real
> data property on the object. But this is confusing to developers
> since `__proto__` is not a real data property, but usually an
> accessor property on the `Object.prototype`.
>
> Additionally all other internal properties are reported using the
> [[Name]] notation, with the [[Prototype]] having been the strange
> outlier.
>
> Drive-by-cleanup: Use an ArrayList to collect the name/value pairs
> inside Runtime::GetInternalProperties(), which makes this function
> more readable and easier to add things.
>
> Bug: chromuium:1162229
> Fixed: chromium:1197019
> Screenshot: https://imgur.com/a/b7TZ32s.png
> Change-Id: Ic4c1e35e2e65f90619fcc12bf3a72806cadb0794
> Doc: http://doc/1Xetnc9s6r0yy4LnPbqeCwsnsOtBlvJsV4OCdXMZ1wCM
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2814565
> Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#73881}

Bug: chromuium:1162229
Change-Id: Ia893ad672eb370fa6fce7eddf2947bf8f6755831
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2818386
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#73886}

This reverts commit b49638c5.

Reason for revert: Buggy for avx2 and --no-enabled-sse4-2 (but avx is available on bots), see review comments for details.

Original change's description:
> [x64][ia32] Set lower SSE flags when newer extensions are enabled
>
> If SSE4.2 is enabled, all the previous extensions should also be
> enabled. In particular, you cannot have --enable-sse4_1 and
> --no-enable-sse3.
>
> Bug: chromium:1195579
> Change-Id: Id3e10db24cee2aee14449a77c9e7cff82e97edff
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2808621
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Commit-Queue: Zhi An Ng <zhin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#73840}

Tbr: ahaas@chromium.org,clemensb@chromium.org
Bug: chromium:1195579
Change-Id: Iabce159a82e8b71cbec8336091323f35e9aff16e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2818562Reviewed-by: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#73885}

This reverts commit dcdaf42f.

Reason for revert: This has problems on mac-arm64:
https://ci.chromium.org/p/v8/builders/ci/V8%20Mac%20-%20arm64%20-%20release/3591

Original change's description:
> [wasm] Add CPU time metrics
>
> This adds CPU time metrics to the WasmModuleDecoded (except for streaming),
> WasmModuleCompiled and WasmModuleTieredUp events. This can later be used
> to provide this information as UKMs or UMAs.
>
> Bug: v8:11611
> Change-Id: I36818f5efbdcae2d3ed6f27c16db21f9d8440d98
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2796952
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Commit-Queue: Emanuel Ziegler <ecmziegler@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#73882}

Bug: v8:11611
Change-Id: I1c82c3e4f19b3a486538fd62665669f6c5b98438
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2818380
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#73884}

Change-Id: I03462b0632da3846b53047588597eb16a098b057
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2815561Reviewed-by: Milad Fa <mfarazma@redhat.com>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/master@{#73883}

This adds CPU time metrics to the WasmModuleDecoded (except for streaming),
WasmModuleCompiled and WasmModuleTieredUp events. This can later be used
to provide this information as UKMs or UMAs.

Bug: v8:11611
Change-Id: I36818f5efbdcae2d3ed6f27c16db21f9d8440d98
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2796952Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Emanuel Ziegler <ecmziegler@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73882}

Previously the inspector was trying to add a special `__proto__`
property to every JSObject, which looked and behaved like a real
data property on the object. But this is confusing to developers
since `__proto__` is not a real data property, but usually an
accessor property on the `Object.prototype`.

Additionally all other internal properties are reported using the
[[Name]] notation, with the [[Prototype]] having been the strange
outlier.

Drive-by-cleanup: Use an ArrayList to collect the name/value pairs
inside Runtime::GetInternalProperties(), which makes this function
more readable and easier to add things.

Bug: chromuium:1162229
Fixed: chromium:1197019
Screenshot: https://imgur.com/a/b7TZ32s.png
Change-Id: Ic4c1e35e2e65f90619fcc12bf3a72806cadb0794
Doc: http://doc/1Xetnc9s6r0yy4LnPbqeCwsnsOtBlvJsV4OCdXMZ1wCM
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2814565
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73881}

This is a reland of 62ff82e4

Original change's description:
> cppgc: Add tests for in-construction during ctor
>
> Adds explicit tests that check that an object is marked as in
> construction while running the constructor.
>
> Bug: chromium:1056170
> Change-Id: I7f7340832e1bc31cec98784c261ed86deb402e72
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2811238
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Omer Katz <omerkatz@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#73869}

Bug: chromium:1056170
Change-Id: I38c8579dc2ed437f2ad530bd552b5ef037ba8621
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2817603
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Auto-Submit: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73880}

The primary reason for this change is that this fixes a race condition
when one scavenger thread moves a WasmTypeInfo object that another
scavenger thread needs to read for visiting a Wasm struct.
Aside from that, since these objects are long-lived, it also generally
makes sense to pretenure them.

Fixed: v8:11618
Change-Id: I61e81752306dd6f29e0d26a0c40120a6301b0c12
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2814561Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73879}

These tests unnecessarily rely on the `//# sourceURL` annotation. This
is preparatory work to eventually move the treatment of `sourceURL` to
the DevTools front-end.

Bug: chromium:1183990
Change-Id: I934eb1580f503b7b9f8d97c250b7c798bc67e268
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2814568
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73878}

This CL temporarily skips the fast-api-calls mjsunit test, as it
fails on GC stress bots for unrelated CLs (see
https://chromium-review.googlesource.com/c/v8/v8/+/2814740).

Change-Id: I884827a0a5fb030d676f9ded738f644cd4086ec6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2814564
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73877}

Use the newer method getBestMatchResult() and
makeResolvedLocale() to resolve the locale instead.

Bug: v8:11584
Change-Id: Ifbd7a9b0d05506d83c2603c301b4d9e4caf2d689
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2783662
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73876}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/77edba1..0006b44

Rolling v8/third_party/aemu-linux-x64: SeLS6a0f6IL-PCOUKbMTN5LYgjjJbDSnb3DGf5q9pwsC..SCU6888HuyC5TF12MrqnyC2eTRFiqzg1KUCITYThpxIC

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/41a5e5e..868d5d0

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/98a52e2..1cabb17

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/a387faa..3b0c35b

Rolling v8/tools/luci-go: git_revision:d6d24b11ecded4d89f3dfd1b2e5a0072a3d4ab15..git_revision:0f11e003d56071a19f4403570ebfdb8f197c2f87

Rolling v8/tools/luci-go: git_revision:d6d24b11ecded4d89f3dfd1b2e5a0072a3d4ab15..git_revision:0f11e003d56071a19f4403570ebfdb8f197c2f87

Rolling v8/tools/luci-go: git_revision:d6d24b11ecded4d89f3dfd1b2e5a0072a3d4ab15..git_revision:0f11e003d56071a19f4403570ebfdb8f197c2f87

TBR=v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I84f879faeaf0ab23dd1ae37976dbb8e822a85c34
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2816303Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#73875}

For consistency with the PtrComprCageBase struct and the upcoming
PtrComprCage.

Bug: v8:11460
Change-Id: I2e393331c36481ee911edeaf9fb3ff971cfdba83
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2787701
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73874}

Port: 3e689a7d

Bug: v8:11421

Change-Id: I733a68d8ce6d4cbc11a63e82ccb6bd951f5e5870
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2763963Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Brice Dobry <brice.dobry@futurewei.com>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Yahan Lu <yahan@iscas.ac.cn>
Cr-Commit-Position: refs/heads/master@{#73873}

Port: 064ca18c

Bug: v8:11420
Change-Id: I4a8051b10fa2c1eab316f8a8d7928a5e134b59e7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2814119
Auto-Submit: Liu yu <liuyu@loongson.cn>
Reviewed-by: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/master@{#73872}

Bug: v8:8179
Change-Id: I7f699073807d1874d0c10a4f1641de6bfb0efe6f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2741582
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73871}

This reverts commit 62ff82e4.

Reason for revert: compilation failure: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Win64%20-%20msvc/b8850484852067442832/overview

Original change's description:
> cppgc: Add tests for in-construction during ctor
>
> Adds explicit tests that check that an object is marked as in
> construction while running the constructor.
>
> Bug: chromium:1056170
> Change-Id: I7f7340832e1bc31cec98784c261ed86deb402e72
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2811238
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Omer Katz <omerkatz@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#73869}

Bug: chromium:1056170
Change-Id: If9e75ab6da3762553e8e34e851cbf1120cd49925
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2816100
Auto-Submit: Francis McCabe <fgm@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#73870}

Adds explicit tests that check that an object is marked as in
construction while running the constructor.

Bug: chromium:1056170
Change-Id: I7f7340832e1bc31cec98784c261ed86deb402e72
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2811238
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73869}

Implantation now includes using a combination of
multiplly even and odd flowed by a vector merge low or high.

vector merge instructions are also added to the simulator.

Change-Id: I144c5d07e5e6bd978788a70aacabd61463f93289
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2815562
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Reviewed-by: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/master@{#73868}

input needs to be casted into the result type before
doing the multiplication.

Change-Id: I797e8d3586678508f35c51d7890ad0d31fc7f1ea
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2815559Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#73867}

TBR=hablich@chromium.org, vahl@chromium.org

Change-Id: I6c77e5de7a7c0222f01ee237f125a97538dd8cc6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2814558Reviewed-by: Lutz Vahl <vahl@chromium.org>
Commit-Queue: Lutz Vahl <vahl@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73866}

This is a reland of f41bc94b

The remaining test failures where fixed.

Original change's description:
> Reland "[test] Extend testing on Mac on arm64"
>
> This is a reland of f187d0a1
>
> The cctest breakage got fixed in the meantime.
>
> Original change's description:
> > [test] Extend testing on Mac on arm64
> >
> > Ensure more testing of --future for different test types on Mac.
> >
> > No-Try: true
> > Bug: v8:11527
> > Change-Id: Iac499dc48dde3342ad2057f86ef1ad5fa43b4eac
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2772981
> > Reviewed-by: Igor Sheludko <ishell@chromium.org>
> > Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#73514}
>
> No-Try: true
> Bug: v8:11527
> Change-Id: Ie82c69e652f84a7ac43436d28806e70f27aa3e72
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2807601
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#73806}

No-Try: true
Bug: v8:11527
Change-Id: I6ca48bb0917d9bf2950302127d108d844bd6eebc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2814559
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Liviu Rau <liviurau@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73865}

Port 05265d88

Original Commit Message:

    This removes all wasm-related flags in no-wasm builds.
    We could have made them read-only, but fully removing them actually
    forces us to consider the no-wasm case at every use site, which often
    hints at further cleanups.

R=clemensb@chromium.org, joransiu@ca.ibm.com, junyan@redhat.com, midawson@redhat.com
BUG=
LOG=N

Change-Id: Ib68968683023f602f2226f0fa8d7c26bcc04b170
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2814899Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#73864}