We currently allow OSR (On-Stack Replacement) of arbitrarily deep return
addresses. This is in direct violation of Intel CET's shadow stack,
which we plan to enable eventually.

This change works around this by postponing OSR until after we return to
the old code. The main changes are:
- Reserve a slot in Liftoff frames to store the OSR target,
- Skip the return address modification, and instead store the new code
pointer in the dedicated slot,
- Upon returning to the old code, check the slot and do an indirect jump
to the new code if needed.

CET also prevents indirect jumps to arbitrary locations, so the last
point is also a CET violation. Valid indirect jump targets must be
marked with the ENDBRANCH instruction, which I will do in a follow-up
CL.

Bug: v8:11654
Change-Id: I6925005211aa95d60803b9409e3c07c7c226b25c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2826127
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73977}

This should catch potential build file misconfigurations.

Change-Id: I1bd1f808a4758e0d3b71c862cfc34e7b01e6fbd9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2827894
Auto-Submit: Dan Elphick <delphick@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73976}

Change-Id: I8db5f0b4cb1cfa23e210ac43b50680ce96e622b8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2826538
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73975}

- Allow pass/fail for all test-heap/LeakNativeContextVia* tests in
stress_concurrent_inlining mode.
- Don't capture stack locations in lambdas passed between threads.

Bug: v8:7790,v8:11650
Change-Id: I6c23b527d5f96f2f4b2354d16f39d832dea17e71
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2827895
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73974}

An exploitation technique that abuses `pop` and `shift` to create a JS
array with a negative length was publicly disclosed some time ago.

Add extra checks to break the technique.

Bug: chromium:1198696
Change-Id: Ie008e9ae60bbdc3b25ca3a986d3cdc5e3cc00431
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2823707Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Sergei Glazunov <glazunov@google.com>
Cr-Commit-Position: refs/heads/master@{#73973}

Changes:
- Implement function subtyping in wasm-subtyping.cc.
- Add Signature::Build(), which takes initializer lists for the return
  and parameter types.
- Only throw kTrapFuncSigMismatch in call_indirect, change that trap's
  message.
- Add a missing "return 0" in function-body-decoder-impl.h
- Fix a faulty check in wasm-objects.cc.
- Improve some comments.
- Write tests. Improve readability of subtyping-unittest.

Bug: v8:7748
Change-Id: I1caba09d5bd01cfd4d6125f300cd9c16af7aba99
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2822633Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73972}

No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:11650
Change-Id: I12857a479f95f8c60a921118cf68f7f88a81a822
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2826537
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73971}

- FLAG_turbo_inline_js_wasm_calls data race
- Map::instance_descriptors non-atomic concurrent loads
- Skip one more cctest incompatible with stress_concurrent_inlining

Bug: v8:7790,v8:11648,v8:11651
Change-Id: Ie4833373a1da34497f4cfe129254071d8a5772dd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2827891Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73970}

Some logic still remains, notably in compiler/.

Bug: v8:8888
Change-Id: I7e7f10a487e1bc8b90bbbfedbc46bf09bae0717e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2825589
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73969}

building the unittests target for example fails when cppgc_is_standalone
is set to true due to conflicting implementations of trace-event.h. It
is not clear from the output for these failures that V8 targets cannot
be built with cppgc_is_standalone.
We could disable all non-cppgc targets that depend on cppgc when
cppgc_is_standalone is set, but that would be fragile and dirty.
Since all V8 targets need to include cppgc-js headers, adding a  static
assert in cpp-heap.h would cover all V8 targets. The static assert
doesn't hide the current output, butadds a clear and expllicit message
stating that it cannot be done.

Bug: chromium:1056170
Change-Id: I8bd1b1a5ada18d9688e6b78de4693386539d78bf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2826535Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73968}

.. to increase coverage of concurrent inlining, at least in this stress
mode. The common pattern in mjsunit tests is to call
`%OptimizeFunctionOnNextCall(f)` for interesting function `f`. This
explicitly triggers non-concurrent compilation, significantly decreasing
relevant coverage of concurrent inlining.

This CL recovers coverage by spawning an additional concurrent compile
job when 1. --stress-concurrent-inlining is enabled, and 2. the
requested compile mode is non-concurrent. The result of these
additional jobs is discarded.

Drive-by: Fix two simple uncovered issues.

Bug: v8:7790,v8:11513,v8:11648
Change-Id: If1e8ca5ba737e3cecdec9e15e4a86b28fe9fb2de
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2824440
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73967}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/b30d9d1..e966858

Rolling v8/third_party/aemu-linux-x64: 81MEiC7zu9wgtKKP_jHorqj5uRmgBSx04zU75G1PX8YC..V4pHBauOtd8S1jDOxP65uQ5t1vxtzWpESymTE3h7ZMMC

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/6cb38d7..3898886

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/f9d141a..b1cc5ed

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/633b99a..eefe475

Rolling v8/tools/luci-go: git_revision:de0691397dd4daa4ae63d308fe911bb6ee8630d6..git_revision:4b61ac9cadfb8d19a09262c6e6f5342d9324acd0

Rolling v8/tools/luci-go: git_revision:de0691397dd4daa4ae63d308fe911bb6ee8630d6..git_revision:4b61ac9cadfb8d19a09262c6e6f5342d9324acd0

Rolling v8/tools/luci-go: git_revision:de0691397dd4daa4ae63d308fe911bb6ee8630d6..git_revision:4b61ac9cadfb8d19a09262c6e6f5342d9324acd0

TBR=v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I193cd09e604cf60f4a3243c7512de1d27a745149
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2826915Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#73966}

Bug: v8:11589
Change-Id: I30dbdbc6266d703ce697352780da1d543afbb457
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2826711
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73965}

This is a partial port of :
2c38a477

Some of the opcodes were added back in later CLs.

Change-Id: Iba33b0930f5b7ec95cdbe6febaa38766a9a6344f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2826238Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#73964}

The following error occurs without braces:

error: suggest explicit braces to avoid ambiguous 'else'.

Change-Id: Iae1af51dcaf8ab6b34fd9312f3133fbd395a653c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2826234Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#73963}

The bricklink.com brickage has since been fixed upstream.

I2S with LGTMs:
https://groups.google.com/a/chromium.org/g/blink-dev/c/I8S78w7aFmE/m/qLHAcjhRCQAJ

Bug: v8:10961
Bug: chromium:1170196
Change-Id: I460e1080aee837bde0e9861d761f2e7dbc8fd6b0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2824101
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73962}

Bug: chromium:1056170
Change-Id: I78844ed1921c5558a2c5ab6121208c1887fe8b3f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2826118
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73961}

Migrating unittests from Blink that were not already covered by cppgc.

Bug: chromium:1056170
Change-Id: If31591c3f1e99562028087c2b818f5ceb8122ec9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2821542
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73960}

This reverts commit d435eaa5.

Reason for revert: Breaks compilation on the vtunejit bot, see https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux%20-%20vtunejit/41247/overview

Original change's description:
> [api] Add v8::Isolate::ThrowError helper
>
> Add a ThrowError helper to encourage throwing full Error objects
> instead of just v8::Strings.
>
> Bug: v8:11195
> Change-Id: I15d75b1d39b817de3b9026a836b57a70d7c16a28
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2811738
> Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> Reviewed-by: Dan Elphick <delphick@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Reviewed-by: Marja Hölttä <marja@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#73958}

Bug: v8:11195
Change-Id: I2773d8ca7d73e7952d274381e2e0a2e5733a83da
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2826533
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#73959}

Add a ThrowError helper to encourage throwing full Error objects
instead of just v8::Strings.

Bug: v8:11195
Change-Id: I15d75b1d39b817de3b9026a836b57a70d7c16a28
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2811738
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73958}

The flag is useful for disabling tests that are not supported in
the third_party_heap build configuration.

Example usage in the status files:
['third_party_heap', {
  'testname': [SKIP],
}],  # third_party_heap

Bug: v8:11155
Change-Id: I991532bf7cdf89d8c505e4d6cbd7cf9e4d70dd63
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2821960
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73957}

After https://crrev.com/c/2807609 a test has started
failing as parameter_slots was more than 16 bits, hence
we need to load it instead of using it as an immediate value.

Change-Id: I738472634b3e30cbf277959965e72b028f9fb969
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2826231
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Reviewed-by: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/master@{#73956}

R=manoskouk@chromium.org

Change-Id: Ia5ecd3fac9178f2f9519686e818f9025ae95086d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2824441Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73955}

Port 885b1ac9

Original Commit Message:

    Similarly to Windows, on macOS we should touch the memory in a page
    when allocating stack space that crosses page boundaries.

R=victorgomes@chromium.org, joransiu@ca.ibm.com, junyan@redhat.com, midawson@redhat.com
BUG=
LOG=N

Change-Id: I6d3fc012c5a88e287deb0bb4d78ae001a1318b4b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2826230Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#73954}

Bug: chromium:1173527
Change-Id: If918b739f137b9c09030104b909e7bd2d4cd5984
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2817616Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73953}

Change-Id: I3828c6a854d09629784f481c76781003b4030993
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2814562Reviewed-by: Brice Dobry <brice.dobry@futurewei.com>
Commit-Queue: Brice Dobry <brice.dobry@futurewei.com>
Cr-Commit-Position: refs/heads/master@{#73952}

Instead of assigning serial numbers when the template infos are
created, this patch creates serial numbers only when they are added to
cache.

This way only the ones that are first instantiated are allocated the
fast template cache. Previously, various accessors and methods that
would almost never get instantiated got assigned to the fast template
cache.

Bug: v8:11284
Change-Id: I8f7578aa0dae48267bbc6303515114eb6e24c1c4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2621081Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#73655}
TBR: ulan@chromium.org
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2825592
Cr-Commit-Position: refs/heads/master@{#73951}

Change-Id: If33624193cb771ec0f1d7fc3364d50c850af7dcb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2822276Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73950}

.. of the backing store, instead of continuing and silently attempting
to deref nullptr.

Bug: chromium:1198657
Change-Id: I82e51abc4d2f9dfe0de596b082a6f78089af7df8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2824438Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73949}

Similarly to Windows, on macOS we should touch the memory in a page
when allocating stack space that crosses page boundaries.

Change-Id: I8968805c4abe255123a41d0f63f89d4af509b6c8
Bug: v8:11615
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2825588
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73948}

By using RWX memory to write we've likely managed to avoid the largest
part of the cost on Intel CPUs.

Bug: v8:11420
Change-Id: Ibf571abc136fc97b3e6429fe42ebf4cfc423b458
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2824443
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73947}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/79006be..b30d9d1

Rolling v8/third_party/aemu-linux-x64: dXMWT4elldlEXvj4YHtc9u0W4YEfTP-KZbIKpA75-7MC..81MEiC7zu9wgtKKP_jHorqj5uRmgBSx04zU75G1PX8YC

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/8680ff0..6cb38d7

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/057831e..f9d141a

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/7168936..633b99a

Rolling v8/tools/luci-go: git_revision:cbabdf2ff62e64e99bfdf57ab5625d3da3eb5db9..git_revision:de0691397dd4daa4ae63d308fe911bb6ee8630d6

Rolling v8/tools/luci-go: git_revision:cbabdf2ff62e64e99bfdf57ab5625d3da3eb5db9..git_revision:de0691397dd4daa4ae63d308fe911bb6ee8630d6

Rolling v8/tools/luci-go: git_revision:cbabdf2ff62e64e99bfdf57ab5625d3da3eb5db9..git_revision:de0691397dd4daa4ae63d308fe911bb6ee8630d6

TBR=v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: Iffe657ca45beccf7379237650b0cd8574b55b836
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2824104Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#73946}

https://crrev.com/c/2817958 is going to support artificial
calls of NoAllocDirectCall for a testing purpose, and this
new API will be used there.

Change-Id: If47ba080eede96e91ba60b89ff502dd3d3e34b93
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2822188Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Yuki Shiino <yukishiino@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73945}

We add one more member function template to AvxHelper to allow one new
way of calling:

- Andps(x, y, z) -> vandps(x, y, z), andps(x, z) && x == y

Clean up a bunch of places where we need to pass an int literal as a
byte.

Unfortunately we cannot define Movq using AVX_OP. Because of the way
movq is defined in the assembler, using function templates, there are
versions of movq with 1 argument defined. That is not a valid
instruction (but is valid for `dec`). We end up selecting
vmovq(XMMRegister, Register) and movq(XMMRegister), which is not valid.

Bug: v8:11589
Change-Id: I45e3bc213d93ece7f65da8eb1e3fa185aec4c573
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2815560
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73944}

We optimized swizzle with constant mask, but failed to actually swizzle
using the masks...

Bug: v8:10992
Change-Id: If655fdad1e17e92b62e8a2eaabbf1f8d82e4d5e4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2822951Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73943}

This is similar in spirit to https://crrev.com/c/2808621, which is to
ensure that no matter what combination of --[no-]enable-{extension} flag
is passed, we end up with a set of supported extensions that make sense.

The 2 rules are:

- If a newer extension is supported (SSE4_2), older extensions are
supported (SSE4_1, SSSE3, SSE3),
- If an older extension is not supported (SSE4_1), new extensions are
not supported (SSE4_2, AVX)

Tests have been added to both ia32 and x64 to check that we follow these
above 2 rules.

We change the ProbeImpl to have a reconciliation step to ensure that we
stick to the 2 rules.

E.g. if --enable-avx --no-enable-sse4-2, we will first set AVX to
supported, then in the second step, fix-up AVX to unsupported. In this
sense, the --no version of the flags take priority. This more accurately
follows the intention of the flags.

Bug: chromium:1195579
Change-Id: I0390f24de9d203fe6bbd4cc02a23771a1f052618
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2818570
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73942}

Added a comparison to throw a TypeError when the "enumerable"
field of the new descriptor doesn't match the one of the old descriptor.

Bug: v8:10782
Change-Id: I2f1acf215e597b85be5d29e22c006cbd79afcb47
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2818067
Commit-Queue: Luis Fernando Pardo Sixtos <lpardosixtos@microsoft.com>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73941}

Bug: chromium:728583
Change-Id: I0d88b7516d053f2024a43bed84843ee47e06cd42
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2823697Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Jochen Eisinger <jochen@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73940}

This reverts commit 6ec52d90.

Reason for revert: Caused failure on Chromium android-asan bot. More info in crbug.com/1198565.

Original change's description:
> [wasm] Enable wasm threads by default in V8
>
> Finer grained control of platforms that support threads are
> enforced by chromium.
>
> Bug: chromium:1167733
> Change-Id: Ic34a4950aebf6ba394053b79df97b703af333636
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2810190
> Reviewed-by: Lutz Vahl <vahl@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#73919}

Bug: chromium:1167733
Change-Id: I8a7740c70c227dea42de5a54bb1cfa07fc139098
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2821704
Auto-Submit: Victor Vianna <victorvianna@google.com>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#73939}

Change-Id: I5b5024fdcf4806b6e91112448db3c334f9ede48b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2821957
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73938}