The GetReadOnlyRoots will need to remain on HeapObject due to pointer
compression and the Isolate overload of HashSeed is convenient.

Change-Id: Id7fa8e57e3b8bfa6f50465c24da1fc5d0b4db0bd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2397889
Commit-Queue: Dan Elphick <delphick@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Auto-Submit: Dan Elphick <delphick@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69729}

These flags are later packed into an InstructionCode by the
instruction selector, but not all bits are preserved. This CL adds a
few assertions and helper methods to clarify and make this a bit
safer.

Bug: v8:8888
Change-Id: I01adc9f7887cc21c623d790dc204ac1d4b9bc7ac
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2388116
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69728}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/fc95b89..2dc8141

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/8584a9d..69e45dc

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/a070dd1..9218ba2

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: Icccb92296366c45ff1a1a1b33a6310504465861f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2397199Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#69727}

The current implementation in AssembleSwap will generate a push-pop pair to swap between a general register and a stack slot for both x64 and ia32 targets. This is unnecessary for x64 target, as we can use the kScratchRegister to save the general register and swap with the stack slot.

Change-Id: I10e0dc360dec22cdf5afa63ece3d5943685d7ecb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2394177Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Yolanda Chen <yolanda.chen@intel.com>
Cr-Commit-Position: refs/heads/master@{#69726}

With this CL we emit safepoint maps for externref values on the Liftoff
value stack. With that there is support for externref parameters and
locals in Liftoff, as well as for intermediate values of type
externref.

R=thibaudm@chromium.org

Bug: v8:7581
Change-Id: I2df0a8d00b2da33fe06ff474b039cca4c7be726d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2387571
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69725}

When a WasmGCForegroundTask starts during runMessageLoopOnPause, the
stack may contain Wasm code. In this case we need to scan the stack to
report live code.

This is already caught by some tests when RemoveBreakpoint is
implemented correctly, which will be done in a separate CL, so no
regression test is added here.

R=clemensb@chromium.org

Bug: v8:10337
Change-Id: I308145b9c2cf69f0100853be47ec9e30ce79a876
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2379510Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69724}

If we generate more code than allowed by the --wasm-max-code-space flag,
the {WasmCodeManager::Commit} method will fail (via fatal error). The
DCHECK that was placed before that call checked for a related condition
though, and failed before the {Commit} method could fail.
By moving it after the call, we fix this issue.

Adding a test case for this seems to be involved, since that test would
crash the whole process (because of the fatal error). So it would have
to be a unittest such that we can use ASSERT_DEATH_IF_SUPPORTED. In
unittests though we don't yet have the infrastructure to create a
NativeModule (needed for the WasmCodeAllocator). Alternatively we could
add special testing methods (and a constructor) to the
WasmCodeAllocator, but I do not consider this worth the effort for this
little fix.

R=thibaudm@chromium.org

Bug: chromium:1124646
Change-Id: Ief09dfbd0a5b0b040fe9cf8a34e458d1d01dfacc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2390754
Auto-Submit: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69723}

This avoids race conditions in certain situations detected by TSAN.

Bug: v8:10644
Change-Id: Ic3082da4e918890940fcc1cabf0933b0419f41de
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2396083
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69722}

memchr is used in the default case but for two-byte strings that contain
mostly ascii sequences every other byte is 0.

This CL special-cases the 0 byte search in a two-byte string to simply
peform a simple for loop which is rouhly 10x faster than the repeated
memchr approach.

Bug: v8:10737
Change-Id: Icde6b858b6679da69448295616734c46aa95e439
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2364507Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69721}

The BigInt constructor has quadratic complexity while parsing strings,
and the input is unbounded. Interrupts should be checked during this
operation to ensure the embedder has control over runaway execution.

since the implicit cast from string may now throw.

BigInt: :CompareToString and BigInt::EqualToString now return Maybe<..>
Change-Id: Iccb85fafac4df69075a34d1de647cb4f0184cb12
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2392629Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69720}

Guessing the architecture on the testing machine is not required to
derive if the simulator is supposed to run. The architecture check
doesn't work on some platforms.

We derive this now by checking if we have compiled a simulator build:
target_cpu != v8_target_cpu.

Bug: chromium:1110824
Change-Id: Id30a647f0610f21efb00d68ad1602e62dcd2c65c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2395563Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69719}

This can be done since --local-heaps is also temporarily enabled. This
lets us perform a reverse finch trial and start testing out direct heap
access.

Bug: chromium:1125606, v8:7790
Change-Id: I746e459824aa345dec8184bccc21bbd54070e3b4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2396077Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69718}

This reverts commit 95aa697b.

Reason for revert: breaks under tsan

Original change's description:
> [test][d8] Add d8.log.getAndStop helper
> 
> The new helper function allows us to write tests for log parsing
> without the need to first generating a log file. This makes it easier
> to spot errors when the log format changes.
> 
> - Add d8 global variable
> - Add file_name accessor to Logger and Log classes
> - Change OS::LogFileOpenMode to w+ / wb+
> - Use separate Log::WriteLogHeader method
> - Remove unused logger_ instance variable from Log
> 
> Bug: v8:10644
> Change-Id: Ifc7e35aa4e91b3f01f0847843263946e085944c3
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2387563
> Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69715}

TBR=mlippautz@chromium.org,cbruni@chromium.org,gsathya@chromium.org,verwaest@chromium.org

Change-Id: Iad47d2f1e3391cae3c2f8c9e6c904c43925e1671
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10644
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2396080Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69717}

Change-Id: I04bab17c1636e99f7486987bc777bea73997a0c6
Bug: v8:10201
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2387579
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69716}

The new helper function allows us to write tests for log parsing
without the need to first generating a log file. This makes it easier
to spot errors when the log format changes.

- Add d8 global variable
- Add file_name accessor to Logger and Log classes
- Change OS::LogFileOpenMode to w+ / wb+
- Use separate Log::WriteLogHeader method
- Remove unused logger_ instance variable from Log

Bug: v8:10644
Change-Id: Ifc7e35aa4e91b3f01f0847843263946e085944c3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2387563
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69715}

When the interface descriptor of a builtin uses DEFINE_JS_PARAMETERS, the extra stack arguments must be positioned just above the return address, otherwise we would need to calculate its offset depending on the actual number of the arguments, we currently use a fixed offset to access them in CSA.

Therefore, these extra arguments are either the first arguments when V8_REVERSE_JSARGS is enabled or otherwise the last arguments.

Change-Id: If38ac7fd7f0079fc0e4fdccdb6cfb26e0425eb84
Bug: v8:10825
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2379854Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69714}

Normalize the target object if we're guaranteed to end up in
dicionary mode after copying over all enumerable properties from the
source object.

This partially addresses performance issues when using the spread
operator on large dict-mode objects.

Change-Id: I5be7cbc6e6a7e4b1b59412779db9b651f5f68b45
Bug: v8:10763
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2362961Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69713}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/2b8377b..fc95b89

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: Ic59889e29560c4a2d8b91fbe04e4fd1101f4b924
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2394857Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#69712}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/a9ca728..2b8377b

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/5dba9c9..a070dd1

Rolling v8/third_party/zlib: https://chromium.googlesource.com/chromium/src/third_party/zlib/+log/59187e1..aec16ef

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I03c0e9bb1562243c059175d4e09cb5b03655a7fa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2393889Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#69711}

Port 5c0f7219

Original Commit Message:

    The 64-bit instruction selectors check whether the input value to
    a ChangeUint32ToUint64 node was produced by a node that sets the upper
    32 bits to zero, and if so, they avoid emitting an extra instruction to
    clear the upper bits. This change:

    1. Extends that existing mechanism to also include phi values: if all of
       the inputs to a phi value guarantee that the upper 32 bits are zero,
       then the phi value does too.
    2. Updates x64 to include non-negative int32 constants in the list of
       nodes that always clear the upper bits. I didn't add this to any
       other architecture because I'm less certain of how they resolve moves
       from constants.

    This change improves the speed of the Mono interpreter on x64 by about
    5%.

R=seth.brenith@microsoft.com, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: Ic515a254025b518c767fb64c5b1282cdf226f5ff
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2393742Reviewed-by: Seth Brenith <seth.brenith@microsoft.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#69710}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/7cbd827..a9ca728

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/56048e6..5dba9c9

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: Ic9a9215b971e8e2de9eeb5d8d2f58972c49a24a5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2393535Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#69709}

Bug: chromium:1124085
Change-Id: I92bea75caad4ffc99d3890440295115f6d65e849
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2393216Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Reviewed-by: Nico Weber <thakis@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Auto-Submit: Zequan Wu <zequanwu@google.com>
Cr-Commit-Position: refs/heads/master@{#69708}

Some comparison ops are missing from the list, so an incorrect
replacement type was set on those instructions.

Bug: v8:10507
Change-Id: I1ebee298261a33863fe09e62e94336a792966a47
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2393099Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69707}

The 64-bit instruction selectors check whether the input value to
a ChangeUint32ToUint64 node was produced by a node that sets the upper
32 bits to zero, and if so, they avoid emitting an extra instruction to
clear the upper bits. This change:

1. Extends that existing mechanism to also include phi values: if all of
   the inputs to a phi value guarantee that the upper 32 bits are zero,
   then the phi value does too.
2. Updates x64 to include non-negative int32 constants in the list of
   nodes that always clear the upper bits. I didn't add this to any
   other architecture because I'm less certain of how they resolve moves
   from constants.

This change improves the speed of the Mono interpreter on x64 by about
5%.

Bug: v8:10606
Change-Id: Ife8ce9c7330524e0b2fad836209a81180b4870e8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2382509Reviewed-by: Bill Budge <bbudge@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#69706}

Functions with v128 in their signatures are always lowered to 4 word32.
So if a return happens to be have an input that is a f32x4 operation, we
get a register allocator error because it tries to fit a float into a
general register. To fix that we need to do some checks when lowering
kReturn, and for each input node, if we are returning a v128, and it is
to be lowered into 4 f32 nodes, we bitcast the floats to ints.

Bug: v8:10507
Change-Id: Iea2fdfc4057304ebf0898e6f7091124629c589f0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2391331
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69705}

Tests do not expect concurrent allocation and are simply skipped in that
configuration.

Bug: v8:10315
Change-Id: Ia371efa3c27e1f8b76fab47abcce2d7c218224bc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2390774Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69704}

This reverts commit 825c61d8.

Reason for revert: Processing interrupts triggers a DisallowHeapAllocation scope failure.

Original change's description:
> Check interrupts in runtime BigInt parser
> 
> The BigInt constructor has quadratic complexity while parsing strings,
> and the input is unbounded. Interrupts should be checked during this
> operation to ensure the host has control over runaway execution.
> 
> Change-Id: I15db9adeeafadc7b866a395dd8263aa8c2109ce8
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2384166
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69679}

TBR=jkummerow@chromium.org,leszeks@chromium.org,marcel@laverdet.com

Bug: chromium:1124477
# Not skipping CQ checks because original CL landed > 1 day ago.

Change-Id: I1ba8c1de1f809f71a1c4fae9b56a8bd40f9f7e7f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2392815Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69703}

We are comparing equals to 0, we can remove this equality comparison,
and invert the phi outputs. This saves 1 op/node for every lowered
comparision.

Bug: v8:10824
Change-Id: I4957bed635c34d47fff98c5556ab55754d3fd91e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2391911Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69702}

There are some objects that are serialized with concurrent inlining off
even when they are part of HEAP_BROKER_NEVER_SERIALIZED_OBJECT_LIST.

Bug: v8:7790
Change-Id: I91aa0e9d93cf86e2765f1f56bcfb8456c4b7685e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2382310
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69701}

The generic wrapper can be used for Wasm functions with int32 parameters
and 0 or 1 int32 return values.

Added tests for cases when the return value can & cannot be converted to
a Smi.

Bug: v8:10701
Change-Id: I470954ed0aced0e4ec6e65a9f38caac19c576549
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2390141
Commit-Queue: Eva Herencsárová <evih@google.com>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69700}

Do not use the already existing always_allocate() method for allowing
all allocations after tear down was started. Use explicit checks
of gc_state() == TEAR_DOWN instead.

This ensures that background threads extend the heap beyond its limits
only when tearing down the isolate. always_allocate() is also used
during regular execution in C++ code.

Bug: v8:10315
Change-Id: I66b5bfb06fa854048f37305a5d0cb7d60fadb30f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2390764
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69699}

PagedSpace::CommittedPhysicalMemory() needs to use mutex when iterating
chunks due to concurrent allocations.

Also reorder sampling of memory statistics according to this order:

1) used memory
2) committed physical memory
3) committed memory

That way, used <= committed physical <= committed should hold.

Bug: v8:10315
Change-Id: Ie922ecc4846f724a09c71667a898bf74a8652220
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2390768
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69698}

Port: a2fd94f0

Change-Id: I174ef5523806d23a0425e546ffe557b2c21defe7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2390828Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#69697}

HeapWithPointerCompressionTest.HeapLayout sometimes raced with
background threads. When iterating chunks, background threads might add
chunks concurrently. Prevent this by enforcing safepoint during
iteration.

Bug: v8:10315
Change-Id: I2852ec3ea18905b669e60eadc660d9343ea35f48
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2390767
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69696}

There is an int version that will be TNodified in a follow-up CL.

Bug: v8:9708, v8:6949
Change-Id: I3a47cb352396dfe9dea426b6396216c06e0e3254
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2387963
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69695}

This is a reland of 9eb090d2

The android-pie-arm64-dbg compiler error was fixed in:
https://chromium-review.googlesource.com/c/v8/v8/+/2381450

Original change's description:
> [heap] Add concurrent typed slot recording
>
> Since the typed slot set is not thread-safe, each concurrent marking
> barrier collects typed slots locally and publishes them to the main
> typed slot set in safepoints.
> Bug: v8:10315
>
> Change-Id: If1f5c5df786df88aac7bc27088afe91a4173c826
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2370302
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69576}

Bug: v8:10315
Change-Id: Iae2882bad1cd0ffcae28c96318ba5fd7937f2215
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2390763Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69694}

Tests that use SimulateFullSpace and SealCurrentObjects do not work
if there is a background thread allocating concurrently.

Bug: v8:10315
Change-Id: I73a4c9db8eb32fdf3e07fcb8f5dda309de797709
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2390765Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69693}

This used to break x64 no embed bot due to it being Large code objects
but no embed no longer exists so this isn't a problem anymore.

Bug: v8:9708, v8:6949, v8:9637
Change-Id: I83836a94ff1747841315d46ca0e7ec5c73bbaf0d
Fix: v8:9637
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2387962Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69692}

ManualGCScope is used in tests that perform GC manually. Stressing
concurrent allocation interferes with that and may trigger more GCs
than the test expects.

Bug: v8:10315
Change-Id: I6705f0b7cc555074b319a41d29810936b5a2a556
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2392242Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69691}

This is a reland of 453cf219

Original change's description:
> [compiler] Add a StartNode wrapper class
>
> .. to make implicit semantics of output nodes explicit.
>
> Bug: v8:8888
> Change-Id: I2ea5f5fa02f3d1f51196ea1e1e46b526dd9dc7d6
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2388117
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69681}

Tbr: tebbi@chromium.org
Bug: v8:8888
Change-Id: I7ff3fc64c607a5289981a0762ad3a2b1de5a284d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2392241
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69690}