This reverts commit 4ad20bff.

Reason for revert: New test seems to be failing on TSAN/incremental marking stress (https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20TSAN%20-%20stress-incremental-marking/6346/overview)

Original change's description:
> heap: Fix the tracing of GC cycles
>
> Conceptually, a full GC cycle completes when the sweeping phase is
> finished. As sweeping is performed concurrently, this happens after
> Heap::CollectGarbage has returned and, at the latest, before the next
> full GC cycle begins. However, an arbitrary number of young GC cycles
> may happen in the meantime. Tracing information for the sweeping phase
> must be added to the corresponding full GC cycle event. Until now, this
> was not done correctly: this information was added to the GCTracer's
> current event and could thus be attributed to a subsequent young or full
> GC cycle.
>
> This CL introduces methods GCTracer::(Start|Stop)Cycle to delimit a
> cycle (still allowing for full GC cycles to be interrupted by young GC
> cycles). These methods are different from (Start|Stop)ObservablePause,
> which delimit the observable pause of each GC. The events of "pending"
> full GC cycles are kept until they are properly amended and reported,
> when the sweeping phase is finished.
>
> Bug: chromium:1154636
> Change-Id: I2fbc65d4807c78656d4abc8c451043f6f86211b1
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3404733
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Omer Katz <omerkatz@chromium.org>
> Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#78905}

Bug: chromium:1154636
Change-Id: Id6688cfe982f9d8159c66d715b7079782a371bed
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3431489
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Owners-Override: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78908}

I32x4UConvertF32x4 is also slightly optimized by removing 2
instructions.

Change-Id: Ie61fbd34628beb2410ae3ef916de7c3119c7ad9c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3429463Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#78907}

This is the second step towards moving away from sending `url` with
every call frame when emitting the `Debugger.paused` event.

Bug: chromium:1270316, chromium:1271078
Change-Id: Ib4f996024b5200cded155bd8a564d01d36856400
Doc: https://bit.ly/devtools-debugger-callframe-url
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3431485
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78906}

Conceptually, a full GC cycle completes when the sweeping phase is
finished. As sweeping is performed concurrently, this happens after
Heap::CollectGarbage has returned and, at the latest, before the next
full GC cycle begins. However, an arbitrary number of young GC cycles
may happen in the meantime. Tracing information for the sweeping phase
must be added to the corresponding full GC cycle event. Until now, this
was not done correctly: this information was added to the GCTracer's
current event and could thus be attributed to a subsequent young or full
GC cycle.

This CL introduces methods GCTracer::(Start|Stop)Cycle to delimit a
cycle (still allowing for full GC cycles to be interrupted by young GC
cycles). These methods are different from (Start|Stop)ObservablePause,
which delimit the observable pause of each GC. The events of "pending"
full GC cycles are kept until they are properly amended and reported,
when the sweeping phase is finished.

Bug: chromium:1154636
Change-Id: I2fbc65d4807c78656d4abc8c451043f6f86211b1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3404733Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78905}

UpdateDispatchTables is the hottest function during Wasm instantiation,
thus dehandlify it, as it does not allocate on the JS heap anyway. This
saves ~20% of instantiation time locally.

R=manoskouk@chromium.org

Bug: v8:12593
Cq-Include-Trybots: luci.v8.try:v8_linux_gc_stress_dbg_ng
Cq-Include-Trybots: luci.v8.try:v8_mac64_gc_stress_dbg_ng
Change-Id: Ifdd3f8fcd2e31950b591b179a62a0d397c41c339
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3429205Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78904}

Some of the numeric opcodes have a variadic signature, e.g. table.grow
or table.fill, and soon also the bulk memory opcodes because their
consumed types depend on the memory type.

For those opcodes, remove the signature definition from the opcode macro
lists, because using it might result in bugs.

R=thibaudm@chromium.org

Bug: v8:10949, chromium:1281995
Change-Id: I350e75db7197d97a561f8219cedba5fe85b5c9c9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3424494Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78903}

This is a reland of 7ddacd68

- Allocate JSObject only after the properties are fully deserialized

Original change's description:
> [web snapshot] Dehandlify more parts of the deserializer
>
> - Use Heap::AddGCEpilogueCallback to update often accessed FixedArrays
>   in the WebSnapshotDeserializer.
> - ReadValue returns now a raw value to avoid handle creation in more
>   cases
> - Drop representation support for now in ReadValue
> - Avoid a few more handles when setting up objects
>
> Bug v8:11525
>
> Change-Id: I6955b56887834bc655bdaa9c390016d9a17db82d
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3416242
> Reviewed-by: Marja Hölttä <marja@chromium.org>
> Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#78862}

Change-Id: I2b64e59df02d4d723f76e157aad045f94a22d2b9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3427202
Auto-Submit: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78902}

The CL does following:
1) Makes sure young generation works and tests pass;
2) Provides CollectGarbageInYoungGenerationForTesting() that is needed
   to support remaining tests in Blink;
3) Moved cppgc_enable_young_generation GN flag to v8.gni to refer to it
   from Blink;
4) Bails out from marking TracedReferences in UnifiedHeapMarkingState;
5) Disables (temporarily) prompt freeing for young generation;
6) Fixes remembered set visitation for nullptr|kSentinel slots.

Bug: chromium:1029379
Change-Id: I5165fa22c8a0eaa708ef7a35a9978cb12e1cb13e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3429202Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Auto-Submit: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78901}

RecordWrite uses callee saved registers, so only the clobbered registers
need to be saved by the caller.
This change gives us a 1% reduction in embedded blob size for arm64.
No change is seen for arm as the STM instruction can store and load
multiple registers.

Change-Id: I8e41da43851e96d3454a01c7093d76f2e0378214
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3406744Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Martyn Capewell <martyn.capewell@arm.com>
Cr-Commit-Position: refs/heads/main@{#78900}

Bug: chromium:1206289
Change-Id: Ib0cc2a0d159b763efa4fe33502b0a6562973b430
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3429501Reviewed-by: Lutz Vahl <vahl@chromium.org>
Commit-Queue: Lutz Vahl <vahl@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78899}

... instead of obj.IsCode() because it's not safe to use the latter
during GC which might have already moved the object.

Bug: v8:11880, chromium:1292688
Change-Id: Idbe973c0b1919a79c6aa66a8f490d952266aa66d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3429209
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78898}

Bug: v8:12563
Change-Id: I564c973d5d03c198bffc8edba8d9a3b7ec66c8e6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3423581
Auto-Submit: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78897}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/6b20164..a0549e2

Rolling v8/buildtools/third_party/libc++abi/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi/+log/df43e1b..5b0a8cf

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/1c33cd6..1e084a5

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/9c2e78d..60206c4

Rolling v8/third_party/googletest/src: https://chromium.googlesource.com/external/github.com/google/googletest/+log/28e1da2..4517697

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/b9ea102..cb91247

Rolling v8/tools/luci-go: git_revision:ce8e2e60bf68fb270355d04aaa7ce5e644a049b6..git_revision:d46a9c7ad4e38935bbacb01602fc1d09a162884b

Rolling v8/tools/luci-go: git_revision:ce8e2e60bf68fb270355d04aaa7ce5e644a049b6..git_revision:d46a9c7ad4e38935bbacb01602fc1d09a162884b

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I15d6d2055909af6e855251d4624a229451e79e8b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3427830
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#78896}

Change-Id: I89ddf2895619b27e87ee9c808e6f9104a153ebb3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3429291Reviewed-by: Milad Farazmand <mfarazma@redhat.com>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/main@{#78895}

Fix build breakage of
https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20riscv64%20-%20sim%20-%20builder/7023
and
Mark some test SKIP on arm64 for
https://ci.chromium.org/p/v8/builders/ci/V8%20Android%20Arm64%20-%20N5X/17069

Bug: v8:10776
Change-Id: Ia24d7b7397bd48599a63b3a674312b09d1f65ee6
Cq-Include-Trybots: luci.v8.try:v8_linux64_riscv64_rel_ng,v8_android_arm64_n5x_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3427297Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78894}

This reverts commit f942f656.

Reason for revert: Breaks gc-stress

Original change's description:
> Reland "[wasm] Resume suspender on resolved promise"
>
> This is a reland of a865d16b
>
> Changes:
> - Make the next ID atomic
> - Leave more space for runtime calls in debug mode
>
> Original change's description:
> > [wasm] Resume suspender on resolved promise
> >
> > Implement the WasmResume builtin, which resumes a wasm suspender
> > when the corresponding JS promise resolves.
> >
> > Drive-by 1: Fix detection of empty stacks in the stack frame iterator.
> > Drive-by 2: Add a stack ID for better tracing.
> >
> > R=ahaas@chromium.org
> > CC=​fgm@chromium.org
> >
> > Bug: v8:12191
> > Change-Id: Ifa3f00c4259f802292b04d426c739e9b551f87b9
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3420827
> > Reviewed-by: Andreas Haas <ahaas@chromium.org>
> > Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> > Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
> > Cr-Commit-Position: refs/heads/main@{#78842}
>
> Bug: v8:12191
> Change-Id: I3c231690b27be79a0c00e13043342bb4a3628886
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3427203
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#78890}

Bug: v8:12191
Change-Id: I5037419b6cee7a3bb49c1649e5a5d11a935a9b28
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Auto-submit: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3429500
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Auto-Submit: Thibaud Michaud <thibaudm@chromium.org>
Owners-Override: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78893}

Change-Id: I62ddb8cfbaa558f4b84288bed5ead2d61456d723
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3429211
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Wez <wez@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78892}

Threshold analysis:
https://docs.google.com/document/d/19xRt6UeRQ-ml0rwDRdY3LED0G2fpi1p4Rh-FH6_YzmU

Bug: v8:12315, chromium:1292983
Change-Id: I00478e16e7c971e0963d750417e7ff06547fada3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3429210
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78891}

This is a reland of a865d16b

Changes:
- Make the next ID atomic
- Leave more space for runtime calls in debug mode

Original change's description:
> [wasm] Resume suspender on resolved promise
>
> Implement the WasmResume builtin, which resumes a wasm suspender
> when the corresponding JS promise resolves.
>
> Drive-by 1: Fix detection of empty stacks in the stack frame iterator.
> Drive-by 2: Add a stack ID for better tracing.
>
> R=ahaas@chromium.org
> CC=​fgm@chromium.org
>
> Bug: v8:12191
> Change-Id: Ifa3f00c4259f802292b04d426c739e9b551f87b9
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3420827
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#78842}

Bug: v8:12191
Change-Id: I3c231690b27be79a0c00e13043342bb4a3628886
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3427203Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78890}

Port 276355cb

Original Commit Message:

    The 32-bit value is zero-extended to pointer size, which is a no-op on
    32-bit systems. The operation changes nothing about the signedness of
    the value, so the old name was a bit misleading.

    We also provide one unified no-op implementation for all 32-bit systems.

R=clemensb@chromium.org, joransiu@ca.ibm.com, junyan@redhat.com, midawson@redhat.com
BUG=
LOG=N

Change-Id: Ica443175725f12e44e69ad22e5fe347c56ea6c13
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3429208Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#78889}

We often allocate many of them (six digit numbers), and allocating them
in new space causes a lot of GCs.
This CL makes table initialization more than 30% faster for Photoshop,
which again makes each Wasm instantiation ~20% faster.

R=manoskouk@chromium.org

Bug: v8:12593
Change-Id: Ia913079b6412fa718b55c62681ba23751f3934e3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3429204Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78888}

Previously, when accessing SandboxedPointer fields with the sandbox
disabled, we would always do a ReadUnalignedValue/WriteUnalignedValue.
However, that is only necessary when pointer compression is enabled.
Otherwise, the field will be properly aligned.

This CL also factors out the logic to determine when to use an unaligned
or aligned read/write for a field into two new helper functions.

Bug: chromium:1292669
Change-Id: I2c1af187c5b2699101c3fee9cc551be788d3a845
Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3429200Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Samuel Groß <saelo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78887}

- Adds a GN flag to enable the feature
- Adds facets to manifest used by d8/unittests
- Adds some DCHECKS
- Uses zx_handle_t type to avoid global initialization/destructor

Bug: v8:11232
Change-Id: Ibd7766abefbf8c213393cf6365c34f9ff4e6ed7d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3420828Reviewed-by: Wez <wez@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78886}

This explicitly passes along the break reason when requesting a pause
that is handled via an interrupt. Pushing the break reason is not
enough (as done before), as the reason may be used and consumed on
another pause call that triggers a setPauseOnNextCall.

Fixed: chromium:1292519
Change-Id: If8635c9397a7b9a1e6757be8048c9edc613c27f8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3427208Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Kim-Anh Tran <kimanh@chromium.org>
Auto-Submit: Kim-Anh Tran <kimanh@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78885}

The ctors dispatch between atomic and non-atomic writes; there's no
need for a default initializer.

Bug: chromium:1292728
Change-Id: I2b4c3341ee2d2682ba0113c8366456147ebc717e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3429201Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Auto-Submit: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78884}

This is the 2. CL in a series of CollectGarbage refactoring CLs.

It moves two kinds of callbacks to the epilogue of CollectGarbage:
- Weak second pass phantom callbacks
- GCEpilogueCallbacks

As the prologue callbacks have also been moved outside the GC cycle,
with this CL the need for nesting tracers is eliminated. DCHECKs are
put in place to ensure this.

Bug: v8:12503
Change-Id: I0bc2c0fa0de1b0ffc32b5c648a612c0b3e0e1f3e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3427199Reviewed-by: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78883}

Bug: none
Change-Id: I00903b3d709106b0aa6493bec916c70fa522b529
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3429199
Auto-Submit: Kim-Anh Tran <kimanh@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78882}

The 32-bit value is zero-extended to pointer size, which is a no-op on
32-bit systems. The operation changes nothing about the signedness of
the value, so the old name was a bit misleading.

We also provide one unified no-op implementation for all 32-bit systems.

R=thibaudm@chromium.org

Bug: v8:10949, chromium:1281995
Change-Id: Id04641fe793155ea98bf878b6789e4afce3da7df
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3424493Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78881}

Rolling v8/third_party/google_benchmark/src: https://chromium.googlesource.com/external/github.com/google/benchmark/+log/6d51a11..14eee07

bump numby, as per dependabot (#1336) (Dominic Hamon)
https://chromium.googlesource.com/external/github.com/google/benchmark/+/14eee07

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com,mlippautz@chromium.org

Change-Id: Iff78283b44fefc94d20aeebc5e34570229d68994
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3427905
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#78880}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/eaca789..6b20164

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/6b30850..1c33cd6

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/8dd74d4..9c2e78d

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/00a9400..b9ea102

Rolling v8/tools/luci-go: git_revision:9c88febc5ab63469baf5aae05a74f8e419970ef3..git_revision:ce8e2e60bf68fb270355d04aaa7ce5e644a049b6

Rolling v8/tools/luci-go: git_revision:9c88febc5ab63469baf5aae05a74f8e419970ef3..git_revision:ce8e2e60bf68fb270355d04aaa7ce5e644a049b6

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: Icfa2588818cbf9d508db44dc74824d6361a8e3c6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3427903
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#78879}

Implement ALL in NumberFormat v3 except:
* Add PluralRules.prototype.selectRange
* Add NumberFormat.prototype.formatRange(ToParts)?
(which will be reviewed in later CLs)
* Change NumberFormat.prototpe.resolvedOptions

https://github.com/tc39/proposal-intl-numberformat-v3

https://chromestatus.com/guide/edit/5707621009981440

Design Doc: https://docs.google.com/document/d/19jAogPBb6W4Samt8NWGZKu47iv0_KoQhBvLgQH3xvr8/edit

Bug: v8:10776
Change-Id: I1acf833ec25fb05437cb0b21c5510bb99d1c4583
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3405649Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78878}

Change-Id: Ide34fe0b2e5c12640a084b001ae17ff316de3f3e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3423578Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#78877}

- This enables a hash table for local names in ScopeInfo.
- Drive by fix iterating local names in FinalizeReparsedClassScope

Bug: v8:12315
Change-Id: I02c22bfdc4f1d91f19f368885fca24b2a577d26e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3422632
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78876}

Hoist the LocalIsolate before the loop consuming the
compilation jobs.

Bug: v8:12054
Change-Id: I6ec46c2747a22fee06ebaac5f04dffe3d34ac2ae
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3427200Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78875}

If PKU is used, we just called {pkey_mprotect} and called it a day,
whereas {PageAllocator::SetPermissions} also discards the system pages
when switching to {kNoAccess} (both in {OS::SetPermissions}, which is
used by the default platform, as well as the GIN platform used in
Chrome).

In order to avoid memory regressions when using PKU, this CL changes the
PKU implementation to behave like the POSIX {OS::SetPermissions}
function and also discard system pages when removing all access.

R=jkummerow@chromium.org

Bug: v8:11974
Change-Id: I35f9c436925c1500e5884db1caf620c975586f7e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3424496Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78874}

This guarantees that they are smaller than the maximum external pointer
table index when shifted to the right on load.

Bug: v8:10391
Change-Id: I601f37fbb9640ee4b5215958afcc474c5e0eb9af
Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3359631Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Samuel Groß <saelo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78873}

Change-Id: Ia103e4010faa67daa3ebd504449e495652a55a3b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3425098Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#78872}

We might have to wait for background tasks to complete (e.g. when
awaiting ax  WebAssembly.instantiate) and not just other promises.

Bug: v8:12568
Change-Id: Ibf99074d7a3c924b77b7959006087a05d39ffd3b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3423777Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78871}

Whenever running any test with --jitless, V8 crashes with
Contradictory flag implications, because:
jitless -> !sparkplug
concurrent_sparkplug -> sparkplug

Change-Id: I51206dfb8d6978a9f9bfdb73e9068dcd5d8f9274
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3423783
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78870}

We temporarily disable fuzzing for wasm-gc until we update the fuzzer
to the isorecursive hybrid type system.

Bug: chromium:1291959
Change-Id: I2238c37bc49cbac2bf1c4085815a2283db982ab3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3423782Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78869}