LocalAllocationBuffer is used on the background thread so it needs
to use CreateFillerObjectAtBackground for creating filler objects.

Bug: v8:10315
Change-Id: Ifc22d87e1e835cfdd65d82fc79b20ee74b2c87b1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2336795Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69224}

This adds CDP methods to support skipping locations
on stepOver and stepInto.

Bug: chromium:1105765
Change-Id: I8b902009883807082cf5fda0411b992e90dee81d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2335181Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Kim-Anh Tran <kimanh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69223}

Add functionality to emit an event upon double
clicking on an event type on the timeline track
selected entries panel.

Bug: v8:10644

Change-Id: I54d4397abfeab471f01c2b24bae4eb1ff705afcd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2328787Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Zeynep Cankara <zcankara@google.com>
Cr-Commit-Position: refs/heads/master@{#69222}

Test now passes even if RO_SPACE sharing is enabled.

Bug: v8:10454
Change-Id: Ic7377c3367199383bb6a96a9beedcc52bbc3362f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2335184
Commit-Queue: Dan Elphick <delphick@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Auto-Submit: Dan Elphick <delphick@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69221}

Changes:
- Fix error message typo in function-body-decoder.
- Generalize wasm test macros related to reference types.
- Change wasm-gc test API to return bytes.
- Add unittests for ref.test/cast.

Bug: v8:7748
Change-Id: I361987e0b6ac90c4e89a49a8abc125757a5fc8d0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2317319
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69220}

This was wrong because ObjectBoilerplateDescription is a subclass of
FixedArray. The wrong order didn't cause problems because we explicitly
call the ObjectBoilerplateDescription constructor in the places that
matter.

Bug: v8:7790
Change-Id: I63b6b8741472862d2b1b9b843d7aa2490c620f87
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2335180
Commit-Queue: Georg Neis <neis@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Auto-Submit: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69219}

This CL aims to clean the code in App Class to
handle State, View according to the Model-View-Controller
design pattern.

Bug: v8:10644, v8:10735

Link: https://docs.google.com/presentation/d/1ssCIWKS5TIp_PHZRUx2BfElEz6JFrYzz_Ce1h1g8ZBg/edit?usp=sharing

Change-Id: Ie36d437df0df574f505a4396b26526a82215f237
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2324247
Commit-Queue: Zeynep Cankara <zcankara@google.com>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69218}

Let StressConcurrentAllocatorTask allocate small, medium and large
objects to test different code paths.

Bug: v8:10315
Change-Id: Ifff7e91bc95f0d926a58321b481183e9acf8bd32
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2335182
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69217}

This is a reland of b354e344

This CL adds 3 fixes:

* Unprotect code object before creating filler
* Allows AllocationObserver::Step to add more AllocationObservers
* Update limit in NewSpace::UpdateLinearAllocationArea

Original change's description:
> [heap] Refactor allocation observer in AllocationCounter
>
> Moves accounting of allocation observers into the AllocationCounter
> class. This CL removes top_on_previous_step_ for counters that are
> increased regularly in the slow path of the allocation functions.
>
> AdvanceAllocationObservers() informs the AllocationCounter about
> allocated bytes, InvokeAllocationObservers() needs to be invoked when
> an allocation step is reached. NextBytes() returns the number of bytes
> until the next AllocationObserver::Step needs to run.
>
> Bug: v8:10315
> Change-Id: I8b6eb8719ab032d44ee0614d2a0f2645bfce9df6
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2320650
> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69170}

Bug: v8:10315
Change-Id: I89ab4d5069a234a293471f613dab16b47d8fff89
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2332805Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69216}

A minor refactoring to the logic for triggering callbacks:
1. If compilation failed, do only trigger the kFailedCompilation event.
2. Use the TriggerCallbacks method also for triggering the
  kFailedCompilation event.

R=thibaudm@chromium.org

Bug: chromium:1101340
Change-Id: I3446d708d28068448e6eca3e637c9af673f5311d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2332171Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69215}

Bug: v8:10701
Change-Id: I6e6d0c67889f29647ea225163cf051d3432da338
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2335058Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Eva Herencsárová <evih@google.com>
Cr-Commit-Position: refs/heads/master@{#69214}

In preparation for adding new NCI (and TP) code kinds.

- Free the unused bit in Code::flags.
- Be more precise about the flag field sizes (int32 instead of int).
- Add and refactor related static asserts.

Bug: v8:8888
Change-Id: Ice0d4df9de528de77dfb5c04279cfdc4b030efc9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2328788
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69213}

The DevTools front-end uses so-called Wasm evaluator modules to get to
the values of variables in scope when the wasmDWARFDebugging experiment
is turned on. We rely on the `Debugger.executeWasmEvaluator()` method in
the Chrome DevTools Protocol (CDP) to accomplish this, which in turn is
controlled by this global flag.

Since we intend to gather more feedback from selected internal /
external teams on the DWARF debugging experience, we need to ship this
flag by default to make it easier to test the new experiment without
having to fiddle with additional flags to pass to Chrome on the command
line (and asking folks whether they really started Chrome correctly).

Bug: chromium:1041362
Change-Id: I1e170383fa7a34c41eec8c4867c38b7d8e871e8b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2335072
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Michael Hablich <hablich@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69212}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/edf75c7..b2c431c

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/f80ffe3..ce6a663

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/98b332f..6c7b829

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: If97b9c9eb4d56364f94f9e0453ba67b462643505
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2335955Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#69211}

I tripped over this str/bytes issue as part of bringing up the
Chromium build under Python3.

Bug: chromium:1112471
Change-Id: I723c7d9df8bcac24c160c549a03dcbd34c1d92f6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2334222
Commit-Queue: Dirk Pranke <dpranke@google.com>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69210}

No-Try: true
Change-Id: If5ed824ad3ea1a2815a0a48ed2668281733ac533
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2332603Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69209}

x64's implementation of i64x2.shr_s was overwriting the scratch
register. kScratchRegister is used to hold the extracted lane of the
SIMD register, but in certain cases [0], is also used to back up the
value of rcx. When this happens, the supposed backed-up rcx was
overwritten (definitely) by each extract lane, so we end up restoring
an incorrect value of rcx, leading to an eventual crash in certain
benchmarks, when this extracted lane was used as a memory operand (see
linked bugs).

[0] when register holding the shift value is not rcx, which sarq_cl
relies on

Bug: v8:10752
Bug: chromium:1111522
Change-Id: Iaf3264e16f94e78bad4290783757f0b722d40411
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2334354Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69208}

This is a stop-gap solution (while we wait for a proper spec)
that lets managed WasmGC objects perform round-trips through
JavaScript. On the JavaScript side, they appear as empty/opaque.

Bug: v8:7748
Change-Id: I0dd368bc14d622f3ef41871484228267359e9b5b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2316306
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69207}

This reached consensus in the July 2020 TC39:
https://github.com/tc39/ecma262/pull/2054

Bug: v8:10769
Change-Id: Iecea1d9d9c9be5c2fbfb820aed2285719c4e6382
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2333350
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69206}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/7c2575f..edf75c7

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/src/buildtools/+log/42e9461..6139217

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I80cf25941086ec9e94f0f5806c8c550ea0210280
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2334660Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#69205}

After allocating a new code space, we do some initial allocations in the
new space (e.g. for the jump table). These allocations are not allowed
to fail.
If this in indeed what's happening in the linked bug, this CHECK will
give fuzzers a chance to find us a reproducer.

Drive-by: Introduce {WasmCodeAllocator::kUnrestrictedRegion} to remove
magic constants.

R=ahaas@chromium.org

Bug: v8:1111266
Change-Id: Ia76721653226bd4aa346b89ffab0c80f67892794
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2333250
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69204}

If we cancel the task in the thread where it's supposed to run,
task cancelling will always succeed.

This simplifies the logic.

Bug: v8:10239
Change-Id: I3fb5c93a49c52d958aa947d693700161bc18eee5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2332807Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69203}

The majority of the content is the Atomics.waitAsync implementation
which I wrote.

"git blame" shows I've touched 123 / 274 lines in futex-emulation.h and
551 / 875 lines in futex-emulation.cc.

(Status before https://chromium-review.googlesource.com/c/v8/v8/+/2319989 which was moving
code around.)

No-Try: True
Change-Id: Ib31dc0bb778aed90d5c4c56ccb0e556655ce6946
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2332813
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69202}

Bug: chromium:1112260
Change-Id: I8c225594b48c4c2c69b6fde21ba65f8693e078c8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2335065
Commit-Queue: Liviu Rau <liviurau@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69201}

... since it's still a valid index.

Change-Id: I498ff27898cefa5df752ac0ad73408ce76ac06c6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2327911
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69200}

Change-Id: I5e31bbce2bfbf0effa2c660a67ec88bcd49d06a8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2335054
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69199}

Adds support for non-simple fp aliasing (e.g., Arm) for the fast
register allocator.

BUG=v8:9684

Change-Id: I6717ef1c6cb4e585fa4b6ea8cea7087e68f441e9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2300483
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69198}

A stricter V8-side check to flush out the linked bug.

Bug: v8:10460
Change-Id: I20a0026e35719632e90f0a00bc49eb27d81b273b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2335061
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69197}

Change-Id: Id545ca00106fb54ee08078177ad7f24842752afe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2332799Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69196}

Allow the allocation of large old space objects through
LocalHeap::AllocateRaw. OldLargeObjectSpace::AllocateRawBackground will
allocate a large object on the background thread.

Bug: v8:10315
Change-Id: I9212f0c6770855dbe33490516aae7056987e192d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2332804
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69195}

reinterpret_cast to std::atomic was missing const.

Bug: chromium:1108537
Change-Id: Ib737418bddbef6774deafa9714b0efcf2e3fd07c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2332797
Auto-Submit: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69194}

LocalHeap::AllocateRaw will be similar to Heap::AllocateRaw and
handle all allocations. LocalHeap::AllocateRawOrFail will perform a GC
and afterwards retry the allocation in a loop.

Bug: v8:10315
Change-Id: I68468962cf9102697aa547b2aa05c7ec6bafd19e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2332801Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69193}

Bug: v8:10315
Change-Id: Ic0ccaa608c9b11258e6923919d3e72d23cedc5c2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2333249Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69192}

Bug: v8:7790
Change-Id: Ie296b0bcc6c3b26be5ad54f4558a75250a2f2157
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2332232
Auto-Submit: Santiago Aboy Solanes <solanes@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69191}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/17f3b1c..7c2575f

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/2cd291a..f80ffe3

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/b63a569..1078c41

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I17dbc645ac8c8463a4468589277ab4203a5e9279
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2331870Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#69190}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/7f53cfc..17f3b1c

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/fd3758a..b63a569

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I7b38ec37acb0cd78f06f714b814072ebf68b63e3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2331868Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#69189}

Chrome is currently adding a 128-bit V8ContextToken to keep track of
V8 contexts across multiple isolates and processes. Having per-isolate
token exposed by V8 leads to confusion of these two tokens.

This moves v8::Context::Token to v8::metrics::Recorder and changes
the corresponding functions:
- v8::Context::GetToken => v8::metrics::Recorder::GetContextId
- v8::Context::GetByToken => v8::metrics::Recorder::GetContext

This CL is purely mechanical and does not change the behaviour.

Bug: chromium:1101749
Tbr: clemensb@chromium.org
Change-Id: I31bbfa02ebab1c0d91b00f0d08c1b236392d14d2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2330023
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Emanuel Ziegler <ecmziegler@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69188}

This reverts commit b354e344.

Reason for revert: Clusterfuzz found issues with this CL.

Original change's description:
> [heap] Refactor allocation observer in AllocationCounter
> 
> Moves accounting of allocation observers into the AllocationCounter
> class. This CL removes top_on_previous_step_ for counters that are
> increased regularly in the slow path of the allocation functions.
> 
> AdvanceAllocationObservers() informs the AllocationCounter about
> allocated bytes, InvokeAllocationObservers() needs to be invoked when
> an allocation step is reached. NextBytes() returns the number of bytes
> until the next AllocationObserver::Step needs to run.
> 
> Bug: v8:10315
> Change-Id: I8b6eb8719ab032d44ee0614d2a0f2645bfce9df6
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2320650
> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69170}

TBR=ulan@chromium.org,dinfuehr@chromium.org

Change-Id: Icd713207bfb2085421fd82009be24a0211ae86da
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10315
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2332667Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69187}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/65e3fac..7f53cfc

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I934b4eebcf58727531022998657954b718899b99
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2333182Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#69186}

Implement https://github.com/tc39/ecma402/pull/487
Also improve test/intl/toStringTag.js

see also: https://github.com/tc39/test262/pull/2712

Bug: v8:10744
Change-Id: I678876aa21f169a8dfcec8e3ce974978a8847fe0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2315455Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69185}