Reduce the dispatching overhead in the hottest loop when parsing log-lines.

- Using a JSMap we can avoid internalizing strings
- Preprocess the dispatch table and only have varArgs or functions as
  parsers
- string[] seems to be slightly faster than string.charAt()

Bug: v8:10644
Change-Id: I03b13bdeecda1ad037191ff74e05142ceeb6533c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3571890Reviewed-by: Patrick Thier <pthier@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79816}

The 'ForRegs' method is not needed for clarity of the code, it's pretty
clear what to construct a register list from. Hence turn the static
{LiftoffRegList::ForRegs} method into a constructor. This makes the code
more concise.

Also, turn the for loop into a C++17 folding expression, which might
generate better code because the loop will automatically be unrolled.

R=thibaudm@chromium.org

Bug: v8:12425
Change-Id: Ic4446f23022db5f17420303d45b9c15fa5daff60
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3572041Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79815}

This CL adds additional checks for typed slots cleanup in the sweeper:

1) Old-to-old typed slots should never be removed during sweeping. Such
slots are only ever recorded on live code objects (which are never
e.g. right-trimmed or invalidated).

2) Old-to-new typed slots should never be removed when sweeping
lazily or concurrently. New space is empty after a full GC, therefore
the old-to-new typed slots are also cleared during a full GC. The main
thread can record new slots but not in free memory.

Bug: v8:12760
Change-Id: I7b507c862e43a15437e8ee609c6c2af0abf3a5ec
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3568479Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79814}

This is a reland of commit 54e360d1.
The two WasmGC cctests which require SSE4.1 support in Liftoff are now
skipped, so we can keep disallowing any bailout (even for missing CPU
features) in --liftoff-only.

Original change's description:
> [wasm] --liftoff-only should disable --wasm-dynamic-tiering
>
> A Liftoff only configuration should never tier up to TurboFan, hence add
> a proper implication to disable dynamic tiering if --liftoff-only is
> set.
> Also, add a DCHECK to ensure we never accidentally compile with TurboFan
> if --liftoff-only is set.
>
> R=jkummerow@chromium.org
>
> Bug: v8:12281
> Change-Id: Ia9b81add503cc939f59fde3f4d3bb67252facf2c
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3569741
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Clemens Backes <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#79779}

Bug: v8:12281
Change-Id: I334bd81f75c3ef6d31b6117da5ef59a33fb46ae2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3572043Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79813}

Remove the pre-C++17 implementation of void_t, just use std::void_t now.

R=omerkatz@chromium.org

Bug: v8:12425
Change-Id: Iabf72f1540ddb4db666e5a74f169f73546241c1f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3571888Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79812}

Change from V8_DEPRECATE_SOON to V8_DEPRECATED. It turned out that we
don't have to make changes in chrome code, so we can go to deprecated
right away.

Bug: chromium:1310790
Change-Id: I1bd529536d3a0098f11f13b3e44fe3dbc80eed04
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3571897Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Stephen Röttger <sroettger@google.com>
Cr-Commit-Position: refs/heads/main@{#79811}

This reverts commit 8ba60b7a.

Reason for revert: code_serializer failures: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux%20-%20debug/38940/overview

Original change's description:
> [string] Non-transitioning shared strings
>
> Instead of transitioning shared strings to ThinString on
> internalization, use a forwarding table to the internalized string and
> store the index into the forwarding table in the string's hash field.
>
> This way we don't need to handle concurrent string transitions that
> modify the underlying string data.
>
> During stop-the-world GC, live strings in the forwarding table are
> migrated to regular ThinStrings.
>
> Bug: v8:12007
> Change-Id: I6c6f3d41c6f644e0aaeafbf25ecec5ce0aa0d2d8
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3536647
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Reviewed-by: Jakob Linke <jgruber@chromium.org>
> Reviewed-by: Shu-yu Guo <syg@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Commit-Queue: Patrick Thier <pthier@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#79801}

Bug: v8:12007
Change-Id: I740904f3edfc395331f06c7218e89476b06b0563
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3574543
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Owners-Override: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#79810}

Change-Id: Ibc256e202a75f7dbcba27dad2b591cf45738b005
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3571900
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79809}

Change-Id: Ia574baaa796f1b2d6feea3e76364c9c417fb8ceb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3571899
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79808}

* When the source node is above the target node we draw curved (cubic bezier) lines.
* Else, we fallback to rectangular lines.

Change-Id: Ic80245c7b449942e4477f0056e63618cfbeaaaf7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3565715Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Auto-Submit: Harshal Nandigramwar <pro.bbcom18@gmail.com>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79807}

Report per-cycle incremental mark/sweep statistics to the Recorder API.
These will be used by Blink to populate UMA histograms such as
V8.GC.Cycle.MainThread.Full.Incremental.(Mark|Sweep).
Also, report time spent in starting incremental marking, used by Blink
to populate V8.GC.Event.MainThread.Full.Incremental.Mark.Start.

Bug: chromium:1154636
Change-Id: Iad205471f3b20843b7e439f47c0d681e840c9043
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3568480Reviewed-by: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79806}

With this CL, spilled parameters with ref type in a call to wasm
function, will be placed at a consecutive area in the generic
JSToWasmWrapper frame as WasmCallDescriptor expected.

Bug: v8:12722
Change-Id: I8b82f35b712a32b87abf5100ec46ee499a8178bc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3563445Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79805}

This enabled dynamic tiering by default in V8. Chromium overwrites the
default, so this CL by itself has no effect on Chrome users, but a
similar CL will land in the chromium repo.

R=mslekova@chromium.org

Bug: v8:12281
Change-Id: Iaa6d77dc80063f3c4e1d005c371573fc70c698aa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3568449Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79804}

Use C++17's std::conjunction instead.

R=leszeks@chromium.org

Bug: v8:12425
Change-Id: I004a1bb4fe1b09f441f8822075a72fd20fc90fec
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3570429Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79803}

This flag was a leftover from very early Turbofan days and serves no
purpose. Non-OSR TF code automatically uses function context
specialization (FCS) when appropriate without looking at the flag
value. OSR TF code should never use FCS since it is cached by the
SharedFunctionInfo (not by the JSFunction).

Bug: v8:12161
Change-Id: Ifb5a10918dbdf34a7164f7e665a230698b793e9e
Fixed: chromium:1313419
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3571895
Auto-Submit: Jakob Linke <jgruber@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79802}

Instead of transitioning shared strings to ThinString on
internalization, use a forwarding table to the internalized string and
store the index into the forwarding table in the string's hash field.

This way we don't need to handle concurrent string transitions that
modify the underlying string data.

During stop-the-world GC, live strings in the forwarding table are
migrated to regular ThinStrings.

Bug: v8:12007
Change-Id: I6c6f3d41c6f644e0aaeafbf25ecec5ce0aa0d2d8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3536647Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Jakob Linke <jgruber@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79801}

Oilpan minor GC currently doesn't support running with the stack. The CL
changes minor GCs to run only when running from task.

Bug: chromium:1029379
Change-Id: I96552772e9c3b653a137f48bbaae44278db8f014
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3571891Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79800}

This CL introduces the --separate-gc-phases flag, which prevents that young and old generation GCs can happen at the same time. When incremental marking is in progress and a young generation GC triggers, marking is forced to finish and the full collection takes care of the young generation.

Bug: v8:12503
Change-Id: Ia3e4814f46bff0fdc404b0ac618dfd48fe7cf20c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3351973Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79799}

Only remove old-to-old slots during a GC, but DCHECK that the
old-to-old-slot set is empty after a full GC.

Previously we simply removed from the remembered set during and outside
the full GC. We now have a flag to DCHECK this more precisely.

Bug: v8:12760
Change-Id: Ie6adc3f47a700497aaa818da0e83d6cb94e3c75d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3562981Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79798}

Port commit 1ff685d8

Fixed: v8:12765
Change-Id: Ia5ac9f06a70a11c3d7a9d97f6772f8f37db0df6f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3573114
Auto-Submit: Yu Liu <liuyu@loongson.cn>
Reviewed-by: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/main@{#79797}

This reverts commit 8d51d561.

Reason for revert: This has runtime failures because including
cmx fragments isn't working ocrrectly. Still investigating why
this wasn't discovered by CQ.

Original change's description:
> [fuchsia] Use SDK provided gn templates for v8_unittests
>
> cr_fuchsia_package is deprecated in favor of using the Fuchsia
> SDK provided rules directly.
>
> Bug: chromium:1092804
> Change-Id: I86a59b6a717cb0aa8c3473e8410bdd98f0ffd042
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3537883
> Reviewed-by: Victor Gomes <victorgomes@chromium.org>
> Reviewed-by: Wez <wez@chromium.org>
> Reviewed-by: Camillo Bruni <cbruni@chromium.org>
> Commit-Queue: Bryant Chandler <bryantchandler@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#79763}

Bug: chromium:1092804
Change-Id: I33e8a6f07c99d7040cffa579a95508e79904889e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3572005
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79796}

Add AO: DefaultMergeFields
Spec Text:
https://tc39.es/proposal-temporal/#sec-temporal.calendar.prototype.mergefields
https://tc39.es/proposal-temporal/#sec-temporal-defaultmergefields


Bug: v8:11544
Change-Id: I270f8bffb79e57ef50736ae7ce87cfa53f9cafb1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3388428Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79795}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/1356876..e5b74ea

Rolling v8/buildtools/linux64: git_revision:859dde4a7f34a4383179522f8e1061dcffac8691..git_revision:5eb3845ec2d8296b4f41da4eca85302eb111fe69

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/c4e6210..ec5b008

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/c4b1b77..b8a4c0b

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/fbe0742..bd06a4f

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: Ifb08780b273b3abd5321040de125f18b0d3edf73
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3572947
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#79794}

Also add AO: RegulateISODate, ResolveISOMonth, ISODateFromFields

Spec Text:
https://tc39.es/proposal-temporal/#sec-temporal.calendar.prototype.datefromfields
https://tc39.es/proposal-temporal/#sec-temporal-regulateisodate
https://tc39.es/proposal-temporal/#sec-temporal-resolveisomonth
https://tc39.es/proposal-temporal/#sec-temporal-isodatefromfields

Note:
This is only the non-intl version. The intl version in
https://tc39.es/proposal-temporal/#sup-temporal.calendar.prototype.datefromfields
will be implemented in later cl.

Bug: v8:11544
Change-Id: I493dc60694421e9908eb5d785fdb8b07fc968699
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3408462Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79793}

Bug: v8:12750, v8:11111
Change-Id: I3e9947ec8e2883364178b497a49299a3a96332e4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3569879Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79792}

Port 1ff685d8

Change-Id: Ie60f3b9258114564d3e6a20a0049552694003d52
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3573783
Auto-Submit: Yahan Lu <yahan@iscas.ac.cn>
Reviewed-by: ji qiu <qiuji@iscas.ac.cn>
Commit-Queue: ji qiu <qiuji@iscas.ac.cn>
Cr-Commit-Position: refs/heads/main@{#79791}

If the name of a wasm function is empty, use wasm-function#id instead.

Change-Id: Ifdfb969a4d0ba5329fea0325397938e8274cf3db
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3566229Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Commit-Queue: Jie Pan <jie.pan@intel.com>
Cr-Commit-Position: refs/heads/main@{#79790}

For the normative change, see https://github.com/tc39/ecma262/pull/2723

Bug: v8:12750, v8:11111
Change-Id: I8e8a2e9b443622b20bb5a4c2d453f782dfbd2ed6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3570865
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79789}

https://chromium.googlesource.com/external/github.com/tc39/test262/+log/4c7c24646a..d7c0a2076c

Bug: v8:7834, v8:10776, v8:11544, v8:12744, v8:12750
Change-Id: I782a347833af3418ff5c15562ae24f213375b539
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3573067
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Auto-Submit: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79788}

The FastArray path for Array#groupBy and Array#groupByToMap does not
recheck the input array's length each iteration. This is incorrect since
the grouping callback can truncate the length, and we should deopt to the
generic path when this happens.

Bug: chromium:1312838, v8:12499
Change-Id: Id3a4973e9960500a2f29ed63281ea721777d4dd3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3570342Reviewed-by: Marja Hölttä <marja@chromium.org>
Auto-Submit: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79787}

- Double click on the current timeline selection to focus and zoom in
- Make timeline-tracks focusable by setting a tabindex
- Add back arrow-key navigation for the map panel (only when focused)
- Prepare code for adding keyboard-based horizontal scrolling
- Use --code-font CSS variable

Bug: v8:10644
Change-Id: Ic473695c9fcdc795d173cd064b4660e100ae8b24
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3568475Reviewed-by: Patrick Thier <pthier@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79786}

The DCHECKs check that the metrics from previous cycles are extracted
for both young and full GCs.

Bug: chromium:1029379
Change-Id: I8390d474abc8bd698e7f02896383b6fe013d792e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3570430Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79785}

Incremental finalization previously used to rescan roots to avoid any
new work showing up in the atomic pause.

With concurrent marking we should be way faster in finalizing, so that
we can save ourselves this work. In particular, if we finalize in the
same JS execution we would be doubling work as the atomic pause
anyways needs to rescan all roots.

Bug: v8:12775
Change-Id: I58a5a931da72c8d5c8aee4cd5dad4512954668b4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3570427Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79784}

Use C++17's std::void_t instead.

R=leszeks@chromium.org

Bug: v8:12425
Change-Id: I1367af170505ed97a725e22f6b60cce056f72cb1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3568476Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79783}

Pass the context as an argument of the runtime function, instead
of using the stack frame iterator to find it.

R=jkummerow@chromium.org

Bug: v8:12191
Change-Id: I43c0cf74b1b83b9c1c63df99c3816bd3f3e94ebf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3562984Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79782}

This reverts commit 54e360d1.

Reason for revert: Waterfall failures https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux%20-%20debug/38922/overview

Original change's description:
> [wasm] --liftoff-only should disable --wasm-dynamic-tiering
>
> A Liftoff only configuration should never tier up to TurboFan, hence add
> a proper implication to disable dynamic tiering if --liftoff-only is
> set.
> Also, add a DCHECK to ensure we never accidentally compile with TurboFan
> if --liftoff-only is set.
>
> R=​jkummerow@chromium.org
>
> Bug: v8:12281
> Change-Id: Ia9b81add503cc939f59fde3f4d3bb67252facf2c
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3569741
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Clemens Backes <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#79779}

Bug: v8:12281
Change-Id: Ie1551a9c7b4491cf02995acd0b72a276c2f68eab
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3572042
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79781}

When the heap is gracefully terminated, all the destructors are called.
CrossThreadPersistents must clear the back references (references from
CrossThreadPersistentRegion) so that further GCs on other threads will
not access freed CTPs.

To force destruction with young-gen enabled, the CL unmarks the heap on
termination.

Bug: chromium:1029379
Change-Id: I7f4a34a914ca20b50fe6d2ad493d56e0ba525ecc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3568473Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79780}

A Liftoff only configuration should never tier up to TurboFan, hence add
a proper implication to disable dynamic tiering if --liftoff-only is
set.
Also, add a DCHECK to ensure we never accidentally compile with TurboFan
if --liftoff-only is set.

R=jkummerow@chromium.org

Bug: v8:12281
Change-Id: Ia9b81add503cc939f59fde3f4d3bb67252facf2c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3569741Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79779}

This reverts commit 1f0d7d20.

Reason for revert: Speculative revert for roll failures in https://chromium-review.googlesource.com/c/chromium/src/+/3569445

Original change's description:
> cppgc-js: Concurrently process v8::TracedReference
>
> Adds concurrent marking for reaching through v8::TracedReference.
> Before this CL, a v8::TracedReference would always be processed on the
> main thread by pushing a callback for each encountered reference.
>
> This CL now wires up concurrent handling for such references. In particular:
> - Global handles are already marked as well and not repurposed during
>   the same GC cycle.
> - Since global handles are not repurposed, it is enough to
>   double-deref to the V8 object, checking for possible null pointers.
> - The bitmap for global handle flags is mostly non-atomic, with the
>   markbit being the exception.
> - Finally, all state is wired up in CppHeap. Concurrent markers keep
>   their own local worklist while the mutator marker directly pushes to
>   the worklist owned by V8.
>
> Bug: v8:12600
> Change-Id: Ia67dbd18a57dbcccf4dfb9ccfdb9ee438d27fe71
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3516255
> Reviewed-by: Omer Katz <omerkatz@chromium.org>
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#79736}

Bug: v8:12600
Change-Id: I8a91dcd6880580207bf8d315b264edbe42a794e5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3568474
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Owners-Override: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79778}

R=jkummerow@chromium.org
CC=fgm@chromium.org

Change-Id: I57c1860ef35919cdc7752e1dcc1beccfb4282b90
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3555770Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79777}