This reverts commit 48c9ca44.

Reason for revert: Possible clusterfuzz issues
Bug: chromium:1028952

Original change's description:
> [names] Fix some test262 name tests to conform with spec changes
>
> In order to reflect web reality, TC39 has made some slight changes to
> name descriptors, see https://github.com/tc39/ecma262/pull/1490 for
> details. V8 was mostly already in compliance with these changes, but
> ThrowTypeError and anonymous classes needed some slight changes.
>
> Bug: v8:9646
> Change-Id: I163238954938f0c005e3adbc61b90498e01436da
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1764622
> Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
> Commit-Queue: Joshua Litt <joshualitt@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#63373}

TBR=gsathya@chromium.org,joshualitt@chromium.org

Bug: v8:9646
Change-Id: I06dd5527d30052d9c9dfc45a2862be930274aba7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1939948Reviewed-by: Joshua Litt <joshualitt@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Joshua Litt <joshualitt@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65216}

port edd50ad2 https://crrev.com/c/1924355

Original Commit Message:

  In both ChangeIntPtrToSmi and ChangeInt32ToSmi we can use bitcasts
  instead of change nodes for Smi Tagging, when we are using 31 bit
  smis in 64 bit architectures with pointer compression enabled.

  In ChangeIntPtrToSmi we can ignore the truncation as well.

  Updated DecompressionOptimizer to match the new pattern.

Change-Id: I309e6c7ba671499f721149e1ea1c8e153fe3b2ef
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1939028
Auto-Submit: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65215}

Bug: chromium:1028475
Change-Id: I0101930e01d41b0f29fa28a257e3dc720069faff
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1936835Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Joshua Litt <joshualitt@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65214}

Adaptation coming from the ports for upstream purposes.

Change-Id: Ia1d0d6dabfd10d5840084bb90814c33ea9fb6aa8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1906373Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65213}

This removes the marking worklist draining loop from IncrementalMarking
and makes it use the one of MarkCompactCollector.

Bug: chromium:973627
Change-Id: I226b4b45be7d542a82bba20162ad210dfb419c39
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1940250
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65212}

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/1ef02be..fec12b8

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/341d41b..34267f8

Rolling v8/third_party/instrumented_libraries: https://chromium.googlesource.com/chromium/src/third_party/instrumented_libraries/+log/b627b3e..8c512f2

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: Iebb343ff9117ecf7377b7c4db9073807f44b6779
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1939745Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#65211}

In order to implement {dlsym} like functionality, toolchains might
generate code that grows the table by one element at a time (e.g.
Emscripten currently does that). To improve performance in such a case,
we over-allocate the backing store of the {WasmTableObject}. Whenever
the backing store grows, it grows at least by the old size of the table.
This ensures exponentially growth, avoiding too many re-allocations.

R=mstarzinger@chromium.org
CC=​ecmziegler@chromium.org

Bug: v8:10018
Change-Id: I502d590a89f7804363938a157b7ed2189283227a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1939051Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65210}

No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Change-Id: I0b0ab62625b69c3baa88d0b9850f946b901f31d5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1939456
Commit-Queue: Liviu Rau <liviurau@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65209}

BUG: v8:7463

Change-Id: I75e81aa78ce2cd75ab4e393ffaec614da6e2bf7b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1939708
Commit-Queue: Yang Guo <yangguo@chromium.org>
Auto-Submit: Yang Guo <yangguo@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65208}

Bug: chromium:1028669
Change-Id: I3f690508f09a98b6b6b0f3808033fac4fae40700
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1940248
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65207}

ObjectRefs either use the serialized data or access the heap depending
on whether broker mode is disabled or not. This cl changes it to use
the mode of the data and accesses heap for UnserializedHeapObject. This
allows us to access heap for some of the objects (ex: readonly object)
instead of serializing them.

This change shouldn't change any behaviour. In a followup cl, we will
mark readonly objects as UnserializedHeapObjects even when broker mode
is serialized.

Bug: v8:9684
Change-Id: I8775e60ed480957b485c39df254827dd69c655a8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1937148Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65206}

This reverts commit 347092ac.

Not a clean revert, since other changes got baked on top, but rather
a manual removal of LoadLazyICParameters.

Reason for revert: Seems to actually regress bindings perf tests (see
bugs and https://chromeperf.appspot.com/group_report?rev=62539), doesn't
seem to improve performance elsewhere, and increases complexity.

Original change's description:
> [ic] Load name/context lazily in LdaNamedProperty
>
> Introduces LazyLoadICParameters which allow a LazyNode for context and
> name. These aren't used on the fast path, so we want to avoid reading
> them for both performance and register pressure reasons.
>
> Change-Id: Ifb637cf4782ce984feee9af503998e7539beb823
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1686665
> Commit-Queue: Leszek Swirski <leszeks@chromium.org>
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#62539}

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: chromium:981797
Bug: chromium:982630
Change-Id: I88af764d17afb76d6e64b95a3d1e4aaa1c6c8978
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1934327
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65205}

Deprecated in 79.

Change-Id: If0e2b95b4b66328858b33a533454a469c80fad63
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1940147
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Auto-Submit: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65204}

No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Change-Id: I24ea5db016039f916a07f7c9361442b00d44a6c1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1939454
Commit-Queue: Liviu Rau <liviurau@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65203}

Enabling concurrent inlining builds the graph on background thread
reducing the time spent on main thread.

Bug: v8:9684
Change-Id: Iee00aa991ab8e14fad76b0d9c0b0fd9f8d1eecde
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1937149Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65202}

https://v8.dev/blog/tags/release is the new ChangeLog!

No-Try: true
Bug: v8:10010
Change-Id: I6a0a8a893dfa29607ba2431daeea8ad1b11e2405
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1940148Reviewed-by: Mathias Bynens <mathias@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65201}

We want to grow the table entries exponentially, so the entries length
will not reflect the actual size of the table any more. Hence, introduce
another field on {WasmTableObject} to store the actual length.

R=mstarzinger@chromium.org
CC=ecmziegler@chromium.org

Bug: v8:10018
Change-Id: Ie8252f33fddda3ae60dd24bd8db148fd67262226
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1939050
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65200}

To indicate that the Isolate* in getters might not be a "real" isolate,
but rather a calculated one from GetIsolateForPtrCompr only used for
calculating the isolate root, make that function return a const Isolate*
and change field getters, Object::IsFoo predicates, and related
functions to all take a const Isolate* instead of an Isolate*

With this change, we can slightly more confidently use Objects that are
in OffThreadSpace, without having to worry too much about having an
Isolate* floating around that could accidentally be used.

This is a slight abuse of const semantics, but it allows implicit
conversion from Isolate* arguments to the const Isolate* parameter.

Bug: v8:7703
Bug: chromium:1011762
Change-Id: I54d4a65d2299477195f4d754cabe64ce34fdaa4c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1939455
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65199}

This was added in 2d889aa9 but all consumers of it have since been
removed.

Bug: v8:10021
Change-Id: I13aa12853e1720b2f919ca8b29737fedb96bc145
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1938462
Auto-Submit: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65198}

No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Change-Id: I2dfffdbcb2052880c57a02f7b67cd7f8a4da706f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1939453
Commit-Queue: Liviu Rau <liviurau@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65197}

This enum defined three modes of doing inlining:
kGeneralInlining, kRestrictedInlining, kStressInlining.
kStressInlining was unused. kRestrictedInlining meant
that JSInliningHeuristic::Reduce would return NoChange,
but only after wasting some time inspecting calls. This
is now replaced by simply not installing JSInliningHeuristic
as a reducer when inlining is disabled.

Note: There is still a --stress-inline flag, which sets
(through flag implications) a bunch of parameters that affect
inlining.

Change-Id: I05bafbe3f1f35610d7035a2c71c5ac17bdb80758
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1936473
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65196}

Bug: v8:9861
Change-Id: I7bcd8059145cf8be12d59b30745e79f56b896ef2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1932369
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65195}

All builtins are now guaranteed to be in the embedded blob. Setup of
the builtins entry table can be simplified to directly fetch
instruction starts from the embedded blob.

Additionally, this CL adds a sanity check for the builtin Code
object's builtin_index (to verify the Code object is uncorrupted). The
CHECK can be removed or changed to a DCHECK once the linked bug is
resolved.

Bug: chromium:1020986
Change-Id: I38832790132e284c7fc23251a5dc2eefb8456de6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1939048
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65194}

After landing a few relatively simple ports in preceding work, this CL
ports the more involved Array.prototype.forEach reduction, containing
checkpoints, JS and runtime calls, loops, and exceptions. With the
mechanisms introduced in this change, I'd expect a large chunk of
js-call reductions to be trivially portable.

Newly introduced:
- IfBuilder0 for if-then-else statements (with optional else).
- ForBuilder for for-loop statements.
- MayThrow() for exceptional control flow. Exceptional edges are
  automatically merged and wired into the outer graph if necessary.

Bug: v8:9972
Change-Id: I835bf90c5871fbd94a1d12721d44b500fbef75e2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1921798Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65193}

Bug: v8:7783
Change-Id: I5273d7fb34d216d556792aa940765d7e1a060b7c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1939448Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65192}

https://v8.dev/blog/tags/release is the new ChangeLog!

This also removes an unused file push_to_candidate.py which wasn't deleted
earlier as it's intertwined a lot in test cases. This CL also cleans that
up.

Furthermore, logic for selecting CLs for the ChangeLog (using LOG= lines)
is removed as well. Nobody has used this feature for more than 5 release
cycles.

We'll delete the ChangeLog file in a separate CL.

Bug: v8:10010
No-Try: true
Change-Id: Idee551dc0600c3df9f784cc543897e3e18517ca1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1930616Reviewed-by: Tamer Tas <tmrts@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65191}

This adds a few tests that test that the output of Liftoff is
deterministic.
These tests will be extended to test the debug side table in follow-up
CLs.

R=mstarzinger@chromium.org

Bug: v8:10019
Change-Id: Ia7992e7a889bf6dad963e5abe5b50507735996a1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1932371
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65190}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/e2349a5..5fafe92

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/bee6bf4..1ef02be

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/83aafc9..341d41b

Rolling v8/third_party/fuchsia-sdk: https://chromium.googlesource.com/chromium/src/third_party/fuchsia-sdk/+log/1785f0a..a841030

Rolling v8/third_party/zlib: https://chromium.googlesource.com/chromium/src/third_party/zlib/+log/7c4128a..e77e1c0

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: I58e4daf7b3be28b0c254bc104dfc601304bcbec2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1936836Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65189}

The ShlPair function has two out of order instructions, this patch
reorder them and add some checks to prevent the dst register from
conflicting with the src register.

Change-Id: I2dd4b20a5c55fbbe75b126162302997acec5a6bb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1936647
Auto-Submit: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65188}

Port edd50ad2

Change-Id: Ibad74933a6f70c6cbd2fb06f5d1a824f0a199609
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1935256Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#65187}

This should help reduce the number of false positives detected
by dead variable analysis.

Bug: v8:9680, chromium:1000635
Change-Id: Id2893dd5f26cad230dede96930a5caacc0272b64
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1924359
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65186}

Now since we also encode KeyedAccessStoreMode information in the slow
handler for some cases, the DCheck can result in failure.The Check can
result in failures for other cases of StoreSlow. Removing the DCHECK
altogether, now verifying the correctness of the behavior using the
Kind Bits of the Handler in the method GetKeyedAccessStoreMode.


Bug: chromium:1027025, chromium:1028085
Change-Id: I59acedbb499930e67ae5999d4bfd0f040a34b46e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1929408Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Suraj Sharma <surshar@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#65185}

Make WasmFeatures a proper class which uses an EnumSet under the hood.
This way, it inherits all behaviour of EnumSet like comparison, merge,
etc.
Accesses change from being simple field access into the struct to
actually bit tests in the EnumSet.

R=mstarzinger@chromium.org

Bug: v8:10019
Change-Id: I768f92b90ac0294156f4482defba5ce00bc70165
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1934334
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65184}

Until now, the in-object properties on JSObject have been invisible to
tools using the postmortem debugging library. With this change, those
tools will get enough information to show a flat list of property
values. This is still less powerful than the runtime printers, which can
show the corresponding key for each value, but it's a big step up from
manually inspecting memory.

This change basically requires a reimplementation of
Map::GetInObjectProperties for postmortem debugging. I'm not
enthusiastic about duplicating this logic, but it's pretty small and I
don't see any good alternatives.

As a drive-by cleanup, I moved some inline string literals into a batch
of constexpr char arrays.

Bug: v8:9376
Change-Id: Ia24c05f6e823086babaa07882d0d320ab9a225db
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1930174Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#65183}

R=jkummerow@chromium.org

Bug: v8:9810
Change-Id: I1ce34f5c34c0a858cb725d56ef47d9dbd697a1e3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1934336
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65182}

Significantly reduces the number of blocks in CSA code generated by
Torque by merging blocks along a straight-line path into a single
block.

Bug: v8:9861
Change-Id: I592cc1ed5b1ca0ad12c907d5cce7dcf7fec5f141
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1917157
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65181}

We were abusing of ChangeInt32ToIntPtr since we were using it with Smis
as inputs. The new ChangeTaggedInt32ToSmi takes a smi value in 32 bits
and extends it (if necessary) to 64 bits.

Knowing it's a smi lets us skip the ChangeInt32ToInt64 when we are
using 31 bit smis.

Change-Id: Ibd88127fa8122d4b9f683151469cd37320515b5c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1921985
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65180}

This fixes a simple error in the parser fuzzer, where we accessed the
{parentheses} vector without checking that it is non-empty.

Drive-by: Some formatting cleanup, and switch to {vector} for
  performance.

R=mstarzinger@chromium.org

Bug: chromium:1027132
Change-Id: I5faa39885801953f2fb698b1131eab1f138a524d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1936472Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65179}

This renames the macro parameter {index} to {sig_index} to make clear
that this should be the index of a signature.
It also fixes some tests that wrongly passed a function index here (with
no observable difference in the test outcome unfortunately).
It also renames some {f[0-3]} variables to {sig[0-3]} to make it clear
that they refer to signatures.

R=mstarzinger@chromium.org

Bug: v8:10021
Change-Id: Ia4f697acd5d6a2e6f2fb45b680dac20f24ea1b08
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1936471
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65178}

(1) One more place in ic.cc must guard against "lookup->name()" calls
when the LookupIterator might be in indexed mode.

(2) Rather than burdening LookupIterator users with specifying
"kGuaranteedNoTypedArray", we can do the corresponding calculation in
the LookupIterator itself, which makes it robust towards any callers
that haven't been updated (specifically, in Object.values).

Bug: chromium:1027461,chromium:1028213
Change-Id: I76b5d08e309fc2a694955b537adbeb5a30e681f7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1936474Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65177}