Class Constructors are special, because they are callable but [[Call]]
raises an exception. Instead of checking if a JS function is a class
constructor for every JS function call, this CL adds a new instance
type for class constructors.
This way we can use a fast instance type range check for the common
case, and only check for class constructors in the uncommon case were
a class constructor is called and when we need to raise an exception.

Change-Id: Ic6fdd9829722d05559fdfd01f6100c61873a0872
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3186434Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77140}

During a final atomic pause CrossThreadPersistent handles need to be
frozen after they have been marked to avoid any
WeakCrossThreadPersistent handles creating new strong references
(through their Lock() call) that would retain objects.

Handles are frozen by acquiring a lock. Since this lock is also taking
by other threads on WCTP::Lock() this can introduce jank.

This CL improves the situation by delaying processing of CTP
references until absolutely necessary, i.e., when we have otherwise no
more objects to mark.

Bug: chromium:1252743
Change-Id: I872f38c6d24d7955bea74fd59685abd3019b385e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3194253Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77139}

.. and refactor js-regexp.h.

- Hide the generic DataAt/SetDataAt accessors and replace them by
  dedicated accessors. Use the common lower_case naming scheme for
  these.
- Shuffle around definitions in js-regexp.h s.t. they are in a
  meaningful order.
- Dedupe the source/flags accessors - these fields are stored both
  on the instance and on the data array. We keep only accessors for
  the instance. Previously, these were disambiguated through naming
  oddities (e.g. Pattern() returned data->source).

Change-Id: I3d53c8b095f0d59621ff779608438f7fa5e8c92a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3193534
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77138}

Bug: v8:7790
Change-Id: I5439fa0a8ecfab8f407e2aeeaffd4b4f656cdfe1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3192674
Commit-Queue: Georg Neis <neis@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77137}

Change-Id: Ieb986b9e17103ec24ca98a7ab44e7bef9caa6bfa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3194013Reviewed-by: ji qiu <qiuji@iscas.ac.cn>
Commit-Queue: ji qiu <qiuji@iscas.ac.cn>
Cr-Commit-Position: refs/heads/main@{#77136}

This is a reland of 7d849870

Original change's description:
> [regexp] Reorganize and deduplicate in the regexp parser
>
> The parser is organized in a somewhat tricky way s.t. it can be
> hard to map the implementation back to the specified grammar.
>
> In particular, the logic for CharacterClassEscape, ClassEscape,
> and CharacterEscape was implemented twice - once inside a character
> class, once outside.
>
> This CL refactors related logic to have only a single implementation.
>
> As a drive-by, fix one related inconsistency related to \k inside
> a character class.
>
> Fixed: v8:10602
> Change-Id: I5858840159694fa6f8d1aa857027db80754e3dfd
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3178966
> Reviewed-by: Mathias Bynens <mathias@chromium.org>
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#77114}

Fixed: v8:10602,chromium:1253976
Change-Id: I9e7cc6a34d3be06e1a68895775aa50b0eee78c57
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3193531Reviewed-by: Mathias Bynens <mathias@chromium.org>
Commit-Queue: Mathias Bynens <mathias@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77135}

Rolling v8/base/trace_event/common: https://chromium.googlesource.com/chromium/src/base/trace_event/common/+log/715537d..68d8169

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/a76920d..ecb990f

Rolling v8/third_party/aemu-linux-x64: 6Vr4alb5803W2n5PbA5ZLwCcJznKdmFX1pDoy_5hfOAC..e_KiIcYNB7sHa2eqRBhqVoR_Mmg2Q7nqmzRCXzegWQAC

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/2146b04..5afc365

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/ce514ad..764c927

Rolling v8/third_party/googletest/src: https://chromium.googlesource.com/external/github.com/google/googletest/+log/e4717df..ab36804

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/2e80143..278dd91

Rolling v8/tools/luci-go: git_revision:e9585787c808e21d6eaa2c7d7a928dbc19999172..git_revision:a373a19da0fbbbe81b2b684e3797260294393e40

Rolling v8/tools/luci-go: git_revision:e9585787c808e21d6eaa2c7d7a928dbc19999172..git_revision:a373a19da0fbbbe81b2b684e3797260294393e40

Rolling v8/tools/luci-go: git_revision:e9585787c808e21d6eaa2c7d7a928dbc19999172..git_revision:a373a19da0fbbbe81b2b684e3797260294393e40

TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I4765817d9f51dd6f7d9a600799098134eee1a8fb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3192297Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#77134}

This reverts commit 649e9113.

Reason for revert: Abseil was reverted due to gcc failures, so reverting this first. When upstream fixes land, we can reland abseil and this change.

Original change's description:
> [bazel] Adds support to abseil
>
> No-Try: true
> Bug: v8:11006
> Change-Id: Ie2758849fcb8b19ae34289d3e762094b062f2a5c
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3168644
> Reviewed-by: Dan Elphick <delphick@chromium.org>
> Commit-Queue: Victor Gomes <victorgomes@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#76938}

Bug: v8:11006
Change-Id: Iedde555df8bc736cf922b0d9f51b0a78f7e1db49
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3192192
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77133}

This reverts commit 214ef26d.

Reason for revert: gcc bots are failing https://crbug.com/v8/12248

Original change's description:
> Reland "[DEPS] Add abseil to deps"
>
> This is a reland of 3c49308a
>
> Original change's description:
> > [DEPS] Add abseil to deps
> >
> > Add a dependency on the chromium abseil-cpp subdir mirror.
> >
> > Bug: v8:11006
> > Change-Id: Icaad757269d27c65bc368ed539f84c5bb79ee62d
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2464940
> > Commit-Queue: Leszek Swirski <leszeks@chromium.org>
> > Reviewed-by: Yang Guo <yangguo@chromium.org>
> > Reviewed-by: Victor Gomes <victorgomes@chromium.org>
> > Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#70786}
>
> Bug: v8:11006
> Change-Id: I2befd2eadd11d485eee47c68119d93be9a3e1655
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2504257
> Commit-Queue: Leszek Swirski <leszeks@chromium.org>
> Reviewed-by: Adam Klein <adamk@chromium.org>
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Reviewed-by: Hannes Payer <hpayer@chromium.org>
> Reviewed-by: Victor Gomes <victorgomes@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#76897}

Bug: v8:11006
Change-Id: Icdc7ed108a49fa33a0233a1af8ba8e4d9daadfd8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3191392Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77132}

Refactor code such that the linear algorithm is actually executed
outside the method for the fixpoint iteration. Also added a CHECK
which verifies that iterating the ephemerons one more time results in
no further marked objects.

Also force another iteration when ProcessMarkingWorklist() processed
some object. In such cases we need to re-process all ephemerons
otherwise ephemeron semantics might be broken.

Bug: chromium:1252918
Change-Id: I9123dda50e34227a04825fd8b3172368286cc76f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3190100
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77131}

Bug: v8:12244,v8:12245
Change-Id: I81cf283f4b38930c74c1e4508711af0d4702128d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3187273Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77130}

Bug: v8:12244
Change-Id: I7ea68dd74a376221631d7f56b4a012207f68a1ec
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3182899Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77129}

As now struct and array types are generated arbitrary,
struct.set should only pick mutable fields.

Bug: v8:11954, chromium:1253031
Change-Id: Ic248e93b09ffefd4f5547e102c8ea4d56bb2bd90
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3186439
Commit-Queue: Maria Tîmbur <mtimbur@google.com>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77128}

This reverts commit e47f9200.

Reason for revert: https://ci.chromium.org/p/v8/builders/ci/V8%20Win64%20-%20msvc/19428?

Original change's description:
> cppgc: Inline allocation fast path across api boundary
>
> Bug: chromium:1239030, chromium:1056170
> Change-Id: I4a559027e63ebbd99e51344aa659d4fb284df88f
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3190094
> Commit-Queue: Omer Katz <omerkatz@chromium.org>
> Reviewed-by: Anton Bikineev <bikineev@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#77124}

Bug: chromium:1239030, chromium:1056170
Change-Id: I13b6f16449361a7fb9f1cac5b2e0938632df6518
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3191210
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77127}

Because there can be fewer function signatures than there are
functions a new ForceAddSignature function was added which does
not deduplicate.


Bug: v8:11954
Change-Id: Ib028de47962dd1e797ead1b1f05a4e6815029487
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3186431
Commit-Queue: Maria Tîmbur <mtimbur@google.com>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77126}

This reverts commit 7d849870.

Reason for revert: Will block roll. Broke error message tests upstream:

https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Blink%20Win/6635/overview


Original change's description:
> [regexp] Reorganize and deduplicate in the regexp parser
>
> The parser is organized in a somewhat tricky way s.t. it can be
> hard to map the implementation back to the specified grammar.
>
> In particular, the logic for CharacterClassEscape, ClassEscape,
> and CharacterEscape was implemented twice - once inside a character
> class, once outside.
>
> This CL refactors related logic to have only a single implementation.
>
> As a drive-by, fix one related inconsistency related to \k inside
> a character class.
>
> Fixed: v8:10602
> Change-Id: I5858840159694fa6f8d1aa857027db80754e3dfd
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3178966
> Reviewed-by: Mathias Bynens <mathias@chromium.org>
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#77114}

Change-Id: Ic7404d6c9f0e6ea51e8cd8f1ab672856dca0c637
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3190692
Auto-Submit: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#77125}

Bug: chromium:1239030, chromium:1056170
Change-Id: I4a559027e63ebbd99e51344aa659d4fb284df88f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3190094
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77124}

Update outdated comments and address TODO about kDataIndex.

Change-Id: Ibf6e91857c0430cb9a598c98933db63ac42a1d1f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3189197
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77123}

When preparing to take a heap snapshot for the devtools, V8 uses
CollectAllAvailableGarbage, which runs 2 to 7 rounds of garbage
collection, depending on whether weak callbacks indicate that further
rounds might be beneficial. Depending on how many rounds of GC run,
varying amounts of bytecode and baseline code may be flushed, leading to
inconsistent behavior and underreporting the amount of memory used by
bytecode and baseline code. In this change, I propose that bytecode
should not increase in age during these collections, so that the
resulting snapshot is a better indication of actual memory usage.

Change-Id: I644be37833f85bb58e2e2fad5da62949cbdc9bef
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3182885Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/main@{#77122}

Bug: v8:12257
Change-Id: I0c78e692a1712082818e8af32593b0489c4e18ff
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3190103
Commit-Queue: Almothana Athamneh <almuthanna@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77121}

Change-Id: I796eacdf7c0e1fc9de5b31e47bf0e20cd4aa70d7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3190430
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77120}

Use `const void*` to signal that we are not hashing for the
`char*` contents.

Change-Id: Ib8c31e293ec1e57a7799a68cfd2d59ce39076d43
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3190108
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77119}

.. to avoid the expensive malloc call.

Fixed: v8:9455
Change-Id: I6734fe07a3884b228d818f60be83d9e45c2ee383
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3190105
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Patrick Thier <pthier@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77118}

Add the use_remoteexec arg to the reclient mixin.  Set both use_rbe and
use_remoteexec while switch from one ot the other.

Bug: chromium:1252752
Change-Id: I415a849dbd27c4de23d6f9fcfde7c1beba8f5f7f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3188950Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Savigny <msavigny@google.com>
Cr-Commit-Position: refs/heads/main@{#77117}

When handling the 'end' opcode, there was a confusion with the value of
"unreachable". This DCHECK assumes the value of "unreachable" before
closing the scope, but was placed after the value is potentially updated
to reflect the state after the 'end' opcode.

R=clemensb@chromium.org

Bug: chromium:1251845
Change-Id: Iea526e6485fa705f6ff4077f54a53204cc70a926
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3190102Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77116}

R=manoskouk@chromium.org

Bug: chromium:1252747
Change-Id: I337d5e26015f5af8c76caebb962093d1dad42952
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3190095Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77115}

The parser is organized in a somewhat tricky way s.t. it can be
hard to map the implementation back to the specified grammar.

In particular, the logic for CharacterClassEscape, ClassEscape,
and CharacterEscape was implemented twice - once inside a character
class, once outside.

This CL refactors related logic to have only a single implementation.

As a drive-by, fix one related inconsistency related to \k inside
a character class.

Fixed: v8:10602
Change-Id: I5858840159694fa6f8d1aa857027db80754e3dfd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3178966Reviewed-by: Mathias Bynens <mathias@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77114}

Bug: v8:12244,v8:12245
Change-Id: Ic677503ceeb5903e94cc60d7c95f0ec990fba691
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3183163
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77113}

The intent of the RISC-V ISA is that 32-bit C values are stored sign extended in registers, even for unsigned types.
So we skip cctest case RunLoadStoreZeroExtend64/RunUnalignedLoadStoreZeroExtend64 due to sign extend uint32

Change-Id: Icfe727916b1c04aad5681902ec4782cc98906964
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3184560Reviewed-by: Ji Qiu <qiuji@iscas.ac.cn>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Ji Qiu <qiuji@iscas.ac.cn>
Cr-Commit-Position: refs/heads/main@{#77112}

Several of the cctest/test-bytecode-generator/* tests used to rely
on the __COUNTER__ C++ compiler macro, which could cause spurious
test failures due to mismatched expectations when usages of that
macro were added or removed elsewhere in the code. This patch switches
to a custom, controllable static counter variable instead, to make
the tests' behaviors self-contained.

Bug: v8:12244
Change-Id: I4d875b6095e4ee4ef91933ab8c60c89054d1894a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3186836Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77111}

Port commit a0ace8a8

On mips64 and loong64, sign-extend the 32-bit value.

Change-Id: I058e3fcba94c25ad36ab1d751dea6bfc0558471a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3189854Reviewed-by: Liu yu <liuyu@loongson.cn>
Commit-Queue: Liu yu <liuyu@loongson.cn>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/main@{#77110}

No-Try: true
Bug: v8:12261
Change-Id: Ib51f8b694156228d2a3217b3cf171d15390af87d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3190092
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77109}

Port e301d71f
 [compiler] Teach InstructionScheduler about protected memory accesses

Port a0ace8a8
 [wasm] Interpret table.grow result as 32 bit

Port [regexp] Fix UAF in RegExpMacroAssembler

Change-Id: Ieac5e4deae9c6bbf844788d927f5201b906495f6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3189213
Commit-Queue: Ji Qiu <qiuji@iscas.ac.cn>
Reviewed-by: Ji Qiu <qiuji@iscas.ac.cn>
Cr-Commit-Position: refs/heads/main@{#77108}

Bug: chromium:1252747
Change-Id: I2eb0f71049836ca5a761928e3c8adf7034f5fdb2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3186437Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77107}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/6476f40..a76920d

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/src/buildtools/+log/9d33a71..a9bc3e2

Rolling v8/buildtools/linux64: git_revision:de86ec4176235871a7cb335756987e41246dae4a..git_revision:0153d369bbccc908f4da4993b1ba82728055926a

Rolling v8/buildtools/third_party/libc++abi/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi/+log/c883cb1..50e90b8

Rolling v8/buildtools/third_party/libunwind/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind/+log/a7e4ce0..a002c72

Rolling v8/third_party/abseil-cpp: https://chromium.googlesource.com/chromium/src/third_party/abseil-cpp/+log/a46a633..8aecb68

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/444aba8..2146b04

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/f35d350..ce514ad

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/efd7c81..2e80143

TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: Ifcb08d19030149f8f920d334f4b0072c286d80bd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3189492Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#77106}

Port 3162604 3173681
Bug: v8:11382

Change-Id: Iea5910dfe1f091cb0d202f1abe894562f5c6c63f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3184561Reviewed-by: Ji Qiu <qiuji@iscas.ac.cn>
Commit-Queue: Ji Qiu <qiuji@iscas.ac.cn>
Cr-Commit-Position: refs/heads/main@{#77105}

These tests test allocation failure and time out on TSAN.

Bug: v8:11852
Change-Id: I81e0af3ab8130c05488c6a117dd1c6ef12aba33b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3188071
Auto-Submit: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77104}

After the parameter processing, the arraybuffer may have been detached.
TypedArray copyWithin/fill should throw in that condition. TypedArray
includes should return false if the search element is not undefined.

Change-Id: If507d0efa1dafbe3dcefcd368e5ea27406bb3df8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3144315Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77103}

Bug: v8:7790
Change-Id: Ibf6e842c2bec780a9a52643494def8efbab92466
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3185920
Auto-Submit: Georg Neis <neis@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77102}

Bug: v8:12244,v8:12245
Change-Id: Ib0db9d9431e42399d3031b5d7f315ddf3cd9993d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3182441
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77101}