Mostly test/fuzzer, test/inspector, test/unittests.

Bug: v8:13006
Change-Id: I825efa5d72a224bb3cb9f86a9fac8763e9dbd1cf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3769696Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81799}

Additionally, the CL creates a BranchIfRootConstant node and updates
JumpIfTrue and JumpIfFalse.

Bug: v8:7700
Change-Id: I7ee98f4b726ffef0f7969231b598d6216b09ccfc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3769828Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81798}

This CL is part of an effort to enable concurrent marking in MinorMC.

For this purpose we plan to reuse the IncrementalMarking class which
already implements a part of the concurrent marking code for MajorMC
(and is currently coupled with MarkCompactCollector).

We plan to parameterize IncrementalMarking with CollectorBase, which
can be either MinorMarkCompactCollector or MarkCompactCollector, in
a subsequent CL.

Bug: v8:13012
Change-Id: I595bfdcb6e1abaa270d8037d889620433f26a416
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3749183
Commit-Queue: Leon Bettscheider <bettscheider@google.com>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81797}

Bug: v8:13081
Change-Id: I34a736e8c3aaf0712da677925ff7ad64842ebc54
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3770018
Auto-Submit: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81796}

Change the return value to fallback while the property
is not one specified in the value.
https://github.com/tc39/proposal-intl-numberformat-v3/pull/92

Bug: v8:13053
Change-Id: I40e430152c71258f1ff85fec1d69928937d0ad99
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3759224
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81795}

The LeftTrimFixedArray will call OnMoveEvent every time. Even though when the profiling is not enabled in user mode, it still need to do some check, and the function call itself has certain overhead. This patch aims to remove the unnecessary check. We only need to check it when the logging status changes.

Change-Id: I0e957860616a18415398f7753ed21caab5a4361f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3751964Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Jianxiao Lu <jianxiao.lu@intel.com>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81794}

This reverts commit 50e944f0.

Reason for revert: Breaking GPU tests on all platforms
https://ci.chromium.org/ui/p/v8/builders/ci/Win%20V8%20FYI%20Release%20(NVIDIA)/15929/overview
https://ci.chromium.org/ui/p/v8/builders/ci/Mac%20V8%20FYI%20Release%20(Intel)/18070/overview
https://ci.chromium.org/ui/p/v8/builders/ci/Linux%20V8%20FYI%20Release%20(NVIDIA)/20597/overview

Original change's description:
> [turbofan] Support Phi nodes in SL Verifier
>
> Drive-by: Fix incorrect typing of Phi node in
> JSTypedLowering::ReduceJSHasInProtoypeChain
>
> Bug: v8:12619
> Change-Id: Iac6e04e7de7596caa11d021f2cb0759b50aa9bc3
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3755113
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#81785}

Bug: v8:12619
Change-Id: Idcd4881e981ae6f886ae2bc5ed77958f01bb178e
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3770010
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Auto-Submit: Shu-yu Guo <syg@chromium.org>
Owners-Override: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81793}

Spec text:
https://tc39.es/proposal-temporal/#sec-temporal-iso8601grammar

Support 'T' prefix in time-only strings and require it in cases of ambiguity
Remove TemporalDateString and TemporalRelativeToString from parser
Change algorithm of ParseTemporalDateString

Related spec changes:
https://github.com/tc39/proposal-temporal/pull/1952
https://github.com/tc39/proposal-temporal/pull/2187


Bug: v8:11544
Change-Id: I7430afabb7dd78930b339b818bad7c7721decb99
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3636361Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81792}

This adds a bunch of tracing hooks to the module decoder and uses
them to support "annotated hexdump" output for full modules in wami:

$ out/x64.release/wami my_module.wasm --full-hexdump

Change-Id: I5821d940b5ec236df9708eecd0124172d8893ffd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3754741Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81791}

This file did not include all the headers it needed, so when
https://crrev.com/c/3749178 removed a bunch of headers, the MSVC build
broke. Add in the missing header to address the MSVC compiler falure.

Change-Id: I646787cfde802d8cabe7d61bac2f2066beaec436
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3764190Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81790}

Port d5b3d8e9

Original Commit Message:

    This change already landed for x64, now come arm and ia32. The code
    already existed for arm64.

    The wasm instance got pushed three times in the lazy-compile builtin:
    1) as part of the parameters;
    2) as a parameter for the runtime function;
    3) to load the jump table address after the runtime function;

    The third push can be avoided by loading the jump table address after
    all parameters get loaded from the stack again.

R=ahaas@chromium.org, joransiu@ca.ibm.com, junyan@redhat.com, midawson@redhat.com
BUG=
LOG=N

Change-Id: I731473b2d5e08e7ea5841ef589dd3f896b5302db
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3769698
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Reviewed-by: Junliang Yan <junyan@redhat.com>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81789}

... in order to avoid expensive computation of cage_base for Code
objects and in order to avoid issues with wrong cage base values
computed from Code objects in external code space.
Drive-by: cage-bas'ify some accessors in JSFunction and Code.

This is a step towards Code-less embedded builtins.

Bug: v8:11880
Change-Id: I95dd8bcd4680e09c7463e1bc7d72dcbf9f2e5c1c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3769831Reviewed-by: Patrick Thier <pthier@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81788}

Bug: v8:7748
Change-Id: Ib8fadc272178fb0d49f7d5fab7d1953e2328a1ad
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3770107
Auto-Submit: Matthias Liedtke <mliedtke@google.com>
Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81787}

Bug: v8:11880
Change-Id: I07d5811132d2b1e3cb853f58972970c77fdae026
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3769697
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81786}

Drive-by: Fix incorrect typing of Phi node in
JSTypedLowering::ReduceJSHasInProtoypeChain

Bug: v8:12619
Change-Id: Iac6e04e7de7596caa11d021f2cb0759b50aa9bc3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3755113Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81785}

Until crbug.com/1269989 is completely resolved.

R=clemensb@chromium.org

Bug: chromium:1269989
Change-Id: I35f6278425857d727ea99470d9531fd70a58a3c0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3769692
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81784}

... which might be undefined during initialization.

Bug: v8:13054
Change-Id: Ia3a7a95ffb1133b5d3d299c36bfb3875bcee2dfa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3769830Reviewed-by: Patrick Thier <pthier@chromium.org>
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81783}

This change already landed for x64, now come arm and ia32. The code
already existed for arm64.

The wasm instance got pushed three times in the lazy-compile builtin:
1) as part of the parameters;
2) as a parameter for the runtime function;
3) to load the jump table address after the runtime function;

The third push can be avoided by loading the jump table address after
all parameters get loaded from the stack again.

R=clemensb@chromium.org

Bug: v8:13049, v8:12926
Change-Id: Ifdbe943520c031ec5c480798694bcacc490a64bc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3764348Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81782}

This is a reland of commit 8218c061.
Compile errors on mac arm64 are fixed.

Original change's description:
> [wasm] Reset PKRU before spawning new threads
>
> We sometimes hit the DCHECK in the wasm code manager:
>   DCHECK_IMPLIES(writable, !MemoryProtectionKeyWritable());
>
> This is because we spawn new threads while having a
> {CodeSpaceWriteScope} open. In the case of PKU, this changes the PKRU
> register to allow writes to the code space, and the value of that
> register is inherited by any new thread. If this thread then tries to
> switch to writable code spaces, it hits the DCHECK. It would hit a
> similar DCHECK when trying to execute code.
>
> We fix this issue by temporarily resetting the PKRU register to
> non-writable while we call the {NotifyConcurrencyIncrease} method. This
> is not a very robust solution, as any new call that potentially happens
> inside a {CodeSpaceWriteScope} needs to do the same, but refactoring the
> code to avoid spawning new threads while being in writable state would
> be a lot of work with other downsides.
>
> R=jkummerow@chromium.org
>
> Bug: v8:13075
> Change-Id: Ibc7270aa597902dc6d9649cb6bcdfce8b1a9bafc
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3762579
> Commit-Queue: Clemens Backes <clemensb@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#81729}

Bug: v8:13075
Cq-Include-Trybots: luci.v8.try:v8_mac_arm64_compile_rel
Cq-Include-Trybots: luci.v8.try:v8_mac_arm64_compile_dbg
Change-Id: I2e634959c969fc022393ae51c391397c7195ee54
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3769829
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81781}

We check page flags in the deferred write barrier, and bail out early
if pointers to that page are not interesting. Make sure that the slot
register saving happens after that early bailout, to avoid unbalanced
push/pop.

To avoid bugs like this in the future, add a stack size check as a
prefix to every node's code gen.

Bug: v8:7700
Change-Id: I54a00fcbc843d473a1ca1e6cf3d852a0c60621c0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3769695Reviewed-by: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81780}

... in particular:
 * safepoint table accessors,
 * constant pool accessors,
 * handler table accessors.

This is a step towards Code-less embedded builtins.

Bug: v8:11880
Change-Id: I50c21000a821d0895295e4003ab321ddd8856546
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3764349Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81779}

The stack offsets of cache slots are always positive, but the compiler
does not know that. The lack of this knowledge makes division by the
system pointer size significantly more expensive.

One solution would be to rewrite the division to be an actual right
shift. Another solution is to teach the compiler that offsets are
positive. This CL does the latter.

This reduces the overall Liftoff compile time of the reproducer in the
linked issue by nearly 25%.

R=jkummerow@chromium.org, cbruni@chromium.org

Bug: v8:13063
Change-Id: Ib55b35d407e9909c792ae095a6767aaa03faebdc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3760453Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81778}

Mostly test/cctest/.

Bug: v8:13006
Change-Id: I8853d38feb79bed6234a4354ab25a13255a1871b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3755149
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81777}

... for configurations with disabled pointer compression.

Bug: v8:12797, v8:13059
Change-Id: I0547ded7934f1f28a4c2ca45738fefd7311576c3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3763868
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81776}

In {ControlPathState} with {kMultipleInstances}, a node should be able
to be mapped to different states, but not twice to an identical state.

Change-Id: Ida340a6f4f5e891f586d5a90e7ae818f24dfbe98
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3769693
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81775}

In this part: at

Drive-by: test helper cleanup

Bug: v8:11111
Change-Id: I760d0c4ee078c397c8a8365ec96101b488986d41
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3764344Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81774}

Bug: v8:7748
Change-Id: Ie39a12097f287e0eaf7e3f6c0072dd4cd5a40457
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3764347Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Auto-Submit: Matthias Liedtke <mliedtke@google.com>
Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81773}

Templetize ControlPathState on whether multiple states are allowed for the same node. Instantiate BranchElimination to allow a single state
per node, and WasmGCOperatorReducer to allow multiple.
This fixes a performance regression caused by crrev.com/c/3717994.

Bug: chromium:1339826
Change-Id: Id52d643daad618f45c3d8509f2a661e177609a0c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3754941
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81772}

The sandbox crash filter must be installed after the sandbox has been
initialized, which now happens during V8::Initialize.

Bug: v8:10391
Change-Id: I0103e32f091843415aaff4ec1c9bd93603244144
Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3769689Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Auto-Submit: Samuel Groß <saelo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81771}

 - Removed duplication and unnecessary indirection from all suites testcfgs.
 - Introduced a more comprehensive context to cover both command context and other platform specific concerns.
 - Propagated above context to TestLoader to allow for test counting command execution on all platforms.
 - Wrapped original pool with another class to give it a new interface and allow injecting different implementations in the future.
 - Consolidated progress indicators under a single processor in the pipeline.
 - Consolidated result retention requirements calculation outside of pipeline chain.
 - Refactored LoaderProc and got it under tests.
 - Added some more tests for the standard runner.
 - Extracted BuildConfig class.


Bug: v8:12785
Change-Id: I87be040e91f792a983662bb5a10d55b36a14ea7f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3701595Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Liviu Rau <liviurau@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81770}

The configuration was only enabled behind
  `cppgc_enable_object_names = true`

Bug: chromium:1321620
Change-Id: Id762a0603e6788ad218cc367b44c71a5c0f48e95
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3769827
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Auto-Submit: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81769}

Change-Id: Ia2cf7a509736ef6a9400b81a5726c717ac3c82b2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3763869Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Auto-Submit: Alexander Schulze <alexschulze@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81768}

Bug: v8:7700
Change-Id: I0fb6de81c924e8200bd0c3117e3bf08e0365d939
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3764346
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81767}

Also sort the owners entries.

No-Try: true
Change-Id: Ie59dcd47bdf1e644cef9f1dc96201bdc1fcfdd38
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3769686Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81766}

Rolling v8/third_party/google_benchmark/src: https://chromium.googlesource.com/external/github.com/google/benchmark/+log/1531ee0..48c2d1c

Expose google_benchmark.State for python bindings. (#1430) (Ross McIlroy)
https://chromium.googlesource.com/external/github.com/google/benchmark/+/48c2d1c

Suppress nvcc `offsetof` warning (#1429) (Cezary Skrzyński)
https://chromium.googlesource.com/external/github.com/google/benchmark/+/4efcc47

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com,mlippautz@chromium.org

Change-Id: I758c48c4c5c061d980026f298531bb5d09e1f78d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3767890Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81765}

No-Try: true
Bug: chromium:1292013
Change-Id: I5e30116230d88f2f38d20451735c5713691f2af2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3521791Reviewed-by: Liviu Rau <liviurau@chromium.org>
Commit-Queue: Liviu Rau <liviurau@chromium.org>
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81764}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/5c74423..679de1e

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I0e93dc6623c0bb15e9bb603bc8aae4e0362d6c44
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3767889
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#81763}

Baseline compiler generates instructions for bytecode JumpLoop with
the below layout:

  [OSR Check Armed]
  [OSR Handle Armed]
  [Jump Loop Header]

This CL advances [Jump Loop Header] and the layout will be:

  [OSR Check Armed]
  [Jump Loop Header]
  [OSR Handle Armed]

This can reduce the sizes of loops in baseline code.

Change-Id: I0a3996fddffd33caaef965c05f5c2593ad8951bc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3759947Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Hao A Xu <hao.a.xu@intel.com>
Cr-Commit-Position: refs/heads/main@{#81762}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/84a5cd0..5c74423

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I0df2e2bc9e6b0480a63b52cfe0d5e933a06aaa70
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3767886
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#81761}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/39eb47b..84a5cd0

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I5ecd049de24372eae11805995578512b22e5dba0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3766879
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#81760}