https://chromium.googlesource.com/external/github.com/tc39/test262/+log/33a5433d..8f5c7aed093

Bug: v8:7834
Change-Id: I0b1419127becef463044a5c1b62fb45a2a9569ac
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3606546
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80232}

This is a follow-up to https://crrev.com/c/3581774.
It inlines method GCTracer::Scope::Name so that the calculation of the
name of the trace event can be performed at compile time and optimized
away, at most call sites.

This is a reland of 370cae1d
which was reviewed here: https://crrev.com/c/3602511

Bug: chromium:1318062
Change-Id: I617fcad07448ebbd63790600a071e51964baf85c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3605811Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80231}

Check that we don't accidentally end up entering a microtask if we have
a pending terminating exception.

Bug: chromium:1319267
Change-Id: Id1ec7e3deb39aa18f08c363e17bb8df599379d66
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3610624Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80230}

This reverts commit b36c87e3.

Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux%20-%20noi18n%20-%20debug/42210/overview

Original change's description:
> [test] Move cctest/test-regexp to unittests
>
> ... /regexp/regexp-unittest.
>
> Bug: v8:12781
> Change-Id: I3c3ba4c519ff503b242c39d0e3b2350f25d7e84c
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3607370
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Commit-Queue: 王澳 <wangao.james@bytedance.com>
> Cr-Commit-Position: refs/heads/main@{#80217}

Bug: v8:12781
Change-Id: I0c5fae4b156df0a305b83acfa639bb0ff6eeb87f
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3610626
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80229}

ToSpaceContainsSlow is only from Heap:InSpaceSlow that is never used for
new space.
FromSpaceContains is never called.
ToSpaceContains is called from unittests and from Heap::Contains, and
replacing it wioth  NewSpace::Contains should keep things fast as that
one relies on a page flag.

Bug: v8:12612
Change-Id: I58d63a85fd66aa27f9c4a7794e21838a59aab3d0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3610447Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80228}

tests where moved from cctest to unittests under this cl:
https://crrev.com/c/3607370

Bug: v8:12781
Change-Id: If625e0dda51034e731c5e7fe87d591dce9804888
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3611182Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#80227}

Allow live ranges to be displayed beside the
instruction sequence in turbolizer.

Bug: v8:7327
Change-Id: Idec5130655ccc9365dd32ec6927d8615a3e5c570
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3585960
Commit-Queue: George Wort <george.wort@arm.com>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80226}

Bug: v8:7700
Change-Id: I44b5fd2172522034bfe9566ab314dc93e05b2e80
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3610425
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80225}

Previously the POSIX version of TimeTicks::Now() was used on Fuchsia.
It's more efficient to call zx_clock_get_monotonic() directly.

Bug: chromium:1317914
Change-Id: I56da954a2567bcb866100c157878176bcb7cf319
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3595601
Auto-Submit: Sergey Ulanov <sergeyu@chromium.org>
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80224}

Change-Id: Ib94979f4cf7f52a1544f2b3c0d51c0266a4fa14c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3586985Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80223}

Bug: v8:12795, chromium:1316443
Change-Id: I0ecaf8ebbf1a83d0d5b305fd014bc5a765c0d2f5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3610446Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80222}

Add an unboxing double field load node, and fix a couple of locations
where it might be used enough to pass tests.

Bug: v8:7700
Change-Id: Ic134484e87a4fa363cbd8a3de667ac8e8116d502
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3610623Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80221}

This reverts commit f196c878.

Reason for revert: https://crbug.com/v8/12838

Original change's description:
> [test] Move cctest/test-log to unittests/logging/log-unittest
>
> Bug: v8:12781
> Change-Id: If94de50440b15f000ff2f961f2dd77abd9c90ca4
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3607389
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Commit-Queue: 王澳 <wangao.james@bytedance.com>
> Cr-Commit-Position: refs/heads/main@{#80209}

Bug: v8:12781
Change-Id: I9e2d9496f16581ebbb851fb207191d6b77b51c0d
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3610448
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#80220}

Bug: v8:12023
Change-Id: I6feed0560daa89c363b37f735510d5c3aac4567a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3610443Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Almothana Athamneh <almuthanna@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80219}

This fixes the ordering of DCHECKs which expect the value to not be in
the free list yet when it is dropped.

Bug: v8:7700
Change-Id: Ifb85d0e20cfe5c083d1f2bc971817143265fdc7f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3610444
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80218}

... /regexp/regexp-unittest.

Bug: v8:12781
Change-Id: I3c3ba4c519ff503b242c39d0e3b2350f25d7e84c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3607370Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Cr-Commit-Position: refs/heads/main@{#80217}

Port commit 91453880

Bug: v8:12161
Change-Id: If2a465a80387d08df885e72e07b16962b6bc5d8b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3609227
Auto-Submit: Yu Liu <liuyu@loongson.cn>
Reviewed-by: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/main@{#80216}

... /objects/object-unittest.

Bug: v8:12781
Change-Id: I48156098cf2ce216b8231a05dd68cfa96e04911d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3607388Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Cr-Commit-Position: refs/heads/main@{#80215}

CheckedFloat64Unbox mutates the input value, but the register allocator
does not expects this behaviour and propagates a wrong value in the register.
In particular we deopt with the wrong value if the second Float64Unbox
in a Float64Add needs to deopt.

This fixes the input value after we convert to double.

Bug: v8:7700
Change-Id: Ib89573e9f728dc3a34b817fc84f1afcb96f14d18
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3610422
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80214}

The JS import returns a tagged value, not a value of the machine
representation that corresponds to the signature's return type, since it
hasn't been converted yet.

R=ahaas@chromium.org

Bug: v8:12191
Change-Id: I0783af85eed9c5d25347200540e3e4eee48edfd4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3464036Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80213}

This logic was confused in the presence of inlined frames; the
deopt exit offset would point inside the innermost inlined frame
while we incorrectly assumed it points at the outermost frame.

Fix this by always referring to the bytecode offset of the outermost
frame.

Bug: v8:12161
Fixed: chromium:1320094
Change-Id: I2eb28498639432c5344859f64a9388d93ee23bde
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3608630
Auto-Submit: Jakob Linke <jgruber@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80212}

This makes it hopefully easier to add new operations and fixes
the current bug where we add new nodes (box/unbox/smitag/smiuntag)
that is not being used since the operation does not support a fast path.

Bug: v8:7700
Change-Id: I7ce33e44a4f8e63f42541a615fa72aa6e1b5cccc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3605819Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80211}

The AssemblerBufferCache was so far only used for Liftoff compilation.
Hence all TurboFan compilation was using unprotected assembler buffers.

This CL passes the AssemblerBufferCache from the function compiler down
to the TurboFan PipelineData. From there it is used when instantiating
the CodeGenerator to generate the AssemblerBuffer for the
TurboAssembler. This will protect the assembler buffers used for
TurboFan Wasm compilation via PKU, if available.

Since PipelineData has a single constructor for all Wasm compilation, we
have a single choke point to ensure that an AssemblerBufferCache is
passed down. For Wasm stub compilation (import wrappers etc) we
currently explicitly pass a nullptr, this will be fixed in a follow-up
CL.

R=thibaudm@chromium.org, tebbi@chromium.org

Bug: v8:12809
Change-Id: I268bd21047adbd7f0aab78e8b0a4b4df1d1f8ddf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3596172Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80210}

Bug: v8:12781
Change-Id: If94de50440b15f000ff2f961f2dd77abd9c90ca4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3607389Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Cr-Commit-Position: refs/heads/main@{#80209}

Bug: v8:12802
Change-Id: I4e12edc71ce110f603026f2b9a446af8965f9510
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3598887Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Almothana Athamneh <almuthanna@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80208}

params.start was not set when marker was present, however the barrier
relies on params.start.

Bug: chromium:1029379
Change-Id: I12cfbdbdec63518cfc0d0d174085ea8aefb3a375
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3605822Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80207}

Add flag --always-use-string-forwarding-table to always use the
forwarding table (usually only used for shared strings) instead of
ThinString migrations initially (during GC strings will be migrated
to normal ThinStrings). The goal is to get more coverage of this code
that is designed for shared strings.

Bug: v8:12007
Change-Id: I7eb2e5ccf0018c4ac349611aebe337d8288de5c8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3536650Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80206}

Port commit 4ae5a813

Change-Id: I2b4fccff6bf5266cd4cf9df45cabe3a19f29ab41
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3609751
Commit-Queue: Yahan Lu <yahan@iscas.ac.cn>
Auto-Submit: Yahan Lu <yahan@iscas.ac.cn>
Reviewed-by: ji qiu <qiuji@iscas.ac.cn>
Commit-Queue: ji qiu <qiuji@iscas.ac.cn>
Cr-Commit-Position: refs/heads/main@{#80205}

Add a simple unwinder for gdb which, on x64,  walks frame pointers
whenever there is no source information available. Ideally we would only
do this for V8 PCs but this appears hard to do in an Unwinder without
messing with gdb's internal assumptions.

Change-Id: Iba1e62a3768340ee912e81d691237c1920a8ae91
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3608628Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80204}

Bug: v8:7700
Change-Id: I766b523cfaf30eda9c33d9f2c580bc72a2eaa9ca
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3605815
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80203}

If the following conditions hold:
1) value is kSentinel,
2) slot is on stack,
3) stack is allocated below 4GB,
then the generational barrier would be erroneously triggered for the
stack object object. This CL fixes it. At the same time, it aims to
simplify the code and potentially optimizes it (by having 'and' instead
of 'sub').

Bug: chromium:1029379
Change-Id: Iafd91d50b0a1c3d97647f7bf3643dfcc7e9fb48f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3608629Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80202}

These can be tricked into corrupting memory when an attacker can leak
the "hole" value due to a bug. This CL simply adds CHECKs to prevent
this. A longer-term solution might be to introduce "special-purpose
holes" so that a leaked "hole" value can no longer be used to confuse
unrelated code like the JSMap implementation because that would then use
a different "hole" value.

Bug: chromium:1315901
Change-Id: Id6c432d39fb97002fa67efe90d34014fc5408ba3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3593783Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Samuel Groß <saelo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80201}

Introduce a bottleneck for right-trimming an object. In a subsequent CL
we will use this method to update the cached size of invalidated
objects.

This CL also tries to clean-up the various CreateFillerObjectAt
methods. CreateFillerObjectAtRaw is now the internal method for all
these methods. After moving right-trimming to NotifyObjectSizeChange,
both CreateFillerObjectAt and CreateFillerObjectAtBackground don't need
those arguments for clearing slots or memory anymore.

Bug: v8:12578, chromium:1316289
Change-Id: I6ff0bfaced3e0a1765152700e68a4ad33a155723
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3607992Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80200}

... /objects/modules-unittest.

Bug: v8:12781
Change-Id: Ie3d63ac470e435858dfd0e32b7fda2f78502aa17
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3607369Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Cr-Commit-Position: refs/heads/main@{#80199}

This CL includes count value to InvalidCountValue error message to make
it easier to dignoise RangeError of String.prototype.repeat. When
InvalidCountValue error throw, we could not know it's
caused by which count value if count value is not included.

Bug: none
Change-Id: I16e6693da0fc3b181241cb90daca27957f59c77c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3593574Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80198}

Port 91453880

Change-Id: I863c060cee8a0830a33594d8843898e40e7a71d0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3606619
Auto-Submit: Yahan Lu <yahan@iscas.ac.cn>
Reviewed-by: ji qiu <qiuji@iscas.ac.cn>
Commit-Queue: ji qiu <qiuji@iscas.ac.cn>
Cr-Commit-Position: refs/heads/main@{#80197}

PR85 https://github.com/tc39/proposal-intl-numberformat-v3/pull/85
Throw RangeError while roundingIncrement is not 1 and
minimumFractionDigits != maximumFractionDigits
Test by new test cases in intl/number-format/rounding-increment-v3.js

Add more unit test to check the resolved options of roundingIncrement,
minimumFractionDigits, and maximumFractionDigits.

PR91 https://github.com/tc39/proposal-intl-numberformat-v3/pull/91
Throw TypeError instead of RangeError while roundingIncrement is not 1
and RoundingType is not fractionDigits
Test by intl402/NumberFormat/constructor-roundingIncrement-invalid.js
in test262

Bug: v8:10776
Change-Id: I071bfe8b3e844c5999144d74bb5f79ea9811e37b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3603059Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80196}

Also add AOs:
IsIntegralNumber, ToIntegerWithoutRounding, ToTemporalDurationRecord,
ToTemporalDuration, ParseTemporalDurationString, CreateDurationRecord

Spec Text:
https://tc39.es/proposal-temporal/#sec-temporal.duration.from
https://tc39.es/ecma262/#sec-isintegralnumber
https://tc39.es/proposal-temporal/#sec-temporal-totemporaldurationrecord
https://tc39.es/proposal-temporal/#sec-temporal-totemporalduration
https://tc39.es/proposal-temporal/#sec-temporal-parsetemporaldurationstring
https://tc39.es/proposal-temporal/#sec-temporal-createdurationrecord

Bug: v8:11544
Change-Id: I0f4176921e088bd2f2fd48ddd28f22f3b454bd3b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3379233Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80195}

Port 91453880

Original Commit Message:

  This is a reland of commit 91da3883

  Original change's description:
  > Fixed: Use an X register for JumpIfCodeTIsMarkedForDeoptimization
  > on arm64.
  > Bug: v8:12161

Change-Id: I6e63bd5995340bac32654ef12c52d25b496140e3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3607997Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#80194}

Change-Id: Idca60865da669dc90112eb04bdd464041fc447f3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3608119Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80193}