Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/277ad43..3e568c8

Rolling v8/test/wasm-js/data: https://chromium.googlesource.com/external/github.com/WebAssembly/spec/+log/c90bc96..a56cf2e

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/5e1c1c2..f929109

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/f170af4..0db62fc

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/3041f30..36daae0

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: I57e0b3aa389b6a42d64134de607ee2e2267f04a4
Reviewed-on: https://chromium-review.googlesource.com/c/1312241Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#57196}

Change the order of creating property for the return object
of Intl.NumberFormat.property.resolvedOptions()
according to the table in the spec.
This is due to spec change in from "any order" to "table "
in https://github.com/tc39/ecma402/pull/279
Failure w/o fixing it will happen once we land
test262/intl402/NumberFormat/prototype/resolvedOptions/order

Bug: v8:8378
Change-Id: Ic68fcfeba78af87d9bbd13c935ad9a91e76f4965
Reviewed-on: https://chromium-review.googlesource.com/c/1303195
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57195}

and reland "[ubsan] More Object** replacements"

This reverts commit 162d4e6d.

Reason for revert: Not the culprit, test failed before.

Original change's description:
> Revert "[ubsan] Replace Object** in GlobalHandles"
> 
> This reverts commit 93927279.
> 
> Reason for revert: Speculative revert, seems the most probable cause of
> https://bugs.chromium.org/p/v8/issues/detail?id=8396
> 
> Revert "[ubsan] More Object** replacements"
> 
> This reverts commit 5cce694d.
> 
> Speculative revert.
> 
> NOTRY=true
> 
> Bug: v8:8396
> Change-Id: I9c2866a9db707cd03e4cf90822acde20813cebf0
> Reviewed-on: https://chromium-review.googlesource.com/c/1309761
> Commit-Queue: Maya Lekova <mslekova@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#57174}

TBR=yangguo@chromium.org,mstarzinger@chromium.org,mslekova@chromium.org

Bug: v8:8396
Change-Id: I64fc80804b4ec324cef80ac528d08b724963f7f7
Reviewed-on: https://chromium-review.googlesource.com/c/1311813Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57194}

This was removed from gtest and	is necessary to	roll gtest in
Chromium.

TBR=adamk@chromium.org

Bug: chromium:893369
Change-Id: I21762aa65ab2fc3f52731e7e812f0bf155f285e6
Reviewed-on: https://chromium-review.googlesource.com/c/1310598
Commit-Queue: Fabrice de Gans-Riberi <fdegans@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57193}

This is preparation to support the Torque port of Object.fromEntries,
including tests to make sure that the interface of the iterator functions
is correct and compiles when used.

Change-Id: I2a30ef80a80f42d4744a92746c8cd383abc10c19
Reviewed-on: https://chromium-review.googlesource.com/c/1303726
Commit-Queue: Daniel Clifford <danno@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57192}

Fix the broken test of the to-be-landed
test262/intl402/ListFormat/prototype/resolvedOptions/order
The ecma402 spec change from "any order" to "table " order
in https://github.com/tc39/ecma402/pull/279 the intl* proposals
will follow.

Bug: v8:7871
Change-Id: If47ab44791920c23fe2e1101e60205589d0ac093
Reviewed-on: https://chromium-review.googlesource.com/c/1302058
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57191}

Bug: v8:8387
Change-Id: Ifd640603febddd32a778167bbce84e96539ac9c2
Reviewed-on: https://chromium-review.googlesource.com/c/1311373Reviewed-by: Mathias Bynens <mathias@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57190}

Bug: chromium:899029
Change-Id: I0fc724d5c77e5cbf2580de53f48934ae6f968934
Reviewed-on: https://chromium-review.googlesource.com/c/1310196Reviewed-by: Mathias Bynens <mathias@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57189}

The Intl.RelativeTimeFormat.prototype.formatToParts does not
correctly implement the spec. Change the implementation by refactoring
the JSNumber::FormatToParts and delegate part of the

JSRelativeTimeFormat::FormatToParts to call the new refactored function.

Bug: v8:8382
Change-Id: Ie153aa256ca78ce71c92efcdad55262564349ca9
Reviewed-on: https://chromium-review.googlesource.com/c/1305936
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57188}

R=joransiu@ca.ibm.com

Change-Id: I7d8f430df2f1f35145df7ba2326b3149d3193a60
Reviewed-on: https://chromium-review.googlesource.com/c/1297487
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#57187}

Bug: chromium:900585
Change-Id: I2f6045ce23af9a15baddc73127b0c4e3e514841c
Reviewed-on: https://chromium-review.googlesource.com/c/1310294
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57186}

This reverts commit 5f9b9b99.

Reason for revert: not longer necessary.

Original change's description:
> [tools] Temporarily make Node.js bot experimental
> 
> R=​sergiyb@chromium.org,yangguo@chromium.org
> NOTRY=true
> 
> Bug: v8:8397
> Change-Id: I528642fe0cf023fab7d653e9370a0d5a39a6bbb4
> Reviewed-on: https://chromium-review.googlesource.com/c/1310198
> Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
> Commit-Queue: Maya Lekova <mslekova@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#57179}

TBR=yangguo@chromium.org,sergiyb@chromium.org,mslekova@chromium.org

Change-Id: Iaa14f5358f925313a450916c5caaa355b00e07be
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:8397
Reviewed-on: https://chromium-review.googlesource.com/c/1310873Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57185}

This is a reland of 0f15ed05

Original change's description:
> [torque]: Implement catch handlers for try blocks
> 
> In addition (and in combination), try statements now support "catch"
> clauses at the end that catch JavaScript exceptions throw by any builtin
> or runtime function contained in the try block:
> 
>   try {
>     ThrowTypeError(context, ...);
>   }
>   catch (e) {
>     // e has type Object
>   }
> 
> Bug: v8:7793
> Change-Id: Ie285ff888c49c112276240f7360f70c8b540ed19
> Reviewed-on: https://chromium-review.googlesource.com/c/1302055
> Commit-Queue: Daniel Clifford <danno@chromium.org>
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#57169}

Bug: v8:7793
Change-Id: I3c4182303acfdfa625654976bec372cf531d954f
Reviewed-on: https://chromium-review.googlesource.com/c/1310295Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Daniel Clifford <danno@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57184}

Change-Id: I44ac330e093a4cbca4540a1948c9365c08f73914
Reviewed-on: https://chromium-review.googlesource.com/c/1310293Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57183}

We'd flatten upon compile anyway; and hashing the cons string also
creates a local flattened version that's not cached.

Change-Id: Ib5c82385ab009464b45bf1ceb289d04caaa77fcf
Reviewed-on: https://chromium-review.googlesource.com/c/1309827Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57182}

- introduced ValueMirror interface, this interface contains methods to generate
  different protocol entities,
- introduced DebugPropertyIterator, this iterator iterates through object properties
  in the following order: exotic indices, enumerable strings, all other properties,
- removed all injected script infra, e.g. closure compiler,

R=dgozman@chromium.org
TBR=yangguo@chromium.org

Bug: chromium:595206
Change-Id: I030fdb3a80074ca6edd4749f86b39b590776ae6f
Reviewed-on: https://chromium-review.googlesource.com/c/1310056Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57181}

JSON format does not support \xNN encoding. Use \uNNNN instead.

+ Add myself to the src/tracing/OWNERS

BUG=chromium:895974

Change-Id: I410a09d44af08b61837579fa09d263d897b9385e
Reviewed-on: https://chromium-review.googlesource.com/c/1303535Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
Commit-Queue: Alexei Filippov <alph@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57180}

R=sergiyb@chromium.org,yangguo@chromium.org
NOTRY=true

Bug: v8:8397
Change-Id: I528642fe0cf023fab7d653e9370a0d5a39a6bbb4
Reviewed-on: https://chromium-review.googlesource.com/c/1310198Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57179}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/49671d3..277ad43

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/36a23a7..5e1c1c2

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/cb629a4..f170af4

Rolling v8/third_party/icu: https://chromium.googlesource.com/chromium/deps/icu/+log/b029971..42d5027

Rolling v8/third_party/instrumented_libraries: https://chromium.googlesource.com/chromium/src/third_party/instrumented_libraries/+log/a90cbf3..a959e4f

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: I951bed28ed3181406ceab213cee37c473a7c0c7f
Reviewed-on: https://chromium-review.googlesource.com/c/1309294Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57178}

This reverts commit 0f15ed05.

Reason for revert: Braking Node.js integration, see
https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Linux64%20-%20node.js%20integration/3917

Original change's description:
> [torque]: Implement catch handlers for try blocks
> 
> In addition (and in combination), try statements now support "catch"
> clauses at the end that catch JavaScript exceptions throw by any builtin
> or runtime function contained in the try block:
> 
>   try {
>     ThrowTypeError(context, ...);
>   }
>   catch (e) {
>     // e has type Object
>   }
> 
> Bug: v8:7793
> Change-Id: Ie285ff888c49c112276240f7360f70c8b540ed19
> Reviewed-on: https://chromium-review.googlesource.com/c/1302055
> Commit-Queue: Daniel Clifford <danno@chromium.org>
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#57169}

TBR=danno@chromium.org,mstarzinger@chromium.org,tebbi@chromium.org

Change-Id: Ib9e3155ef46cc46851c4ca8a2624fd7634238e13
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7793
Reviewed-on: https://chromium-review.googlesource.com/c/1310197Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57177}

This reverts commit 7e079c66.

Reason for revert: native implementation should be ready for navigation.

Original change's description:
> inspector: move injected script source to native
> 
> - introduced ValueMirror interface, this interface contains methods to generate
>   different protocol entities,
> - introduced DebugPropertyIterator, this iterator iterates through object properties
>   in the following order: exotic indices, enumerable strings, all other properties,
> - removed all injected script infra, e.g. closure compiler,
> 
> R=​dgozman@chromium.org
> TBR=yangguo@chromium.org
> 
> Bug: chromium:595206
> Change-Id: Idcfc04489ee52e015ad1d1d191c3474cc65e63f2
> Reviewed-on: https://chromium-review.googlesource.com/c/1308353
> Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
> Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#57150}

TBR=dgozman@chromium.org,yangguo@chromium.org,kozyatinskiy@chromium.org

Change-Id: I8c5c61f4cfe5a66cd33eadd02ab4acec539cc3bb
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:595206
Reviewed-on: https://chromium-review.googlesource.com/c/1310055Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57176}

This reverts commit fd22cfc8.

Reason for revert: Breaking MSAN build, see
https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/23602

Original change's description:
> [parser] Remove RETURN_IF* part 16
> 
> Bug: v8:8363, v8:7926
> Change-Id: I9f0b9e25cf6b47c8ff32451880e348b92ab3cfaa
> Reviewed-on: https://chromium-review.googlesource.com/c/1309760
> Commit-Queue: Toon Verwaest <verwaest@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#57172}

TBR=ishell@chromium.org,verwaest@chromium.org

Change-Id: Ic03a669c1a9598c7bd5ca186d783987e91dca5b5
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:8363, v8:7926
Reviewed-on: https://chromium-review.googlesource.com/c/1309828Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57175}

This reverts commit 93927279.

Reason for revert: Speculative revert, seems the most probable cause of
https://bugs.chromium.org/p/v8/issues/detail?id=8396

Revert "[ubsan] More Object** replacements"

This reverts commit 5cce694d.

Speculative revert.

NOTRY=true

Bug: v8:8396
Change-Id: I9c2866a9db707cd03e4cf90822acde20813cebf0
Reviewed-on: https://chromium-review.googlesource.com/c/1309761
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57174}

The slow path in Runtime_ArrayIndexOf allocates handles in each
iteration over the input object. This CL gives each iteration its
own handle scope in order to avoid consuming more and more memory
the longer the loop runs.

This can be observed e.g. by executing
 console.log(new Proxy(new Array(2**30), {}).indexOf(42))
which used to run out of memory on my machine.

Bug: v8:8386
Change-Id: Idab98ef7e1e4047c21c1dc0e01ba2d3d363c1f09
Reviewed-on: https://chromium-review.googlesource.com/c/1309759
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57173}

Bug: v8:8363, v8:7926
Change-Id: I9f0b9e25cf6b47c8ff32451880e348b92ab3cfaa
Reviewed-on: https://chromium-review.googlesource.com/c/1309760
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57172}

This addresses comments remaining from

https://crrev.com/c/1301512

Bug: v8:8238
Change-Id: Ia7687d65e90f061bb3bb87c37b84ec5559083816
Reviewed-on: https://chromium-review.googlesource.com/c/1309819Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57171}

Bug: v8:7926
Change-Id: I012b5bbf25b7aa4cbef64cce302c8ae971589663
Reviewed-on: https://chromium-review.googlesource.com/c/1309758Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57170}

In addition (and in combination), try statements now support "catch"
clauses at the end that catch JavaScript exceptions throw by any builtin
or runtime function contained in the try block:

  try {
    ThrowTypeError(context, ...);
  }
  catch (e) {
    // e has type Object
  }

Bug: v8:7793
Change-Id: Ie285ff888c49c112276240f7360f70c8b540ed19
Reviewed-on: https://chromium-review.googlesource.com/c/1302055
Commit-Queue: Daniel Clifford <danno@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57169}

Bug: v8:7926
Change-Id: Icbdd05b799afd26a8eaaa67905516d82f4b1d2bd
Reviewed-on: https://chromium-review.googlesource.com/c/1309815
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57168}

R=titzer@chromium.org

Bug: v8:6600
Change-Id: Ib926c068b468df6fcbaab9ef4734e9cd90ba553c
Reviewed-on: https://chromium-review.googlesource.com/c/1309814Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57167}

Bug: v8:8363, v8:7926
Change-Id: I227febcb3aafb56e1c5138650b6639ddeb883b52
Reviewed-on: https://chromium-review.googlesource.com/c/1309813Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57166}

Move code logging out of the finisher task. Schedule a separate task
for logging, but only if logging is actually enabled.

R=mstarzinger@chromium.org

Bug: v8:7921
Change-Id: Ib2c7db22c87e60e204096df3e8ef5b354802984f
Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_rel
Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_isolates_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/c/1308113
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57165}

Notry: true
Change-Id: Ia3cb4872703a6d1e5f6d0007a5e59afcd743907d
Bug: v8:7327
Reviewed-on: https://chromium-review.googlesource.com/c/1309754Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57164}

You can now serve the page locally by running

npm i
npm run-script build
npm run-script dev-server

Notry: true
Change-Id: Iefe8459a8c53445570ecfed4cc843a4e8ed9c42d
Bug: v8:7327
Reviewed-on: https://chromium-review.googlesource.com/c/1309753Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57163}

This allows the compiler to generate slightly better code and actually reduces
binary size a little.

Bug: v8:7926
Change-Id: Ib43ff1508ab85b5ffabfa4338d4f0ebacb7eac0c
Reviewed-on: https://chromium-review.googlesource.com/c/1309637
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57162}

Bug: v8:8363, v8:7926
Change-Id: Ibecb5c8df0703249207c1541ae42e60dd9f50d80
Reviewed-on: https://chromium-review.googlesource.com/c/1309635
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57161}

Now that lazy deserialization has been removed, we can roll back all
the mechanisms we introduced to support lazy single-builtin
deserialization.

This CL moves serialized builtin code objects (i.e.
off-heap-trampolines in most cases) back into the startup snapshot.
Support classes for builtin serialization and deserialization, as well
as the builtins snapshot itself are removed. Templatization on the
allocator class is removed as well.

Tbr: delphick@chromium.org
Bug: v8:6666, v8:7990
Change-Id: I2a910f8d3278b7e27b5f18ad408361ebd18871cc
Reviewed-on: https://chromium-review.googlesource.com/c/1304539Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57160}

Obvious in hindsight. The problem wasn't that a signaling nan snuck
into the array, but that equality comparisons always return false if
either operand is a nan.

Bug: chromium:900133
Change-Id: I9cf82afd1ad1fcc3bf7138b612f615b1bd51b98a
Reviewed-on: https://chromium-review.googlesource.com/c/1309634Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57159}

Bug: chromium:900383, v8:8363, v8:7926
Change-Id: I6e3e38ee4cc986757926ef745d2e35865ba797a1
Reviewed-on: https://chromium-review.googlesource.com/c/1309633Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57158}

CanCover is not transitive. The counter example are Nodes A,B,C such
that CanCover(A, B) and CanCover(B,C) and B is pure. In this case the
effect level of A and B might differ.

This CL adds a missing CanCover check to a case of shift reduction where
we assumed transitivity.

Change-Id: I9f368ffa6907d2af21bbc87b3e6570d0d422e125
Bug: v8:8384
Reviewed-on: https://chromium-review.googlesource.com/c/1307419
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57157}