Add return register to the allocator. SetPendingMessage is a ValueNode
and returns the previous pending message.

This was not identified before, because we do not support
exception handlers yet.

Bug: v8:7700
Change-Id: Ia03ea609e85297198792816edda22d4f1c79708c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3849652
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82654}

This is a reland of commit c3a5c5b1

The previous CL was writing into the wrong sets when invoking
CollectSlots<OLD_TO_SHARED>(). Also move the NULL checks out of
that condition to also check this for chunks in the young generation.

Original change's description:
> [heap] Ensure all old-to-shared slots are recorded
>
> This CL adds verification of the old-to-shared remembered set to
> --verify-heap. During shared GCs client heaps will be scanned for
> references into the shared heap, this CL will CHECK that every found
> slot is contained in the old-to-shared remembered set. After this
> gets a bit more stable, the full heap iteration can be dropped and we
> can fully rely on the remembered set instead.
>
> Bug: v8:11708
> Change-Id: I0b5c4edfe3271306e4e7af7394472534113e1953
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3792605
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#82578}

Bug: v8:11708
Change-Id: I24b7787977f06708efb7a017dd1ec72f78d0ea13
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3841570Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82653}

Adds flags to allow overriding marking support. This adds
compatibility with EmbedderHeapTracer which allows for disabling
incremental marking support with `--no-incremental-marking-wrappers`.

The corresponding CppHeap flags are
* `--cppheap-incremental-marking`
* `--cppheap-concurrent-marking`

This allows embedders that use types that do not support incremental
and concurrent marking to switch from EmbedderHeapTracer to CppHeap.

Bug: v8:13207
Change-Id: I74bdf8ef4be3f6aed8d4d587ea4399546ba2fda4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3840939Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82652}

Publish all local worklists and don't ignore the one corresponding to
the current context.

Bug: chromium:1355679
Change-Id: I1944acd6258178d509610d3806c5aca047bbbbf8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3849651
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Auto-Submit: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82651}

There is somes flag errors in the comments, which clarify how to
use pgo for builtin.

Change-Id: I0c418aee57adb7c6774735d32fc63a143bee5c7e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3849654Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Wenqin Yang <wenqin.yang@intel.com>
Cr-Commit-Position: refs/heads/main@{#82650}

This reverts commit c060af4d.

Reason for revert: Fails with `v8_enable_verify_csa = true`:

```
# Fatal error in ../../src/compiler/machine-graph-verifier.cc, line 821
# TypeError: node #1503:Word32Equal uses node #1501:Load[kRepWord64] which doesn't have a compressed, tagged, or int32 representation.
#     Current block: id:187 <= id:154 <= id:183 <= id:93 <= id:144
#
#     Specify option --csa-trap-on-node=RegExpExecInternal,1503 for debugging.
```

Original change's description:
> Fix CSA_CHECK failure on BE
>
> The load for external reference should be a full pointer load
> instead of tagged size.
>
> Change-Id: I3460a26abea5053ba6daa5c6ed908cb93431654a
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3842348
> Reviewed-by: Camillo Bruni <cbruni@chromium.org>
> Commit-Queue: Junliang Yan <junyan@redhat.com>
> Cr-Commit-Position: refs/heads/main@{#82625}

Change-Id: Iaf9d0432157cba8c585377d33083a798c62e516c
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3848171
Auto-Submit: Jakob Linke <jgruber@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#82649}

- Swap() was not necessary as all uses merely required Merge()
- Remove unused empty Local ctor
- Use refrence for backref as it's always supposed to be non-null

Bug: v8:13193
Change-Id: Ide0a0de15185a67d028890371ae30528fd55a058
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3846863Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82648}

Rolling v8/third_party/google_benchmark/src: https://chromium.googlesource.com/external/github.com/google/benchmark/+log/77d1e74..e8baf26

Link error when use as static library on windows. (#1470) (Pavel V. Sysolyatin)
https://chromium.googlesource.com/external/github.com/google/benchmark/+/e8baf26

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com,mlippautz@chromium.org

Change-Id: I3d24d85c9f69c2ef17695056d0a44d7ebbe26c5e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3849647
Commit-Queue: Alexander Schulze <alexschulze@chromium.org>
Reviewed-by: Alexander Schulze <alexschulze@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82647}

This reverts commit 40901824.

Reason for revert: UBSan errors (https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20UBSan/22822/overview)

Original change's description:
> [ext-code-space] Enable Code-less embedded builtins
>
> Bug: v8:11880, v8:12592
> Change-Id: I8d3d6ad0a4c26eb1fea2a998ffeddd1d96afa690
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3784593
> Commit-Queue: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Jakob Linke <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#82642}

Bug: v8:11880, v8:12592
Change-Id: Iaf0f87d2e5c1e1e3876d3edc6a82c8578eed81bb
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3846471
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#82646}

Bug: v8:12781
Change-Id: I649318b653d62ba484d6b2d96ee66e8fb30ad6b5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3829324Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82645}

.. in OptimizedCompilationInfo.

Bug: v8:7700
Change-Id: I1dcff9c798ae3e70ae5dd84d815f45f7303e39e7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3845083Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Auto-Submit: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82644}

This change adds support for new table element types besides the
existing support for func and extern.
The newly supported types are the generic types of the 'any' subtype
hierarchy: any, eq, data and array.
All these table types are also usable and accessible via JavaScript,
causing implicit internalization and externalization of the elements
on Table::get() and Table::set().

Bug: v8:7748
Change-Id: Ie85d8f5e1d70471360dd2fb8a39cd38efaac2c22
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3838729Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82643}

Bug: v8:11880, v8:12592
Change-Id: I8d3d6ad0a4c26eb1fea2a998ffeddd1d96afa690
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3784593
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82642}

We found there are redundant load context operations in
some bytecode array.

like this:
LdaImmutableCurrentContextSlot [1]
Star0
......   (don’t edit accumulator)
LdaImmutableCurrentContextSlot [1]
Star1
Add r1

In that case, we could modify this bytecode array as:
LdaImmutableCurrentContextSlot [1]
Star0
......   (don’t edit accumulator)
Add r0

This CL will elide these redundant bytecodes
(LdaImmutableCurrentContextSlot and Star1), because there is no
side effect for loading context, and this context slot is immutable.

Change-Id: Ia26f4b934d3bd1d48c50c0c4699ba7942939991c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3816221Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82641}

This CL refines https://crrev.com/c/3829539 to only apply to let and
const declared variables. `var`s should stay `undefined`.

R=jarin@chromium.org

Bug: chromium:1328681
Change-Id: I35778c89fb04439348a4f6aebcdeb2db6234f9d0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3848960Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82640}

FastForwardSchedule() was the only operation left which need the
StepResult. However, we can also invoke that method from
AdvanceOnAllocation(). That way we can remove all uses of StepResult.

Bug: v8:12775
Change-Id: If91d76906f0f75342abce1456ea7d4a6fe089bee
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3843142
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82639}

This reverts commit 3615ae69.

Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20TSAN%20-%20stress-incremental-marking/8836/overview

Original change's description:
> [test] Migrate cctest/test-global-handles to unittests/
>
> Bug: v8:12781
> Change-Id: If7681564f3e0c087e3347557a3f9169625b51607
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3817621
> Reviewed-by: Camillo Bruni <cbruni@chromium.org>
> Commit-Queue: Igor Sheludko <ishell@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#82633}

Bug: v8:12781
Change-Id: Ia0e714028e1554b46421d455d86759b61883fd8f
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3845712
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Owners-Override: Nico Hartmann <nicohartmann@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#82638}

When you use the IntelliJ IDE, all the project-specific
settings for the project are stored under the .idea folder.
This patch add .idea to .gitignore to support IntelliJ IDE.

Change-Id: I55ca6530f00fd64f088485f7c856ad602b145f63
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3813066Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82637}

Per-context mode marking segregates worklists per context. Upon doing
so, Worklist::Local's move ctor was invoked which cleared the back
pointer to worklist. This break switching to that context which
happens in rare secnarios.

Rework Local marking worklists avoiding the move ctor which is also
removed.

Bug: chromium:1355545
Change-Id: If0e8c7f08df564b2a1e27e4a3fc5a6a40e46ee46
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3845630
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82636}

The generational barrier isn't supported on the background thread at the
moment. Make sure it isn't used on such threads by accident.

Bug: v8:13203
Change-Id: I5577f3802c1aba246955519c8c778fa741d56d96
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3840300
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82635}

The concurrent marker needs an override for JSObject subclasses with
their own visitor id and body descriptor. Implement the missing
VisitJSSynchronizationPrimitive.

Bug: v8:13214
Change-Id: Ie4f64e2b4e9b211f9661da75bf8d2d012f8d16ac
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3846320Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Auto-Submit: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82634}

Bug: v8:12781
Change-Id: If7681564f3e0c087e3347557a3f9169625b51607
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3817621Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82633}

In collator and localeCompare, we have an incorrect optimization
for zero length string that compare the length and ignore the
fact some non zero length string could be considered as equal to
a zero length string because the content are all ignoreable.

Took out this incorrect optimization with test cases.

The regression is introduced in
https://source.chromium.org/chromium/_/chromium/v8/v8.git/+/6fbb8bc806da7231ceb81e492d09abe3f43e320e which first appeared in 97.0.4665.0



Bug: chromium:1347690
Change-Id: Ie70feb9598b1842f8a8744c38f33b3397865abfd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3832526Reviewed-by: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Jakob Linke <jgruber@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82632}

Namely:
 - AccessorInfo::getter and AccessorInfo::js_getter,
 - CallHandlerInfo::callback and CallHandlerInfo::js_callback.

The redirected/non-redirected callback distinction is required only
for simulated builds but we wasted memory also for all native builds.

Now we store these fields in "redirected" form which allows us to call
them directly from builtins or generated code. In case it's necessary
to call a callback from C++ code the C function address is read from
the redirection. This additional indirection makes the callback calls
from C++ code in simulated builds slower but saves memory for native
builds.

This CL should recover a part of memory regression caused by inlining
Foreign fields into AccessorInfo and CallHandlerInfo.

Bug: v8:12949, chromium:1336105, chromium:1335930
Change-Id: I38470ed21ee23b281247c11a9531542c7e4acca1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3835686Reviewed-by: Jakob Linke <jgruber@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82631}

This changeset include:
1. [prepare for migrate] move `cctest/compiler/value-helper.h`,
`cctest/compiler/c-signature.h`, and `cctest/compiler/call-tester.h` to
`test/common` directory because both `test-codegen` and a lot of cctest file
include it.
2. [prepare for migrate] separate the tester helper part of `test-codegen`
into a new `codegen-tester` file.
3. finally, migrate test-codegen.cc to `codegen-unittest.cc`

Bug: v8:12781
Change-Id: Ia2f52c1d3b6b62501066dc1c4308a2c09d699e92
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3831146Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82630}

Bug: v8:7327
Change-Id: I4aececd931359785aa806f749dd27029f8ca4ebe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3840758
Commit-Queue: Danylo Boiko <danielboyko02@gmail.com>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82629}

Bug: v8:12781
Change-Id: I3dfbc03dd2dd4ac32d16cf153146979a0b4bcf50
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3829504
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82628}

Move forward with the deprecation.

R=mlippautz@chromium.org

Bug: chromium:634547
Change-Id: I46227ee119923d7f6ac364769718e5bca90686e7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3780531
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82627}

We used to treat Heap::ReportExternalMemoryPressure just like
allocation observer marking steps. Which means that we advance
incremental marking but never finalize here immediately. This is
now problematic without a separate COMPLETE phase when we don't reach
the stack guard because we are stuck in C++ for awhile. In such cases
we might perform way more marking work than we used to.

We can fix this by finalizing marking immediately at this point when
the stack guard was already armed. Otherwise we prefer to finalize
marking in a task where we don't have a stack at all.

For this we add a new method
IncrementalMarking::AdvanceAndFinalizeIfNecessary. AdvanceFromTask
is renamed to AdvanceAndFinalizeIfComplete to make the difference
between those methods more clear.

Bug: v8:12775, chromium:1354911
Change-Id: If57bedb1a5f87923ccb8ad3fe2b60952e3843975
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3845082
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82626}

The load for external reference should be a full pointer load
instead of tagged size.

Change-Id: I3460a26abea5053ba6daa5c6ed908cb93431654a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3842348Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/main@{#82625}

This is a reland of commit 9b0d5cb1

The newly added check does not allow comparisons with stale or
invalid pointers because attempt to access the page header might
crash.

Original change's description:
> [ext-code-space] Fix Code vs non-Code comparisons
>
> When external code space is enabled comparing Code and non-Code objects
> by looking at compressed values is not always correct. Such an approach
> works only for comparing Code vs Code objects or non-Code vs non-Code
> objects.
>
> This CL instroduces SLOW_DCHECK into Object comparison operators to
> ensure that such a comparison is allowed. Also, this CL instroduces
> an Object::SafeEquals() method which compares uncompressed values
> and thus is safe to be used for comparing Code with non-Code objects.
>
> Bug: v8:11880
> Change-Id: I7ccf1f90f927beb2bb9f45efb303e902b1838d02
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3838172
> Reviewed-by: Jakob Linke <jgruber@chromium.org>
> Reviewed-by: Camillo Bruni <cbruni@chromium.org>
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Commit-Queue: Igor Sheludko <ishell@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#82611}

Bug: v8:11880
Change-Id: Iab3c8fe49cb954b2dc9171b3fc4b189e84763e73
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3842932Reviewed-by: Jakob Linke <jgruber@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82624}

Bug: v8:10391
Change-Id: If85a308a6f6ed1b17d86f87b4911c82d2327ea72
Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3757341Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Samuel Groß <saelo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82623}

Bug: v8:9407
Change-Id: I159b2ce338ab55d8171b0892a6942c9a5144d632
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3842156Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Qifan Pan <panq@google.com>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82622}

This check leads to quadratic runtime, which is problematic on huge
stacks (>10000 entries in the reproducer).
Typically stacks are small, so we check the first 16 entries one by one,
and then increase the step size. This still gives fuzzers and other
tests a good chance to find bugs, but avoids quadratic runtime.

R=thibaudm@chromium.org

Bug: chromium:1344481
Change-Id: Iaa3684410939d4c56177eed62787b29e409c3136
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3842154Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82621}

Drive-by-fix: Clean up html header tags a bit

Change-Id: Ib9d3e0a24497f393b1d45b7b6ab46af381252613
No-Try: True
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3845076Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82620}

Currently, when the input ArrayBuffer is detached during DataView
construction, the code will create an invalid DataView object whose
length, offset, and data_pointer are all incorrect. While this is
currently ok as the DataView is never exposed to JavaScript in that
case, it does cause issues as setting the data_pointer to a value
outside of the V8 sandbox leads to a CHECK failure. This CL now ensures
that the constructed DataView is always in a sane state to fix this.

Bug: chromium:1354429
Change-Id: I04260a5cf5547a420956d7a75e77f41408aa4f78
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3841931Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Samuel Groß <saelo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82619}

This reverts commit 97997681.

Reason for revert: Races fixed. Skipping no longer needed.

Original change's description:
> Skip HeapTest.GrowAndShrinkNewSpace under tsan
>
> Bug: v8:13185
> Change-Id: I0c6e4ba8b325c3ac70dbceb927e2a8b1f9d68a16
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3830286
> Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
> Auto-Submit: Adam Klein <adamk@chromium.org>
> Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
> Cr-Commit-Position: refs/heads/main@{#82449}

Bug: v8:13185
Change-Id: I4e1c117250932358dbd8d09ebe2cc2d331e7236f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3844530
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Auto-Submit: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82618}

Port commit aaa15e65

Change-Id: I728d5f786c3e217d249bf6d356b2a004896ed582
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3844663
Auto-Submit: Yahan Lu <yahan@iscas.ac.cn>
Reviewed-by: ji qiu <qiuji@iscas.ac.cn>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82617}

This reverts commit 9b0d5cb1.

Reason for revert: Seems to fail on gc-stress bots (e.g. https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/43472/overview)

Original change's description:
> [ext-code-space] Fix Code vs non-Code comparisons
>
> When external code space is enabled comparing Code and non-Code objects
> by looking at compressed values is not always correct. Such an approach
> works only for comparing Code vs Code objects or non-Code vs non-Code
> objects.
>
> This CL instroduces SLOW_DCHECK into Object comparison operators to
> ensure that such a comparison is allowed. Also, this CL instroduces
> an Object::SafeEquals() method which compares uncompressed values
> and thus is safe to be used for comparing Code with non-Code objects.
>
> Bug: v8:11880
> Change-Id: I7ccf1f90f927beb2bb9f45efb303e902b1838d02
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3838172
> Reviewed-by: Jakob Linke <jgruber@chromium.org>
> Reviewed-by: Camillo Bruni <cbruni@chromium.org>
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Commit-Queue: Igor Sheludko <ishell@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#82611}

Bug: v8:11880
Change-Id: Ie34af0135625eff2975f78f4d2901a76b8517eb7
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3842930
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Owners-Override: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82616}

This CL shuffles around some code in `ScopeIterator` to better reflect
the two (internal) iteration modes:

  - While "inside" the paused function we iterate based on lexical
    scopes.
  - Once we move past the paused function we iterate based on runtime
    contexts.

This CL renames the advancing functions to `AdvanceScope` and
`AdvanceContext` respectively which operate in the following way:

  - `AdvanceScope` first checks if the current lexical scope requires
    a context. If so, we move one context up the chain, since the next
    lexical scope belongs to that next context. Then we move up one
    lexical scope.

  - `AdvanceContext` moves one context up the context chain. Then we
    we move up through all the lexical scopes until we find the next
    lexical scope that requires a context.

The tricky bit is the transition from scope iteration mode to context
iteration mode. This is where the bug fix comes in. After doing one
standard `AdvanceScope` from the `closure_scope_` to the next
lexical scope, we need to keep moving up through the lexical scope
until we find the next lexical scope that requires a context.

The CL also changes how we collect the locals blocklist. The
locals blocklist is always put on the current context. So every
time we move up one context we reset the locals blocklist and
every time we move up the lexical scope we collect the scope
locals into the blocklist.


R=bmeurer@chromium.org, jarin@chromium.org

Fixed: chromium:1354464
Change-Id: I7b37687a8827c20d0660a25413d2c9117b5fe5ba
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3842158
Commit-Queue: Simon Zünd <szuend@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82615}