Add a SerializedCodeData constructor which skips all sanity checks aside
from the source hash check, to be used after off-thread deserialization
(which does these other checks already). In particular, this skips doing
the checksum again, which would otherwise require a second walk over the
serialized data.

This requires saving the off-thread sanity check result (in the case of
a failure), since it is no longer recomputed.

Change-Id: I664c309c9cb8dca94a74b4293c84ceb353f37ed4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3240402
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77537}

A follow-up to crrev.com/c/3240782.

Drive-by: extend JSRegExp printing.

Fixed: chromium:1263327
Bug: v8:11069
Change-Id: Iff64ded27ca93641f0f572df2ce0a9f846948f7f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3245110
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77536}

Some fields didn't have default values, which made it impossible to
check whether or not all fields are initialized.

Bug: chromium:1056170
Change-Id: I8c6f89e64661420460bfc351473a47a623ef6399
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3243462Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77535}

v8_enable_v8_checks has very little coverage outside of V8 itself.
Move pointer verification checks behind DEBUG so that they fire in
regular debug or dcheck_always_on builds.

Change-Id: Ib2803240dd996f4223e403d20e927aff2955afbc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3242006Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77534}

This fixes webkit/run-json-stringify broken by
https://crrev.com/c/3222765

Failure: https://logs.chromium.org/logs/v8/buildbucket/cr-buildbucket/8832393633085738145/+/u/Bisect_23af060d/Retry_-_default/run-json-stringify


Bug: chromium:1244145
Change-Id: I1235f6db8ab10356476cd1028b20300f86510119
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3242005
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Auto-Submit: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77533}

Rolling v8/third_party/google_benchmark/src: https://chromium.googlesource.com/external/github.com/google/benchmark/+log/80d70dd..365670e

Added Doxygen support. (#1228) (Vitaly Zaitsev)
https://chromium.googlesource.com/external/github.com/google/benchmark/+/365670e

TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com,mlippautz@chromium.org

Change-Id: I124d163fd57ea7702462ff8e8998e5aff56092d6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3244951Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#77532}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/acad0f2..0afcdef

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/src/buildtools/+log/f5750f5..850fe71

Rolling v8/third_party/aemu-linux-x64: 8buMrGFlldiiEGiS-u8rclQGhORwxrcN14vZGo5U8sgC..anmoXU7qoa185RNsOxsBoD0U-T6rHNnNeGfdCNx1LB0C

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/7a6ff98..7bd4c88

TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I15b45d42227221ebbd7c99efdf612ecc789ecfc8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3244930Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#77531}

Bug: v8:12050
Change-Id: I599338eba458e177327870699b6ea8a423e144c2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3211577
Commit-Queue: Wez <wez@chromium.org>
Auto-Submit: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Wez <wez@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77530}

Check for the most commonly used wrong sentinel value (-1). Users
should use cppgc::kSentinelPointer instead.

Bug: chromium:1263009
Change-Id: I200954bcd70c6a100ffec24aece3e1843e1438a0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3242002
Auto-Submit: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77529}

Bug: v8:12297
Change-Id: Ifbf6ac61e6b61e419b361d1fc14009d6d745193c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3231484Reviewed-by: Milad Fa <mfarazma@redhat.com>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Commit-Queue: Vasili Skurydzin <vasili.skurydzin@ibm.com>
Cr-Commit-Position: refs/heads/main@{#77528}

ObjectSizeTrait::GetSize is used by Trace methods in Blink and may be
called while concurrent marking is active. The current version is
non-atmoic and therefore can race with marking on other threads.

Bug: chromium:1261860
Change-Id: Ia0b41ec496ac64ae3dd5a040b25f6972b21561c5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3240832Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77527}

variable 'pushed_stack_space' set but not used.

Change-Id: I427f76448b9933f9c8f1169709e28eef4512241f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3241543Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#77526}

R=ahaas@chromium.org

Change-Id: I860cd7aebdf46f323c7f6ad0cd563246a061c4d1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3226338
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77525}

For the upcoming host_defined_options fixes we will have to explicitly
pass the host-defined options to Invoke so we will be able to install
it in the script context in the future.

Bug: chromium:1244145
Change-Id: I690cc774d6a17278db4381aba8c3408e979606c1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3222765
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77524}

Persistent node slots are dynamically allocated and their allocation
may fail. Delegate to the proper OOM handler in this case.

Bug: chromium:1243257
Change-Id: I985f5b0c940f7ac4996f3f3243123a07119005b9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3240786Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77523}

R=clemensb@chromium.org

Change-Id: Ia804d29a61e9d716b5ee5acebce7cb9c273697d7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3241363
Commit-Queue: Liviu Rau <liviurau@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77522}

This CL fixes an issue in EffectControlLinearizer, where the primitive
type of the argument of a fast C call was used to compute its
MachineType even when the argument was actually a TypedArray, which
should always be treated as a Tagged type. This resulted in Float32/64
typed arrays being passed in FP registers, leading to a crash in the
register allocator.

Drive-by fix: Fixed output from --trace-turbo-alloc so that all of its
sub-parts are printed with PrintF, avoiding interleaved log lines.

Bug: chromium:1260954
Change-Id: I249c8629daae3af437fb52f53f45211f3a214222
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3231341Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77521}

Drive-by: Use only LocalIsolate in AllocateConcurrentSP

Bug: v8:12054
Change-Id: Ibdd8b562548f249fc2be4dca723ce4fedc7c09ad
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3240783
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77520}

Bug: v8:11880
Change-Id: I9a936c293e261142111e235c041e3526680d9629
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3240828Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77519}

Marking verification should only process young generation objects when
verifying the marking state of a young generation garbage collection.

Bug: v8:12324
Change-Id: I01db261437ec5c42ddb6c79c44e31b5fe0e536d7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3231343Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77518}

No-Try: true
Bug: chromium:1262423
Change-Id: I9d56e347d046944f01e33aa6fb8752c889e2d38d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3240784
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77517}

Bug: chromium:1254189
Change-Id: I77854c767cf5c5748999fdd40a4a42e25dff3f79
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3236989Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77516}

We introduce simple escape analysis for wasm-gc objects, where struct
allocations that are only assigned to are eliminated. Handling phi uses
of allocated objects is left for future work.

Bug: v8:11510
Change-Id: Ibd0b220466546e150b26b02890572a5174c6872d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3229744Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77515}

Character class handling in the irregexp pipeline is quite complex;
codepoints outside the BMP (basic multilingual plane) are only
translated into surrogate pairs when needed, e.g. when the subject
string is two-byte. If not needed, the codepoints simply stay part of
the list of CharacterRanges.

In EmitCharClass, we determine the valid subset of ranges through
ranges_length; until this CL, we forgot to pass that information on to
MakeRangeArray. Do that now by truncating the list of CharacterRanges.

Fixed: chromium:1262423
Change-Id: I5bb5b839e9935890ca2d10908ad66d72c3217178
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3240782
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77514}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/ad1e3fb..acad0f2

TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I9a41a3b68d828e01cfe2d8e9e06b26974965ad55
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3239926Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#77513}

Port commit 1cd7a582

Change-Id: Iec6b60caeb55fd240407acc99872ebf0558654bf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3239087Reviewed-by: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Auto-Submit: Liu yu <liuyu@loongson.cn>
Cr-Commit-Position: refs/heads/main@{#77512}

Change-Id: Id6d8f1224cb59fb55decbd6fef1c8e674ea6de63
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3237328Reviewed-by: ji qiu <qiuji@iscas.ac.cn>
Commit-Queue: ji qiu <qiuji@iscas.ac.cn>
Auto-Submit: Yahan Lu <yahan@iscas.ac.cn>
Cr-Commit-Position: refs/heads/main@{#77511}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/263ec78..ad1e3fb

Rolling v8/buildtools/third_party/libunwind/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind/+log/fa8d4c8..21acd3f

Rolling v8/third_party/aemu-linux-x64: KDNRxWTmjlQIxZYPFEwIygxfih4aexkTD2JwU6hED-8C..8buMrGFlldiiEGiS-u8rclQGhORwxrcN14vZGo5U8sgC

TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I0a097f57932644ddde82209d64ecb5c1dd92f415
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3239523Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#77510}

Narrow down the list of owners to choose from in the gcmole auto-update CLs.

Bug: v8:11169
Change-Id: I9f553124c43dc9fc094a8f4a6e2bcc832fe27636
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3236993
Commit-Queue: Liviu Rau <liviurau@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77509}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/4d4596d..263ec78

Rolling v8/buildtools/third_party/libc++abi/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi/+log/be63497..9b8228b

Rolling v8/buildtools/third_party/libunwind/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind/+log/6f77fbf..fa8d4c8

TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I01ebcedc4000923f7e433e0a8dc87d1f042f6f08
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3237759Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#77508}

Some variables are only used in DCHECKs, which leading to the
`unused-but-set-variable` check fail in release mode.
So we need to explicitly mark them as used.

Change-Id: I18dc8ec97ea5fbbaa081a52629b9572b863d901e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3237558Reviewed-by: Liu yu <liuyu@loongson.cn>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/main@{#77507}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/ee9068d..4d4596d

Rolling v8/buildtools/third_party/libc++abi/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi/+log/4c834ab..be63497

Rolling v8/third_party/aemu-linux-x64: CtkoubyWN1QNNB68v2CsV0fsa-ikErKqmbujQdM_iGMC..KDNRxWTmjlQIxZYPFEwIygxfih4aexkTD2JwU6hED-8C

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/2d03634..e9a87dc

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/ed33756..7a6ff98

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/2b09788..e193c0a

TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I913db72cd3a1b0b7351a95d33829f85bb643268e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3237409Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#77506}

Bug: v8:12301
Change-Id: Ia87943478c1b67c077a18785668c485c404cd5dd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3235814Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77505}

Extract instructions, and pextrq.

Bug: v8:12207
Change-Id: I919ce53a6bb1357cb70d78b3c7f12fc3d2128deb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3223969
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77504}

https://chromium.googlesource.com/external/github.com/tc39/test262/+log/8d420cef4..1ad9bb7626a

Bug: v8:7834
Change-Id: Icc082f9834aabd39f0d21f85d6ff9ed8ad1d0137
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3235813Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77503}

https://github.com/google/benchmark/pull/1256 has been upstreamed.
Manually roll forward and immediately remove the build-time work
around.

Change-Id: I567dc0bdfda128656c874b6555dc6a89eeaa8100
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3236991
Auto-Submit: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Nico Weber <thakis@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77502}

Bug: chromium:1260621
Change-Id: Iddfd5ee70ce9479209ff81f41197805e738298e0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3236990Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77501}

This flag will force the usage of the mid-tier register allocator, which
is otherwise only used for huge functions, hence does not get much
fuzzer coverage.

R=machenbach@chromium.org

Bug: v8:12330
Change-Id: I30b602b54adf858a2a3aaf73d8828875c1f6df7a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3234492Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77500}

Change-Id: Ia4151fe23a8217f3f62d895fb74f96f934ab9618
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3236766Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#77499}

To get more details about the failure when it flakes.

Bug: v8:12332
Change-Id: I1bf5188efe13a75e34dd9832e6275fd985ee8dbd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3233974
Commit-Queue: Joyee Cheung <joyee@igalia.com>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77498}