Changes:
- Rename kWasmTrapDataSegmentDropped to the more accurate ~OutOfBounds.
- Drop unused argument from {WasmCompiler::ArrayInit}.
- Rename {Factory::NewWasmArray} -> NewWasmArrayFromElements.
- Add error handling to {InitExprInterface}.
- Allow the data count section to appear anywhere in the module under
  --experimental-wasm-gc. Add the same capability in
  wasm-module-builder.js.
- Add {WasmArray::MaxLength(uint32_t element_size_log2)}.
- Add kTrapArrayTooLarge in wasm-module-builder.js.
- Small test improvements in gc-nominal.js.

Bug: v8:7748
Change-Id: I68ca0e8b08f906503f0d82e5866395018d216382
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3401593Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78730}

Change-Id: I4da78ec0f309c72007ee30336d77a77205f3e3fd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3406597
Auto-Submit: Andrey Kosyakov <caseq@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78729}

https://chromium.googlesource.com/external/github.com/tc39/test262/+log/6c9b4de5..e87b0048

Bug: v8:7834
Change-Id: Ie6e13a6753c0b67be63186143574350ce30ba1f0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3405216Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78728}

Bug: v8:12565
Change-Id: I8765b325c97740a2a3e32535ec70198c3e9cb2dc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3406747Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78727}

Rolling v8/third_party/google_benchmark/src: https://chromium.googlesource.com/external/github.com/google/benchmark/+log/9e859f5..acd7562

Refine the User Guide CPU Frequency Scaling section (#1331) (Matt Armstrong)
https://chromium.googlesource.com/external/github.com/google/benchmark/+/acd7562

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com,mlippautz@chromium.org

Change-Id: I49f0df390c6f06d810e942e67193b3ef83632080
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3411771
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#78726}

The frame construction code in AssembleConstructFrame saves the registers on the
stack, if this does not occur for every code path then the values restored to
the registers in AssembleReturn will be incorrect.

The relevant DCHECK had been removed here:
https://chromium-review.googlesource.com/c/v8/v8/+/2922604/5/src/compiler/pipeline.cc.

This was not previously an issue as no builtins used callee saved registers,
this changed in the following patches:
https://chromium-review.googlesource.com/c/v8/v8/+/2922604/
https://chromium-review.googlesource.com/c/v8/v8/+/2944844

Bug was found using PGO for the RecordWriteOmitRememberedSetSaveFP builtin on
AArch64.

Change-Id: I23fbea9f39c9b61ef0d0b28b73ebe6063e478fef
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3401589Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Martyn Capewell <martyn.capewell@arm.com>
Cr-Commit-Position: refs/heads/main@{#78725}

This reverts commit 77be1c60.

Reason for revert: breaks msan https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/42062/overview

Original change's description:
> factory: Move FeedbackVector construction to type
>
> Drive-by: Avoid unnecessary memset and clean up Init().
>
> Bug: v8:12559
> Change-Id: I6a79f42dd62b47397d70f92efec3b569ca664c3e
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3404097
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#78722}

Bug: v8:12559
Change-Id: I79bea5753eeadf209dc2867c8387cc42c675e567
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3406757
Auto-Submit: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#78724}

Change-Id: I92479fe32ff4f55a0cf33c1d0898740e3f3cd5ad
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3406752Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78723}

Drive-by: Avoid unnecessary memset and clean up Init().

Bug: v8:12559
Change-Id: I6a79f42dd62b47397d70f92efec3b569ca664c3e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3404097Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78722}

Externref does not need a translation from WebAssembly to JavaScript.
The return value can therefore just be forwarded to JavaScript.

R=thibaudm@chromium.org

Bug: v8:12565
Change-Id: I3b3ae37578c2793f6c09d1345f4ee555b40c853d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3404779Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78721}

This is similar to the previous SIMD spilling fixes, but this time at
block merges. The logic is similar to the existing cases, but not quite
the same. I did not find a nice way to unify the different locations
where we check for SIMD register overlap.

R=thibaudm@chromium.org

Bug: chromium:1283395, v8:12330
Change-Id: I5ab9b6831368cbce40b8368e4ec7954e985bff96
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3404780Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78720}

The C-API does not support dynamic tiering and still waits for top-tier
compilation to finish before serializing code when the explicit
serialize() function gets called. This means that serialize() can only
finish if the kFinishedTopTierCompilation event was triggered first.
With this CL the kFinishedTopTierCompilation event is also triggered
after deserialization so that serialize() can work after
deserialization.

R=clemensb@chromium.org

Bug: v8:11024
Change-Id: I3dd14e37087e3cbfbc28cb5625c9f3715f6c236b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3404773Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78719}

Bug: v8:11111
Change-Id: Ia84fe23c85b193bc7e31349eddc3705447795c33
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3400960Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78718}

Bug: v8:12356
Change-Id: Ib9e99c8b05e24a8983c5ff3d36ca534a262738a0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3404774
Auto-Submit: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78717}

We used to serialize the full source code of the script being
serialized. This CL makes the source code maximally minimal (only
including the needed outer functions) while maintaining the "inner
function is textually inside its outer function" relationship.

Bug: v8:11525
Change-Id: Ic42772f7ecb76744bc11b97fa1784d847558e1f6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3401864Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78716}

Save the PC in the jump buffer and implement the suspend builtin.

R=ahaas@chromium.org
CC=​fgm@chromium.org

Bug: v8:12191
Change-Id: I1a6d965d7864dce0a572f6c8d7102046dad190fd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3345006Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78715}

Allow Wasm to generate calls directly to Fast API C functions.
This massively reduces the overhead of these calls (~300%).
Currently options parameter is not supported.

This is a reland of
https://chromium-review.googlesource.com/c/v8/v8/+/3364356
with a fix to a data race.

Bug: chromium:1052746
Change-Id: I8c1c255419496d03a94ec2b443329842469586d5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3398394Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Paolo Severini <paolosev@microsoft.com>
Cr-Commit-Position: refs/heads/main@{#78714}

Bug: v8:11544
Change-Id: I1a942badc31c0428e8eb07b7e2884f0aab803676
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3373930Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78713}

So far this flag was process-global, so if one isolate used v8::Locker
all isolates were forced to use v8::Locker. With the shared isolate
now being a thing that routinely gets migrated between different
threads, all users of the shared isolate would be forced to use
v8::Locker. So we now store that flag on the isolate such that using
v8::Locker for the shared isolate does not affect other isolates.

Deprecate v8::Locker::WasEverUsed() at the same time.

Bug: v8:11708
Change-Id: I60531f084cc1b1b113620c46f5bed20511f52c26
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3401595Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78712}

Bug: v8:12561
Change-Id: I6910723a3a85df7ba3d49816e5e800cd4ee6bad6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3404732
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78711}

Change-Id: I0d72b9c72e3a2244409dee6f4694c92ecb3d41b0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3403043Reviewed-by: Milad Farazmand <mfarazma@redhat.com>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/main@{#78710}

Change-Id: I6e20fa4ae24db6b799d854aef2ef98e7a8e1e552
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3403041Reviewed-by: Milad Farazmand <mfarazma@redhat.com>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/main@{#78709}

The external pointer table is now managed by the GC, which marks entries
that are alive during major GC, then sweeps the table afterwards to free
all dead entries and build a free list from them. For now, only major GCs
are supported, Scavenger GCs do not interact with the external pointer table.

In more detail, garbage collection of the external pointer table works
as follows:

1. The external pointer table now reserves a large region of virtual
   address space for its backing buffer and is then never reallocated,
   only grown in place until the maximum size is reached.
2. When the GC's marking visitor marks a HeapObject with an external
   pointer as alive, it also marks the corresponding external pointer
   table entry as alive. This can happen on a background thread.
3. For that, it uses the MSB of each entry in the table to indicate
   whether the entry has been marked or not. This works because the MSB
   is always cleared during the AND-based type check performed when
   accessing an external pointer.
4. After marking, the external pointer table is swept while the mutator
   is stopped. This builds an inline, singly-linked freelist of all
   newly-dead and previously-free entries.
5. When allocating an entry from the table, the first entry on the
   freelist is used. If the freelist is empty, the table grows,
   populating the freelist with the new entries.
6. Every newly-allocated entry is marked as alive, and every store to an
   existing entry also automatically marks that entry as alive (by also
   setting the MSB). This simplifies the design of the table GC with
   regards to concurrency (See ExternalPointerTable::Mark).

Bug: v8:10391
Change-Id: I8877fdf5576af3761bde65298951bb09e601bd14
Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3359625Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Samuel Groß <saelo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78708}

Change-Id: I5114f6975563a59c586c9a28711034cdd35a9b31
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3401870Reviewed-by: Lutz Vahl <vahl@chromium.org>
Commit-Queue: Lutz Vahl <vahl@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78707}

This reverts commit 757830b0.

Reason for revert: Speculatively revert due to a number of
performance regressions

Original change's description:
> [Torque] Generalize Torque literals to larger size
>
> Previously, literals in Torque were stored as double values, which
> made it impossible to precisely represent 64 bit integer values.
> This CL replaces the old literal expression with an integer and
> floating point literal expression that are unbounded in size. We
> allow implicit conversion of these literals to arbitary integer
> and floating point types respectively and insert a corresponding
> bounds check into generated CSA.
>
> Bug: v8:7793
> Change-Id: I46c231aab92bc2f0c26955d1876079f306b358c6
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3329792
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#78671}

Bug: v8:7793
Change-Id: I9896e28b3c69b8cf2488bf93e993ec320d8c5d2e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3401866Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Owners-Override: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78706}

Bug: v8:11525
Change-Id: I5bc01779cbc7edf4f50377bc55a26dca1f96f5b8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3401587Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78705}

This reverts commit 83bf6629.

Reason for revert: Have to revert dependent CL

Original change's description:
> [Torque] Fix compile error in integer-literal.h
>
> Bug: v8:7793
> Change-Id: I88e6ea24909ba1dde8cada90d7b195b6f6ecc783
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3400958
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
> Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#78678}

Bug: v8:7793
Change-Id: I4e62d8d121c0585df15f47653c44569d0f6b5606
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3401597
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Owners-Override: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78704}

This reverts commit 519ee9d6.

Reason for revert: Need to adjust to 10.0

Original change's description:
> Version 9.10.0
>
> Change-Id: I1be4d945e1ba2c1816b5fd335e7fe08eb4aca4c1
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3404534
> Reviewed-by: Lutz Vahl <vahl@chromium.org>
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Commit-Queue: Liviu Rau <liviurau@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#78702}

Change-Id: I2f6f8b64123d477f7c982e2623aca43fc8b245ae
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3404771
Auto-Submit: Lutz Vahl <vahl@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Reviewed-by: Lutz Vahl <vahl@chromium.org>
Reviewed-by: Liviu Rau <liviurau@chromium.org>
Commit-Queue: Liviu Rau <liviurau@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78703}

Change-Id: I1be4d945e1ba2c1816b5fd335e7fe08eb4aca4c1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3404534Reviewed-by: Lutz Vahl <vahl@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Liviu Rau <liviurau@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78702}

Split method into ShouldRecordRelocSlot and ProcessRelocInfo.
ProcessRelocInfo can then be reused in the write barrier and in the
future for the OLD_TO_SHARED remembered set. SlotTypeForRelocInfoMode
got moved into ProcessRelocInfo.

In addition rename and document SlotTypes. This CL does not change
behavior.

Bug: v8:11708
Change-Id: Iff712e7e6f5d3a4da64510b67b604b9e04998361
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3400968Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78701}

Bug: v8:12558
Change-Id: Ib615c192a0ec6bc7c8ee8b0ee0f393092a5dedb4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3401590
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78700}

Need to reverse the index on big endian platforms due to
this previous change: https://crrev.com/c/1508572

Change-Id: I12e0230d929f5f16ecd2300a49970f92b0d3be50
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3402363Reviewed-by: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#78699}

Bug: v8:12552
Change-Id: I99e4d8e8aeba5460f11e54cc1b2bcaea98a5276d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3400964Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78698}

In case the requested permissions are kNoAccess, nothing needs to be
done as the mapping backing an AddressSpaceReservation is always
mapped kNoAccess. This fixes a performance regression on macOS.

Bug: chromium:1287599
Change-Id: I77d80489caf477e29434f9d0a06899746cb9403f
Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3398144Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Samuel Groß <saelo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78697}

Bug: v8:12405
Change-Id: I00f727ad5172d08f430b5dc2b7a348cbec344c4a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3401721Reviewed-by: Lutz Vahl <vahl@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Liviu Rau <liviurau@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78696}

Change-Id: I8fd11742c4ea13cfd5cd3864e167785b97f1383a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3404274Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Jochen Eisinger <jochen@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78695}

Bug: v8:12558
Change-Id: If5f8048d1a48719329c257282195f5096e101512
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3401586
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78694}

This CL fixes two issues:

1) When the specified vmar_offset was zero, the previous logic would
   incorrectly conclude that no target address was specified, and would
   potentially place the allocation elsewhere in memory, not at the
   desired address. This CL now passes both the target address and the
   VMAR base address to AllocateInternal, which can then correctly
   determine whether a target address was supplied.

2) When the root_vmar was used and a hint specified, the previous logic
   would incorrectly use nullptr as base address of the root_vmar, which
   appears to be incorrect. The new logic now obtains the actual base
   (apparently 2MB) through zx_object_get_info during initialization.

Bug: v8:10391
Change-Id: Ia8215440a790b4a2a0c8d33f623d3ecb6a731a97
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3398506Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Samuel Groß <saelo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78693}

Use the FatalProcessOutOfMemory function such that tooling recognizes
these crashes as OOM's.

Drive-by: Skip one more test that leads to such stack overflows.

Fixed: v8:12555, chromium:1288456
Bug: v8:12472
Change-Id: Ib9203a4aa0487744f7cea9a212aeeffda579ae23
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3401861
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78692}

Port commit db9f6bff

Bug: v8:11112

Change-Id: I6c69e0501cae6c46e723d847bf56e69bb4835bec
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3398260Reviewed-by: ji qiu <qiuji@iscas.ac.cn>
Commit-Queue: ji qiu <qiuji@iscas.ac.cn>
Cr-Commit-Position: refs/heads/main@{#78691}