Bug: v8:10021
Change-Id: Id0616fa2c320bd5a817745310debf63fcf58e107
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1950490
Auto-Submit: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65348}

Currently a TracedNode of a TracedReference is freed only if its target
V8 object is unreachable. This is problematic for TracedNodes created for
long-living (or immortal) V8 objects and leads to memory leaks.

This CL adds logic for collecting unreachable TracedNodes:
1) Each TracedNode gets a markbit. Initially the markbit is set (i.e.
   we have black allocation for TracedNodes).
2) During marking RegisterEmbedderReference sets the markbit of the
   corresonding TracedNode.
3) In the atomic pause of Mark-Compact when TracedNodes are iterated,
   we check the markbits and free TracedNodes with cleared markbits.
   After this processing all markbits are cleared for the next GC.

Note that the new logic does not apply to TracedNode that have
callbacks and/or destructors.

Bug: chromium:1029738
Change-Id: I38e76a8b4a84170793998988b1a7962e40874428
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1948722
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65347}

... even in release builds.

Bug: chromium:1029576
Change-Id: Iefc6b267c9db09f68742152a302726fcfe4c75b7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1948714
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65346}

Also make return and unconditional jumps kill the environment instead
of clearing it. This was still leftover from before we introduced
liveness and prevented sharing as well.

Bug: v8:7790
Change-Id: Ic79d64c9eaedf608d26e3265d4b27d21f7f3dfe1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1948710
Auto-Submit: Georg Neis <neis@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65345}

Bug: v8:9909
Bug: chromium:1030912
Change-Id: I56134087156e4fe2598ef5a282cd57344a729a38
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1950225
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65344}

Change-Id: I2ad2c61a3ca77611bb40e66647a269b5d16a64b3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1950976Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65343}

port 91ee5f04 https://crrev.com/c/1925614

Original Commit Message:

 [wasm-simd] Implement f64x2 min max for arm

Change-Id: I41b350cdcc9242b2fed6260873dc202367509137
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1947690
Auto-Submit: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65342}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/e35470d..4538ab6

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/10bac4e..989b615

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/9777ab3..9212599

Rolling v8/third_party/zlib: https://chromium.googlesource.com/chromium/src/third_party/zlib/+log/e77e1c0..f262c1b

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: I05d2c76d1e776edff77bf16a763ca6d80121546a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1950924Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#65341}

port 9fcbb5e3 https://crrev.com/c/1873700

Original Commit Message:

  Replace unsigned extract lane followed by sign extend
  as added here https://chromium-review.googlesource.com/c/v8/v8/+/1846711
  with a signed extract lane for I8x16 and I16x8.

Change-Id: I46f9d3ed364f28289e23a635281ea0ef44865d1a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1947689
Auto-Submit: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65340}

Since other files now call this template function, where no definition
of it is available, definitions need to be generated explicitly.

This fixes Node.js debug builds with the current V8 master branch.

Refs: https://chromium-review.googlesource.com/c/v8/v8/+/1940250
Refs: https://github.com/nodejs/node-v8/issues/129
Change-Id: Icc99f7a4c3669452ade65229d6ae48b49e2da0e4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1950971Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65339}

Bug: v8:10035
Change-Id: Ie4172d366a90b9d7ee2256aadc96835311775aac
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1950970
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Francis McCabe <fgm@chromium.org>
Reviewed-by: Francis McCabe <fgm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65338}

This patch implements inspector support for private instance methods:

- Previously to implement brand checking for instances with private
  instance methods we store the brand both as the value with the brand
  itself as the key in the stances. Now we make the value the context
  associated with the class instead.
- To retrieve the private instance methods and accessors from the
  instances at runtime, we look into the contexts stored with the
  brands, and analyze the scope info to get the names as well as
  context slot indices of them.
- This patch extends the `PrivatePropertyDescriptor` in the inspector
  protocol to include optional `get` and `set` fields, and make the
  `value` field optional (similar to `PropertyDescriptor`s).
  Private fields or private instance methods are returned in the
  `value` field while private accessors are returned in the `get`
  and/or `set` field. Property previews for the instaces containing
  private instance methods and accessors are also updated similarly,
  although no additional protocol change is necessary since the
  `PropertyPreview` type can already be used to display accessors.

Design doc: https://docs.google.com/document/d/1N91LObhQexnB0eE7EvGe57HsvNMFX16CaWu-XCTnnmY/edit

Bug: v8:9839, v8:8330
Change-Id: If37090bd23833a18f75deb1249ca5c4405ca2bf2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1934407
Commit-Queue: Joyee Cheung <joyee@igalia.com>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65337}

Port 785fa6b4

R=zhin@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I34f98cef7b78c694ba909e02d8c7bb251c7b5301
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1949153Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#65336}

TBR=tebbi@chromium.org

Bug: v8:10034
Change-Id: I5a4be45ac6795bd517d53f64a699691de90b4624
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1950969
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65335}

Bug: v8:7327
Change-Id: I0baece9baa3147c9cf0b555879b0cbb138f5e871
Notry: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1940158
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Auto-Submit: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65334}

This reverts commit 5bddc0e1.

Reason for revert: Possible culprit for https://bugs.chromium.org/p/chromium/issues/detail?id=1029863

Original change's description:
> Implement top-level await for REPL mode
> 
> Design doc: bit.ly/v8-repl-mode
> 
> This CL allows the usage of 'await' without wrapping code in an async
> function when using REPL mode in global evaluate. REPL mode evaluate
> is changed to *always* return a Promise. The resolve value of the
> promise is the completion value of the REPL script.
> 
> The implementation is based on two existing mechanisms:
>   - Similar to async functions, the content of a REPL script is
>     enclosed in a synthetic 'try' block. Any thrown error
>     is used to reject the Promise of the REPL script.
> 
>   - The content of the synthetic 'try' block is also re-written the
>     same way a normal script is. This is, artificial assignments to
>     a ".result" variable are inserted to simulate a completion
>     value. The difference for REPL scripts is, that ".result" is
>     used to resolve the Promise of the REPL script.
> 
>   - ".result" is not returned directly but wrapped in an object
>     literal: "{ .repl_result: .result}". This is done to prevent
>     resolved promises from being chained and resolved prematurely:
> 
>     > Promse.resolve(42);
> 
>     should evaluate to a promise, not 42.
> 
> Bug: chromium:1021921
> Change-Id: I00a5aafd9126ca7c97d09cd8787a3aec2821a67f
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1900464
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Commit-Queue: Simon Zünd <szuend@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#65273}

TBR=yangguo@chromium.org,leszeks@chromium.org,verwaest@chromium.org,szuend@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: chromium:1021921
Change-Id: I9eaea584e2e09f3dffcbbca3d75a3c9bcb0a1adf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1948719Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65333}

This reverts commit 78786a2f.

Reason for revert: Possible culprit for https://bugs.chromium.org/p/chromium/issues/detail?id=1029863

Original change's description:
> Introduce and emit "function calls in detached window" use counters.
> 
> Bug: chromium:1018156
> Change-Id: I2133bd8fc4ae4d9ce3c16c50887beb677d979e18
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1924000
> Commit-Queue: Bartek Nowierski <bartekn@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#65272}

TBR=ulan@chromium.org,tasak@google.com,jgruber@chromium.org,bartekn@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: chromium:1018156
Change-Id: I78465f5e979b219079bd4156bb7277b3a968c85d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1948718Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65332}

Looks like even the small amount of logic needed to extract ReadOnlyRoots
from a const Isolate* (e.g. a HeapObject check) is enough to cause
regressions.

Revert these predicates to take non-const Isolate*, while keeping const
Isolate* elsewhere. If we ever need const Isolate* for the oddball
predicates, we can add it in addition to the non-const one.

Bug: chromium:1029457
Bug: chromium:1030001
Bug: chromium:1030003
Bug: chromium:1030102
Change-Id: Ia6fa45f282a1a1961c0afa8ed973baebf6fbafd3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1948721Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65331}

Bug: v8:10032
Change-Id: Iff7ea0ce0f60b734a6f97b5bde068fa30a4774af
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1950484
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65330}

This fixes the operation functions (i.e. WebIDL interface member and
namespace member operations) for WebAssembly to not have 'prototype'
properties and not be marked as constructors.

R=ahaas@chromium.org
TEST=mjsunit/wasm/js-api
BUG=chromium:1027945

Change-Id: I4db753a9ca570b95c45cb033c36de65bcafafe8f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1950483Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65329}

Bug: v8:7790
Change-Id: I75be15cae0b7ddc3ad5650008fdb3af0df7157f9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1950486
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65328}

This fixes a compilation error with Xcode.

Change-Id: Iaab7cab0d3200c5622f306c7ad0926931d5dce47
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1948716Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Michaël Zasso <mic.besace@gmail.com>
Cr-Commit-Position: refs/heads/master@{#65327}

This helper method is no longer needed since we have removed all usages
of indexes for the purpose of accessing stack spill slot.

The parameter names for FillStackSlotsWithZero in the header file is
also corrected to match the names in the implementation.

Bug: v8:9909
Change-Id: I6093f020e05701ff8e8d6362015d2e07165b2397
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1950224Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65326}

Forgot to pass the method name to the message template.

Bug: v8:9800
Change-Id: Id1b53b166a6908f6d906abb7a820bbf201e906fa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1947326
Auto-Submit: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Joshua Litt <joshualitt@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65325}

Change-Id: Ia5c6793f22b3eeff3614542e455d46daa76657a0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1948792Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65324}

Missed out ppc in https://crrev.com/c/1947350

Bug: v8:9909
Change-Id: I1cdd02b75fda093d279ec9f4e8d99835a3e6c962
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1950223Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65323}

Bug: v8:9561
Change-Id: I39a3148570664909eb08f1559b2cb418477a6c15
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1948717
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65322}

Imports can also have associated names, and in fact we generate these
names for asm.js. Thus in logging, just append this name to the
generated signature.

R=jkummerow@chromium.org

Bug: chromium:1030103
Change-Id: I3969bcf8d1d17f4256b5a0643acdf8a24766f889
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1948705
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65321}

Bug: v8:9909
Change-Id: I997ae6f19c580f08eb9ff8ee039e0dd647091616
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1947350
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65320}

This was probably meant by the TODO removed in
https://crrev.com/c/1946354, I just failed to see it because the TODO
was placed at the wrong place.

The fix triggered a bug in the profiler, which made the wrong
assumption that the passed wasm name is null-terminated. This is also
fixed in this CL.

R=jkummerow@chromium.org, petermarshall@chromium.org

Change-Id: Ibf798e7511e61f6b305dd2d05d1aeca43be774a0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1948704Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65319}

The ScopeIterator only requires accurate information for the whole
script during local debug-evaluate, when the accurate scope information
is used to build stack local blacklists. Otherwise it is enough to only
reparse the closure. This should recover some performance during
stepping, especially with large stacks and scripts.

Drive-by: Remove unused COLLECT_NON_LOCALS enum option.

Bug: chromium:1028093, v8:9938
Change-Id: I6b3a34e9015e564d683e76b88388daabc426e1cb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1948715
Commit-Queue: Simon Zünd <szuend@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65318}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/a82ba26..e35470d

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/ca84a42..10bac4e

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/6d31ed5..9777ab3

Rolling v8/third_party/fuchsia-sdk: https://chromium.googlesource.com/chromium/src/third_party/fuchsia-sdk/+log/a841030..4225f68

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: I6f02720a886864a85623ad8d6a469da8ff4d88ae
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1947672Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#65317}

Port 9fcbb5e3

Original Commit Message:

    Replace unsigned extract lane followed by sign extend
    as added here https://chromium-review.googlesource.com/c/v8/v8/+/1846711
    with a signed extract lane for I8x16 and I16x8.

R=george.wort@arm.com, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I09254621c45298a431da44cc1670a90c7a8add0b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1949062Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#65316}

Change-Id: I47f11509a4e0022ec0f50fdfd29f7cc3d4d547bd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1949054Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#65315}

Bug: v8:7790
Change-Id: Ic82dbf1497913012138a62f22c53b936114df3e3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1948708
Auto-Submit: Georg Neis <neis@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65314}

Currently, we show wasm frames, js frames, and js-to-wasm frames (the
latter two are identified as "OPTIMIZED"). This CL makes us also show
wasm-to-js frames in CPU profiling.

R=petermarshall@chromium.org

Bug: chromium:1029470
Change-Id: I2d09f73e7d7e62867554f2a95dc8ad4500a2cde1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1948706Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65313}

Bug: chromium:1029576
Change-Id: If647f764da2682a0f278b9b8060d0665fab1c40c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1948711
Commit-Queue: Georg Neis <neis@chromium.org>
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65312}

Bug: chromium:1001376
Change-Id: I63811e33272715dd5b87a6d58ab2d48d3fc096a7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1948791Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65311}

I noticed that the generated code from the Torque macro
EnsureArrayLengthWritable included an imul instruction, even though the
inputs to that instruction are both constants. This change adds the
ability for MachineOperatorReducer to get rid of that operation.

Change-Id: Ia2050c888d76f110d1290fd9eab13853c3353a63
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1941138
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65310}

Bug: v8:9813
Change-Id: I8907a207448a6d3a38b5454107100959d485b8e6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1925614Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65309}