Found by combining dcheck_always_on with is_ubsan on x64.

Change-Id: Ie9bcf2402693aa3752be17421dd485533656df08
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1962271Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65417}

Change-Id: I2733dbbe77ac731a61c9a8dfcf6ed52a9ace4eaf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1946687Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Reviewed-by: Milad Farazmand <miladfar@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#65416}

Bug: chromium:1027441
Change-Id: Ieac67e06aebf57a11327cbd34dd31f62cbe540b1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1957847
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65415}

This reverts commit 7e632f57.

Reason for revert: clusterfuzzed
Bug: chromium:1032906

Original change's description:
> Reland "[replaceAll] Stage String.prototype.replaceAll."
> 
> This reverts commit 3114000a.
> 
> Reason for revert: Clusterfuzz issue should be fixed.
> 
> Original change's description:
> > Revert "[replaceAll] Stage String.prototype.replaceAll."
> > 
> > This reverts commit 825f65d3.
> > 
> > Reason for revert: Clusterfuzzed
> > Bug: chromium:1028475
> > 
> > Original change's description:
> > > [replaceAll] Stage String.prototype.replaceAll.
> > > 
> > > Intent to ship thread:
> > > https://groups.google.com/a/chromium.org/forum/#!topic/blink-dev/raep1X9R_SE
> > > 
> > > Bug: v8:9801
> > > Change-Id: I61c559b82b4119084420ffb0a14a27774e37c760
> > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1930608
> > > Reviewed-by: Adam Klein <adamk@chromium.org>
> > > Commit-Queue: Joshua Litt <joshualitt@chromium.org>
> > > Cr-Commit-Position: refs/heads/master@{#65161}
> > 
> > TBR=adamk@chromium.org,joshualitt@chromium.org
> > 
> > Change-Id: I7fa44eda475b8f421f74491e60a3131d381eb789
> > No-Presubmit: true
> > No-Tree-Checks: true
> > No-Try: true
> > Bug: v8:9801
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1935024
> > Reviewed-by: Joshua Litt <joshualitt@chromium.org>
> > Commit-Queue: Joshua Litt <joshualitt@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#65175}
> 
> TBR=adamk@chromium.org,joshualitt@chromium.org
> 
> # Not skipping CQ checks because original CL landed > 1 day ago.
> 
> Bug: chromium:1028475, v8:9801
> Change-Id: Idb5fbd1ec38084222357aeb2d9ff05d703f10eb5
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1946737
> Reviewed-by: Joshua Litt <joshualitt@chromium.org>
> Reviewed-by: Adam Klein <adamk@chromium.org>
> Commit-Queue: Joshua Litt <joshualitt@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#65308}

TBR=adamk@chromium.org,joshualitt@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: chromium:1028475, v8:9801
Change-Id: I17dd634cac7b11d4db8d24ec30be10c06dea757b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1961941Reviewed-by: Joshua Litt <joshualitt@chromium.org>
Commit-Queue: Joshua Litt <joshualitt@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65414}

Found by MSVC. Cast the std::numeric_limits() result to size_t to make
the two sides of the comparison match.

Change-Id: Id480b973aad927315ae174003bf2e9ae182cd585
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1960905
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65413}

Check aliased FP registers when constructing the {to_be_live} set from
multiple predecessors.

R=sigurds@chromium.org

Bug: chromium:1029642
Change-Id: I3db7b705ad5689bd8321aebc5e9c5f364951870b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1958054Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65412}

This is a reland of 0f4c29dc

Original change's description:
> Update V8 DEPS.
> 
> Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/b1050d1..c80cf17
> 
> Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/8953fbe..129810e
> 
> Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/6b52dc2..ee67b97
> 
> Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/57e481c..ed95c84
> 
> TBR=machenbach@chromium.org,tmrts@chromium.org
> 
> Change-Id: I5d3841c1a02e708ba7adadc2f08effe6bea2a7d9
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1958750
> Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
> Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
> Cr-Commit-Position: refs/heads/master@{#65407}

Change-Id: I4ab6519d892ad51db53ad8ddcb5310da31c7df7e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1960290Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65411}

This reverts commit 5f5b4b04.

Reason for revert: Breaks vtunejit bot - see https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20vtunejit/32958

Original change's description:
> Support Intel VTune ITT API
> 
> Add VTune domain support extension to use VTune Domain/Task API and
> tagging trace data for particular JS code block.
> 
> How to use:
> 1. Set `"checkout_ittapi" = True` in the custom_vars section of .gclient
> file to download intel/ittapi by 'gclient sync'
> 2. Build d8 with gn build flag 'v8_enable_vtunetracemark = true'
> 3. Run d8 with flag '--enable-vtune-domain-support'
> 
> The Vtune Domain/Task API can be invoked from JS to mark JS code block.
> You can mark the start of a JS task by
>     vtunedomainmark(domain_name, task_name, "start")
> and the end of a task by
>     vtunedomainmark(domain_name, task_name, "end")
> Tasks can nest.
> 
> The VTune API (ittapi) is integrated as an external third party library
> while the v8_vtune_jit also relies on the VTune ittapi. We have another
> patch almost ready which refactors the v8_vtune_jit related code to
> depend on the third_party/ittapi. We will submit the refactored v8_vtune_jit
> code after this patch stabilized and landed.
> 
> 
> Contributed by fanchen.kong@intel.com
> 
> Change-Id: I0ecc9dd4e1ea52545f1b6932fcdadfa7c1a6d2b2
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1938490
> Commit-Queue: Shiyu Zhang <shiyu.zhang@intel.com>
> Reviewed-by: Hannes Payer <hpayer@chromium.org>
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#65409}

TBR=machenbach@chromium.org,hpayer@chromium.org,verwaest@chromium.org,shiyu.zhang@intel.com

Change-Id: I44a6e5b1aa32e753ae41966ed321ed787cc752f8
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1960291Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65410}

Add VTune domain support extension to use VTune Domain/Task API and
tagging trace data for particular JS code block.

How to use:
1. Set `"checkout_ittapi" = True` in the custom_vars section of .gclient
file to download intel/ittapi by 'gclient sync'
2. Build d8 with gn build flag 'v8_enable_vtunetracemark = true'
3. Run d8 with flag '--enable-vtune-domain-support'

The Vtune Domain/Task API can be invoked from JS to mark JS code block.
You can mark the start of a JS task by
    vtunedomainmark(domain_name, task_name, "start")
and the end of a task by
    vtunedomainmark(domain_name, task_name, "end")
Tasks can nest.

The VTune API (ittapi) is integrated as an external third party library
while the v8_vtune_jit also relies on the VTune ittapi. We have another
patch almost ready which refactors the v8_vtune_jit related code to
depend on the third_party/ittapi. We will submit the refactored v8_vtune_jit
code after this patch stabilized and landed.


Contributed by fanchen.kong@intel.com

Change-Id: I0ecc9dd4e1ea52545f1b6932fcdadfa7c1a6d2b2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1938490
Commit-Queue: Shiyu Zhang <shiyu.zhang@intel.com>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65409}

This reverts commit 0f4c29dc.

Reason for revert: https://ci.chromium.org/p/v8/builders/ci/V8%20Blink%20Linux/2302

Original change's description:
> Update V8 DEPS.
> 
> Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/b1050d1..c80cf17
> 
> Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/8953fbe..129810e
> 
> Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/6b52dc2..ee67b97
> 
> Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/57e481c..ed95c84
> 
> TBR=machenbach@chromium.org,tmrts@chromium.org
> 
> Change-Id: I5d3841c1a02e708ba7adadc2f08effe6bea2a7d9
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1958750
> Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
> Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
> Cr-Commit-Position: refs/heads/master@{#65407}

TBR=machenbach@chromium.org,v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com,tmrts@chromium.org

Change-Id: I30aafc3f7089a0c9bb50f18c2f307cace170376e
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1960289Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65408}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/b1050d1..c80cf17

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/8953fbe..129810e

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/6b52dc2..ee67b97

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/57e481c..ed95c84

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: I5d3841c1a02e708ba7adadc2f08effe6bea2a7d9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1958750Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#65407}

This should have been included in https://crrev.com/c/v8/v8/+/1949047
but I missed it. Without the GN file declaring outputs correctly,
incremental builds are not guaranteed to work correctly. Example error
caused by this problem:
https://ci.chromium.org/p/v8/builders/try/v8_win_rel_ng/b8894499008446857360

Change-Id: I04d358c8f6387a59cb1cf747dda1844408bb6fc8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1960590Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#65406}

Add a method to set the URL of a Wasm script from a WasmStreaming object.
This will allow devtools to report the actual URL when it is available.

R=clemensb@chromium.org

Bug: v8:9762
Change-Id: Iccd41d76c9a4a2e1858716e8d555782404719faa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1944153Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65405}

Bug: v8:9838
Change-Id: Ia9a84ca2c9c5ba9bed7b6ebddc3135f689e2cfaa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1955665Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Joshua Litt <joshualitt@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65404}

This reverts commit c924f54e.

Reason for revert: Suspect for GPU failures:
https://ci.chromium.org/p/v8/builders/ci/Linux%20V8%20FYI%20Release%20(NVIDIA)/7641

Original change's description:
> [turbofan][ptr-compr] Remove redundant ChangeTaggedToCompressed
> 
> The final goal is to eliminate it altogether. This CL just
> eliminate the redundant ones.
> 
> Bug: v8:7703
> Change-Id: If6e718c373fca7c65ce46c347533ec4550fbc444
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1950968
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#65398}

TBR=tebbi@chromium.org,solanes@chromium.org

Change-Id: Id280d7b0a850e3aacd56f839a0fc36d02a88f34c
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7703
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1960286Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65403}

Change-Id: Ie0b6e7876abe229915afa4aaf3b1692750254cbc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1950977Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65402}

Change-Id: I00a1cd9c74f6f58b89e35068721dbc30abf396e8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1955732Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Liviu Rau <liviurau@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65401}

- Move {function_} and {closure_hints_} out of each {Environment}, as
  it's sufficient to only have it in the serializer class.
- Similarly, remove {parameter_count_} and {register_count_} from
  {Environment}. To accomodate for that, change implementation of
  "dead" environments to be based on a flag.
- Remove {ClearEphemeralHints}. This was called for any bytecode not
  recognized by the serializer. I think it makes more sense to just
  do nothing at all for those, i.e. keep whatever hints we have.
- Split the magical {ephemeral_hints_} vector into three separate
  things for clarity: {accumulator_hints_}, {parameters_hints_}, and
  {locals_hints}. Note that we already had {current_context_hints_}.

Bug: v8:7790
Change-Id: Icbe33f500bdbd0f8002570934f59425f49c9de12
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1958010
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65400}

- Remove CLEAR_ENVIRONMENT_LIST of bytecodes, since clearing the
  environment is already the default behavior.
- Address a TODO in Environment::Merge: also merge context hints.
- Don't needlessly clear register hints for InvokeIntrinsic.

Bug: v8:7790
Change-Id: Ibead921002e45ed46c8c1629cae7bb9febf09b90
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1952870Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65399}

The final goal is to eliminate it altogether. This CL just
eliminate the redundant ones.

Bug: v8:7703
Change-Id: If6e718c373fca7c65ce46c347533ec4550fbc444
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1950968Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65398}

This CL generalizes and improves how we handle allocations in Torque.

Overview of the changes:
- Remove obsolete special handling for JSObject classes, since it was
  incomplete: It breaks as soon as slack tracking is active.
- Handle array initialization using slices.
- Properly align allocation sizes. This enabled allocating strings.
- Port AllocateSeq{One,Two}ByteString to Torque, which is much easier
  now than the old CSA code since allocation size alignment and
  large-object space allocation just happen out-of-the-box.
- Remove obsolete or unnecessary intrinsics, some of them turn into
  macros in the torque_internal namespace.
- Distinguish between header size and overall size for ClassType,
  make size optional and only defined when it is statically known.


Bug: v8:10004 v8:7793
Change-Id: I623db233e7fb4deed54e8039ae0c24705e9a44e8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1932356Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65397}

Deprecation was prepared by:
https://crrev.com/c/1899774

Bug: v8:9941
Change-Id: Idf236c2ebfc23e26dcb264747721d7c18986b6b8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1955552Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65396}

Add HeapObject overloads for MarkingBarrier, GenerationalBarrier and
WriteBarrierForCode, which the compiler automatically prefers if a
setter's type is a subclass of HeapObject. These overloads can skip
the IsHeapObject check, providing maybe a small performance boost and
I measure a ~4.5kB binary size reduction in libv8.so

Change-Id: Ia65ff8425ae4895da406587101c7813fe6bf5a2b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1958055
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65395}

Bug: v8:10021
Change-Id: Ieffa39c09e028b9c0f91f1823ea6e89f81fec4cb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1948707
Commit-Queue: Simon Zünd <szuend@chromium.org>
Auto-Submit: Simon Zünd <szuend@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65394}

NOTE! This re-introduces the following change with a modification that
detached_window_time_in_seconds is initialized with 0, instead of
current time.
https://chromium-review.googlesource.com/c/v8/v8/+/1924000

Bug: chromium:1018156
Change-Id: I6d0880e0355d2cb08dbf4f2ef92c8fcead03f9ad
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1958344Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Bartek Nowierski <bartekn@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65393}

The API thread_cputime() is only defined but not yet implemented on IBMi.

Change-Id: I8ea7ff724e749f537b54e75a00d718500807ca8a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1957831Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#65392}

We use the compilation entry point as a caching scope for deserializing
lookups, to avoid redundantly iterating over parent scopes when
accessing the same variable multiple times.

However, this caching scope messes with lookups that are looking for
lexical name conflicts, as opposed to just resolving variables. In
particular, it messes with name conflict lookups and sloppy block
function hoisting checks, when there are other scopes in the way, e.g.

    function f() {
      let x;
      try {
        throw 0;
      }
      catch (x) {
        // This catch is the entry scope

        // Naive use of caches will find the catch-bound x (which is
        // a VAR), and declare 'no conflict'.
        eval("var x;");

        // Naive use of caches will find the catch-bound x (which is
        // a VAR), and determine that this function can be hoisted.
        eval("{ function x() {} }");
      }
    }

Previously, we worked around this by avoiding cache uses for these
lookups, but this had the issue of instead caching the same variable
multiple times, on different scopes. In particular, we saw:

    function f() {
      with ({}) {
        // This with is the entry scope, any other scope would do
        // though.

        // The conflict check on `var f` caches the function name
        // variable on the function scope, the subsequent 'real'
        // lookup of `f` caches the function name variable on the
        // entry i.e. with scope.
        eval("var f; f;");
      }
    }

With this patch, we change the caching behaviour to cache on the first
non-eval declaration scope above the eval -- in the above examples, this
becomes the parent function "f". For compilations with no intermediate
non-decl scopes (no with or catch scopes between the function and eval)
this becomes equivalent to the existing entry-point-based caching.

This means that normal lookups do have to (sometimes) iterate more scopes,
and we do have to be careful when using the cache to not use it for
lookups in these intermediate scopes (a new IsOuterScope DCHECK guards
against this), but we can now safely ignore the cache scope when doing
the name-collision lookups, as they only iterate up to the outer
non-eval declaration scope anyway.

Bug: chromium:1026603
Bug: chromium:1029461
Change-Id: I9e7a96ce4b8adbc7ed47a49fba6fba58b526235b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1955731
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65391}

This reverts commit 026a0c21.

Reason for revert: Reverting due to https://crbug.com/1029461

Original change's description:
> [parser] Fix variable caching for conflict lookup
> 
> During conflict lookup (for lexical variables and sloppy block function
> hoisting), we cache the looked-up variable on the current scope if the
> lookup goes through a ScopeInfo. However, for variable lookup during
> scope analysis, we use the "entry point" as the cache.
> 
> Since both lookups can create Variables, this can cause us to create
> duplicate variables, e.g. a duplicate function name variable in the
> attached test.
> 
> Instead, for ScopeInfo conflict lookups we can cache the result on the
> function's outer scope, which shoud be equivalent to the entry point.
> 
> As a (necessary) drive-by, we can terminate the lookup early if we find
> a VAR with the same name, as we can safely assume that its existence
> means that it doesn't conflict, which means that our variable can't
> conflict either.
> 
> Bug: chromium:1026603
> Change-Id: I19f80f65597ba6573ebe0b48aa5698f55e5c3ea1
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1928861
> Commit-Queue: Leszek Swirski <leszeks@chromium.org>
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#65138}

TBR=leszeks@chromium.org,verwaest@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: chromium:1026603
Bug: chromium:1029461
Change-Id: Id7f5dd342e32e1bb57c51b3748feff32ee0ba41d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1958014Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65390}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/4f02786..b1050d1

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/c3cb105..8953fbe

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: If375ec3ca9676c651ec7097a431e101aad5ff843
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1955992Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#65389}

This reverts commit c4cf2ea4.

Reason for revert: Seems to cause more regressions than improvement. Let's see what the perf bots say about the revert.

Original change's description:
> [codegen] Remove redundant xorpd instructions
> 
> It seems like they were originally added in https://crrev.com/23654026
> (Sep 2013) to break dependences in the OOO pipeline. This code pattern
> was then later copied for other instructions too
> (https://crrev.com/1424333002).
> The reason for the xorpd is not mentioned in the code though, and I
> found no other compiler doing this. So maybe it's obsolete by now, and
> only increases code size.
> 
> Let's remove them and see if we get any performance regressions.
> 
> R=​ahaas@chromium.org
> CC=​yangguo@chromium.org
> 
> Change-Id: I0e6d65afa67f0ee286e5b0ba95c91092c5261c8f
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1926427
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Commit-Queue: Clemens Backes <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#65077}

TBR=yangguo@chromium.org,ahaas@chromium.org,clemensb@chromium.org

Bug: chromium:1027876, chromium:1027449
Change-Id: I533729722e294dbe567222b1c4084df6b864d2ff
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1958053Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65388}

Instead of using hard-coded clang flags (which are missing important
flags and are thus not that useful), use the flags for some unrelated
C++ file.

R=ahaas@chromium.org

No-Try: true
Change-Id: I516df9431e8aad1a63e832aa28450475193fd404
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1955549
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65387}

No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Change-Id: Iae100d8f9676f2f387d915ab6e70fa31d7ad30af
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1955551
Commit-Queue: Liviu Rau <liviurau@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65386}

Before this CL a byte was used per bucket to store whether the bucket
is possibly empty or not. This CL changes this such that each bucket
only needs a single bit.

PossiblyEmptyBuckets is now a word in the page header. If more bits
are needed than fit into a single word, an external bitmap is
allocated using AlignedAlloc. Storing this on the page header, allows
to remove initial_buckets from the SlotSet. The SlotSet allocation is
then again a power-of-2 in release mode.

Reland of https://crrev.com/c/1906376: Incorrect DCHECK was removed.
WordsForBuckets was simplified and a test was added for it.

Bug: chromium:1023139
Change-Id: I9a08e03a9c10e5781a146b9a28dab38824aad91f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1954391Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65385}

This removes the --experimental-wasm-sat-f2i-conversions flag. This
feature is shipped since v7.5.

R=ahaas@chromium.org

Change-Id: I354d9528be40caac77cd4e41adcd39d013448339
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1958009Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65384}

Some fuzz test cases set Math.min to a different function. Let the fake
typed array constructors remember the original Math.min.

No-Try: true
Bug: chromium:1024815
Change-Id: Ia389439fe6757f2497e22187042c5cdf1d1c649f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1958050
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65383}

Mostly for f32x4 instructions.

Bug: v8:9561
Change-Id: I3a3dc06305acb9e336c494fc399cf5d21518c0e8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1950488Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65382}

This caused compile errors since https://crrev.com/c/1934407:
ld.lld: error: undefined symbol: v8::debug::AccessorPair::CheckCast(v8::Value*)
>>> referenced by debug-interface.h:578 (../../src/debug/debug-interface.h:578)
>>>               obj/test/cctest/cctest_sources/test-debug.o:(TestGetPrivateMethodsAndAccessors())

R=verwaest@chromium.org
CC=joyee@igalia.com

Change-Id: I4a727ddd2673c75ec16368459114cfcafdd18912
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1955595
Auto-Submit: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Joyee Cheung <joyee@igalia.com>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65381}

This CL is a prepatory step towards moving the stack locals blacklist
from the DebugEvaluateContext to the respective {ScopeInfo} objects.

The locals blacklist is used during local debug evaluate to
decide whether a context lookup can advance the context chain
upwards, or if lookup needs to stop at the current scope.

This CL also introduces a "Recreate" static helper method, that
allows an existing ScopeInfo to be cloned, but with a locals
blacklist attached. This will be needed since blacklists are only
created on-demand during debugging.

R=leszeks@chromium.org

Bug: chromium:1027475, v8:9938
Change-Id: I673dbc99ce9fdc84cb5cda3f9710ba2b76ab92ee
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1946349
Commit-Queue: Simon Zünd <szuend@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65380}

R=yangguo@chromium.org

Change-Id: Ia58394ec14b34dcd9641d6cf3a810ac272431801
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1958006
Commit-Queue: Simon Zünd <szuend@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Auto-Submit: Simon Zünd <szuend@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65379}

For each wasm feature flag, this adds a link to the proposal repository,
and states who is the v8-side owner of the implementation.
For stated and shipped features, it also sais since which v8 version
this is the case.
It also adds some documentation about the meaning of the three categories
(experimental, stages, shipped).

R=mstarzinger@chromium.org, adamk@chromium.org

No-Try: true
Change-Id: Idbb26eb9e68c7a81aed0e1c1b1d12d5de40d7c2e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1954395
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65378}