This CL adds partial support for objects whose slow mode dictionaries
are OrderedNameDictionaries. This is the case for all slow mode objects
if V8_DICT_MODE_PROTOTYPES is enabled.

Bug: v8:7569
Change-Id: I0b5a0d751e6551e78121569ddefd9e00c164cc5a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2489692Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Frank Emrich <emrich@google.com>
Cr-Commit-Position: refs/heads/master@{#70952}

Turboprop adds a negative implication for inlining to disable inlining
with turboprop. When we add tiering up support from Turboprop, this
implication means we would no longer inline functions even with
Turbofan. This cl instead turns off inlining for turboprop compilations
so we still don't inline for Turboprop compilations but support
inlining for Turbofan.

Bug: v8:9684
Change-Id: I5c7d2ca02f591ea007d66725200f12a4b0025d85
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2517119
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70951}

Currently MockPlatform has shorter lifetime than the isolate that uses
it. Creating isolate before MockPlatform leads to races in concurrent
tasks that were scheduled before the MockPlatform replaced the default
TestPlatform. This caused issues after landing
https://chromium-review.googlesource.com/c/v8/v8/+/2502808

This CL ensures that MockPlatform is valid throughout the whole
lifetime of the isolate

Change-Id: Ia888fba93819ea98b935a1d36307d98dd358fcad
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2507379Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Etienne Pierre-Doray <etiennep@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70950}

.. to be reverted in a day or two.

Bug: v8:8888
Change-Id: Iee156da614b50c351ca9a07cc497177c92de865d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2512907
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Lutz Vahl <vahl@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70949}

For atomic.wait we have to check in generated code if the memory is
shared. If not, the code has to trap. In compiled code, this is done in
the runtime function. In the interpreter, however, this check was
missing. This CL adds the check to the interpreter.

R=thibaudm@chromium.org

Bug: chromium:1144603
Change-Id: If897e3f10b404ff677341ee14ad9eda7f5e64d16
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2512922Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70948}

Slight performance regression by adding locking around feedback
vector get/set. The lock isn't necessary for reads on the main thread,
since the main thread is the only source of change.

Bug: chromium:1144777
Change-Id: I7cc9898ad0d8e8c468ba150c0bc6bef3176fd256
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2516475Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70947}

Concurrent allocation test was failing flakily. Do not fix this simply
by increasing heap size since this would reduce frequency of GCs.
Instead allow allocations to fail. Even in this case the allocation
code path is still executed which we want to test.

Bug: v8:11084, v8:10315
Change-Id: I0daa9ad9177aab8b02b7decf2ccfd50e0d8ab9b6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2516471Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70946}

String::FlatContent and FlatStringReader are ways of reading a flat
String. Both of them provide a speedy interface to read a String since
they bypass the dynamic dispatch of String::Get. For this very same
reason, they are not safe to be used from background threads.

Bug: v8:7790
Change-Id: I919ae5e3862df81ff3ebb5131144ff5961197b35
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2509596
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70945}

Rename files to match contents (src/objects/compilation-cache-table*),
and extract implementations from objects.cc into dedicated .cc file.

Bug: v8:8888
Change-Id: I02915316ee62186f94373b1859c7d8119a1953f1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2516473
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70944}

Minor refactors to improve readability and consistency between
FeedbackVectorSpec and FeedbackMetadata:

- Rename FeedbackVectorSpec::slots to slot_count.
- Rename FeedbackVectorSpec::closure_feedback_cells to
  create_closure_slot_count, likewise all related fields.
- Store FeedbackVectorSpec::slot_kinds_ as an array of
  FeedbackSlotKind.

Bug: v8:8888
Change-Id: I3a45177163d1484b1625de8dfba5c6c05cfc426d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2512908Reviewed-by: Mythri Alle <mythria@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70943}

This broke building with the use_perfetto_client_library gn flag.

Change-Id: Ifbcaf77286c0d121b463e4867913d63b85da7fc6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2516701
Commit-Queue: Eric Seckler <eseckler@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Auto-Submit: Eric Seckler <eseckler@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70942}

Port 42e8c231

Because the shift amount may not a 5-bit or 6-bit value, remove the
DCHECK in shift operations like x86 and arm platforms;

Change-Id: I50e8f4662ced9eadcc4d867c5862077174619f1d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2509089Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Auto-Submit: Liu yu <liuyu@loongson.cn>
Cr-Commit-Position: refs/heads/master@{#70941}

This reverts commit 8156dd85.

Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Win64%20ASAN/15800/overview

Original change's description:
> GetCurrentStackPosition() -> base::Stack::GetCurrentStackPosition()
>
> Remove the duplicate utility function and use the base::Stack
> equivalent instead which provides more stack utilitiy functionality.
>
> Change-Id: Ia7a79f2530b64ceb6e2ce33445c876980b4b2a3d
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2509595
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70930}

TBR=mlippautz@chromium.org,clemensb@chromium.org,verwaest@chromium.org

Change-Id: Id18949a3c82171e74370e729cd303607d46c8805
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2515431Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70940}

The CommandlineAPI destructor retrieves the property descriptors for
every function it installed on the global object, but it doesn't do
anything with the descriptor directly, just verifies that it could
retrieve them.

As there are cases where 'getOwnPropertyDescriptor' can actually fail,
such as stack overflow or termination exceptions, we remove the check.

R=yangguo@chromium.org

Bug: chromium:914286
Change-Id: I01147195bdf107131de602789f448abe0afa6b0e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2516470
Commit-Queue: Simon Zünd <szuend@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70939}

This is a reland of 1ec8f1da

Original change's description:
> [presubmit] Add JS formatting for tools/system-analyzer
>
> Bug: v8:10670
> Change-Id: Ifb653ada003719faff261b6e5b2169db37cffdaf
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2282522
> Reviewed-by: Tamer Tas <tmrts@chromium.org>
> Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#68909}

Bug: v8:10670
Change-Id: I4903b3eb8ff39a76594324076f0840b06290044e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2307229
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Reviewed-by: Tamer Tas <tmrts@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70938}

Port 9124b7f9
https://chromium-review.googlesource.com/c/v8/v8/+/2485250

Port f89869a2
https://chromium-review.googlesource.com/c/v8/v8/+/2486236

Bug: v8:11038
Change-Id: Ia524e6ca11650b35916f1a78e7c859a570146a50
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2513870Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/master@{#70937}

Port 808a5d76

Change-Id: Ibdff3a17ac7f2aab12543eb913e8b739559287bd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2515326
Auto-Submit: Liu yu <liuyu@loongson.cn>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70936}

R=clemensb@chromium.org

Bug: v8:11074
Change-Id: Ic65dd7c1f7beac65ae24aab1d657715374434500
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2507721
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70935}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/eb675d7..92c40db

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/dcd4fb3..888c272

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/9396c2b..655afeb

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/e5230a2..4c43492

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: Iac7c9de526c2a1a176fac96bd804cdf5fbf9c68c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2516079Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#70934}

Following the disassembler, break up these opcodes into a separate
function.  The decoding follows the disassembler quite closely, except
in places where the simulator implementation grouped opcodes together to
share code.

Code is all copy paste, more clean ups to follow.

Bug: v8:11074
Change-Id: I426d3542715a27e7c3a49e2118efebe595c7baa4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2509091
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70933}

These correspond to the SpecialValue 4 and 6, I extracted them out into
their own section, following the decoding guide in the manual (and used
in the disassembler).

Mostly copy paste, actual code changes limited to breaking up logic for
separate opcodes so they end up in different clauses.

Bug: v8:11074
Change-Id: I15d9ed4a65291a55c76a11db3d24803cd79100ef
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2509090Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70932}

IWYU some headers, remove/inline helpers that were only used once.

Bug: v8:11074
Change-Id: I3e3d7e22b56e77076f1a2faac07ca727fb6e4f46
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2513871Reviewed-by: Ben Smith <binji@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70931}

Remove the duplicate utility function and use the base::Stack
equivalent instead which provides more stack utilitiy functionality.

Change-Id: Ia7a79f2530b64ceb6e2ce33445c876980b4b2a3d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2509595Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70930}

Also updated LoadConstantPoolPointerRegisterFromCodeTargetAddress
to add instruction size to the new constant_pool_offset.

Bug: v8:11036
Change-Id: Ib92a1b0606c60f82628d3e63ade54b312e4cf196
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2508691
Commit-Queue: Junliang Yan <junyan@redhat.com>
Reviewed-by: Milad Fa <mfarazma@redhat.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70929}

This reverts commit adceb459.

Reason for revert:
- ConcurrentAllocationInLargeSpace fails in verify CSA bot: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20-%20verify%20csa/20547
- New test fail on Windows bot: https://ci.chromium.org/p/v8/builders/ci/V8%20Win32/29622

Original change's description:
> [x64][ia32] Add stack overflow check in InvokePrologue
>
> In case of no arguments adaptor frame, we massage the arguments in InvokePrologue pushing undefined objects if the actual argument count is below the parameter count. This CL adds a stack overflow check before pushing these undefined objects to the stack.
>
> Change-Id: I2a88bf6fdfd17958f6f6884143a67d50ea842fd2
> Bug: v8:10201
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2491039
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Commit-Queue: Victor Gomes <victorgomes@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70927}

TBR=neis@chromium.org,ishell@chromium.org,victorgomes@chromium.org

Change-Id: I7371e1603659ce512a39c0c0a8bb01baf7b916e0
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10201
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2514505Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70928}

In case of no arguments adaptor frame, we massage the arguments in InvokePrologue pushing undefined objects if the actual argument count is below the parameter count. This CL adds a stack overflow check before pushing these undefined objects to the stack.

Change-Id: I2a88bf6fdfd17958f6f6884143a67d50ea842fd2
Bug: v8:10201
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2491039Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70927}

Change-Id: I7df25ca2c7caabed429cfdc0b4aab0aeb5e03fcd
Bug: v8:10201
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2463222Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70926}

Port 808a5d76

Original Commit Message:

    InterpreterEntryTrampoline checks
    1. If there is any optimization marker, and process the marker by
    calling the correct runtime function
    2. If there is any optimized code, it installs optimized code and starts
    executing optimized code.

    Earlier it was OK to do these two checks in any order, since it wasn't
    possible that we have both a marker and optimized code. Turboprop code
    calls out to IET to process the optimization marker / install next tier
    optimized code. So we have to check for optimization marker before we
    check for optimized code.

R=mythria@chromium.org, joransiu@ca.ibm.com, junyan@redhat.com, midawson@redhat.com
BUG=
LOG=N

Change-Id: I37f470809e244f675862e109ae609170a2b019f0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2513792Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#70925}

Change-Id: I14941fcc34773791a86c6fb250237279641fd690
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2510070Reviewed-by: Milad Fa <mfarazma@redhat.com>
Reviewed-by: Michael Dawson <midawson@redhat.com>
Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#70924}

With the recent switch from the tasks API to the jobs API for thread
management within WebAssembly compilation we got the problem that
TurboFan compilation of a previous compilation can block the Liftoff
compilation of a new compilation. With synchronous compilation, this can
cause significant delays for the user. With this CL we increase the
priority of synchronous compilation so that at least synchronous
compilation can only be blocked by other synchronous compilation. This
fixes issues that we saw on autocad.

Why is it okay to increase the priority of synchronous compilation?
* On the main thread, synchronous compilation is only allowed for small
  modules which should not take long to compile. Also, the compilation
  blocks the main thread and should finish as fast as possible.
* On worker threads, delaying other background work is not such a big
  issue.

Downsides:
* This does not only increase the priority of the initial compilation,
  but also for the TurboFan optimization. Similar to above, for small
  modules on the main thread this should not be a big deal because
  compilation is fast. Big modules can only be compiled on worker
  threads.

Note that this is supposed to be a fix for the problems we see at the
moment with autocad on stable and beta. Eventually compilation job
management should be done by the wasm engine for all WebAssembly
compilation, so that not each WebAssemly module has to do its own
compilation job management.

R=clemensb@chromium.org

Bug: chromium:1142686, v8:11088
Change-Id: Iee4948b2fcad944f587918e9452e6888258857f9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2512911
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70923}

This adds a first simple version of the inspector fuzzer, which is a
stripped-down version of the inspector-test executable. The fuzzer
generates inputs which are compatible with inspector-test.

There are still memory leaks, and the fuzzer will probably run into
timeouts most of the time. Both of this will be addressed in follow-ups.

R=szuend@chromium.org, machenbach@chromium.org

Bug: chromium:1142437
Change-Id: I4d13da460f571d791a3642b0705a1f07b442c11b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2505722
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70922}

Drive-by fixes:
 - Use constexpr types to determine C++ type names.
 - Fix factory constructors to not skip write barriers in old generation.

Change-Id: I0ebbfd56c06ad41d02836fb48531ae7eded166bf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2400994Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70921}

Change-Id: Ic72d37bd7707633569a01a6639a91f2aef6f03e8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2512915Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70920}

- Move all createElement helpers onto a separate DOM class
- Make ICPanel.update async
- Show number of selected IC events in the ICPanel header
- Use shared bound functions for event listeners in the ICPanel groups
- Use triangle to mark opened and closed ICPanel groups
- Use global --border-color CSS variable

Bug: v8:10644
Change-Id: Ib35d94db1019d5cdcee057f0f047472f478ab3be
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2507718Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70919}

The comment at the beginning of ordered-hash-table.h desribing the
layout of ordered hash tables seems to have become outdated.

1. There was a "kPrefixSize + " missing in the description of the left
  bound of the first non-fixed-sized part in normal and obsoleted
  tables.

The following only affects obsoleted tables:

2. The bucket count doesn't reside at [kPrefixSize + 0], instead it is
  unchanged w.r.t normal tables, and resides at [kPrefixSize + 2]
3. The next newer table takes place of the element count, residing
  at  [kPrefixSize + 0]. This can be seen by NextTableIndex() being
  defined as NumberOfElementsIndex()
4. The number of removed holes is never written anywhere when
  obsoleting a table. Instead, the number of deleted elements count is
  used for this. This can be see by
  DCHECK_EQ(table->NumberOfDeletedElements(), removed_holes_index);
  in method Rehash
5. kClearedTableSentinel is written to the number of deleted element
  slot when clearing a table, as seen by
  table->SetNumberOfDeletedElements(kClearedTableSentinel);
  in method Clear

Bug: v8:7569, v8:11074
Change-Id: I0e6750fc57c90b6c09fc41f001cd555f7c455fd3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2505763
Commit-Queue: Frank Emrich <emrich@google.com>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70918}

Have a new macro-assembler function Pshufb that does not require dst and
src to be equal, since the vpshufb can have 3 operands. On SEE, if dst
and src are not equal, emit a movapd(dst, src). This saves a move on
AVX.

Small cleanup to use kScratchDoubleReg2 instead of requesting
for a tmp (x64).

Bug: v8:9561
Change-Id: I131ad0456b272da857350762582cac1fb240ae40
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2513868
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70917}

On newer compilers the {operator delete} with explicit {size_t}
argument would be instantiated for {v8::BackingStore} and used
in the destructor of {std::unique_ptr<v8::BackingStore>}. The {size_t}
argument is wrong though, since the pointer actually points
to a {v8::internal::BackingStore} object.
The solution is to explicitly provide a {operator delete}, preventing
an implicitly generated {size_t} operator.

Bug:v8:11081

Change-Id: Iee0aa47a67f0e41000bea628942f7e3d70198b83
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2506712
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70916}

This cl adds support for tiering up in TurboProp. This cl makes
necessary changes to support tier up but doesn't tier up yet. More
specifically this cl:
1. Introduces a new flag for interrupt_budget_for_midtier and
updates code to use the correct interrupt_budget.
2. Introduces a flag turboprop_as_midtier and necessary support
to tier up. When this flag is enabled, we introduce checks for tierup
and updating interrupt budget.


Bug: v8:9684
Change-Id: I58785ce4b9de46488a22d3b4d0cebedac460a773
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2460822
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70915}

InterpreterEntryTrampoline checks
1. If there is any optimization marker, and process the marker by
calling the correct runtime function
2. If there is any optimized code, it installs optimized code and starts
executing optimized code.

Earlier it was OK to do these two checks in any order, since it wasn't
possible that we have both a marker and optimized code. Turboprop code
calls out to IET to process the optimization marker / install next tier
optimized code. So we have to check for optimization marker before we
check for optimized code.

Bug: v8:9684
Change-Id: Iaefb51aec9c2de0bcbacbdbd8a5dff513e573036
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2505721Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70914}

Use pointer arithmetic to go back to the first nodes_ element
instead of computing the address manually.

Bug: none
Change-Id: I887c41908dc6891ed15aa03698ca2305924dcab2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2512904Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Hans Wennborg <hans@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70913}