Changes:
- Move enhancement of locals_count by 1 inside AnalyzeLoopAssignment.
- Update documentation of AnalyzeLoopAssignment.
- Factor out invocation to OpcodeLength();
- Use uint32_t for locals count consistently in related testing
  functions.

Change-Id: I5bb5a324c4f4ed1aafc37849f3762d7a9630da51
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2549966Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71312}

This CL adds partial support for objects whose slow mode dictionaries
are OrderedNameDictionaries. This is the case for all slow mode objects
if V8_DICT_MODE_PROTOTYPES is enabled.

Specifically, this CL contains bailouts to the runtime in places where
the subsequent CSA or Torque code may have to access property
dictionaries.
These bailouts only happen if V8_DICT_MODE_PROTOTYPES is set, in which
case the property dictionaries are of type OrderedNameDictionary, which
cannot be handled by most CSA/Torque code.

The idea is that these bailouts are temporary and will all be removed
once we've implemented the actuall dictionary accesses in CSA/Torque.

Bug: v8:7569, v8:11167
Change-Id: I8308b2f8ba2d4dbf7918da42f995ae270c825fff
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2545711
Commit-Queue: Frank Emrich <emrich@google.com>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71311}

Reset main_thread_local_isolate_ only after Heap::TearDown was executed.
main_thread_local_isolate_ is still needed in there for e.g.
HandleBase::IsDereferenceAllowed in MemoryMeasurement.

Bug: chromium:1150867, v8:10315
Change-Id: Ia1ebfd561b7a3ab2d346f0c17b239f75ad77471f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2549969Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71310}

This is a reland of e26863df

The test now works with the no-i18n case.

Original change's description:
> [foozzie] Suppress access to CurrentTimeValue
>
> This stubs out CurrentTimeValue for differential fuzzing as otherwise
> the non-deterministic value leaks from Intl.DateTimeFormat format and
> formatToParts.
>
> This also affects other date creations, like Date.now(), which is
> already stubbed out on the JS side. We keep that code for
> backwards-compatibility to keep bisection stable.
>
> Bug: chromium:1149050
> Change-Id: Ifd82844c9fb8ce7262b55da6cf9f88f544268942
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2546685
> Reviewed-by: Camillo Bruni <cbruni@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#71294}

Cq-Include-Trybots: luci.v8.try.triggered:v8_linux_noi18n_rel_ng_triggered
Bug: chromium:1149050
Change-Id: I4a750b580495532ca0ffb125522f8f5958e4cad6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2552401
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71309}

We had a test which first enabled the profiler, and then compiled wasm
code. In this case, all code objects were registered correctly and the
profile looked as expected.
This CL extends the test for also test another order: First compile the
wasm code, then enable the profiler. In that case, we were reporting a
wrong debug name of the exported wasm function. The name of that
function is spec'ed to be the string representation of the function
index. But for debugging, we want to see a more meaningful name,
identical to the name we show when reporting the code during
compilation.

This fix requires handlifying the {SharedFunctionInfo::DebugName}
method, because for exported wasm functions, it needs to allocate a new
name on the JS heap.
In order to avoid this allocation where possible, a second variant is
added which returns a unique_ptr directly. This can be used in all
places where the name is just being printed, which turned out to be the
majority of cases ({DebugName().ToCString()}).

R=petermarshall@chromium.org

Bug: chromium:1141787
Change-Id: I0343c2f06f0b852007535ff07459b712801ead01
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2543931
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71308}

This is a reland of 800307f6, with a
minimal fix for arm64 (uint64_t -> uintptr_t).

Original change's description:
> [wasm][memory64] Prepare Liftoff for ptrsize offsets
>
> This CL prepares the LiftoffAssembler interface for uintptr_t offsets.
> Many places can still only handle 32-bit values, but after this CL we can
> start storing the offsets as uintptr_t in the memory access immediates.
> Some TODOs are placed to extend code generation for 64-bit additions, if
> memory64 is enabled.
> All of this will be addressed in follow-up CLs.
>
> R=manoskouk@chromium.org
>
> Bug: v8:10949
> Change-Id: Id3b9b8aa555ab41f082ba012f4f8d80586c35b89
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2529452
> Commit-Queue: Clemens Backes <clemensb@chromium.org>
> Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#71236}

Bug: v8:10949
Tbr: manoskouk@chromium.org
Change-Id: I33a9676afbf84d2032b181de2afd745841575900
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2550663Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71307}

We added this to add elements kind to handlers so Turboprop could
use the elements kind information for inlining array builtins when using
dynamic map checks. This information isn't useful without other map
based optimizations like constant folding to inline array builtins.
So we don't need this information.

Bug: v8:10582
Change-Id: I846c037ca2d87158dd017e2e23c7d1a0dfc685b4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2549950
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71306}

This reverts commit 64bf4c53.

Reason for revert: fix in patchset 2

Original change's description:
> Revert "cppgc: Use tracing scopes"
>
> This reverts commit 548fe208.
>
> Reason for revert: Issues on Mac64: https://ci.chromium.org/p/v8/builders/ci/V8%20Mac64%20-%20debug/31710
>
> Original change's description:
> > cppgc: Use tracing scopes
> >
> > The scopes themselves mostly have the same coverage as current scopes in
> > blink. A few exception due to encapsulation exist and are highlighted as
> > comments on the CL.
> >
> > Bug: chromium:1056170
> > Change-Id: I48af2cfdfd53a8caa1ab5d805d377f6f13a825bc
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2540552
> > Commit-Queue: Omer Katz <omerkatz@chromium.org>
> > Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> > Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#71285}
>
> TBR=ulan@chromium.org,mlippautz@chromium.org,omerkatz@chromium.org
>
> Change-Id: I20dce9309dcaeff6ea61bdc51df3a2f62c2a103f
> No-Presubmit: true
> No-Tree-Checks: true
> No-Try: true
> Bug: chromium:1056170
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2550782
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Commit-Queue: Clemens Backes <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#71289}

TBR=ulan@chromium.org,mlippautz@chromium.org,clemensb@chromium.org,omerkatz@chromium.org

# Not skipping CQ checks because this is a reland.

Bug: chromium:1056170
Change-Id: I9c57cdb3b0d310366cdf3e6fbcd1254fdc363163
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2550666
Auto-Submit: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71305}

This CL adds partial support for objects whose slow mode dictionaries
are OrderedNameDictionaries. This is the case for all slow mode objects
if V8_DICT_MODE_PROTOTYPES is enabled.

Specifically, this CL contains minor changes to CSA code, short of
actually performing ordered dictionary lookups using CSA
implementations of these lookups.

Bug: v8:7569
Change-Id: I0dab0f21000ca3b9b170ace58787ec639d587e64
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2540590
Commit-Queue: Frank Emrich <emrich@google.com>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71304}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/26db078..ee1c001

Rolling v8/third_party/aemu-linux-x64: C3a5C0JPR3a0eNVs8zflK6G9ym7N3f47xoQOm1lQe-gC..4f-YWuHlGrqS9jy308GUs0eo8DxU3h6PwgpHfNYq290C

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/6e44bd8..2ed6fc0

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/5589652..2f8e0fa

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/2d30d87..41850cb

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I340428694480dbe67f5e8cbd512bb6314a4def0c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2551920Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#71303}

We had some tests, but weren't checking for OOB. Add some tests.

Change-Id: I63d4d199fe8b7be51a8e0a5a2d9b3a328e5d7ab5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2546127Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71302}

Change-Id: I6d7dc411c701797ba678d11e135cc214c913690b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2551714Reviewed-by: Milad Fa <mfarazma@redhat.com>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/master@{#71301}

LocaleBuilder validates better, it also fixes most cases in
transformed-ext-invalid except one.

Bug: v8:10447
Change-Id: I6fed6692ca3264198e42ccc3d9ca4bfb54fb0517
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2549688
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71300}

Change-Id: I233972d124c3582ed8eba7f1c1a31fa9d61fda8c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2544902Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Milad Fa <mfarazma@redhat.com>
Commit-Queue: Vasili Skurydzin <vasili.skurydzin@ibm.com>
Cr-Commit-Position: refs/heads/master@{#71299}

This reverts commit e26863df.

Reason for revert: Fails on noi18n bot, see https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux%20-%20noi18n%20-%20debug/34852/overview

Original change's description:
> [foozzie] Suppress access to CurrentTimeValue
>
> This stubs out CurrentTimeValue for differential fuzzing as otherwise
> the non-deterministic value leaks from Intl.DateTimeFormat format and
> formatToParts.
>
> This also affects other date creations, like Date.now(), which is
> already stubbed out on the JS side. We keep that code for
> backwards-compatibility to keep bisection stable.
>
> Bug: chromium:1149050
> Change-Id: Ifd82844c9fb8ce7262b55da6cf9f88f544268942
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2546685
> Reviewed-by: Camillo Bruni <cbruni@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#71294}

TBR=machenbach@chromium.org,cbruni@chromium.org,clemensb@chromium.org

Change-Id: I958ca723de826ab427d27f5121f96618cf50c832
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:1149050
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2551314Reviewed-by: Ben Smith <binji@chromium.org>
Commit-Queue: Ben Smith <binji@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71298}

The basic block instrumentation currently uses 32-bit integers, which
could overflow during a long profiling session. I considered upgrading
them to 64-bit integers, but generating the correct instrumentation code
for various architectures would be rather non-trivial. Instead, this
change uses 64-bit floating-point values, which are simple and also have
the nice behavior that they saturate rather than overflowing.

Bug: v8:10470
Change-Id: I60f7456cb750091809803c03a85dd348dc614b58
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2545573Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#71297}

Bug: v8:11177
Change-Id: Ib4bbdca5fe9811731c15edae5f58243113dd119f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2548080
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71296}

Change-Id: I0ca51abf2468f773986645fec3cb98559bca5bbe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2545143Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Milad Fa <mfarazma@redhat.com>
Commit-Queue: Vasili Skurydzin <vasili.skurydzin@ibm.com>
Cr-Commit-Position: refs/heads/master@{#71295}

This stubs out CurrentTimeValue for differential fuzzing as otherwise
the non-deterministic value leaks from Intl.DateTimeFormat format and
formatToParts.

This also affects other date creations, like Date.now(), which is
already stubbed out on the JS side. We keep that code for
backwards-compatibility to keep bisection stable.

Bug: chromium:1149050
Change-Id: Ifd82844c9fb8ce7262b55da6cf9f88f544268942
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2546685Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71294}

This removes dead methods from wasm-compiler.h and wasm-compiler.cc.
Even though e.g. {BranchExpectTrue} could become useful again in the
future, we still have {BranchExpectFalse} as a template to easily add it
back, and for now it's just untested code which adds to the compile time
and maintenance cost.

R=manoskouk@chromium.org

Bug: v8:10949
Change-Id: Ia3918c4cdfedd2c56bfbfbe7173d11386b9f2499
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2544522Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71293}

The following error is currently thrown on gcc 8:

error: suggest explicit braces to avoid ambiguous 'else'

Change-Id: I1498ef3f6f58874488a4e6897f488c122f4a7f76
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2550841Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#71292}

Before adding more tests, refactor the (single) existing test to be
parameterized by the memory type. This makes it easier to write a single
test with different expectations on memory32 and memory64.

R=manoskouk@chromium.org

Bug: v8:10949
Change-Id: Iaa9bd3af82092d46797e2222cb1c68746200f374
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2544545Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71291}

Deserialization is currently split into three main steps:
1) Read code and allocate code buffer
2) Copy and relocate code
3) Publish

This moves step 2) to a background task so that it can concurrently
process work units added to the work queue by step 1).

Next, step 3) will also be moved to a background task to create a full
pipeline, such that we can start publishing the first units almost
immediately.

R=ahaas@chromium.org
CC=​​clemensb@chromium.org

Bug: v8:11164
Change-Id: I99919765400e03737a46bacf0dcd82cb7fe2aefc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2543932
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71290}

This reverts commit 548fe208.

Reason for revert: Issues on Mac64: https://ci.chromium.org/p/v8/builders/ci/V8%20Mac64%20-%20debug/31710

Original change's description:
> cppgc: Use tracing scopes
>
> The scopes themselves mostly have the same coverage as current scopes in
> blink. A few exception due to encapsulation exist and are highlighted as
> comments on the CL.
>
> Bug: chromium:1056170
> Change-Id: I48af2cfdfd53a8caa1ab5d805d377f6f13a825bc
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2540552
> Commit-Queue: Omer Katz <omerkatz@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#71285}

TBR=ulan@chromium.org,mlippautz@chromium.org,omerkatz@chromium.org

Change-Id: I20dce9309dcaeff6ea61bdc51df3a2f62c2a103f
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:1056170
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2550782Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71289}

Reorder deserialization steps: instead of processing functions one by
one, run each step individually on all functions (read & allocate, copy
& relocate, publish). This prepares for moving some steps to background
tasks.

R=ahaas@chromium.org
CC=clemensb@chromium.org

Bug: v8:11164
Change-Id: Ic6e1e387b6a60ab16efc91f8e0d45cb2acded2a8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2543929
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71288}

This uses the old trick from TypedArrays: a Smi-like all zero
pattern plus an offset that actually contains a raw address to access
off-heap data.

Bug: v8:7793
Change-Id: Ia44448d4ff7e2dcaa02a2c5653f622fb93c3dd09
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2534817Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71287}

roll node-ci in https://chromium-review.googlesource.com/c/v8/node-ci/+/2547360

Bug: chromium:1138555
Change-Id: I894f47023ea45493d94a107ca22038a54543fc6c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2543263
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71286}

The scopes themselves mostly have the same coverage as current scopes in
blink. A few exception due to encapsulation exist and are highlighted as
comments on the CL.

Bug: chromium:1056170
Change-Id: I48af2cfdfd53a8caa1ab5d805d377f6f13a825bc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2540552
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71285}

This CL adds tracing scopes for the various cppgc classes.
Scopes use TRACE_EVENT_BEGIN and TRACE_EVENT_END macros to report trace
events. To do so they need to include trace-event.h. For unified heap
builds, trace-event.h forwards to v8's src/tracing/trace-event.h. For
other builds, trace-event.h provides a subset of
src/tracing/trace-event.h that covers just the parts used by cppgc.

This CL covers what we need for traces and blink gc metrics (up to
renaming events from BlinkGC.* to CppGC.*). UMA and UKM are not yet
handled.

Bug: chromium:1056170
Change-Id: Id92e84b27259ff0aadae7692f3d79d30896fb8e7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2540548
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71284}

Bug: v8:7748
Change-Id: I5d0cc06fafbe7fc05549a4b8fd7f602eaf838bba
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2526382
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71283}

This is required for enabling scopes such that NotifySweepingCompleted
is not called from within a scope.

Bug: chromium:1056170
Change-Id: Ia66aa4de8c22bfa7dfe1e02ee1e0d3ad088f7bf6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2549761Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71282}

When accessing a super property which is a getter, the receiver
is not restricted the same way as when doing normal property access.

In particular, the receiver can be null / undefined.

Bug: v8:9237, chromium:1148758, v8:11161
Change-Id: Ic6bc2053e5d046d4b19e868312aa9b50025256a1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2549941
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71281}

Unpark the thread for logging in TraceAbortedJob. With FLAG_trace_opt
enabled, this method is going to access the heap and therefore the
local isolate cannot be parked.

Bug: chromium:1149131, v8:10315
Change-Id: Ic08de3aebf000df6a4122602940d9f11112b430b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2549946Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71280}

Bug: v8:10961
Change-Id: I79f8410cac1c949100231d4c57dbea0379e88475
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2441128
Commit-Queue: Gus Caplan <snek@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71279}

This CL moves the disabling to the test source code.

Bug: v8:11178
Change-Id: I9771c1eb2ea474143bb401ba40f4452f6e6572ec
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2549963
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71278}

Add ASSERT_NO_SCRIPT_NO_EXCEPTION for places where we don't
want any runtime overhead.

Change-Id: Iac4e87a8802f2c93b0ba3e981fe3b3ac67a4cdba
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2546692
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71277}

For people not too familiar with cloud storage, the direct URL makes it
easier to download the zip archive.

R=machenbach@chromium.org

Bug: chromium:1142437, v8:10891
Change-Id: I6b29ebaac37489a73c4f75473d07e04e7200f2c3
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2543395
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71276}

This CL adds partial support for objects whose slow mode dictionaries
are OrderedNameDictionaries. This is the case for all slow mode objects
if V8_DICT_MODE_PROTOTYPES is enabled.

In particular, this part contains the remaining fixes to runtime code,
except for the class templating logic, which follows in a later CL.

Bug: v8:7569
Change-Id: Ib4d08d7d352125709ca916dfc75018dabf71b0cd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2540549Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Frank Emrich <emrich@google.com>
Cr-Commit-Position: refs/heads/master@{#71275}

This is a reland of e95e1b62

After landing https://crrev.com/c/2546682, this CL can be relanded
without changes.

Original change's description:
> [heap] Introduce LocalIsolate for main thread
>
> Add a LocalIsolate for the main thread to Isolate. This LocalIsolate is
> kept alive during the whole lifetime of the Isolate. The main thread
> LocalIsolate starts in the Running state in contrast to the background
> thread LocalIsolates (those start in Parked).
>
> Code paths in Turbofan that used to create a LocalIsolate on the main
> thread can now simply use the main thread LocalIsolate.
>
> LocalIsolate for the main thread will help in reducing differences
> between the main and background threads. The goal is that the main
> thread behaves more like a background thread.
>
> The main thread LocalIsolate should also make it simpler to share code
> between main thread and background threads by using LocalIsolate for
> both.
>
> Bug: v8:10315
> Change-Id: I7fd61d305a6fd7079e2319d75c291c1021e70018
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2509593
> Reviewed-by: Simon Zünd <szuend@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#71226}

Bug: v8:10315
Change-Id: I418b1217aeac4f3c44a0aa514dea9864f8a58656
TBR: szuend@chromium.org, yangguo@chromium.org, ulan@chromium.org, leszeks@chromium.org, neis@chromium.org
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2543399Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71274}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/a3c2a5d..26db078

Rolling v8/third_party/aemu-linux-x64: ZJSAA8Pwi2mDf7nU7eRK7e3lmUHyrNUgCmzdRwsMbnMC..C3a5C0JPR3a0eNVs8zflK6G9ym7N3f47xoQOm1lQe-gC

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/80f68fb..6e44bd8

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/868f530..5589652

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/1b039cb..2d30d87

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: Ib51eed2e7067c3697c04bf63abb8114873943c34
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2548127Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#71273}