This is a reland of 3cb4039c

Changes since revert:
- Fix FLAG_stress_scavenge interaction with shared Isolate
- Use the shared Isolate's global handles to keep shared values
  alive in transit during a postMessage

Original change's description:
> [string] Support shared strings in Value{Serializer,Deserializer}
>
> When FLAG_shared_string_table is true, postMessaging strings will share
> instead of copy.
>
> Note that not all operations on shared strings are supported, and shared
> strings may be slower than non-shared strings for some operations.
>
> Bug: v8:12007
> Change-Id: I3462128e15410d2568868143571571b3025722c1
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3277250
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Commit-Queue: Shu-yu Guo <syg@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#78614}

Bug: v8:12007
Change-Id: I5d9b99b2dac6f26d5ef046d7aec94f1a1d219419
Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3389533Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78761}

Implementations are added to macro-assembler to be shared between
liftoff and code generator.

Change-Id: I6bde65dc50f1e52b8fbca150854e0b0863dff301
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3416190Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#78760}

Drive-by: fix multi-arch build.

Bug: v8:11880
Change-Id: I4e56370598117fec2a0131e5638d4bac3d84c52f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3412083Reviewed-by: Samuel Groß <saelo@chromium.org>
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78759}

Change-Id: Idce43801ef5f2f3e194a63cea3522eb6710b681e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3413192Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78758}

1. Expose all the functions to empty builtins.
2. Wire up the basic structure of ShadowRealm and internal slots.

Bug: v8:11989
Change-Id: If7545fe18a74b2bd4b70a1a25776e41f03aaff89
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3195532Reviewed-by: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Chengzhong Wu <legendecas@gmail.com>
Cr-Commit-Position: refs/heads/main@{#78757}

The hello world sample needs to initialize V8's default platform in case
it is not built as stand-alone example.

Bug: v8:12427
Change-Id: I78b68fbed2c2a25b0ff03675beb94dfc5b9b4135
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3412088Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78756}

Change-Id: I1289fcab6c4812868258b14492d85bad20ae7e9f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3406536Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78755}

When sandboxed external pointers are enabled, external pointers now only
require 32 bits of storage space in a HeapObject. This CL does not shrink
the size of EmbedderDataSlots, which will happen in a follow-up CL.

Bug: v8:10391
Change-Id: I3cf8b68c3b985cf806a45183717f50462a88c281
Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3359629Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Samuel Groß <saelo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78754}

The check finds implicit conversions of integer literals to bools:
 bool b1 = 1;
 bool b2 = static_cast<bool>(1);
and transforms them to:
 bool b1 = true;
 bool b2 = true;

Bug: chromium:1290142
Change-Id: I1fec7d7a6f25af23e9b9aac687f5896e79f17b51
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3406533
Auto-Submit: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78753}

Bug: v8:12576

Change-Id: I4d63f85d6528f2ad5e6502fffbc5fc7d797818ed
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3412562Reviewed-by: ji qiu <qiuji@iscas.ac.cn>
Commit-Queue: ji qiu <qiuji@iscas.ac.cn>
Auto-Submit: Yahan Lu <yahan@iscas.ac.cn>
Commit-Queue: Yahan Lu <yahan@iscas.ac.cn>
Cr-Commit-Position: refs/heads/main@{#78752}

Rolling v8/third_party/google_benchmark/src: https://chromium.googlesource.com/external/github.com/google/benchmark/+log/acd7562..57b2bfa

Fix some errors in Custom Statistics demo code. (#1332) (YuanYingdong)
https://chromium.googlesource.com/external/github.com/google/benchmark/+/57b2bfa

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com,mlippautz@chromium.org

Change-Id: I6682b979c23ce45e6a365371b5d5818b4b3fc3f4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3413460
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#78751}

Change-Id: I505026e562cda584aad7e56d1dd02f26b42ddf17
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3412808Reviewed-by: Milad Farazmand <mfarazma@redhat.com>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/main@{#78750}

Change-Id: I9a4ba92f9da9cc964056d5c563b0534d9d172fcb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3412809Reviewed-by: Milad Farazmand <mfarazma@redhat.com>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/main@{#78749}

Implementations are added to macro-assembler to be shared between
liftoff and code generator.

Change-Id: I3fac2b82686836106cefa9a78f5feda6105679d4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3412359Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#78748}

Bug: v8:11111
Change-Id: I83778377f1343a6157bf01f13b99ffcb41e4c6d6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3404778Reviewed-by: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78747}

Implementations are added to macro-assembler to be shared between
liftoff and code generator.

Change-Id: Ia26b82de3f0af076ace3d53e285917029d2d5ac4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3407794Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#78746}

This is a reland of 91f08378

When the class scope does not need a context, the deserialized
outer scope of the initializer scope would not be the class scope,
and we should not and do not need to use it to fix up the allocation
information of the context-allocated variables. The original patch
did not consider this case and resulted in a regression when we
tried to reparse the initializer function to look for destructuring
assignment errors. This fixes the regression by not deserializing
the class scope that's going to be reparsed, and using the positions
of the scopes to tell whether the scope info matches the reparsed
scope and can be used to fix up the allocation info.

Original change's description:
> [class] implement reparsing of class instance member initializers
>
> Previously, since the source code for the synthetic class instance
> member initializer function was recorded as the span from the first
> initializer to the last initializer, there was no way to reparse the
> class and recompile the initializer function. It was working for
> most use cases because the code for the initializer function was
> generated eagarly and it was usually alive as long as the class was
> alive, so the initializer wouldn't normally be lazily parsed. This
> didn't work, however, when the class was snapshotted with
> v8::SnapshotCreator::FunctionCodeHandling::kClear,
> becuase then we needed to recompile the initializer when the class
> was instantiated. This patch implements the reparsing so that
> these classes can work with FunctionCodeHandling::kClear.
>
> This patch refactors ParserBase::ParseClassLiteral() so that we can
> reuse it for both parsing the class body normally and reparsing it
> to collect initializers. When reparsing the synthetic initializer
> function, we rewind the scanner to the beginning of the class, and
> parse the class body to collect the initializers. During the
> reparsing, field initializers are parsed with the full parser while
> methods of the class are pre-parsed.
>
> A few notable changes:
>
> - Extended the source range of the initializer function to cover the
>   entire class so that we can rewind the scanner to parse the class
>   body to collect initializers (previously, it starts from the first
>   field initializer and ends at the last initializer). This resulted
>   some expectation changes in the debugger tests, though the
>   initializers remain debuggable.
> - A temporary ClassScope is created during reparsing. After the class
>   is reparsed, we use the information from the ScopeInfo to update
>   the allocated indices of the variables in the ClassScope.
>
> Bug: v8:10704
> Change-Id: Ifb6431a1447d8844f2a548283d59158742fe9027
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2988830
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Commit-Queue: Joyee Cheung <joyee@igalia.com>
> Cr-Commit-Position: refs/heads/main@{#78299}

Bug: chromium:1278086, chromium:1278085, v8:10704
Change-Id: Iea4f1f6dc398846cbe322adc16f6fffd6d2dfdf3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3325912Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Joyee Cheung <joyee@igalia.com>
Cr-Commit-Position: refs/heads/main@{#78745}

This reverts commit 7fc4868e.

Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Clusterfuzz%20Linux64%20-%20release%20builder/26331/overview

Original change's description:
> [ext-code-space] Enable external code space on x64 and desktop arm64
>
> Perf Sheriffs: this CL might regress some benchmarks while improving
> the others.
>
> Bug: v8:11880
> Change-Id: Iddaba0512100eedf61d8b106da0be0a08d273b67
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3412072
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Commit-Queue: Igor Sheludko <ishell@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#78743}

Bug: v8:11880
Change-Id: I238bb143b3781fc0b865edf4e7cb0ae52cbad0c7
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3412078
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Owners-Override: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78744}

Perf Sheriffs: this CL might regress some benchmarks while improving
the others.

Bug: v8:11880
Change-Id: Iddaba0512100eedf61d8b106da0be0a08d273b67
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3412072Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78743}

The allocatable registers have holes, so not all FP registers are one
half of a valid SIMD register. Thus check if {GetAliases} returned an
allocatable SIMD register before looking up if that register is being
used. Otherwise we run into a DCHECK because {simd_reg} is invalid.

The bug was only introduced recently: https://crrev.com/c/3404780

R=thibaudm@chromium.org

Bug: chromium:1290079, v8:12330
Change-Id: I99df1645cfeec375daec82dbf41c110b5474339c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3412075Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78742}

This turns some CHECKs in the mid-tier register allocator into DCHECKs.
The ones inside {CheckConsistency} should be DCHECKs anyway, even if
they are inside an "#ifdef DEBUG" block. This will make ClusterFuzz
correctly detect them as "checks that only happen in debug mode".
Others were just unnecessarily always included, instead of only in debug
builds.

R=thibaudm@chromium.org

Bug: chromium:1271369
Change-Id: I51acde3c951c7a2af9dee36e25b196364ddf8f5c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3406760Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78741}

negation of 'INT64_MIN' cannot be represented in type 'int64_t'.


Change-Id: Ieddb0fc9bae4d3c85485bb94e76c05c72529a978
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3402665Reviewed-by: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/main@{#78740}

... which failed write barrier skipping check.

Bug: v8:11880
Change-Id: Id404914b78f8d722da7129a5f6183596698a150f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3412073
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78739}

This minor change in how we iterate the virtual registers speeds up the
consistency checks by a factor of more than four.

R=thibaudm@chromium.org

Bug: chromium:1271369
Change-Id: Ieb9640d52c84fabacbbcf0fea56825fb594cfc21
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3406759Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78738}

Bug: v8:11111
Change-Id: Id9ea2e4f3e07be509c8e7a29d93ed80036787df1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3404777Reviewed-by: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78737}

Moves between stack slots are rare; they mostly happen for tail calls
or for multi-return blocks. The bug exists since a long time, but was
only uncovered by the fuzzer now.

R=ahaas@chromium.org

Bug: chromium:1289678
Change-Id: Ibb0917717c6b7a468f5fcbb01be34267ba06a449
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3406749Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78736}

.. caused by accidentally removing the continuation case of a
V8_FALLTHROUGH.

Fixed: v8:12561
Bug: v8:12552
Change-Id: I720a531155751b5409339344e96957a2e325a82f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3406538
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78735}

This is the only change in crrev.com/c/3398111 that may have impacted
performance.

Bug: chromium:1289597
Change-Id: I375535aa5c8382073565f1270dc5cc9c5598af4e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3406534Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78734}

This removes a dead method, makes constant fields constant, and avoids a
confusing macro (which just prevented me from finding the call to
{set_imported_mutable_globals}).

R=manoskouk@chromium.org

Bug: v8:12425
Change-Id: I76de744c273ed9e2e429647a2d26dc163e1f4525
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3406758Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78733}

The tests fail on ODROID (native arm), needs investigation.

R=ecmziegler@chromium.org

Bug: v8:11634
Change-Id: I6d5c19a6d10d7a346ff30838a6548bda0c87bde4
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3406535
Auto-Submit: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78732}

This enables the --turbo-use-mid-tier-regalloc-for-huge-functions flag
by default. This configuration has been run through fuzzers for several
weeks, and all found issues have been fixed (see
https://crbug.com/v8/12330).

R=thibaudm@chromium.org

Bug: chromium:1287331, chromium:1285389, v8:12320, v8:12287
Change-Id: I82cec61a143a78bf705019b2b2bc2c6342f577fc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3404096Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78731}

Changes:
- Rename kWasmTrapDataSegmentDropped to the more accurate ~OutOfBounds.
- Drop unused argument from {WasmCompiler::ArrayInit}.
- Rename {Factory::NewWasmArray} -> NewWasmArrayFromElements.
- Add error handling to {InitExprInterface}.
- Allow the data count section to appear anywhere in the module under
  --experimental-wasm-gc. Add the same capability in
  wasm-module-builder.js.
- Add {WasmArray::MaxLength(uint32_t element_size_log2)}.
- Add kTrapArrayTooLarge in wasm-module-builder.js.
- Small test improvements in gc-nominal.js.

Bug: v8:7748
Change-Id: I68ca0e8b08f906503f0d82e5866395018d216382
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3401593Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78730}

Change-Id: I4da78ec0f309c72007ee30336d77a77205f3e3fd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3406597
Auto-Submit: Andrey Kosyakov <caseq@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78729}

https://chromium.googlesource.com/external/github.com/tc39/test262/+log/6c9b4de5..e87b0048

Bug: v8:7834
Change-Id: Ie6e13a6753c0b67be63186143574350ce30ba1f0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3405216Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78728}

Bug: v8:12565
Change-Id: I8765b325c97740a2a3e32535ec70198c3e9cb2dc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3406747Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78727}

Rolling v8/third_party/google_benchmark/src: https://chromium.googlesource.com/external/github.com/google/benchmark/+log/9e859f5..acd7562

Refine the User Guide CPU Frequency Scaling section (#1331) (Matt Armstrong)
https://chromium.googlesource.com/external/github.com/google/benchmark/+/acd7562

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com,mlippautz@chromium.org

Change-Id: I49f0df390c6f06d810e942e67193b3ef83632080
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3411771
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#78726}

The frame construction code in AssembleConstructFrame saves the registers on the
stack, if this does not occur for every code path then the values restored to
the registers in AssembleReturn will be incorrect.

The relevant DCHECK had been removed here:
https://chromium-review.googlesource.com/c/v8/v8/+/2922604/5/src/compiler/pipeline.cc.

This was not previously an issue as no builtins used callee saved registers,
this changed in the following patches:
https://chromium-review.googlesource.com/c/v8/v8/+/2922604/
https://chromium-review.googlesource.com/c/v8/v8/+/2944844

Bug was found using PGO for the RecordWriteOmitRememberedSetSaveFP builtin on
AArch64.

Change-Id: I23fbea9f39c9b61ef0d0b28b73ebe6063e478fef
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3401589Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Martyn Capewell <martyn.capewell@arm.com>
Cr-Commit-Position: refs/heads/main@{#78725}

This reverts commit 77be1c60.

Reason for revert: breaks msan https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/42062/overview

Original change's description:
> factory: Move FeedbackVector construction to type
>
> Drive-by: Avoid unnecessary memset and clean up Init().
>
> Bug: v8:12559
> Change-Id: I6a79f42dd62b47397d70f92efec3b569ca664c3e
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3404097
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#78722}

Bug: v8:12559
Change-Id: I79bea5753eeadf209dc2867c8387cc42c675e567
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3406757
Auto-Submit: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#78724}

Change-Id: I92479fe32ff4f55a0cf33c1d0898740e3f3cd5ad
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3406752Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78723}

Drive-by: Avoid unnecessary memset and clean up Init().

Bug: v8:12559
Change-Id: I6a79f42dd62b47397d70f92efec3b569ca664c3e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3404097Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78722}