RegExpImpl::Compile does a number of transformations that require
directly manipulating the internal representation of the regexp. For
example, when matching a (non-sticky, non-anchored) regular
expression, the pattern must be wrapped in .* so that it can match
anywhere in the input.

In the interest of moving towards a cleaner division between irregexp
and the outside world, it makes sense to move this code into
RegExpCompiler.

R=jgruber@chromium.org

Bug: v8:10406
Change-Id: I6da251c91c0016914a51480f80bb46c337fd0b23
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2140246Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67262}

This is a reland of 52412058

Original change's description:
> [protectors] Add use counters to track invalidations
> 
> ... to make real world protector invalidations measurable.
> 
> Chromium CL: https://crrev.com/c/2149324
> 
> Drive-by: Add missing newline in protector tracing.
> Drive-by: Consistent naming for the regexp species protector.
> 
> Bug: v8:9496
> Change-Id: I3c7238aa8024e03ea9e89daf83345b8ec4f0d768
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2149428
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#67149}

Bug: v8:9496
Change-Id: I3c97bfa747e8429569eaa09ea909de73fc377efa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2151363Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67261}

LoadCurrentCharacterImpl is implemented once in each of the eight
regexp-macro-assembler-<arch>.cc files. Aside from small differences
in comment wording, those eight implementations are identical. The
architecture-specific code for LoadCurrentCharacter is all in
LoadCurrentCharacterUnchecked.

This patch hoists the definition of LoadCurrentCharacterImpl into
NativeRegExpMacroAssembler and turns LoadCurrentCharacterUnchecked
into a virtual function.

Note: The arm64 version of LoadCurrentCharacterImpl contained the
following six-year-old comment, which I don't think is worth
preserving:

// TODO(pielan): Make sure long strings are caught before this, and
// not just asserted in debug mode.

R=jgruber@chromium.org

Bug: v8:10406
Change-Id: Ic81283ad3b618d6b06f4206fb77d30de617dccb7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2140003
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67260}

Port several CLs recorded in bug 9909.
We test this on 3A4000, and find many issues in MSA implement, but they are not related with this patch, will fix in another CL.
Looks like there is no 32-bit os for 3a4000, so we do not implements s128 for mips32.

Bug: v8:9909
Change-Id: Iad7569ebb92904bae66d420c8306cde24afb034a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2147575
Commit-Queue: Yu Yin <xwafish@gmail.com>
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67259}

Bug: v8:9909
Change-Id: I11a07dcfe3362e8476ecf361f7de1c5047a34d7c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154330Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Jing Bao <jing.bao@intel.com>
Cr-Commit-Position: refs/heads/master@{#67258}

With https://crrev.com/c/2118476, we can decode multi byte opcodes. So
the module builder should be emitting the correct LEB encoded bytes for
SIMD opcodes.

This also fixes an error discovered by the fuzzer: I added f64x2.add to
the fuzzer, but that's actually a multi-byte opcode, so it resulted in
incorrect bytes generated. This should fix it.

Bug: chromium:1072090
Bug: v8:10258
Change-Id: I0b32ac27aa24d25ee8694dacb12d3d8339d9f839
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2158005Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67257}

This reverts commit 387d85ad.

Reason for revert: Broke ARM tree https://ci.chromium.org/p/v8/builders/ci/V8%20Arm%20-%20debug/13926?

Original change's description:
> [wasm-simd][liftoff][arm][arm64] Implement integer narrowing
> 
> Bug: v8:9909
> Change-Id: I0664df45fe399bfa018ff8bcacdbdae66944ed29
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154834
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Commit-Queue: Zhi An Ng <zhin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#67254}

TBR=clemensb@chromium.org,zhin@chromium.org

Change-Id: I6e5cac9cf9e6070b4819edbde6cd2ada2d0b476a
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:9909
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2158010Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67256}

Bug: v8:9909
Change-Id: Id7f3c438493d3a41eb36660c69bdea6bfa978c89
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154766
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67255}

Bug: v8:9909
Change-Id: I0664df45fe399bfa018ff8bcacdbdae66944ed29
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154834Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67254}

Upstream fix to the test in https://github.com/tc39/test262/pull/2523
is alredy rolling into test262

Bug: v8:10313
Change-Id: I6f959651df94b6568224c7edd094088f91635664
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2153200Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67253}

Bug: v8:10347
Change-Id: I46890321944cd861f7f8f193e5e499d4d9cd6aea
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2155156Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67252}

Behind --experimental-wasm-gc flag.

Bug: v8:7748
Change-Id: Ib96af9c5bde33f1b88862286a37872dbe70d856b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154198
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67251}

This reverts commit 0a59e0cb.

Reason for revert: Still causing UBSAN issues:

https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20UBSan/10729


Original change's description:
> Reland^2 "[parser] Introduce UnoptimizedCompileFlags"
> 
> This is a reland of d91679bf
> which was a reland of d91679bf
> 
> Fixes missing initialization of ParserBase::allow_eval_cache_
> 
> Original change's description:
> > [parser] Introduce UnoptimizedCompileFlags
> >
> > UnoptimizedCompileFlags defines the input flags shared between parse and
> > compile (currently parse-only). It is set initially with some values, and
> > is immutable after being passed to ParseInfo (ParseInfo still has getters
> > for the fields, but no setters).
> >
> > Since a few of the existing flags were output flags, ParseInfo now has a
> > new output_flags field, which will eventually migrate to a ParseOutputs
> > structure.
> >
> > Bug: v8:10314
> > Change-Id: If3890a5fad883bca80a97bf9dfe44d91797dc286
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2096580
> > Commit-Queue: Leszek Swirski <leszeks@chromium.org>
> > Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> > Reviewed-by: Simon Zünd <szuend@chromium.org>
> > Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#66782}
> 
> TBR=rmcilroy@chromium.org,ulan@chromium.org,szuend@chromium.org
> 
> Bug: v8:10314
> Change-Id: I470de963bdedad31fe7dd149c610f9a89bffa162
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2157030
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Commit-Queue: Leszek Swirski <leszeks@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#67245}

TBR=rmcilroy@chromium.org,leszeks@chromium.org

Change-Id: I1c5f58cc5608217a149b04aa6f50bb3d7606c26d
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10314
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2157657Reviewed-by: Francis McCabe <fgm@chromium.org>
Commit-Queue: Francis McCabe <fgm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67250}

This reverts commit 4158af83.

Reason for revert: causing UBSAN failures:

https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20UBSan/10729?


Original change's description:
> [turbofan] Fix bug in Number.Min/Max typings
> 
> They try to be very precise about when the result can be -0,
> but do so incorrectly. I'm changing the code to just do the
> simple thing instead. Let's see how that affects performance.
> 
> Bug: chromium:1072171
> Change-Id: I9737a84aa19d06685af5b7bca541e348dc37cca8
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2157028
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Commit-Queue: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#67246}

TBR=neis@chromium.org,tebbi@chromium.org

Change-Id: I0d9b312e27f5a8bbbebeccdc9819fa94f10af139
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:1072171
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2157646Reviewed-by: Francis McCabe <fgm@chromium.org>
Commit-Queue: Francis McCabe <fgm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67249}

Change-Id: Ic372c7b7b308650518d0ddf938c389cfb7c2ea07
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2137407
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67248}

To enable this, the following changes were necessary:
- Fix generation of accessors with MaybeObject type
  and a bunch of include problems.
- Torque-generated C++ classes now have a constructor that can allow
  Smi values to enable a hack currently used for the DescriptorArray.


Bug: v8:7793 v8:8983
Change-Id: If6e35db99199a0e2afd2698af3d84777d6d0b18f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2108036
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67247}

They try to be very precise about when the result can be -0,
but do so incorrectly. I'm changing the code to just do the
simple thing instead. Let's see how that affects performance.

Bug: chromium:1072171
Change-Id: I9737a84aa19d06685af5b7bca541e348dc37cca8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2157028Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67246}

This is a reland of d91679bf
which was a reland of d91679bf

Fixes missing initialization of ParserBase::allow_eval_cache_

Original change's description:
> [parser] Introduce UnoptimizedCompileFlags
>
> UnoptimizedCompileFlags defines the input flags shared between parse and
> compile (currently parse-only). It is set initially with some values, and
> is immutable after being passed to ParseInfo (ParseInfo still has getters
> for the fields, but no setters).
>
> Since a few of the existing flags were output flags, ParseInfo now has a
> new output_flags field, which will eventually migrate to a ParseOutputs
> structure.
>
> Bug: v8:10314
> Change-Id: If3890a5fad883bca80a97bf9dfe44d91797dc286
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2096580
> Commit-Queue: Leszek Swirski <leszeks@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Simon Zünd <szuend@chromium.org>
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#66782}

TBR=rmcilroy@chromium.org,ulan@chromium.org,szuend@chromium.org

Bug: v8:10314
Change-Id: I470de963bdedad31fe7dd149c610f9a89bffa162
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2157030Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67245}

The flag is on by default, and tests already rely on the new behaviour.
This CL removes the flag and immediately affected code. More code will
be removed component by component in follow-up CLs.

Drive-by: Inline {RemoveBreakpointFromInfo} into {ClearBreakPoint},
which only redirected to that method after this CL.

R=thibaudm@chromium.org,bmeurer@chromium.org

Bug: v8:10389, v8:10351
Change-Id: I3b18e228dd633cfb25541ddd0f31699b1ceb1db0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154804
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67244}

Random-generated modules can take surprising code paths.

Bug: chromium:1072127, chromium:1072115
Change-Id: Id9973ebe5942e95e6006026c8cbf875d826d355a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2156765Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67243}

This reverts commit 146f5375.

Reason for revert: UBSan (https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20UBSan/10726?)

Original change's description:
> Reland "[parser] Introduce UnoptimizedCompileFlags"
> 
> This is a reland of d91679bf
> 
> This reland adds initializers for the output flags.
> 
> Original change's description:
> > [parser] Introduce UnoptimizedCompileFlags
> >
> > UnoptimizedCompileFlags defines the input flags shared between parse and
> > compile (currently parse-only). It is set initially with some values, and
> > is immutable after being passed to ParseInfo (ParseInfo still has getters
> > for the fields, but no setters).
> >
> > Since a few of the existing flags were output flags, ParseInfo now has a
> > new output_flags field, which will eventually migrate to a ParseOutputs
> > structure.
> >
> > Bug: v8:10314
> > Change-Id: If3890a5fad883bca80a97bf9dfe44d91797dc286
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2096580
> > Commit-Queue: Leszek Swirski <leszeks@chromium.org>
> > Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> > Reviewed-by: Simon Zünd <szuend@chromium.org>
> > Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#66782}
> 
> Bug: v8:10314
> Change-Id: Ibade9658d99fa928709b3d56762c4c002ffff0dc
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2111213
> Commit-Queue: Leszek Swirski <leszeks@chromium.org>
> Reviewed-by: Simon Zünd <szuend@chromium.org>
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#67241}

TBR=ulan@chromium.org,rmcilroy@chromium.org,leszeks@chromium.org,szuend@chromium.org

Change-Id: I204eb9e4d0a5bfaeeefeb6b0f1c82856b57cb175
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10314
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2157029Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67242}

This is a reland of d91679bf

This reland adds initializers for the output flags.

Original change's description:
> [parser] Introduce UnoptimizedCompileFlags
>
> UnoptimizedCompileFlags defines the input flags shared between parse and
> compile (currently parse-only). It is set initially with some values, and
> is immutable after being passed to ParseInfo (ParseInfo still has getters
> for the fields, but no setters).
>
> Since a few of the existing flags were output flags, ParseInfo now has a
> new output_flags field, which will eventually migrate to a ParseOutputs
> structure.
>
> Bug: v8:10314
> Change-Id: If3890a5fad883bca80a97bf9dfe44d91797dc286
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2096580
> Commit-Queue: Leszek Swirski <leszeks@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Simon Zünd <szuend@chromium.org>
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#66782}

Bug: v8:10314
Change-Id: Ibade9658d99fa928709b3d56762c4c002ffff0dc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2111213
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67241}

Port 1d8f1376

R=fanchen.kong@intel.com, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I1fed871f0722084859f527e0745011b7e01e9631
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2155415Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#67240}

This patch adds a new category group for v8.gc + devtools and adds a
missing dependency on Perfetto's generated headers.

Bug: chromium:1006766
Change-Id: Id92fdc0b938d25ab0df5ada936d3f987cc6ec5f3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2156767
Commit-Queue: Sami Kyöstilä <skyostil@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Auto-Submit: Sami Kyöstilä <skyostil@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67239}

This keeps it whitelisted for normal fuzzing.

TBR=neis@chromium.org

Bug: chromium:1070890, v8:10249
Change-Id: I9011db08741e1eef98672847809e7beb2abfe93b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154789Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67238}

is not enough

This CL records the inlined bytecode size in code objects and take it
into consideration when calculating inline candidate's size.

It can improve Speedometer2 by ~1% and JetStream2 by ~3% on 9900K platform.

Contributted by tao.pan@intel.com

Change-Id: Icf31ca52ed5013d62a9c8d5dd550944ef3a4fbda
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2089021Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67237}

Bug: chromium:1044942, v8:10249
Change-Id: I7e6b7cb669697b89dd493db35c04f76106b710aa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154787Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67236}

Bug: chromium:1056170
Change-Id: Ifc519559868d9c3099d309f75ba8faf2018a1578
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154951
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67235}

This reverts commit f5bee002.

Reason for revert: Crashes android webview, see https://crbug.com/1071708.

Original change's description:
> Revisiting auxvec data gathering for PPC/ARM.
> 
> /proc/sys/auxv might not be accessible, instead
> getting these from the user's stack.
> 
> Change-Id: I2dcf696734e2b4dc1da27a991930b9e0d4228d51
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1730990
> Commit-Queue: Clemens Backes [né Hammacher] <clemensb@chromium.org>
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Reviewed-by: Clemens Backes [né Hammacher] <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#64037}

TBR=clemensb@chromium.org,bmeurer@chromium.org,devnexen@gmail.com

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: chromium:1071708
Change-Id: I05659f245c1020e98b7225a25e82987d9955d595
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154800Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67234}

Bug: chromium:1011762
Change-Id: I99d7d48543972c2de8c1728a75a81b6e83f0064f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2122030
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67233}

It doesn't need to implement its own iteration logic, if we refactor a bit.

BUG=v8:10425

Change-Id: I9b33911c2fab9ac85cae847473dbef0c2e88ea96
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2153224Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67232}

This reverts commit ecc61b30.

Reason for revert: I will reland with the flag disabled.

Original change's description:
> [heap] Add a flag for performing incremental marking on allocation
> 
> The flag is true by default and passing
> --noincremental-marking-on-allocation disables starting of incremental
> marking on allocation and incremental marking steps on allocation.
> 
> Change-Id: I4537e0eeaaf93fb713fcacd3860e29b98df441fc
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154194
> Reviewed-by: Hannes Payer <hpayer@chromium.org>
> Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#67228}

TBR=ulan@chromium.org,hpayer@chromium.org,mlippautz@chromium.org

Change-Id: I7dd847513d1628e7137d9e10cb5e9058781a9634
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154803Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67231}

Space::AllocationStep already allocates a filler object at the given
address, so there's no need to do another filler object allocation in
the sampling profiler. In addition, this breaks allocation stepping over
areas that have already been initialized, such as off-thread pages being
merged.

Instead, we replace it with a DCHECK that there is a map at the start of
the allocated chunk, which serves as a proxy for "this area is
iteratable"

Change-Id: Ia0a1375ac83b944cf5631e6bef341805d27b6e96
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2122029
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67230}

NOTRY=true

Bug: v8:10249
Change-Id: I349d877688c6ea86db9974f28c32b02014b58ba2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154791Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67229}

The flag is true by default and passing
--noincremental-marking-on-allocation disables starting of incremental
marking on allocation and incremental marking steps on allocation.

Change-Id: I4537e0eeaaf93fb713fcacd3860e29b98df441fc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154194Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67228}

These GC events will not be visualized in DevTools UI. The intention
is to have these events in JSON trace file for manual inspection during
offline/postmortem investigation of GC performance issues.

Bug: chromium:1072352
Change-Id: I3b05a0b2e5299f9d00d4c940eaf598a48f746aa2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154796Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67227}

The fast store handlers create elements and if we have a typed array
on the prototype chain it is not easy to check when it is OK to create
new elements. The TypedArrays swallow all OOB stores, and there is no
easy way to check if the current store is OOB for JSObjects. So use
slow stub when there are typed arrays on the prorotype chain of
JSObjects.

Bug: chromium:1068492
Change-Id: I9eea9cf00e3eb84931c5545d18ba53c4ec39f353
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2134138
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67226}

Previously, one single retained maps list was used across all contexts. When one context was disposed, this entire list of retained maps was disposed as well. This caused maps that were still alive to be disposed leading to deopts when such maps were embedded in code objects.

This patch makes the list of retained maps be per context so we can dispose only the dead maps.

Bug: v8:9684, v8:10431
Change-Id: I0a50f4f49c9f6d72367c62e950828a039220fdfc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2122016Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67225}

Spec: https://github.com/tc39/proposal-promise-any

Bug: v8:9808
Change-Id: I568b2444df9f00f615f2cda1268e4ecc5b36667e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2139571
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67224}

Deserializer can trigger OOB read in the marking bitmap inside the
RegisterDeserializedObjectsForBlackAllocation function. This happens
for example if an internalized string is deserialized as the last object
on a page and is the turned into a thin-string leaving a one-word filler
at the end of the page. In such a case IsBlack(filler) will try to fetch
a cell outside the marking bitmap.

The fix is to increase the size of the marking bitmap by one cell, so
that it is always safe to query markbits of any object on a page.

Bug: chromium:978156
Change-Id: If3c74e4f97d2caeb3c3f37a4147f38dea5f0e5a8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2152838
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67223}