This will allow us to target the new executable from existing JS fuzzers
(like the ochang fuzzer). Let's see if this gives more interesting JS
input files.

R=machenbach@chromium.org
CC=szuend@chromium.org

Bug: chromium:1142437
Change-Id: Id5bcfe660a487fbb9d6b80d167f43324cc284e1f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2536632
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71182}

Change-Id: I2c9f3ac81710b89543b392819a6cce03eaba6cae
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2536639
Commit-Queue: Georg Neis <neis@chromium.org>
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71181}

This is a reland of 04cdcd5a

Got reverted in https://crrev.com/c/v8/v8/+/2534294 due to
TSAN issues. Those are solved in https://crrev.com/c/v8/v8/+/2537693.

Original change's description:
> [compiler] Move InternalizedString to kNeverSerialized
>
> Bug: v8:7790
> Change-Id: I8311b1f4b8239d0688a4b9b9057d6082942bbc00
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2534471
> Reviewed-by: Georg Neis <neis@chromium.org>
> Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#71159}

Bug: v8:7790
Change-Id: I95d68e23e4bc81399bcdcf7ce2fdcf49ddfb66c5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2536641
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71180}

Bug: v8:7793
Change-Id: I7a34efcd4841a67d1e663f9e9b5f0c8fda09a8e3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2532307Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71179}

Change-Id: I6f0f003b09fea49718eadc59cf35bdb346c585d1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2536636
Commit-Queue: Georg Neis <neis@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71178}

Isolate::thread_id() may be invoked on a background thread to perform
a check if the thread is the main thread.

This also removes the copy constructor of ThreadLocalTop and clears
its fields explicitly.

Change-Id: I2207bf1ebd655805841fce9f23d23cff7be8f13b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2537693Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71177}

Change-Id: Ifc754fb81089aed4cb79b1f6c4aab0cb73a2a5d7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2537690Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71176}

Previously, CodeStubAssembler::AllocateOrderedHashTable() would
allocate hash tables of the (statically known) minimum capacity in-
dicated by the concrete table type.
This CL adds AllocateOrderedHashTableWithCapacity, which is inspired by
AllocateNameDictionary. It takes a Node<IntPtrT> indicating the desired
capacity.

Bug: v8:7569
Change-Id: I4bf28f69286e52773319a1ae37d33b2f55175a84
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2503950
Commit-Queue: Frank Emrich <emrich@google.com>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71175}

We now cast it into a DescriptorArrayData where appropiate, as we do
with all the other Data members.

Bug: v8:7790
Change-Id: I5be0aab9c4e80ae246c58a8df719308a0d475e6c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2534816
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71174}

In a previous CL the logic for generating the description for Trusted Types was added to Blink. Therefore, the corresponding logic remaining in V8 can be deleted safely.

Previous CL: https://chromium-review.googlesource.com/c/v8/v8/+/2502342

Bug: chromium:1048143
Change-Id: I1693fa1d213066cbc1fe822f890d2d7aaf7ce0f6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2502869Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Alfonso Castaño <alcastano@google.com>
Cr-Commit-Position: refs/heads/master@{#71173}

This CL adds the CSPViolation pause reason.
Such an enum will be used to enable breakpoints on Trusted Type violations.

Design doc: https://docs.google.com/document/d/1rlRtq_Ai0leS9sqlRvoOL5RNc1BR6Q1yAVvLLJFasMA/
Frontend CL: https://chromium-review.googlesource.com/c/devtools/devtools-frontend/+/2520827
Follow-up CL: https://chromium-review.googlesource.com/c/chromium/src/+/2517519

Bug: chromium:1142804
Change-Id: Iefdbb52115d0ba1810527773a8a2828e795fe533
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2519513Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Alfonso Castaño <alcastano@google.com>
Cr-Commit-Position: refs/heads/master@{#71172}

Makes ExternalReference count as a subclass of RawPtrT to enable
either to be passed to these functions as base argument.

BUG=v8:6949,v8:11074

Change-Id: I126856815ff7cdc0612e3c3fcdfdd4938cc19bfa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2534820
Auto-Submit: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71171}

Change-Id: I0aede0a2a188fc17492c10c0c13568c052282548
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2534822
Commit-Queue: Georg Neis <neis@chromium.org>
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71170}

Currently, we assume that stack trace creation always succeeds while
filling in the `exceptionDetails` structure. Stack trace creation can
fail under some circumstances so this CL introduces a null check.

R=clemensb@chromium.org

Bug: chromium:1147552
Change-Id: I4055d5276bbb7bf178b648bfc7bd84a288626c09
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2532310
Commit-Queue: Simon Zünd <szuend@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71169}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/b666d10..1053f48

Rolling v8/third_party/aemu-linux-x64: 1m4kyaGrLwSAY48Zj3RAdX1wmPZly0p7PQ4jmqPoDbsC..F0EKpWdiLAqJzq0dh6psRmgvyNI65ezZmuUTuiyMIDkC

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/ac95abd..420f736

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/26cd974..5157fbf

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/3aa688c..013c5b9

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: If2b570769b72d6f0044bed642451e704ea139a14
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2536732Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#71168}

The first operand of the select op isn't restricted to any particular
replacement SimdType, since we can convert any type to Int32x4.

Change-Id: I1821b2ebdc1a192518a2ecc0cb13951a98bb3337
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2534211Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71167}

It's shipped since M84.

Bug: v8:8330
Change-Id: Ia643948c0de83fc9a8faf7307b7fd86a1e117dc1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2511034
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71166}

Per https://tc39.es/proposal-import-assertions/#sec-assert-clause-to-assertions,
import assertions should be sorted by the import assertion [[Key]]s,
in order to prevent hosts from relying on a changing order of the
assertions to determine behavior.

Prior to this change, the assertions were being sorted by pointer. With
this CL, the keys are sorted using a code point ordering so that the
order of the assertions received by the host will be stable and
non-surprising.

This CL also switches the SourceTextModuleDescriptor's ModuleRequestMap,
RegularExportMap, and RegularImportMap to use the code point order
comparison rather than their former shortlex sort.  This change will not
be externally visible, but it seems best to make these consistent.

In order to avoid #including the fairly large ast-value-factory.h
into ast/modules.h, I changed ImportAssertions into a separate class
definition rather than keeping it as a typedef.  The alternative would
be to define a common AstRawStringComparer in ast-value-factory.h and
then #include ast-value-factory.h in both ast/modules.h and
parsing/parser.h so that the ImportAssertions typedef would have a
full, shared definition of the AstRawStringComparer type.

Bug: v8:10958
Change-Id: I29c9544aa0a4340c56e1ee631be6cabb2a2eb921
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2533038
Commit-Queue: Dan Clark <daniec@microsoft.com>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71165}

Change-Id: Ifcd419601d090f5995feb064b017e813dcb00121
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2532878Reviewed-by: Milad Fa <mfarazma@redhat.com>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Vasili Skurydzin <vasili.skurydzin@ibm.com>
Cr-Commit-Position: refs/heads/master@{#71164}

Bug: v8:10201
Change-Id: I947649b9862a8288581b002fd2c8e9242dc5d955
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2532608Reviewed-by: Milad Fa <mfarazma@redhat.com>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/master@{#71163}

It creates a SharedMutexGuard if the boolean parameter in the
constructor is true.

Bug: v8:7790
Change-Id: I77647f648717af05b1239576b690aec6f4e8b268
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2531790
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71162}

This reverts commit 04cdcd5a.

Reason for revert: TSAN failures https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20TSAN/34180

Original change's description:
> [compiler] Move InternalizedString to kNeverSerialized
>
> Bug: v8:7790
> Change-Id: I8311b1f4b8239d0688a4b9b9057d6082942bbc00
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2534471
> Reviewed-by: Georg Neis <neis@chromium.org>
> Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#71159}

TBR=neis@chromium.org,solanes@chromium.org

Change-Id: Ib950d1c6603a80e6fadb61839559c38761aea650
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7790
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2534294Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71161}

BUG=v8:6949,v8:11074

Change-Id: Ia5a52dcf42559d97eb6fd4a24f4abd3c40226017
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2531792
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71160}

Bug: v8:7790
Change-Id: I8311b1f4b8239d0688a4b9b9057d6082942bbc00
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2534471Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71159}

Change-Id: I10dd526c0ec1bee9c049b8a2a352908357bb302a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2534812
Commit-Queue: Georg Neis <neis@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71158}

FLAG_disable_write_barriers is a constexpr so the V8_LIKELY macro isn't
necessary. Interestingly, it can also cause clang to warn that the code
is unreachable, whereas without `__builtin_expect()` the compiler
doesn't mind. See for example:

```
constexpr bool kNo = false;

void warns() {
  if (__builtin_expect(kNo, 0)) {
    int a = 42;
  }
}

void does_not_warn() {
  if (kNo) {
    int a = 42;
  }
}
```

Compiling V8 for arm64 with both `v8_disable_write_barriers = true` and
`v8_enable_pointer_compression = false` would trigger this warning.

Bug: v8:9533
Change-Id: Id2ae156d60217007bb9ebf50628e8908e0193d05
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2534811Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Pierre Langlois <pierre.langlois@arm.com>
Cr-Commit-Position: refs/heads/master@{#71157}

The recently-added verifiers for indexed fields have caught a bug: the
definition of SmallOrderedNameDictionary in Torque contained incorrect
padding for builds without pointer compression.

Bug: v8:11063
Change-Id: I2c3d7f06965ec0598ef4fe56923090aa89bc9df1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2529013Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#71156}

Bug: v8:9237
Change-Id: I1e308a5a325b01fcdc9236f13080653f3be6d328
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2527095
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71155}

Change-Id: I58301ded85db096ea5d141b36eb628d0cea54256
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2533353
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Reviewed-by: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/master@{#71154}

This CL reverses the count logic for the tiering strategy of the
js-to-wasm wrappers. The initial approach was that calls to each
function were counted up, until a threshold was reached and the function
would tier up. With this CL, each function is assigned a budget of calls
that can be handled through the generic wrapper. Calls are counted down
until the budget is exhausted, which will trigger the tier-up
for the function.

This approach comes with two advantages. Firstly, determining whether
a function's budget is exhausted is as simple as checking the flags set
from the decrement of the budget. Secondly, the code generated by the
generic wrapper does not depend on the specific value of the initial
budget.

Bug: v8:10982
Change-Id: I5e186c6cf836a9c197b41d0f7ad075b07c87a4da
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2532300Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Vicky Kontoura <vkont@google.com>
Cr-Commit-Position: refs/heads/master@{#71153}

The fuzzer is expected to generate a lot of syntax and runtime errors,
and the respective messages just flood the fuzzer output. By always
putting a {TryCatch} scope around the execution, we prevent those
messages from being printed.
At the same time, inspector tests need to properly propagate uncaught
exceptions in the backend to the inspector, and fail on uncaught
exceptions in the frontend.

This CL allows for all these behaviours by extending the
{CatchExceptions} enum and the {TryCatch} logic in the task runner.

Drive-by: Use {base::OS::ExitProcess} instead of the explicit
{fflush} and {_exit}.

R=szuend@chromium.org

Bug: chromium:1142437
Change-Id: Ic2cb3b0de2399d25bd8c53090575308cb0e09ab0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2529135
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71152}

which was enabled a long ago and is not supposed to be disabled.

In addition this CL adds Representation::MightCauseMapDeprecation()
predicate and ensures it's consistent with the existing
MostGenericInPlaceChange() and CanBeInPlaceChangedTo().

Bug: v8:11104, v8:8865
Change-Id: Ia8046b76822c9b20fe3ce85de6b98570334aad21
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2527088
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71151}

Bug: v8:9533
Change-Id: Id888929b45a1519f4b4a4bb73159816520461841
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2534478
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71150}

Bug: v8:10201

R=victorgomes@chromium.org,neis@chromium.org,ishell@chromium.org

Change-Id: I1bd0ece0e4c91abc84c24ec8331f9cbb17defa56
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2524295
Commit-Queue: Junliang Yan <junyan@redhat.com>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#71149}

R=ecmziegler@chromium.org

Change-Id: Ifead2feecc5786630ab442d125826688dc170e1b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2534477Reviewed-by: Emanuel Ziegler <ecmziegler@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71148}

TBR=vahl@chromium.org

Change-Id: Ife9b1f135cd181822f39328b2524a739ddd04e6b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2534473Reviewed-by: Lutz Vahl <vahl@chromium.org>
Commit-Queue: Lutz Vahl <vahl@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71147}

This reverts commit 32cae2b2.

Reason for revert: Experiment successful. Opening the tree

Original change's description:
> Reland^3 "Temporary compilation failure to test tree closing"
>
> This is a reland of e3ec228c
>
> Original change's description:
> > Temporary compilation failure to test tree closing
> >
> > This will be reverted after testing the new tree closer.
> >
> > No-Try: true
> > Bug: v8:10661
> > Change-Id: I1b47976ee38cda447e2960ca4b6bd274f16425fe
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2529131
> > Reviewed-by: Maya Lekova <mslekova@chromium.org>
> > Reviewed-by: Liviu Rau <liviurau@chromium.org>
> > Reviewed-by: Clemens Backes <clemensb@chromium.org>
> > Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#71081}
>
> No-Try: true
> Bug: v8:10661
> Change-Id: I90742ecde3f8333c6d069b17e80b185cf26530db
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2531787
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Reviewed-by: Maya Lekova <mslekova@chromium.org>
> Commit-Queue: Liviu Rau <liviurau@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#71145}

TBR=clemensb@chromium.org,mslekova@chromium.org,liviurau@chromium.org,machenbach@chromium.org

Change-Id: Icd9409df994cc1461fae9ea3627e5780ebd635f7
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10661
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2534475Reviewed-by: Liviu Rau <liviurau@chromium.org>
Commit-Queue: Liviu Rau <liviurau@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71146}

This is a reland of e3ec228c

Original change's description:
> Temporary compilation failure to test tree closing
>
> This will be reverted after testing the new tree closer.
>
> No-Try: true
> Bug: v8:10661
> Change-Id: I1b47976ee38cda447e2960ca4b6bd274f16425fe
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2529131
> Reviewed-by: Maya Lekova <mslekova@chromium.org>
> Reviewed-by: Liviu Rau <liviurau@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#71081}

No-Try: true
Bug: v8:10661
Change-Id: I90742ecde3f8333c6d069b17e80b185cf26530db
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2531787Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Liviu Rau <liviurau@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71145}

Now that we loop the entire polymorphic weak fixed array, there's
no need to reorder the deprecated maps.

Bug: v8:10582
Change-Id: Icf03d6c0ada34f385ffb747c7246c79f7341106d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2530875Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71144}

A PropertyCell holding the_hole can't have cell type Undefined when the
compiler sees it.

Change-Id: Idcfe6c57c669a65a4ffbe522803bf25efc8bee5f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2531785
Auto-Submit: Georg Neis <neis@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71143}