Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/b30d9d1..e966858

Rolling v8/third_party/aemu-linux-x64: 81MEiC7zu9wgtKKP_jHorqj5uRmgBSx04zU75G1PX8YC..V4pHBauOtd8S1jDOxP65uQ5t1vxtzWpESymTE3h7ZMMC

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/6cb38d7..3898886

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/f9d141a..b1cc5ed

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/633b99a..eefe475

Rolling v8/tools/luci-go: git_revision:de0691397dd4daa4ae63d308fe911bb6ee8630d6..git_revision:4b61ac9cadfb8d19a09262c6e6f5342d9324acd0

Rolling v8/tools/luci-go: git_revision:de0691397dd4daa4ae63d308fe911bb6ee8630d6..git_revision:4b61ac9cadfb8d19a09262c6e6f5342d9324acd0

Rolling v8/tools/luci-go: git_revision:de0691397dd4daa4ae63d308fe911bb6ee8630d6..git_revision:4b61ac9cadfb8d19a09262c6e6f5342d9324acd0

TBR=v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I193cd09e604cf60f4a3243c7512de1d27a745149
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2826915Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#73966}

Bug: v8:11589
Change-Id: I30dbdbc6266d703ce697352780da1d543afbb457
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2826711
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73965}

This is a partial port of :
2c38a477

Some of the opcodes were added back in later CLs.

Change-Id: Iba33b0930f5b7ec95cdbe6febaa38766a9a6344f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2826238Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#73964}

The following error occurs without braces:

error: suggest explicit braces to avoid ambiguous 'else'.

Change-Id: Iae1af51dcaf8ab6b34fd9312f3133fbd395a653c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2826234Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#73963}

The bricklink.com brickage has since been fixed upstream.

I2S with LGTMs:
https://groups.google.com/a/chromium.org/g/blink-dev/c/I8S78w7aFmE/m/qLHAcjhRCQAJ

Bug: v8:10961
Bug: chromium:1170196
Change-Id: I460e1080aee837bde0e9861d761f2e7dbc8fd6b0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2824101
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73962}

Bug: chromium:1056170
Change-Id: I78844ed1921c5558a2c5ab6121208c1887fe8b3f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2826118
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73961}

Migrating unittests from Blink that were not already covered by cppgc.

Bug: chromium:1056170
Change-Id: If31591c3f1e99562028087c2b818f5ceb8122ec9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2821542
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73960}

This reverts commit d435eaa5.

Reason for revert: Breaks compilation on the vtunejit bot, see https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux%20-%20vtunejit/41247/overview

Original change's description:
> [api] Add v8::Isolate::ThrowError helper
>
> Add a ThrowError helper to encourage throwing full Error objects
> instead of just v8::Strings.
>
> Bug: v8:11195
> Change-Id: I15d75b1d39b817de3b9026a836b57a70d7c16a28
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2811738
> Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> Reviewed-by: Dan Elphick <delphick@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Reviewed-by: Marja Hölttä <marja@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#73958}

Bug: v8:11195
Change-Id: I2773d8ca7d73e7952d274381e2e0a2e5733a83da
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2826533
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#73959}

Add a ThrowError helper to encourage throwing full Error objects
instead of just v8::Strings.

Bug: v8:11195
Change-Id: I15d75b1d39b817de3b9026a836b57a70d7c16a28
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2811738
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73958}

The flag is useful for disabling tests that are not supported in
the third_party_heap build configuration.

Example usage in the status files:
['third_party_heap', {
  'testname': [SKIP],
}],  # third_party_heap

Bug: v8:11155
Change-Id: I991532bf7cdf89d8c505e4d6cbd7cf9e4d70dd63
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2821960
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73957}

After https://crrev.com/c/2807609 a test has started
failing as parameter_slots was more than 16 bits, hence
we need to load it instead of using it as an immediate value.

Change-Id: I738472634b3e30cbf277959965e72b028f9fb969
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2826231
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Reviewed-by: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/master@{#73956}

R=manoskouk@chromium.org

Change-Id: Ia5ecd3fac9178f2f9519686e818f9025ae95086d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2824441Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73955}

Port 885b1ac9

Original Commit Message:

    Similarly to Windows, on macOS we should touch the memory in a page
    when allocating stack space that crosses page boundaries.

R=victorgomes@chromium.org, joransiu@ca.ibm.com, junyan@redhat.com, midawson@redhat.com
BUG=
LOG=N

Change-Id: I6d3fc012c5a88e287deb0bb4d78ae001a1318b4b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2826230Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#73954}

Bug: chromium:1173527
Change-Id: If918b739f137b9c09030104b909e7bd2d4cd5984
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2817616Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73953}

Change-Id: I3828c6a854d09629784f481c76781003b4030993
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2814562Reviewed-by: Brice Dobry <brice.dobry@futurewei.com>
Commit-Queue: Brice Dobry <brice.dobry@futurewei.com>
Cr-Commit-Position: refs/heads/master@{#73952}

Instead of assigning serial numbers when the template infos are
created, this patch creates serial numbers only when they are added to
cache.

This way only the ones that are first instantiated are allocated the
fast template cache. Previously, various accessors and methods that
would almost never get instantiated got assigned to the fast template
cache.

Bug: v8:11284
Change-Id: I8f7578aa0dae48267bbc6303515114eb6e24c1c4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2621081Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#73655}
TBR: ulan@chromium.org
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2825592
Cr-Commit-Position: refs/heads/master@{#73951}

Change-Id: If33624193cb771ec0f1d7fc3364d50c850af7dcb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2822276Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73950}

.. of the backing store, instead of continuing and silently attempting
to deref nullptr.

Bug: chromium:1198657
Change-Id: I82e51abc4d2f9dfe0de596b082a6f78089af7df8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2824438Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73949}

Similarly to Windows, on macOS we should touch the memory in a page
when allocating stack space that crosses page boundaries.

Change-Id: I8968805c4abe255123a41d0f63f89d4af509b6c8
Bug: v8:11615
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2825588
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73948}

By using RWX memory to write we've likely managed to avoid the largest
part of the cost on Intel CPUs.

Bug: v8:11420
Change-Id: Ibf571abc136fc97b3e6429fe42ebf4cfc423b458
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2824443
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73947}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/79006be..b30d9d1

Rolling v8/third_party/aemu-linux-x64: dXMWT4elldlEXvj4YHtc9u0W4YEfTP-KZbIKpA75-7MC..81MEiC7zu9wgtKKP_jHorqj5uRmgBSx04zU75G1PX8YC

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/8680ff0..6cb38d7

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/057831e..f9d141a

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/7168936..633b99a

Rolling v8/tools/luci-go: git_revision:cbabdf2ff62e64e99bfdf57ab5625d3da3eb5db9..git_revision:de0691397dd4daa4ae63d308fe911bb6ee8630d6

Rolling v8/tools/luci-go: git_revision:cbabdf2ff62e64e99bfdf57ab5625d3da3eb5db9..git_revision:de0691397dd4daa4ae63d308fe911bb6ee8630d6

Rolling v8/tools/luci-go: git_revision:cbabdf2ff62e64e99bfdf57ab5625d3da3eb5db9..git_revision:de0691397dd4daa4ae63d308fe911bb6ee8630d6

TBR=v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: Iffe657ca45beccf7379237650b0cd8574b55b836
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2824104Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#73946}

https://crrev.com/c/2817958 is going to support artificial
calls of NoAllocDirectCall for a testing purpose, and this
new API will be used there.

Change-Id: If47ba080eede96e91ba60b89ff502dd3d3e34b93
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2822188Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Yuki Shiino <yukishiino@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73945}

We add one more member function template to AvxHelper to allow one new
way of calling:

- Andps(x, y, z) -> vandps(x, y, z), andps(x, z) && x == y

Clean up a bunch of places where we need to pass an int literal as a
byte.

Unfortunately we cannot define Movq using AVX_OP. Because of the way
movq is defined in the assembler, using function templates, there are
versions of movq with 1 argument defined. That is not a valid
instruction (but is valid for `dec`). We end up selecting
vmovq(XMMRegister, Register) and movq(XMMRegister), which is not valid.

Bug: v8:11589
Change-Id: I45e3bc213d93ece7f65da8eb1e3fa185aec4c573
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2815560
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73944}

We optimized swizzle with constant mask, but failed to actually swizzle
using the masks...

Bug: v8:10992
Change-Id: If655fdad1e17e92b62e8a2eaabbf1f8d82e4d5e4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2822951Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73943}

This is similar in spirit to https://crrev.com/c/2808621, which is to
ensure that no matter what combination of --[no-]enable-{extension} flag
is passed, we end up with a set of supported extensions that make sense.

The 2 rules are:

- If a newer extension is supported (SSE4_2), older extensions are
supported (SSE4_1, SSSE3, SSE3),
- If an older extension is not supported (SSE4_1), new extensions are
not supported (SSE4_2, AVX)

Tests have been added to both ia32 and x64 to check that we follow these
above 2 rules.

We change the ProbeImpl to have a reconciliation step to ensure that we
stick to the 2 rules.

E.g. if --enable-avx --no-enable-sse4-2, we will first set AVX to
supported, then in the second step, fix-up AVX to unsupported. In this
sense, the --no version of the flags take priority. This more accurately
follows the intention of the flags.

Bug: chromium:1195579
Change-Id: I0390f24de9d203fe6bbd4cc02a23771a1f052618
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2818570
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73942}

Added a comparison to throw a TypeError when the "enumerable"
field of the new descriptor doesn't match the one of the old descriptor.

Bug: v8:10782
Change-Id: I2f1acf215e597b85be5d29e22c006cbd79afcb47
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2818067
Commit-Queue: Luis Fernando Pardo Sixtos <lpardosixtos@microsoft.com>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73941}

Bug: chromium:728583
Change-Id: I0d88b7516d053f2024a43bed84843ee47e06cd42
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2823697Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Jochen Eisinger <jochen@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73940}

This reverts commit 6ec52d90.

Reason for revert: Caused failure on Chromium android-asan bot. More info in crbug.com/1198565.

Original change's description:
> [wasm] Enable wasm threads by default in V8
>
> Finer grained control of platforms that support threads are
> enforced by chromium.
>
> Bug: chromium:1167733
> Change-Id: Ic34a4950aebf6ba394053b79df97b703af333636
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2810190
> Reviewed-by: Lutz Vahl <vahl@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#73919}

Bug: chromium:1167733
Change-Id: I8a7740c70c227dea42de5a54bb1cfa07fc139098
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2821704
Auto-Submit: Victor Vianna <victorvianna@google.com>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#73939}

Change-Id: I5b5024fdcf4806b6e91112448db3c334f9ede48b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2821957
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73938}

- Add %BaselineOsr to manually trigger OSR to Baseline.
- Add flags to %GetOptimizationStatus to check if the topmost frame is
an Interpreter/Baseline frame.
- Add mjsunit test.

Bug: v8:11420
Change-Id: Id80421ad97ee719a67ef299cc700da9c44f23bae
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2814567
Auto-Submit: Patrick Thier <pthier@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73937}

Change-Id: I35c08f9d64210f0ddbedd2c394f59bc3cb5180fe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2821635
Commit-Queue: Junliang Yan <junyan@redhat.com>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73936}

From the concurrent compiler's perspective, we can perform those
read/writes non-atomically and have wider TSAN coverage. The concurrent
marker, however, needs them to be atomic.

Bug: v8:7790
Change-Id: I96897f4f6237c90da018ec89be838aae894c24bc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2817538
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73935}

Port: 5e0b94c4

Bug: v8:11624
Change-Id: I0b462dceaf4b155bf662e4fb9204a237c252b4ec
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2822273
Auto-Submit: Liu yu <liuyu@loongson.cn>
Reviewed-by: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/master@{#73934}

R=thibaudm@chromium.org, jgruber@chromium.org

Bug: v8:10740
Change-Id: Iceb20f00f6f8505885856400a0c0228708ff3979
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2807610
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73933}

When looking for intersections between the current range and inactive
range, we can stop the search as soon as the inactive range's next start
is past the current range's end position. We know that subsequent
inactive ranges cannot intersect either, because they are ordered by
their next start.

R=sigurds@chromium.org

Bug: chromium:986862
Change-Id: I249a781be281abc7b438f31848f5d6cb3a25303f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2821434Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73932}

Original CL: https://chromium-review.googlesource.com/c/v8/v8/+/2807157

Bug: v8:11043
Change-Id: I49d29323bf3ae6ede7e48e63645f4ee0a750c83e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2818573Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Sara Tang <sartang@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#73931}

The method was scheduled for removal in M92, as finaly part of the
fn.displayName support removal.

Fixed: chromium:1177685
Doc: https://bit.ly/devtools-function-displayName-removal
Change-Id: I243dd6c9849a6f39e76dd003300b639bfd8df604
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2821954
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73930}

Bug: v8:11263
Change-Id: I320a75b8819353ab7af5bf7608329e6f0a7a66ca
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2821544Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73929}

The CanAllocateArray used to be executed during JSCreateLowering,
leading to bailouts when large arrays are passed as arguments to
an async function or a bound function. This meant that
JSCreateAsyncFunctionObject or JSCreateBoundFunction will reach
JSGenericLowering, where they are not lowered. This CL moves
the checks earlier in the pipeline during JSNativeContextSpecialization
and JSCallReducer respectively, so that those operators are not
created at all in such cases and we bail out to the runtime instead.

Bug: v8:11564
Change-Id: I232ce7d9378730ae0cc8690e52fde840a484e069
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2807609
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73928}

Multivalue has been shipped for a while now, so it is time to remove
its experimental feature flag.

Additional change: Set kV8MaxWasmFunctionReturns to the old
kV8MaxWasmFunctionMultiReturns value.

Change-Id: I5c4d33b036e64a7221de17f0e97119bb0a036838
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2817790Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73927}