Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/5c91684..24023f3

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/src/buildtools/+log/47ec3a8..dbab4f8

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: Icbdab6cc92afa367f65080e42e3c42bf9835765b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3829358
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#82458}

Rolling v8/buildtools/third_party/libc++/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxx/+log/9f503be..1f6f8b7

Rolling v8/buildtools/third_party/libunwind/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind/+log/754d016..030b4eb

Rolling v8/third_party/fuchsia-sdk/sdk: version:9.20220812.0.1..version:9.20220812.1.1

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I8c483eab1de34fe7498e12d5265613b9c83640bf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3829357
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#82457}

Store the is_marking_flag_ in the IsolateData to improve the generated
code for the RecordWrite builtin. This allows to load the value of the
flag directly using the root register, instead of loading that flag's
address first using the root register and only then loading its value.

Bug: v8:11708
Change-Id: Id4076a7e519c5f8126e310771c0ccd958dc07278
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3780536
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82456}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/36b3854..5c91684

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/src/buildtools/+log/11459ac..47ec3a8

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I0dbf72d26734e3ed1082b530c9e73f8d4d5c66b9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3829354
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#82455}

This is a reland of commit a1b863c1

Original change's description:
> [heap] Introduce per-thread storage for concurrent sweeping
>
> Introduce ConcurrentSweeper as indirection between SweeperJob and
> Sweeper to hold per-thread state during sweeping.
> This will be used by MinorMC sweeping to hold the pretenuring feedback
> map.
>
> Bug: v8:12612
> Change-Id: Ib363339f9109b405e4cae7f2c08cb4f0eacff8d0
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3829466
> Commit-Queue: Omer Katz <omerkatz@chromium.org>
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#82442}

Bug: v8:12612
Change-Id: Ic475d0a8a6e9f9e8b5945bb8d28588db1d524510
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3829480Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Auto-Submit: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82454}

Also change Intl.DateTimeFormat to take temporal objects for format.

Design doc: https://docs.google.com/document/d/1gI_Jd9ztnkqhQnDTR4GaI3JOFdMNJW2kQK_UaBPvMug

Implement the intl enabled
Temporal.Instant.prototype.toLocaleString,  Temporal.PlainDate.prototype.toLocaleString
Temporal.PlainDateTime.prototype.toLocaleString
Temporal.PlainMonthDay.prototype.toLocaleString
Temporal.PlainTime.prototype.toLocaleString
Temporal.PlainYearMonth.prototype.toLocaleString
Temporal.ZonedDateTime.prototype.toLocaleString

Implement AOs:
HandleDateTimeTemporalDate, HandleDateTimeTemporalYearMonth, HandleDateTimeTemporalMonthDay, HandleDateTimeTemporalTime
HandleDateTimeTemporalDateTime, HandleDateTimeTemporalInstant, HandleDateTimeTemporalZonedDateTime, HandleDateTimeOthers, HandleDateTimeValue


Spec Text:
https://tc39.es/proposal-temporal/#sec-temporal-handledatetimevaluetemporaldate
https://tc39.es/proposal-temporal/#sec-temporal-handledatetimevaluetemporalyearmonth
https://tc39.es/proposal-temporal/#sec-temporal-handledatetimevaluetemporalmonthday
https://tc39.es/proposal-temporal/#sec-temporal-handledatetimevaluetemporaltime
https://tc39.es/proposal-temporal/#sec-temporal-handledatetimevaluetemporaldatetime
https://tc39.es/proposal-temporal/#sec-temporal-handledatetimevaluetemporalinstant
https://tc39.es/proposal-temporal/#sec-temporal-handledatetimevaluetemporalzoneddatetime
https://tc39.es/proposal-temporal/#sec-temporal-handledatetimeothers
https://tc39.es/proposal-temporal/#sec-temporal-handledatetimevalue
https://tc39.es/proposal-temporal/#sup-temporal.instant.prototype.tolocalestring
https://tc39.es/proposal-temporal/#sup-temporal.plaindate.prototype.tolocalestring
Temporal.PlainDateTime.prototype.toLocaleString
https://tc39.es/proposal-temporal/#sup-temporal.plainmonthday.prototype.tolocalestring
https://tc39.es/proposal-temporal/#sup-temporal.plaintime.prototype.tolocalestring
https://tc39.es/proposal-temporal/#sup-temporal.plainyearmonth.prototype.tolocalestring
https://tc39.es/proposal-temporal/#sup-temporal.zoneddatetime.prototype.tolocalestring

Remove the output_range parameter and use the is_null() of
MaybeHandle<T> for to check the optional return.

Bug: v8:11544
Change-Id: Ia9ffe7a71c8fb68391581eb5ef7620708e2bd1f0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3791526
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82453}

Rolling v8/third_party/icu: https://chromium.googlesource.com/chromium/deps/icu/+log/50ec7b3..b3070c5

[build] Suppress -Wenum-constexpr-conversion (Gulfem Savrun Yeniceri)
https://chromium.googlesource.com/chromium/deps/icu/+/b3070c5

Use LTO bug workaround in Fuchsia build (Roland McGrath)
https://chromium.googlesource.com/chromium/deps/icu/+/4404a4d

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com,ftang@chromium.org

Change-Id: I9f7ffb1b34c1068a1577e6bda164da55f28601d2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3829353
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#82452}

Rolling v8/buildtools/third_party/libc++/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxx/+log/55e0c49..9f503be

Rolling v8/buildtools/third_party/libunwind/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind/+log/a097a1a..754d016

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/b2cd647..6dbdca4

Rolling v8/third_party/fuchsia-sdk/sdk: version:9.20220811.2.1..version:9.20220812.0.1

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: Ie7fd100c2a03e0351888e4362941264ace1b554b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3829352
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#82451}

Bug: v8:11544
Change-Id: I41662b3c43a1a387f3c11796774999e515b00a32
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3824196
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82450}

Bug: v8:13185
Change-Id: I0c6e4ba8b325c3ac70dbceb927e2a8b1f9d68a16
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3830286
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Auto-Submit: Adam Klein <adamk@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#82449}

This is a reland of commit 924be695

Original change's description:
> [heap] Use PagedNewSpace when MinorMC is enabled
>
> This CL also introduces/updates DCHECKs that some methods are never
> reached with MinorMC (they may still be reached by full GC when MinorMC
> is disabled).
>
> Bug: v8:12612
> Change-Id: I8afb8c964bc5c44225a92d0f8d9ac5a4c0ecef75
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3823130
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Commit-Queue: Omer Katz <omerkatz@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#82439}

Bug: v8:12612
Change-Id: I64aa83d48fb48970ee45263356aaf1541e3d6bdc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3827040
Commit-Queue: Adam Klein <adamk@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#82448}

Also add AOs: DifferenceTemporalPlainDateTime, DifferenceTemporalZonedDateTime,

Spec Text:
https://tc39.es/proposal-temporal/#sec-temporal.plaindatetime.prototype.since
https://tc39.es/proposal-temporal/#sec-temporal.plaindatetime.prototype.until
https://tc39.es/proposal-temporal/#sec-temporal.zoneddatetime.prototype.since
https://tc39.es/proposal-temporal/#sec-temporal.zoneddatetime.prototype.until
https://tc39.es/proposal-temporal/#sec-temporal-differencetemporalplaindatetime
https://tc39.es/proposal-temporal/#sec-temporal-differencetemporalzoneddatetime

split from cl/3750098

Bug: v8:11544
Change-Id: I326d91a897fcd7e39de2fb2bfecfc5bfd920eb44
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3827313Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82447}

This reverts commit 924be695.

Reason for revert: speculative revert for TSAN failures:
https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20TSAN%20-%20stress-incremental-marking/8726/overview

Original change's description:
> [heap] Use PagedNewSpace when MinorMC is enabled
>
> This CL also introduces/updates DCHECKs that some methods are never
> reached with MinorMC (they may still be reached by full GC when MinorMC
> is disabled).
>
> Bug: v8:12612
> Change-Id: I8afb8c964bc5c44225a92d0f8d9ac5a4c0ecef75
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3823130
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Commit-Queue: Omer Katz <omerkatz@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#82439}

Bug: v8:12612
Change-Id: I540f38fea17fbacffbd120dd050626d7d1ec32f3
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3827039
Auto-Submit: Adam Klein <adamk@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#82446}

This is a reland of commit cf765fc3

Original change's description:
> [Temporal] Use double instead of int32_t for input of BalanceTime
>
> To avoid overflow int32_t in the math of balancing time.
>
> Bug: v8:13182, v8:11544
> Change-Id: Ib76cf95bbd4f9b47efd6921a67b09d3024e72b13
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3827310
> Reviewed-by: Adam Klein <adamk@chromium.org>
> Commit-Queue: Frank Tang <ftang@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#82409}

Bug: v8:13182, v8:11544
Change-Id: I7550b3a7186beed0e32e95a41cae87030d0c5a7c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3827671
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82445}

The capacity may be modified on one thread when growing the table while
being used in a DCHECK (to sanity-check a provided
ExternalPointerHandle) on another thread, resulting in TSan failures.
This CL turns these accesses into atomic accesses and adds a comment
explaining when the capacity value can be used reliably.

Bug: chromium:1352148
Change-Id: I0b86a47e16cfa14ff2d296e7e507e38a3fb5893c
Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3826244
Commit-Queue: Samuel Groß <saelo@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82444}

This reverts commit a1b863c1.

Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Clusterfuzz%20Linux%20ASAN%20no%20inline%20-%20release%20builder/8288/overview

Original change's description:
> [heap] Introduce per-thread storage for concurrent sweeping
>
> Introduce ConcurrentSweeper as indirection between SweeperJob and
> Sweeper to hold per-thread state during sweeping.
> This will be used by MinorMC sweeping to hold the pretenuring feedback
> map.
>
> Bug: v8:12612
> Change-Id: Ib363339f9109b405e4cae7f2c08cb4f0eacff8d0
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3829466
> Commit-Queue: Omer Katz <omerkatz@chromium.org>
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#82442}

Bug: v8:12612
Change-Id: I66865a807908a6ef296e06530f293dcf27fea1a3
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3829478
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Owners-Override: Nico Hartmann <nicohartmann@chromium.org>
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82443}

Introduce ConcurrentSweeper as indirection between SweeperJob and
Sweeper to hold per-thread state during sweeping.
This will be used by MinorMC sweeping to hold the pretenuring feedback
map.

Bug: v8:12612
Change-Id: Ib363339f9109b405e4cae7f2c08cb4f0eacff8d0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3829466
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82442}

to get rid of the pattern
```
EnsureHash();
uint32_t field = raw_hash_field();
```
which requires an additional load and might be misleading in the
presence of forwarding indices for shared strings, as raw_hash_field()
can return a forwarding index, whereas EnsureRawHash() will always
return a computed hash value.

Bug: v8:12957
Change-Id: I33426fef433f774fb323d4381e784c1037fb6fbb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3829469Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82441}

... to please mksnapshot which expects the new space to be empty.

Bug: v8:10470
Change-Id: I7d5b62db138ef2e334581a8697d137cd13291d7c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3827877
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82440}

This CL also introduces/updates DCHECKs that some methods are never
reached with MinorMC (they may still be reached by full GC when MinorMC
is disabled).

Bug: v8:12612
Change-Id: I8afb8c964bc5c44225a92d0f8d9ac5a4c0ecef75
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3823130Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82439}

This reverts commit a19316d9.

Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20UBSan/22670/overview

Original change's description:
> [heap] Rework Worklist base type
>
> Worklist uses a singly-linked list of segments to hold entries.
> Segment size was based on a compile-time constant but already stored
> in the segment itself.
>
> Rework the segments to query `malloc_usable_size()` on allocation and
> adjust the capacity properly. For PartitionAlloc, it turns out that
> there's ~20% more capacity available for the 64-element segments.
>
> This slows down actual allocation of the segments with the upside of
> improving utilization and requiring 20% less segments.
>
> Change-Id: Ib8595c3fb9fb75b02e4022f6c525bb59a2df7ab7
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3826047
> Commit-Queue: Anton Bikineev <bikineev@chromium.org>
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Anton Bikineev <bikineev@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#82432}

Change-Id: I14994e11ff5ffaba70b93d977d40dd2f6e9e5d35
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3829474
Owners-Override: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#82438}

The existing version for paged spaces simply reset the freelist, which
doesn't work for tests that require actual objects in the space.
The version for new space also doesn't work because it assumes
everything after top is free space.

Fill the space with FixedArray by iterating over the freelist and
creating an object in place of each freelist entry.
This method actually fills the space, so that we can also use it to
force page promotion.

Bug: v8:12612
Change-Id: Ie0d73e846bbf688ea52030be29e0587b2f37ed4e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3823135Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82437}

The WasmStringConcat builtin delegates all the work to yet another
builtin (StringAdd_CheckNone); so from optimized code we might as
well call the latter directly.

Bug: v8:12868
Change-Id: I3876ce1d6341befac5d49ba02c4af47637ad4ba3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3823124Reviewed-by: Clemens Backes <clemensb@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82436}

The CL aims to check if PC is causing a Speedometer regression. The
previous reland was part of the roll that broke builtin PGOs, which
cause large Speedometer2 regression. Now we want to disable and then
reenable pointer compression on M1 just to make sure that there are no
performance regressions caused by PC.

Bug: chromium:1325007
Change-Id: I2442218322d3b045bc5518b03730f57aa2091ebf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3827875Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Auto-Submit: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82435}

Bug: v8:13184
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Change-Id: I0200ce6e7877acf06cbffd8f7edd276119278f50
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3829468
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82434}

When trying to understand why a given module fails to validate, it
can be helpful to disassemble it as far as possible until reaching
the erroneous byte(s).

Change-Id: I0056ba1a81b85a486c0446d15bbf54ccb2e8332e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3827866Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82433}

Worklist uses a singly-linked list of segments to hold entries.
Segment size was based on a compile-time constant but already stored
in the segment itself.

Rework the segments to query `malloc_usable_size()` on allocation and
adjust the capacity properly. For PartitionAlloc, it turns out that
there's ~20% more capacity available for the 64-element segments.

This slows down actual allocation of the segments with the upside of
improving utilization and requiring 20% less segments.

Change-Id: Ib8595c3fb9fb75b02e4022f6c525bb59a2df7ab7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3826047
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82432}

Use AllocationMemento::kSize instead of HeapObject::kHeaderSize

Bug: v8:12612
Change-Id: Ieae62546f10c96fe5e5bcf98f9235f0c7ef7ff77
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3826248Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Auto-Submit: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82431}

Bug: v8:11880
Change-Id: I745caa10106870eb06526cccb8693797a36ba7bd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3825888Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Jakob Linke <jgruber@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82430}

Only hardening; no behavioral changes.

Bug: v8:11111
Change-Id: I66765b661485334b1b14d9ceaa16a8df355d1898
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3826246Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82429}

Bug: v8:13115, chromium:1351395
Change-Id: I8804e2cbc13ed040754ab7426780c4528ed6daaa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3826247Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82428}

Port commit ca33c73e

Bug: v8:7700
Change-Id: I4da1e75be2418ddf6651614c7902a6393b19479a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3828411
Auto-Submit: Liu Yu <liuyu@loongson.cn>
Reviewed-by: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/main@{#82427}

This adds `extern.internalize(ref null extern): ref null any` to wasm
which unpacks the wrapped wasm object if the js-interop flag is not set.
I31 values are still wrapped in object wrappers and don't use SMIs.

Bug: v8:7748
Change-Id: Ie4a4507961d0ad41caf430054a3d341f474b8e66
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3819645Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82426}

nullfuncref = ref null nofunc
nullexternref = ref null noextern
nullref = ref null none

Bug: v8:7748
Change-Id: Ia54ac52c81bde4315e2d6819cff032cb739216c7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3820064
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Auto-Submit: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82425}

This has been broken even prior to the any <-> extern split.
The code decided to use the generic wrapper for type any even though
the generic wrapper doesn't support wrapping the return value of functions
and unwrapping arguments passed to it.

Bug: v8:7748
Change-Id: I9dbb893cc4bc4f2bb789b3b3a9addd0208d526ae
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3826056Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Auto-Submit: Matthias Liedtke <mliedtke@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82424}

Instead of defining one global (FLAG_foo) per flag, define all flag
values as fields in a global {v8_flags} struct. This guarantees that the
memory is contiguous, and together with proper alignment allows us to
later memory-protect that memory space.

In order to avoid rewriting all existing code that uses the {FLAG_foo}
syntax, we define global aliases: {FLAG_foo} is a reference to
{v8_flags.foo}.

After the next branch cut (v10.6), follow-up CLs will rewrite all
existing code to use the {v8_flags.foo} syntax, and after another branch
cut (v10.7) the aliases will be removed.
This should allow us to merge back most fixes to the previous branch
(N-1). Merges to stable (N-2) might still require resolving merge
conflicts manually, if they modify code that reads flags.

R=cbruni@chromium.org
CC=​sroettger@chromium.org

Bug: v8:12887
Change-Id: I8bc44429767f611484fe345d7268af1d55c98124
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3810187
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82423}

This reverts commit 01aed57e.

Reason for revert: Might have caused some regressions, see https://crbug.com/1351991.

Original change's description:
> [heap] Add IncrementalMarking::AdvanceOnTask as new bottleneck
>
> Introduce common bottleneck for all incremental marking step
> invocations from a task context. This will later be used to move
> code out of IncrementalMarking::Step.
>
> Bug: v8:11708
> Change-Id: Iba2dc2402083f8b4152ded56eaf0e13d473442a8
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3822682
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#82343}

Bug: v8:11708
Change-Id: I1ec74974d90b865baf223f9820f5bf346f113d86
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3827865
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82422}

Bug: v8:7327
Change-Id: I41faceac568a87cec4ae47ce2e4fc2c03822ddca
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3794649
Commit-Queue: Danylo Boiko <danielboyko02@gmail.com>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82421}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/9497cae..36b3854

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I2b0eb070497a2f538bf93f1b26af5d1c4c43592f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3827295
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#82420}

Rolling v8/buildtools/linux64: git_revision:c8c63300ac8ecb66d8126af5407257209ae59044..git_revision:0bcd37bd2b83f1a9ee17088037ebdfe6eab6d31a

Rolling v8/buildtools/third_party/libc++/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxx/+log/4d0f32e..55e0c49

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/47666e0..b2cd647

Rolling v8/third_party/fuchsia-sdk/sdk: version:9.20220810.1.1..version:9.20220811.2.1

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I42adf5759bb464a9dd17e66b472435fe4e1e1139
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3827294
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#82419}