- Add filter to skip baseline handlers
- Make profiler types more readable
- Refactor tickprocessor test to use serialized symbols
- Add large tickprocessor stress test with a complete V8 log

Change-Id: Icc09c2eb8ea63c1805d793d2d47f79b0d5080b5b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2784686
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74094}

Based on some test compiles (of three.js and jquery) we can get a decent
estimate of expected bytecode offset table size for a given bytecode
size. Reserve this expected size to avoid resize overhead.

Bug: v8:11420
Change-Id: I8288b01fa796e765a20b11219687fa3d23272416
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2843354Reviewed-by: Patrick Thier <pthier@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74093}

Since there usually aren't many pending 32-bit constants, we can avoid
the cost of malloc/free for most compiles by using a base::SmallVector
instead of std::vector.

I picked a value of 32 entries as the SmallVector's inline size, based
on compiling three.js and jquery with Sparkplug, and printing the size
of the constant pool when emitted. 93% of emitted constant pools had
<=32 entries.

Bug: v8:11420
Change-Id: I7d62da74c60feae08f8a4b16b1e7f93ea69d2c95
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2840447Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74092}

This CL disables two more fast API calls tests that shouldn't be run
on stress_snapshot and jitless variants.

Change-Id: I2e3270ba7b93e598219b87195640675cfc4571ef
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2843362
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74091}

Bug: chromium:1193459
Change-Id: Ia4a79a1f75bb82c459b8b0de35d95c5f25098f1c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2843355Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74090}

Use the general VLQ implementation for RelocInfo, rather than a custom
varint implementation. Note that this reverses the tagging logic (from
end bit to continuation bit) as this is more efficient for small values
(that now don't need to be tagged/untagged when written/read).

Change-Id: I09283f0557f9e182b4466858a2786922affb1453
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2839555
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74089}

Move NewStructInternal to header and templatize it to unroll
initialisation loop.

Bug: v8:11263
Change-Id: Iaaf2929c9a17b9195177b6afa7087b9b4ed6f0b4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2821706Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74088}

This reverts commit ebd9dcda.

Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux%20gcc/11378/overview

Original change's description:
> [compiler] Perform MapRef's SupportsFastArray methods concurrently
>
> We are safe to go through the native_contexts_list_ since we do it
> through IsAnyInitialArrayPrototype which disallows the GC. Furthermore,
> we read that list with an acquire load which guarantees that the fields
> have been initialized.
>
> Bug: v8:7790
> Change-Id: I778d51f4ead44e472f842693a7e9ff577d6acfe3
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2826541
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74086}

Bug: v8:7790
Change-Id: I4ef0056fb5ab9bd037375f67ec704f842e003283
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2843360
Auto-Submit: Sathya Gunasekaran  <gsathya@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74087}

We are safe to go through the native_contexts_list_ since we do it
through IsAnyInitialArrayPrototype which disallows the GC. Furthermore,
we read that list with an acquire load which guarantees that the fields
have been initialized.

Bug: v8:7790
Change-Id: I778d51f4ead44e472f842693a7e9ff577d6acfe3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2826541Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74086}

We have roughly a 7x (5x on ia32) ratio between bytecode and sparkplug
code. Using this number to preallocate the buffer for the emitted code
we can avoid a few copies for larger functions.

Drive-by-fix: Make sure EnsureSpace is marked V8_INLINE

Bug: v8:11420
Change-Id: I6ec48717d2e030c6118c59f5cdc286c952ec2843
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2835732
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74085}

Bug: v8:11510

Change-Id: I6cb4bdb45a735bd85adfa02b92f01cd144517560
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2840324Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74084}

It can happen that the {value} handle initially (when we stored its
contents into the property cell) contained a ThinString but was
subsequently patched by the scavenger to hold the InternalizedString
directly.

Bug: v8:11675
Change-Id: Ia3e5fed5bd28313b6fd2031eee0658ac4136a7ca
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2843350Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74083}

Flag reads from background threads are unfortunately scattered and
hard to completely avoid in the current state of V8. An example TSAN
failure:

ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20TSAN/36369/overview

The root cause is that FlagScope destruction modifies flag values on
the main thread, racing with flag reads from the background thread. In
cctests, there's no need to reset flags back to initial values at the
end of tests. Let's simply remove the problematic flag scopes.

Bug: v8:11658
Change-Id: I59ed3794ddc9ed570772726a423dc22afc4dc207
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2843346
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74082}

Templatize the VLQ methods to avoid std::function overheads, and add a
few optimisations (small value fast path, split writing and tagging).

Change-Id: I840d60c972916d1a6023c8ea2a67bbd540f2d159
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2839554
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74081}

Turning on V8_ENABLE_SYSTEM_INSTRUMENTATION by default has broken
node-v8 builds on Windows, tracked here:
https://github.com/nodejs/node-v8/issues/192. It looks like it is due
to the fact that Node uses pre-compiled headers, which undefines
some macros needed for the event trace APIs to work. (see
src/base/win32-headers.h)

Bug: v8:11043
Change-Id: I3a6caeaaabab59d42e14b79defb2e37efd9ad04d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2830550Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Sara Tang <sartang@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#74080}

This CL hardens the test facility in d8 for interface types for
the fast C API.

Bug: chromium:1201011
Change-Id: Ibfe1bb242f86b4a5edd0d195e049852430f8a2fe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2843344
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74079}

* Filtered some tests that rely on incremental_marking and shape tracking

Bug: v8:11644
Change-Id: Ic9833bf1e49e6413422484858cd1054dd2500092
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2822284
Commit-Queue: Wenyu Zhao <wenyu.zhao@anu.edu.au>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74078}

The compiler/fast-api-interface-types test is incompatible with
jitless and stress_snapshot, so this CL disables it on these two
variants. This fixes a failure on FYI bots:
https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20-%20fyi/21641/overview

The test was first introduced in
https://chromium-review.googlesource.com/c/v8/v8/+/2835711.

Change-Id: I0f9e2cc5d444673a1ad2ca9f16cd789fc2c2a814
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2843343
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74077}

Bug: v8:11589
Change-Id: I90a0c9f8325eb56c607addf1adde60673dfbc9c7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2840688Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74076}

Diary https://docs.google.com/document/d/1T60FUG62FuvZ447FNoK81uE1fgJ7bayPf_w-rPqFrFM
https://chromium.googlesource.com/chromium/deps/icu.git/+log/81d6568..7e7574bd

chrome DEPS rolling https://chromium-review.googlesource.com/c/chromium/src/+/2824939

Bug: chromium:1193795
Change-Id: Ibccb97fe9b6b0601676800dea6c066e0d66a0a6f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2793151Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74075}

Enabling and disable RCS at runtime races with concurrent threads
that use RCS.

Bug: v8:11338
Change-Id: I8fa9edcbaefc339f88b2a0d079d094a7e4290fbf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2840446
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Auto-Submit: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74074}

Bug: v8:11589
Change-Id: I13c57e1dcc77345bcc9d95a14cf878db6dd60e02
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2837589Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74073}

Moves the platform-specific interface-descriptors-<platform>-inl.h into
the v8_internal_headers target so interface-descriptors-inl.h can
include them. (Fixes 1 gn check error).

Bug: v8:7330
Change-Id: Id07635e93a4574b733d258ddba558b106d95c05f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2840448
Commit-Queue: Dan Elphick <delphick@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Dan Elphick <delphick@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74072}

This is a reland of d5457f5f
after a speculative revert.

Additionally it fixes an issue with throwing promise hooks.

Original change's description:
> [api] JSFunction PromiseHook for v8::Context
>
> This will enable Node.js to get much better performance from async_hooks
> as currently PromiseHook delegates to C++ for the hook function and then
> Node.js delegates it right back to JavaScript, introducing several
> unnecessary barrier hops in code that gets called very, very frequently
> in modern, promise-heavy applications.
>
> This API mirrors the form of the original C++ function based PromiseHook
> API, however it is intentionally separate to allow it to use JSFunctions
> triggered within generated code to, as much as possible, avoid entering
> runtime functions entirely.
>
> Because PromiseHook has internal use also, beyond just the Node.js use,
> I have opted to leave the existing API intact and keep this separate to
> avoid conflicting with any possible behaviour expectations of other API
> users.
>
> The design ideas for this new API stemmed from discussion with some V8
> team members at a previous Node.js Diagnostics Summit hosted by Google
> in Munich, and the relevant documentation of the discussion can be found
> here: https://docs.google.com/document/d/1g8OrG5lMIUhRn1zbkutgY83MiTSMx-0NHDs8Bf-nXxM/edit#heading=h.w1bavzz80l1e
>
> A summary of the reasons for why this new design is important can be
> found here: https://docs.google.com/document/d/1vtgoT4_kjgOr-Bl605HR2T6_SC-C8uWzYaOPDK5pmRo/edit?usp=sharing
>
> Bug: v8:11025
> Change-Id: I0b403b00c37d3020b5af07b654b860659d3a7697
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2759188
> Reviewed-by: Marja Hölttä <marja@chromium.org>
> Reviewed-by: Camillo Bruni <cbruni@chromium.org>
> Reviewed-by: Anton Bikineev <bikineev@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#73858}

Bug: v8:11025
Bug: chromium:1197475
Change-Id: I73a71e97d9c3dff89a2b092c3fe4adff81ede8ef
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2823917Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74071}

Change-Id: I2925b0d1378736d3b357e5be7070b6b37510cbff
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2840325Reviewed-by: Milad Fa <mfarazma@redhat.com>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/master@{#74070}

Change-Id: I34d31032b8f1704ddea6334398a4ff2198cc192d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2822631Reviewed-by: Brice Dobry <brice.dobry@futurewei.com>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Brice Dobry <brice.dobry@futurewei.com>
Cr-Commit-Position: refs/heads/master@{#74069}

Port: 2871e05c

Bug: v8:11420
Change-Id: Id4e060ba95d7eb19c0a0a3f5eb224be5eb46fa8e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2839017Reviewed-by: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Auto-Submit: Liu yu <liuyu@loongson.cn>
Cr-Commit-Position: refs/heads/master@{#74068}

Change-Id: Ia553e38ca65587c16c36c736c2b9ca9b686ed3e5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2839561
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Auto-Submit: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74067}

Mistakenly had its set as non-atomic when it was modifying maps the
concurrent compiler could see. Since this accessor is set after map
initialization, but it is not necessary for synchronization we can set
it as relaxed write.

Bug: v8:7790, v8:11668
Change-Id: I605935e96b3da47ed6abfb6676bf14456feeeddd
Fixed: v8:11668
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2839548Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74066}

The test fails because of the race condition between concurrent GC
threads and the destructor of the test.

Bug: v8:11413
Change-Id: I5a138a61c16ddf2398e7c54defe6cc4008ca3330
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2839552Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74065}

This is a reland of 6124a534

It fixes a UAF issue in the d8 test by moving the test API object
constructor to PerIsolateData. It also fixes a crash in Chromium
caused by current usage of v8::ApiObject, which should be migrated
to v8::Value*.

Original change's description:
> [fastcall] Add support for leaf interface type checks
>
> This CL adds an IsTemplateForApiObject method to FunctionTemplate
> allowing the embedder to check whether a given API object was
> instantiated by this template without including parent templates
> in the search. It also replaces the v8::ApiObject in the fast API
> with a raw v8::Value pointer to allow use of standard C++ casts.
>
> Bug: chromium:1052746
> Change-Id: I0812ec8b4daaa5f5005aabf10b63e1e84e0b8f03
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2595310
> Commit-Queue: Maya Lekova <mslekova@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Reviewed-by: Camillo Bruni <cbruni@chromium.org>
> Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#73999}

Bug: chromium:1052746, chromium:1199900
Change-Id: I4b7f0c9e9152919dde4a1d0c48fbf5ac8c5b13d8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2835711Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74064}

Change-Id: Iae17977cec9520cf0194b5686ec31f0501f866f1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2839556
Auto-Submit: Jochen Eisinger <jochen@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74063}

This is a reland of df52b65d

Skip test with variant stress-concurrent-allocation.
The test manually triggers pretenuring for allocation sites, but with
--stress-concurrent-allocation these pretenuring decisions are reset
due to low survival rate in old generation.

Original change's description:
> [test] Rework Allocation Site Pretenruing Tests
>
> - Add %PretenureAllocationSite to manually force pretenuring for an
> allocation site during the next GC.
> - Replace cctest test-compiler/DecideToPretenureDuringCompilation, which
> was not triggering the tested behaviour anymore with mjsunit test
> - Add tests for deoptimizations due to pretenuring decision changes
> during OSR.
>
> Bug: chromium:1193094
> Change-Id: I5d6c35e2914b705bf96f27051a4a286413b6fe26
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2825593
> Commit-Queue: Patrick Thier <pthier@chromium.org>
> Reviewed-by: Maya Lekova <mslekova@chromium.org>
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74032}

Bug: chromium:1193094
Change-Id: I366a4a074435ebffcf2b3af84152067731cd2a5e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2839550Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74062}

This allows using --track-retaining-path with incremental marking
enabled. This CL will also track when an object was kept alive through
the write barrier or the RetainMaps feature.

Bug: v8:11645
Change-Id: I08ab5e500ae3580aead0c188c2caeb8f2a5f9f07
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2829440Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74061}

Introduced in crrev.com/c/2833919.

Tbr: mslekova@chromium.org
Bug: v8:7790
Change-Id: I885aa1034f0edb99a6cb698f08361f5c1bf26389
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2839549Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74060}

This reverts commit f2741b13.

Reason for revert: breaks blink linux bot https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Blink%20Linux%20Debug/9089/blamelist

Original change's description:
> Resolving or rejecting promises doesn't execute script
>
> It just enqueues a microtask.
>
> Bug: chromium:728583
> Change-Id: Iecbc6f33db8a94acd10d9ae1f2173700d872ac50
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2827906
> Reviewed-by: Camillo Bruni <cbruni@chromium.org>
> Commit-Queue: Jochen Eisinger <jochen@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74036}

Bug: chromium:728583
Change-Id: I09a750b9c5cf43adedb395949e246421eeaf0a09
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2839547
Auto-Submit: Sathya Gunasekaran  <gsathya@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#74059}

This is a reland of 7c7cdec5

Original change's description:
> [TurboFan] Fix SpeculativeNumberEqual[Number] with undefined
>
> Bug: chromium:1198309, v8:5660
> Change-Id: I9cb5f66643c0c0ab9b18ca953cf85d2f6aa84b42
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2827899
> Reviewed-by: Georg Neis <neis@chromium.org>
> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74038}

Bug: chromium:1198309
Bug: v8:5660
Change-Id: Ibf9b3abfb62778a970b791432458076cff46d033
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2839544Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74058}

This splits up js-heap-broker.cc into

- js-heap-broker.cc: the JSHeapBroker impl, and
- heap-refs.cc: ObjectRef and ObjectData impls, as well as two
  JSHeapBroker functions that closely deal with refs/data objects.

Bug: v8:7790
Change-Id: I7e097b60cdec4fd61b39d7de9752d536ac313cbe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2833919Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74057}

This is a reland of c83c9590

Changes since revert: nothing, issue was crbug.com/v8/11666

Original change's description:
> [ic] Add a new MegaDOM IC
>
> This patch implements the MegaDOM IC setup and access. A new MegaDOM
> IC state indicates that we've seen only DOM accessors at this access
> site.
>
> This CL only adds support for DOM getters in LoadIC, other kinds of
> access will be added in follow on CLs.
>
> Still remaining TODO before shipping:
> 1. Have a mechanism to invalidate the protector
> 2. Have a mechanism to find the accessors that aren't overloaded
> 3. Use a new builtin to miss to runtime on access check failure
>
> Change-Id: Ie12efe5e9fa284f023043b996d61e7d74e710ee2
> Bug: v8:11321
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2618239
> Reviewed-by: Omer Katz <omerkatz@chromium.org>
> Reviewed-by: Camillo Bruni <cbruni@chromium.org>
> Reviewed-by: Dan Elphick <delphick@chromium.org>
> Reviewed-by: Mythri Alle <mythria@chromium.org>
> Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#73733}

Bug: v8:11321
Change-Id: I2bec54465542b5b40c42adb6eb12b6ce72cce5bd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2794439Reviewed-by: Dan Elphick <delphick@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74056}

- Add v8_code_comments to allow runtime-enabled code comments with
  --code-comments
- v8_code_comments is enable by default in debug mode
- Make MacroAssembler::RecordComment helper inlineable to remove
  call and check overheads when v8_code_comments = false
- Make FLAG_code_comments readonly if v8_code_comments = false and
  benefit from dead-code elimination

This saves roughly 5% CompileBaselineVisit time in sparkplug
on a 5MiB JS file.

Bug: v8:11420
Change-Id: I1174ab37b4bbe1ff8880416c1f6a6e28377a962c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2824428Reviewed-by: Bill Budge <bbudge@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74055}