This is the first part of exception handling support in Liftoff. For
now, the only supported instruction is throw, and only with empty
payload or only i32 values.

R=thibaudm@chromium.org

Bug: v8:11453
Change-Id: I9fdf1328ef46655674a05186fb93216518886d03
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2704659Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72871}

Functions are easier to maintain and to debug than macros, hence
transform the macro into a function.

R=thibaudm@chromium.org

Bug: v8:11384
Change-Id: I6a5a836e14c33dc3c2240b6b06edcb05c6514710
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2704074
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72870}

Code objects are exposed through JSFunction and SharedFunctionInfo.
If they are builtins, we don't have to worry about background threads
seeing partially initialized code objects. If they are optimized code
objects, we may. Background threads read the code fields with
AcquireLoad semantics. The fields are set on the main thread with
ReleaseStore semantics when appropriate.

Special care is taken when setting an optimized code object in a closure
in the interpreter entry stub. Since the MacroAssembler doesn't support
ReleaseStore semantics, this CL ensures that the optimized code object
is stored with those semantics in the feedback vector, where the
interpreter entry stub finds it.

Bug: v8:7790
Change-Id: I41ecedfe0e9d1ad5091cbe9a97f66c66ca9e07dd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2676633
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72869}

This fixes a build failure when compiling swiss-hash-table-helpers.h
on an SSE platform for a non-SSE target.

Change-Id: Ifc9bfc6b31d84d0e5dcc544a8eee8d6ea6e0cd12
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2704675Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Frank Emrich <emrich@google.com>
Cr-Commit-Position: refs/heads/master@{#72868}

We can remove some of the method definitions, as well as the
sloppy-ness from the method.

Bug: v8:6949, v8:11384
Change-Id: I04880daa3fcce097b79009f12bd24128a47c2c80
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2690591Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72867}

The interface descriptor can be looked by via the builtins name, hence
we do not need the template parameter. This also removes redundancy (and
potential errors) for passing the builtin name twice, via the template
parameter and a function parameter.

R=thibaudm@chromium.org

Bug: v8:11384, v8:11453
Change-Id: Id4184a371e8ab8a66ff0b4eb65b4bd87f285149e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2704172Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72866}

Allocate an array big enough to store label data for each byte in the
bytecode array. Use a linked list to store linked labels, and combine
the list with a pointer for an unlinked label.

Bug: v8:11429
Change-Id: Iadf00801f6ddd4460f7e0e1b53eee7be333f66e8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2704542
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72865}

In {MergeFullStackWith}, we were accidentally looking at the cached
instance in the current {cache_state_} instead of the state passed as
{source}. This could lead to missing reload of the instance after a
conditional branch.

R=thibaudm@chromium.org

Bug: chromium:1179182
Change-Id: Ida3c06491f7973a183c43745159abbf6aa8a058b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2704081Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72864}

Change the frame fill to unconditionally subtract already pushed
registers from register count. This ensures that the decision to add a
push loop is dependent on the _remaining_ registers, not the _total_
registers.

Bug: v8:11420
Change-Id: Ide763654e66f0a8c827a00fca1b4a77be2052f76
Fixed: chromium:1179595
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2704672
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72863}

For external uncached strings (also called "Small External Strings")
with cacheable resources, we can cache its resource's data at the
string's creation time. This allows us to safely read the data from the
background as we wouldn't trigger a data() callback.

For more information regarding the investigation and possible proposals
see
https://docs.google.com/document/d/101eAQqFpBPWFGNJicxtdlwYShJkTOUsEuxkVVeu5Hrk/edit?usp=sharing

Bug: v8:7790, v8:11463
Change-Id: I6164092b01a6ccb525a9516f476e066b35fb1f96
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2685177
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72862}

Bug: v8:11420
Change-Id: I41eda774ba31a25b7f199ffea7f97fca9c44835e
Fixed: chromium:1179650
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2704670
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72861}

This reverts commit 76a2ab06.

Reason for revert: A few issues, e.g.
https://logs.chromium.org/logs/v8/buildbucket/cr-buildbucket.appspot.com/8854931126653780144/+/u/Check__flakes_/ArrayWithCowElements

Original change's description:
> [compiler] Direct heap reads for JSArrayRef
>
> There are two aspects to the non-JSObject parts of JSArrayRef:
>
> - JSArrayRef::length. Relevant only in two spots, 1. when reading
> (immutable) array boilerplates and 2. for GetOwnCowElement.
>
> - JSArrayRef::GetOwnCowElement. May read into a copy-on-write backing
> store. Relies on the invariant that cow backing stores are immutable.
>
> This CL renames the length accessor to length_unsafe to make the
> danger explicit at callsites.
>
> For GetOwnCowElement the refactor is slightly larger, since we now
> need to read into the backing store while keeping full control of
> object reads (e.g. JSArray::length and JSArray::elements_kind). We
> make all reads explicit at the call site by requiring that elements,
> elements kind, and length are passed in as arguments to
> GetOwnCowElement. Inside GetOwnCowElement, consistency between these
> is *not* guaranteed due to concurrency. At runtime, consistency *is*
> guaranteed through the reference-equality check on the elements seen
> during compilation. The actual elements read is implemented in
> ConcurrentLookupIterator::GetOwnCowElement.
>
> Bug: v8:7790
> Change-Id: I9aa169ce4f2b1e2bfe1e9232007669eb7654a995
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2695403
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#72834}

Bug: v8:7790, chromium:1180012
Change-Id: I50e72380c544b2b78e1e3dc87a8249281b710912
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2704666
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72860}

Bug: v8:11429
Change-Id: I9472898ccc07e400fb4c61d80e208bae23223a74
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2704665Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72859}

The StackGuard in the sparkplug prologue builtin on x64 was called with
the frame in a weird state; in particular, the baseline code PC wasn't
on the stack. This could lead to oddities like the baseline code getting
collected by a GC during the interrupt.

Now we push the baseline code return address and set up a proper frame
for the interrupt.

Bug: v8:11420
Change-Id: I03b4c2f2d204ad413c5f54f9e8fc28182edf9085
Fixed: chromium:1177219
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2704658
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72858}

This is a reland of
https://chromium-review.googlesource.com/c/v8/v8/+/2688058

This CL is part of a series that adds the C++ implementation of
SwissNameDictionary, a deterministic property backing store based on
Swiss Tables.

This CL adds the initialization code, factory functions and a
canonical SwissNameDictionary plus all helpers required for that.

Bug: v8:11388
Change-Id: I9cf66a3fa755288f7730f55abfb6e6cea82f6b03
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2703653
Commit-Queue: Frank Emrich <emrich@google.com>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72857}

R=gdeepti@chromium.org

Bug: v8:11384
Change-Id: Icbf4ec5014bb1553da618b5958a3e1d5f487cfde
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2700037Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72856}

This reverts commit f731e13f.

Reason for revert: perf regressions, chromium:1179757

Original change's description:
> Remove 'length' field from ScopeInfo
>
> ScopeInfo has a vestigial 'length' field from when it used to be a
> FixedArray. This change removes that field, which saves some memory.
>
> More specifically:
>
> - Make ScopeInfo inherit from HeapObject, not FixedArrayBase which
>   supplied the 'length' field.
> - Privatize the FixedArray-style functions that provide access to
>   ScopeInfo fields by index, and move them from scope-info-inl.h to
>   scope-info.cc. Those functions are still used pretty heavily during
>   initialization (ScopeInfo::Create, etc.), but at least we can avoid
>   presenting them to the rest of the world.
> - Change FactoryBase::NewScopeInfo to allocate the updated object shape.
>   It maintains the existing behavior of filling the newly-allocated
>   object with undefined, even though that's not a valid ScopeInfo and
>   further initialization is required.
> - Move part of AccessorAssembler::ScriptContextTableLookup into a new
>   Torque macro, because it used to rely on casting ScopeInfo to
>   FixedArrayBase.
> - In V8HeapExplorer::AddEntry, don't claim that ScopeInfo objects are
>   arrays. I think it makes more sense to list them under "(system)" in
>   the dev tools, like most other V8 internal types.
>
> Bug: v8:8952
> Change-Id: I8278e3a90027d4409f0d268da0fe7080754c6b8c
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2601880
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Reviewed-by: Peter Marshall <petermarshall@chromium.org>
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
> Reviewed-by: Mythri Alle <mythria@chromium.org>
> Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
> Cr-Commit-Position: refs/heads/master@{#72830}

Bug: v8:8952
Change-Id: I00a69da79e5ac6aaae4436a41ce773ae014cc775
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2706086
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Auto-Submit: Seth Brenith <seth.brenith@microsoft.com>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72855}

Implement i8x16.popcnt, double precision conversions,
v64x2.alltrue and i64x2.ne.

Port: 00babf07
Port: 66964c51
Port: 1b81ffb1

Change-Id: I26f62f31fd362b06f7bcbf1988a8e2ff12d12504
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2706354
Auto-Submit: Liu yu <liuyu@loongson.cn>
Reviewed-by: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/master@{#72854}

Port: 257c303f

Bug: v8:11347,v8:11348,chromium:1174498

Change-Id: I1198ff37045e895082014918ec8d9f339893c1a4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2706307
Auto-Submit: Liu yu <liuyu@loongson.cn>
Reviewed-by: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/master@{#72853}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/99c7b26..d9000c9

Rolling v8/third_party/aemu-linux-x64: X81JiseHcDpE_0A4yjc6A232-BwI6vJSzYlXeAnpNwcC..SesU5Vh9_5Zm4yE0Qtuyv2VQ8UhCuhRMW3IkFgT7n0sC

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/5e37f6d..f362f6f

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/9990265..6cf138c

Rolling v8/tools/luci-go: git_revision:77944aa535e42e29faadf6cfa81aee252807d468..git_revision:fd10124659e991321df2f8a5d3749687b54ceb0a

Rolling v8/tools/luci-go: git_revision:77944aa535e42e29faadf6cfa81aee252807d468..git_revision:fd10124659e991321df2f8a5d3749687b54ceb0a

Rolling v8/tools/luci-go: git_revision:77944aa535e42e29faadf6cfa81aee252807d468..git_revision:fd10124659e991321df2f8a5d3749687b54ceb0a

TBR=v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: Id952af26eb7019ac2603e8f8ad94e93e1fe47300
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2706521Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#72852}

We can use UseScratchRegisterScope instead of requiring a
TempSimd128Register in the instruction-selector. This reduces register
pressure a little bit (when combined with unique register constraints).

Drive-by cleanup of some variable names in code-generator, s/tmp2/tmp/
when there is only 1 tmp.

Bug: v8:11384
Change-Id: I00a365624cbabeaeeaf78d1d08f0eb284c7e44ac
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2705523Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72851}

The atomic pause would not report any marked bytes which in turn would
mean that the used bytes counter would stay at 0 for testing GCs that
always use atomic marking.

Bug: chromium:1056170
Change-Id: Ie35d9b3bc88766c4ef56271f05d944f4835ba431
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2704662
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72850}

My recent change https://crrev.com/c/v8/v8/+/2698057 changed the size of
bytecode for most functions, and attempted to update other heuristic
values to match. However, it caused V8 to be slightly too eager to
perform on-stack replacement in JetStream 2's gaussian-blur test case,
so that the function got compiled separately for each of two nested
loops rather than just once for the outer loop. This is the smallest
change that restores the previous behavior in that benchmark.

Bug: chromium:1179571
Change-Id: I03e98d6bff7355b775c1fdaf495e7444e7c6f095
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2704882Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#72849}

- Remove unused type inference paths which will be replaced
  with more explicit structs.
- Removes the tagged pointer from CTypeInfo since the embedder
  will perform the type check for API objects.

Bug: chromium:1052746
Change-Id: I47a5f5ae35b06845b01b68cb089c67f76a7fb05e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2686685
Commit-Queue: Austin Eng <enga@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72848}

Stage 3 proposal: https://github.com/tc39/proposal-class-static-block

Bug: v8:11375
Change-Id: I579adab4679cce0190b9d8bd814a7cd297ebfa15
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2699449Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72847}

Since we'll immediately run the first check.

Bug: v8:11429
Change-Id: I47de46d8281b42c90d5cd1e1cbbfc6232c752da1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2700672
Auto-Submit: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72846}

Change-Id: I78c6203a6415cc6a94ff4bcefa4421f8eb54cc0e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2704291Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/master@{#72845}

R=ahaas@chromium.org

Bug: chromium:1179545
Change-Id: I0dddf6198a9574c925ca4faaf6b7b70453887029
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2704171Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72844}

R=ahaas@chromium.org

Bug: v8:8091
Change-Id: Id539bc96d9c791e3ed89d822189ab804ea9a24ea
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2699260Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72843}

Port: 3b6eb335

Bug: v8:11265

Change-Id: I6ecd95e64b18a8f45f0aaa2f40d15f8c8cd43340
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2704212
Auto-Submit: Liu yu <liuyu@loongson.cn>
Reviewed-by: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/master@{#72842}

Bug: v8:11420
Change-Id: I1289e2bb290ab80b761e2cdc3d85dff3621b4d0a
Fixed: v8:11465
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2704151
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72841}

This avoids a lot of code repetition for generating the call descriptor
and the actual call for a runtime stub.

R=thibaudm@chromium.org

Bug: v8:11384, v8:11453
Change-Id: Ice5d5513534ee854b50e323d788fa5cb2630e627
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2702336
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72840}

... for creating a FixedArray.
Calling builtins is generally cheaper than calling into the runtime, and
this also saves us a int->Smi conversion.
The builtin still has the "Wasm" prefix, since it's only used in wasm
for now.

R=thibaudm@chromium.org

Bug: v8:11453
Change-Id: I0c5b6b71ae1b07608f51e685014a0e8dc0034111
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2698674Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72839}

Modify the cctests for the inlined JS-to-Wasm calls to use the
%ObserveNode intrinsic, to verify that the JSCall node is actually
inlined . This requires a small refactoring of the %ObserveNode
implementation.

Bug: v8:11092
Change-Id: I01727143fec64c6c11c58b1b664f51daae5bfdb6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2677811
Commit-Queue: Paolo Severini <paolosev@microsoft.com>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72838}

... to reflect reversed parameters.

Change-Id: I3a709eb27f0c64f60ca3f5cb5b5fd7a1b8d5faa0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2702337
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72837}

Bug: chromium:1056170
Change-Id: I9151d31a27ed5fc8e8c98b77b2132aaa7ee562e1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2702334Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72836}

Eager evaluation in DevTools console relies on the builtins side
effect attribution.

Setters on Date object should be marked as no side effects if called
on the temporary object.

This bug was uncovered after considering screenshot from a tweet [1].

[1] https://twitter.com/shuding_/status/1362132984376160256

Change-Id: Iedc0e29e2bdab719304e2f0a0435845f24eaaadc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2703459Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72835}

There are two aspects to the non-JSObject parts of JSArrayRef:

- JSArrayRef::length. Relevant only in two spots, 1. when reading
(immutable) array boilerplates and 2. for GetOwnCowElement.

- JSArrayRef::GetOwnCowElement. May read into a copy-on-write backing
store. Relies on the invariant that cow backing stores are immutable.

This CL renames the length accessor to length_unsafe to make the
danger explicit at callsites.

For GetOwnCowElement the refactor is slightly larger, since we now
need to read into the backing store while keeping full control of
object reads (e.g. JSArray::length and JSArray::elements_kind). We
make all reads explicit at the call site by requiring that elements,
elements kind, and length are passed in as arguments to
GetOwnCowElement. Inside GetOwnCowElement, consistency between these
is *not* guaranteed due to concurrency. At runtime, consistency *is*
guaranteed through the reference-equality check on the elements seen
during compilation. The actual elements read is implemented in
ConcurrentLookupIterator::GetOwnCowElement.

Bug: v8:7790
Change-Id: I9aa169ce4f2b1e2bfe1e9232007669eb7654a995
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2695403
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72834}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/a42736b..99c7b26

Rolling v8/third_party/aemu-linux-x64: 9VxcXi3GhpRxrjwHQwa801vcevGa1Pew2lw1KkUkgmgC..X81JiseHcDpE_0A4yjc6A232-BwI6vJSzYlXeAnpNwcC

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/0391863..5e37f6d

Rolling v8/third_party/icu: https://chromium.googlesource.com/chromium/deps/icu/+log/12825ed..dc4ceac

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/823dc87..9990265

TBR=v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I8bf2a912e9015661d40c5bff074c862d98554080
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2703456Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#72833}

Process global accessors for total physical size and used size are
needed for blink. These are implemented via an allocation observer that
atomically updates static counters.

The public api only provides getters for the counters. An internal class
is in charge of updating the counters as needed. A similar split is also
applied to IsAnyIncrementalOrConcurrentMarking().

Drive-by: ProcessHeap is merged into cppgc::internal::WriteBarrier.

Bug: chromium:1056170
Change-Id: Iaedebd1ac9d49238ce6bdd52ffa5d1ef4d28203d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2695394
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72832}