This tests the hypothesis that the current timeout problems are on
Bionic bots only.

Bug: v8:11818
Change-Id: I68f84cda52ca392fbda5a400eb2bf136b7ee85a3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2916816
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74747}

Enable more complex tooltips with clickable links and references.

- Use short filename for Script.name if they are unique
- Use shared App.isClickable method
- Remove various toStringLong methods
- Rename CodeLogEntry.disassemble to .code
- Add DOM.button helper

Bug: v8:10644
Change-Id: I5d46ffd560b37278dc46b8347cb9ff0a7fdfa2ef
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2916373Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74746}

Change-Id: I6e8f1023c761b94f6e2f6dc985a10f58056667d0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2916814
Commit-Queue: Georg Neis <neis@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74745}

This is a first step towards supporting unwrapped WasmObject objects on
JavaScript side.

In addition this CL
1) introduces Representation::WasmValue which is used for all WasmObject
   fields exposed to JavaScript side.
2) adds creation of meaningful DescriptorArrays for WasmObject's Maps.

Bug: v8:11804
Change-Id: I4afcd39da5cb77b659943da54a2ca34d13bcc9bd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2912776
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74744}

Bug: chromium:1192162
Change-Id: Ida55f1b9f8543177851a2d037b576fc33c44b807
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2912581Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74743}

There are two different limits for the maximum memory size in
WebAssembly:
1) A 4GB limit which is the same on all platforms, and is observable for
JS programs. It is used to limit the allowed declared maximum size of a
wasm memory.
2) A potentially lower limit (2GB on 32-bit systems, 4GB otherwise)
which can be further limited using a command-line flag. This limit is
used whenever actually allocating or growing a wasm memory. This limit
is not directly observable, but we make sure that no wasm memory will
ever be bigger than this limit.

The second limit is the one we should check against when allocating or
growing memory, while the first limit should be used when validating
a module (or the parameters for WebAssembly.Memory). The compiler can
rely on no memory being bigger than the second limit, which again is
never bigger than the first limit.

This CL adds some more documentation to the two limits, and cleans up
all usages.
This also makes {kPlatformMaxPages} and {kMaxMemoryPagesAtRuntime}
obsolete.

R=jkummerow@chromium.org

Bug: chromium:1207263
Change-Id: I43541aafd3f497d1c368bd9400e9bc667bdfd3d9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2910787
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74742}

The previous fix force --single-threaded-gc, but that has no effect
without reapplying flag implication as done in this fix.

Bug: v8:11413
Change-Id: Iecb2d74c7eb8322638dcc843723c560dcbb7bf50
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2912892
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Auto-Submit: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74741}

Bug: chromium:1197053, chromium:324812
Change-Id: I2cccabf838e3a3acbb3adfed33aa59400ec91b11
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2821547Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74740}

This is a reland of 5ef4e14f

The previous CL caused flaky test failures with some concurrent
allocation tests. The reason for this was that the main thread's state
and collection_requested_ can't be updated in an atomic operation
anymore.

Any thread will now invoke RequestGC() first. Then it will wait in
AwaitCollectionBackground() when the main thread was running. Both
methods can and will be invoked more than once.

The new flag block_for_collection_ is used to decide whether a thread
needs wait for the GC. collection_requested_ can't be used for that
purpose because that flag is also true when the main thread is parked.

Original change's description:
> [heap] Replace usages of CollectionRequested with SafepointRequested
>
> CollectionRequested was used exclusively on the main thread when a
> background thread requested a GC. The main thread never used
> SafepointRequested at any time. Now with the shared GC we might need to
> stop multiple isolates in a safepoint in the future. In such a situation
> we would need to use SafepointRequested also on the main thread.
>
> This CL prepares V8 for this situation by using SafepointRequested
> instead of CollectionRequested and friends on the main thread. The slow
> path of Safepoint(), Park() and Unpark() will check in the future
> whether the main thread needs to halt for a shared GC or needs to
> perform a local GC. At the moment, simply performing the local GC is
> still enough.
>
> Bug: v8:11708
> Change-Id: I819b6f7db8251074a4adf8b554e0a1393c76f7da
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2891834
> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74673}

Bug: v8:11708
Change-Id: Ibe245cd1822310123b3af2026872fd9927ee410e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2912576
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74739}

This reverts commit 83c11a30.

Reason for revert: Test is consistently timing out on TSan: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20TSAN/36827/overview

Original change's description:
> [test] Re-enable test-heap/OutOfMemory* test
>
> The underlying issue was fixed in
> https://chromium-review.googlesource.com/c/v8/v8/+/2505724
>
> Bug: v8:7605,v8:8296
> Change-Id: I4a35fd4b73f86934a9d1339655433e2d4c26bd53
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2912890
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74729}

Bug: v8:7605
Bug: v8:8296
Change-Id: Ie1dab9bef269ac980dcd2663c76f80713a68d9d6
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2910631
Auto-Submit: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#74738}

This is a reland of 0a661a9a without
changes (dependency has relanded).

Original change's description:
> Revert "[compiler] Temporarily change ContextRef back to kSerialized"
>
> This reverts commit 445f0f74.
>
> Reason for revert: TryMakeRef is again ready for this.
>
> Original change's description:
> > [compiler] Temporarily change ContextRef back to kSerialized
> >
> > This can be reverted once TryMakeRef checks the heap predicate.
> > I'm not reverting the previous CL because newer changes already depend
> > on it.
> >
> > Tbr: jgruber@chromium.org
> > Bug: v8:11765, v8:7790
> > Change-Id: Iacc6a78a70fe6f40c9421258889c2175fb400b04
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2891579
> > Reviewed-by: Georg Neis <neis@chromium.org>
> > Commit-Queue: Georg Neis <neis@chromium.org>
> > Auto-Submit: Georg Neis <neis@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#74531}
>
> Bug: v8:11765
> Bug: v8:7790
> Change-Id: I0b38791255182f1f8d0a5cf79f18d86568172487
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2897101
> Commit-Queue: Georg Neis <neis@chromium.org>
> Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Auto-Submit: Georg Neis <neis@chromium.org>
> Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74591}

Bug: v8:11765
Bug: v8:7790
Change-Id: I2fc5e0f3b13586479b3608770411bab4cb3d0591
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2904219Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74737}

Bug: v8:3716
Change-Id: Id884bf17dd4173546012aabe24263dac6d68b620
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2910782
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74736}

This is a reland of 1186fc50

This reland fixes NewSpaceAllocationTopAddress() and
NewSpaceAllocationLimitAddress() by returning nullptr if no new space
is available. This is okay since those are never used later on.

We can't make this a build-time flag because we may only want to disable
the new space for the shared heap.

Original change's description:
> [heap] Disable the young generation in shared heaps
>
> A shared heap will not have a young generation in the beginning.
>
> Bug: v8:11708
> Change-Id: I947ddb91a23a72a8cee3aa3e554723dda8146011
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2891569
> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74697}

Bug: v8:11708
Change-Id: I254b919f7076ce624d15c924e63cbde5eb4df749
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2912731Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74735}

Change-Id: I29b3a805a6031bf874e8b7e0775f5725b6180fca
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2914879Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74734}

Trimming is required before the Typer phase to ensure that all nodes
that might be reached via use links have been typed.

Add this phase back on the (background thread) OptimizeGraph
step instead of the (main-thread) CreateGraph phase since there
is no need to do it on the main thread.

BUG=chromium:1212244

Change-Id: I136aadb62d623c8f1898e4e9c0441266d5690be6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2912709Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74733}

The options/cause property is optional, it should not increase its length.

Bug: chromium:1192162
Change-Id: Id3bcc774232320d503d327a95f5e152d0e980e0d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2912732
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74732}

Bug: v8:3742
Change-Id: Ib63b7bacac07456dc1d7bf496b67980a34be306c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2912883
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Auto-Submit: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74731}

R=victorgomes@chromium.org

Change-Id: I2f6ba1d0b127567859c57dd42b73d7e4e0a8d29e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2912728Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74730}

The underlying issue was fixed in
https://chromium-review.googlesource.com/c/v8/v8/+/2505724

Bug: v8:7605,v8:8296
Change-Id: I4a35fd4b73f86934a9d1339655433e2d4c26bd53
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2912890Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74729}

The test has a loop that allocates large objects until it gets an
allocation failure. The test then asserts that the subsequent allocation
should also fail. That however does not necessarily hold because the
previously allocated objects may be collected to free up the space.

This change creates a handle for each allocated object. It also
restricts the size of the heap to 20MB to reduce memory consumption.

Bug: v8:11172
Change-Id: Ic3dc1a0f5f235b0313bab2071546b59a77bd55e5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2912884
Auto-Submit: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74728}

With this CL it is not possible anymore to initialize a func ref table
with extern ref ref.null.

R=manoskouk@chromium.org

Change-Id: If6023da6fc21844dd813cc6191f2a4ca595f8b00
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2912577
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74727}

Lite-mode builds were broken by
https://chromium-review.googlesource.com/c/v8/v8/+/2805623
[compiler] Generalize CallWithArrayLike optimization
This patch fixes the build.

Bug: v8:9974
Change-Id: I07530307e321a260a5d8ff59ab2c440764ebfc41
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2915678Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Paolo Severini <paolosev@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#74726}

This is required by the register allocator.

Bug: v8:11796

Change-Id: I714576fdd89487b88e5c412fe0d2981eb39210d8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2756538Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74725}

Following up on https://crrev.com/c/1946349, this moves the blocklist to
the ScopeInfo instead of storing it directly on the DebugEvaluate
contexts. This is not the final state that we're looking for, but a
small step along the way.

Bug: chromium:1027475, v8:9938, chromium:1072939
Change-Id: I529f2fcacaf057a1236847bf0eb8e12cc1686515
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2910774Reviewed-by: Simon Zünd <szuend@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74724}

CallWithArrayLike was optimized in TF only for 'arguments' in inlined
functions. Here we add logic to optimize also in non inlined functions,
enabling the rewriting of Function.prototype.apply(f, [1, 2, 3])
as f(1, 2, 3).

Bug: v8:9974
Change-Id: Icc9ccfc2276f75d06755176b55e7a02ddfdb04ed
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2805623
Commit-Queue: Paolo Severini <paolosev@microsoft.com>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74723}

Port e5a53a4c

Bug: v8:11767
Change-Id: I4214f844932c4b7b4f91c3c983cd9228c7975891
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2914772
Auto-Submit: Liu yu <liuyu@loongson.cn>
Reviewed-by: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/master@{#74722}

This is a reland of 2c096b53

Relanding as-is. Reason for reland: was speculatively reverted.

Original change's description:
> [codegen] Add TSAN support for tagged stores in generated code
>
> Mimics the kArchStoreWithWriteBarrier store in generated code by having
> a relaxed store to the same address, with the same value. This is done
> in order for TSAN to see these stores from generated code.
>
> Since it is done only for kArchStoreWithWriteBarrier TSAN will see
> tagged stores only.
>
> Bug: v8:7790, v8:11600
>
> Change-Id: I275dd46f5556b3a095c416adc03f2f0ac5bde41c
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2848470
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74568}

Bug: v8:7790
Bug: v8:11600
Change-Id: Id1616a0f65b56cb96ca2ffd25d6ef51d0e7230da
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2914874
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74721}

In WasmCapiCallWrappers, the address is passed in a register instead
of as an immediate, so we reduced 3 instructions to load the address
to t9;

before: lui + ori + dsll + ori;
after: mov;

Port: 54d84cf3

Bug: v8:11774
Change-Id: I423e54216ff65f1c12128c2b26443e1838b68003
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2914771
Auto-Submit: Liu yu <liuyu@loongson.cn>
Reviewed-by: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/master@{#74720}

.. for ObjectData creation.

Bug: v8:7790
Change-Id: I45ca3d8f404862752c2a9c7e7dc983d8f509624a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2909861
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74719}

No-try: true
Bug: v8:5861
Change-Id: I7d09d796788abeced5cae86ff52c052efc0fa456
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2912789
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74718}

Port ec4fd32c

Original Commit Message:

    This ports https://crrev.com/c/2905602 to the other platforms.

R=clemensb@chromium.org, joransiu@ca.ibm.com, junyan@redhat.com, midawson@redhat.com
BUG=
LOG=N

Change-Id: I23b4e944440b9189b12ae26d7b6c33bd07a53cbf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2912781Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#74717}

Bug: v8:11805
Change-Id: Ieb366a45ef0bdb69a64b4e3cc7b0715d7617141d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2912592
Auto-Submit: Georg Neis <neis@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74716}

Register allocator experienced some issues with multiple nodes for
the same parameter, which occurred in a few cases running turboprop.
This CL adds caching of Parameter nodes in BytecodeGraphBuilder such
that there exists only one node for each parameter index.

Bug: v8:11796
Change-Id: I90be5438f43368510ec4c317fa532c92a446e76a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2910314
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74715}

This ports https://crrev.com/c/2905602 to the other platforms.

R=cbruni@chromium.org

Change-Id: Iee941d22449b1e05bc131cc05d87e036e8f223d2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2912588Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74714}

... and use the generated WasmObject instance type range for data refs
checks.

Bug: v8:11804
Change-Id: I855ff76404ff7e3ca919dabec238d35cb39c0baf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2910784
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74713}

This adds a new status file indicator "HEAVY" to mark tests with high
resource demands. There will be other tests running in parallel,
but only a limited number of other heavy tests. The limit is
controlled with a new parameter --max-heavy-tests and defaults to 1.

The change also marks a variety of tests as heavy that recently had
flaky timeouts. Heavy also implies slow, hence heavy tests are
executed at the beginning with a higher timeout like other slow tests.

The implementation is encapsulated in the test-processor chain. A
new processor buffers heavy tests in a queue and adds buffered tests
only if other heavy tests have ended their computation.

Bug: v8:5861
Change-Id: I89648ad0030271a3a5af588ecc9c43285b728d6d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2905767
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Liviu Rau <liviurau@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74712}

They have been disabled for some time and are superseeded by lazy
feedback vector allocation.

Change-Id: Iafc3989b0c1f866ce7d6295d9b13ccaa5ef1c115
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2905609Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74711}

R=ecmziegler@chromium.org

Change-Id: Ibe9b1793a60d21ba853501b19c53647be5321288
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2910786Reviewed-by: Emanuel Ziegler <ecmziegler@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74710}

Additional changes:
- Clean up liftoff implementation of br_on_*.
- Bundle operations everywhere based on operation rather than type.
- Remove reference argument from WASM_BR_ON_* macros, to bring them in
  sync with WASM_BR_ON_CAST.
- Add missing function decoding unittests for br_on_*.

Bug: v8:7748
Change-Id: I5f5ebfac5b50b5a9a201acb435344d7471326242
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2909857Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74709}

AsmWasmFunctions don't allocate / use feedback vectors.

Bug: chromium:1206289
Change-Id: I970d5eaba6603809a844c2fc5753efba411cd719
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2909854
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74708}