This reverts commit 9f902b74.

Reason for revert: Reverting due to various fuzzing issues (numfuzz issues listed in original CL comments, ochang fuzzer in https://bugs.chromium.org/p/chromium/issues/detail?id=1299418)

Original change's description:
> [turbofan] Making OSR concurrent
>
> ... to reduce compilation overhead on the main thread for OSR
>
> Bug: v8:12161
> Change-Id: I54ca5fa6201405daf92dac9cf51d5de4b46577b3
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3369361
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Commit-Queue: Fanchen Kong <fanchen.kong@intel.com>
> Cr-Commit-Position: refs/heads/main@{#79188}

Bug: v8:12161
Change-Id: Id6f6086517cd77fb1aa60b20fd03528b8e2ca686
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3477104
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Owners-Override: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79194}

On 32-bit platforms, we generally don't over-allocate backing stores
for Wasm memories. That leads to quadratic overall complexity of
repeated growth operations by a few pages each though. To fix that,
this patch introduces a small over-allocation factor: when we have
to reallocate to grow a memory, we now grow by at least 1/8th of the
memory's previous size.

Bug: chromium:1294262
Change-Id: I89b5e974c75aac78bece8fcd72fb7a2184345153
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3472496
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79193}

The dynamic tiering budget slot will never be used if dynamic tiering is
disabled. As it's un untagged field (never visited by GC), we can just
leave it uninitialized.

Similarly, the feedback vector slot is only used (and visited by the GC)
if --wasm-speculative-inlining is enabled.

Since both is disabled by default, we can save two spills in each
function, saving 16 bytes on x64.

Drive-by: Add code comments for both code blocks.

R=jkummerow@chromium.org

Change-Id: If325e795f6368e02ed687697c4bdac208214103b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3468348Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79192}

This reverts commit 38db63b2.

Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/42484/overview

Original change's description:
> [profiler] opt-in tracing setting
>
> CpuProfiler includes logic tracing that is only relevant in
> the context of TracingCpuProfiler.
> Adds a setting to disable tracing for SamplingCpuProfiler.
>
> Change-Id: Idcac03dd3f368b5fcd48a532d5cfe60966a64003
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3433219
> Auto-Submit: Corentin Pescheloche <cpescheloche@fb.com>
> Reviewed-by: Camillo Bruni <cbruni@chromium.org>
> Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#79190}

Change-Id: Ib39f3790c5ba63ba2609cd8e5f6c218cd8e96ef7
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3477102
Auto-Submit: Tobias Tebbi <tebbi@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Owners-Override: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79191}

CpuProfiler includes logic tracing that is only relevant in
the context of TracingCpuProfiler.
Adds a setting to disable tracing for SamplingCpuProfiler.

Change-Id: Idcac03dd3f368b5fcd48a532d5cfe60966a64003
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3433219
Auto-Submit: Corentin Pescheloche <cpescheloche@fb.com>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79190}

- Avoid lookup if there is no template_weakmap yet
- More explicit DisallowGarbageCollection scopes
- Avoid handles when settings properties
- Speed up Object::GetSimpleHash by loading only instance_type once

Change-Id: Ib588607340a0c56dc1ba26c3e89485560222a688
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3463717Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79189}

... to reduce compilation overhead on the main thread for OSR

Bug: v8:12161
Change-Id: I54ca5fa6201405daf92dac9cf51d5de4b46577b3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3369361Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Fanchen Kong <fanchen.kong@intel.com>
Cr-Commit-Position: refs/heads/main@{#79188}

Rolling v8/third_party/icu: https://chromium.googlesource.com/chromium/deps/icu/+log/e94822c..b867f20

Don't copy icudtl.dat.hash on non-ChromeOS builds (Andrea Orru)
https://chromium.googlesource.com/chromium/deps/icu/+/b867f20

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com,ftang@chromium.org

Change-Id: I0d625dc016f6776e000722f53cd94203e7c0d993
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3474042
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#79187}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/8ec9695..82354b2

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/d6d7a05..0cfa90e

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I351b137d17e2d9eae24f060e1736bfcbaaa6339e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3474040
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#79186}

Building with Gcc-10 causes error "explicit specialization in non-namespace scope".
This change fixes it.

Bug: v8:12649

Change-Id: I36b2b042b336c2dfd32ba5541fdbbdb8dc8b4fd7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3473997Reviewed-by: ji qiu <qiuji@iscas.ac.cn>
Commit-Queue: ji qiu <qiuji@iscas.ac.cn>
Cr-Commit-Position: refs/heads/main@{#79185}

Weak containers are retraced if they are found through the stack using
the conservative scanner, possibly resulting in a race with the
concurrent marker.

Bug: v8:12648
Change-Id: I0936a2953e3e2151cea4191f335a091b0e334e6b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3474678
Auto-Submit: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79184}

The CL uses GlobalHandles::IterateTraceNodes() to find back references
from V8 to cppgc.

Bug: chromium:1029379
Change-Id: I6e959ae5d591247b817386cafe26b6cd74161b63
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3467874Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79183}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/2fb4402..8ec9695

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/1fe0550..b718bf9

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/988c0af..d6d7a05

Rolling v8/third_party/googletest/src: https://chromium.googlesource.com/external/github.com/google/googletest/+log/ea55f1f..c9461a9

Rolling v8/third_party/zlib: https://chromium.googlesource.com/chromium/src/third_party/zlib/+log/31e5ad1..4aca88e

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: Ie7ba3686f304e44dcdcd7e2be477579984597473
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3474235
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#79182}

Instead, open a single {CodeSpaceWriteScope} that covers all functions.
Note that the exact same thing is already done in
{InitializeLazyCompilation}.

R=thibaudm@chromium.org

Bug: v8:11974, chromium:1298552
Change-Id: I469757f0674a7b95ce56ffa4d42b5e0d9d5a0834
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3474671Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79181}

Currently the Isolate is gotten off of the object that the operation is
being performed on. GetDataProperty may end up using a per-Isolate
lookup cache, which is not threadsafe when the Isolate is shared. Plumb
the executing, non-shared Isolate through.

Bug: v8:12646, v8:12547
Change-Id: Ia08ece9a9e8cbd7eba9ea38b01caa511895f5bf4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3475084Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79180}

Change-Id: Ic83ad566cfd54cfa7cda0ca93d241f60f85436d6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3451045Reviewed-by: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Auto-Submit: Yu Liu <liuyu@loongson.cn>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79179}

The tool has been unmaintained for a while and doesn't work.

We do have either the system-analyzer or profview as valid web-based
replacements. For all other use-cases we recommend using the
command-line versions.

Change-Id: I3a07e80aebfb1f8d6ba16d6bffe16d9da7b9eac4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3474677Reviewed-by: Patrick Thier <pthier@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79178}

It has been deprecated for a couple of years and there is no evidence of
anybody still using it.

Change-Id: I454f2f718aa50c295b29faf62cd0313a5e6e97d7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3417495Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/main@{#79177}

This is a reland of 78bc7852

Original change's description:
> s390x: [baseline] enable sparkplug on s390x
>
> Change-Id: I4646bb0f3f6291c97bb4b397d6248b9bdaa2059a
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3439641
> Reviewed-by: Victor Gomes <victorgomes@chromium.org>
> Commit-Queue: Junliang Yan <junyan@redhat.com>
> Cr-Commit-Position: refs/heads/main@{#78959}

Change-Id: I1f2ce6622d6a6b20c197e23beeee3ee5b0aa32f4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3471523Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/main@{#79176}

Bug: v8:11525
Change-Id: I6a5c1cad0257157df605efb9777737d7fe40a42c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3472078Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79175}

Bug: v8:11880, chromium:1296036
Change-Id: Ib27b144c8258218f3ae28a6692f97a8f35679fec
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3474675Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79174}

Bug: v8:12639
Change-Id: I10aaa576fdc84d848aa28ed8e07d5793a0954ff1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3472023Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79173}

R=​machenbach@chromium.org,alexschulze@chromium.org

Bug: chromium:1298869
Change-Id: Icaba8b1eaf3e9171b39039681e48d54b6a7e479e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3472074
Commit-Queue: Tamer Tas <tmrts@chromium.org>
Auto-Submit: Tamer Tas <tmrts@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79172}

R=machenbach@chromium.org,alexschulze@chromium.org

Bug: chromium:1298869
Change-Id: I1ef1ac1d48ccbea81cfebcc360194f5003da17d0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3474672
Commit-Queue: Tamer Tas <tmrts@chromium.org>
Auto-Submit: Tamer Tas <tmrts@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79171}

This reverts commit 1025bf26.

Reason for revert: https://crbug.com/v8/12645

Original change's description:
> [shared-struct] Prototype JS shared structs
>
> Unlike the Stage 1 proposal, for simplicity the prototype does not add
> any new syntax, instead opting for exposing a SharedStructType
> constructor which takes an array of field names. This type constructor
> returns constructors for shared structs.
>
> Shared structs can be shared across Isolates, are fixed layout, have no
> prototype, have no .constructor, and can only store primitives and
> other shared structs.
>
> The initial prototype does not have TurboFan support.
>
> Bug: v8:12547
> Change-Id: I23bdd819940b42139692bcdb53d372099b0d4426
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3390643
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Marja Hölttä <marja@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Commit-Queue: Shu-yu Guo <syg@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#79156}

Bug: v8:12547
Change-Id: I44f2b8bb7487b4d39ba1282585e0b2282501230f
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3474676
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Owners-Override: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79170}

This CL adds handling of the BigInt types to TurbofanType to allow
verification of BigInt values in %VerifyType.

Change-Id: I1fc6dea16cbff4d22cfbb5483c5dee50fa932f75
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3256687Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79169}

This reverts commit a1838956.

Reason for revert: https://bugs.chromium.org/p/v8/issues/detail?id=12642

Original change's description:
> [heap] Allow shared references in WeakMap
>
> Shared references can also be stored in WeakMaps and during marking we
> need to be able to deal with such references. In a client GC shared
> objects are treated as live, so we don't need to update or check mark
> bits for such objects.
>
> Bug: v8:11708
> Change-Id: I0dbf797472c4779f462750dab63cc9b012aad091
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3447365
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#79153}

Bug: v8:11708
Change-Id: I113672aceba0ef5aa71f6fbedda7e0df854a437d
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3474673
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Owners-Override: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79168}

Previously, V8_OS_MACOSX was, somewhat confusingly, also used for iOS.
With this CL, V8_OS_DARWIN will be set on both macOS and iOS,
V8_OS_MACOS only on macOS, and V8_OS_IOS only on iOS.

This CL also renames V8_TARGET_OS_MACOSX to V8_TARGET_OS_MACOS and
renames platform-xnu.cc to platform-darwin.cc.

Change-Id: I4bcafc7c337586662114144f6c7ccf47d978da1f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3468577Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Samuel Groß <saelo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79167}

Port 89ea44bf

Change-Id: I2fb42032f174f1e8af4903c663f97ea27ab3600f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3467157Reviewed-by: ji qiu <qiuji@iscas.ac.cn>
Commit-Queue: ji qiu <qiuji@iscas.ac.cn>
Cr-Commit-Position: refs/heads/main@{#79166}

Now that we are able to compact map space, we can also get rid of the
map space and allocate maps in the old space instead. This CL introduces
a FLAG_map_space for enabling/disabling the map space but the map space
remains enabled by default for now.

Without a separate space for maps, the GC can't prevent relocation of
maps anymore. Therefore this CL always allows compaction of maps when
running without a map space. Rename flag to --compact-maps to better fit
this scenario.

mkgrokdump and debug_helper also need to be updated to look for maps
also in the old space. The map space is now optional.

Bug: v8:12578
Change-Id: Ic4e4abd0b58bee26e64329b1c92dbccb07d8105a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3424483Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Seth Brenith <seth.brenith@microsoft.com>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79165}

Message tests check the output of a test against an expected file.
Executing with --stress-opt changes the output, since the test will be
run multiple times. For that reason, most message tests explicitly add
the --no-stress-opt flag.

Since this is redundant, and not a per-test setting, just configure this
globally for all message tests instead.

R=machenbach@chromium.org

Bug: v8:12425
Change-Id: I52f1b43da2781fcb6f6bd37e67d483ca69c1c929
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3471637Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79164}

Start the implementation of the shared heap write barrier by renaming
CLIENT_TO_SHARED to OLD_TO_SHARED. I planned to do this with the CL
introducing the write barrier but in order to keep that CL smaller do
this here already.

Bug: v8:11708
Change-Id: I204c728e333a4e80c30c0992e43c3cb6752fc660
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3468351Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79163}

When a terminate_exception is raised while executing one of the promise
related jobs on the microtask queue, we don't clean up properly, leaving
the async stack in the inspector in an inconsistent state, not cleaning
up the promise stack on the Isolate, and also not resetting the global
current_microtask slot. This CL adds appropriate logic to perform the
correct cleanup.

Fixed: chromium:1297964
Change-Id: I4ec64405d4c66bfe1f0115e7039866447fb10f02
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3471815
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79162}

Change NumberFormat.prototpe.resolvedOptions to return new options in v3.
Also fix a heap allocation assertion bug in GetStringOrBooleanOption
while the useGrouping option is an invalid argument.

https://github.com/tc39/proposal-intl-numberformat-v3

https://chromestatus.com/guide/edit/5707621009981440

Design Doc: https://docs.google.com/document/d/19jAogPBb6W4Samt8NWGZKu47iv0_KoQhBvLgQH3xvr8/edit

Bug: v8:10776
Change-Id: Iaeeb0398b77394db3c941a2706d44b734a1f9d8c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3427298Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79161}

When we know that the value in a write barrier is a map, we know that
we are not going to have an old-to-new reference (maps are always in
old generation). Therefore we also don't really need the generational
barrier in RecordWrite. While this is technically correct, we don't
gain much from this optimization. The inline and out-of-line generated
code for the barrier is still the same as in all other cases. Which
means that outside marking we don't even reach the RecordWrite builtin.
Most write barrier executions happen outside incremental marking, hence
performance of the incremental marking barrier isn't critical. This CL
always uses the full RecordWrite builtin using a flag in order to
allow for an easy revert.

This CL is motivated by the shared heap work, which needs an additional
always-on barrier in the future (similar to OLD_TO_NEW) to keep a
OLD_TO_SHARED remembered set up-to-date. While maps are always in the
old generation, they maybe by located in the shared heap.

Bug: v8:11708
Change-Id: I71a6ded2547a0b2bbb9bbbd796dbcae0987b2232
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3471854Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79160}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/996f747..2fb4402

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/src/buildtools/+log/f413334..93c1552

Rolling v8/buildtools/third_party/libunwind/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind/+log/1e0047c..7539622

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/7504934..1fe0550

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/e293d3d..988c0af

Rolling v8/third_party/zlib: https://chromium.googlesource.com/chromium/src/third_party/zlib/+log/901a5d9..31e5ad1

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/0a9dd77..3730026

Rolling v8/tools/luci-go: git_revision:b32c149b6abb5e4e9aead1651c7a65562a956858..git_revision:582e828c5a8aaf5cdd0ad1d5465fb9092b71eab8

Rolling v8/tools/luci-go: git_revision:b32c149b6abb5e4e9aead1651c7a65562a956858..git_revision:582e828c5a8aaf5cdd0ad1d5465fb9092b71eab8

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: If8d8a68c179681c363ac4ef967ef94a4309741bf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3473206
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#79159}

Bug: v8:12638
Change-Id: I88a28b8a17b25ead4a5771870323425772f4f45a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3472873Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Francis McCabe <fgm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79158}

Change-Id: I86f34d698bf34590359a980282fa60d6501a6da9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3469628Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#79157}

Unlike the Stage 1 proposal, for simplicity the prototype does not add
any new syntax, instead opting for exposing a SharedStructType
constructor which takes an array of field names. This type constructor
returns constructors for shared structs.

Shared structs can be shared across Isolates, are fixed layout, have no
prototype, have no .constructor, and can only store primitives and
other shared structs.

The initial prototype does not have TurboFan support.

Bug: v8:12547
Change-Id: I23bdd819940b42139692bcdb53d372099b0d4426
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3390643Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79156}

- Remove debug printing in callstats.py
- Handle non-version nested JSON files better in callstats.html
- Harden RCS extraction from telemetry JSON files

Change-Id: Ied921e54e6281a456c0a6369d797c21785080036
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3471856Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79155}