Add an `array_buffer_allocator_shared` field to the
`Isolate::CreateParams` struct that allows embedders to share
ownership of the ArrayBuffer::Allocator with V8, and which in
particular means that when this method is used that the
BackingStore deleter will not perform an use-after-free access to the
Allocator under certain circumstances.

For Background:

tl;dr: This is necessary for Node.js to perform the transition to
V8 7.9, because of the way that ArrayBuffer::Allocators and their
lifetimes currently work there.

In Node.js, each Worker thread has its own ArrayBuffer::Allocator.
Changing that would currently be impractical, as each allocator
depends on per-Isolate state. However, now that backing stores
are managed globally and keep a pointer to the original
ArrayBuffer::Allocator, this means that when transferring an
ArrayBuffer (e.g. from one Worker to another through postMessage()),
the original Allocator has to be kept alive until the ArrayBuffer
no longer exists in the receiving Isolate (or until that Isolate
is disposed). See [1] for an example Node.js test that fails with
V8 7.9.

This problem also existed for SharedArrayBuffers, where Node.js
was broken by V8 earlier for the same reasons (see [2] for the bug
report on that and [3] for the resolution in Node.js).
For SharedArrayBuffers, we already had extensive tracking logic,
so adding a shared_ptr to keep alive the ArrayBuffer::Allocator
was not a significant amount of work. However, the mechanism for
transferring non-shared ArrayBuffers is quite different, and
it seems both easier for us and better for V8 from an API standpoint
to keep the Allocator alive from where it is being referenced.

By sharing memory with the custom deleter function/data pair,
this comes at no memory overhead.

[1]: https://github.com/nodejs/node/pull/30044
[2]: https://github.com/nodejs/node-v8/issues/115
[3]: https://github.com/nodejs/node/pull/29637

Bug: v8:9380
Change-Id: Ibc2c4fb6341b53653cbd637bd8cb3d4ac43809c7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1874347
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64542}

The CL fixes the following builtins:
  Atomics.add
  Atomics.and
  Atomics.compareExchange
  Atomics.exchange
  Atomics.load
  Atomics.or
  Atomics.store
  Atomics.sub
  Atomics.xor

Bug: v8:4153
Change-Id: Id6170fd093f6e2f9690838b4b789719ed2fc343c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1876847
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64541}

Bug: v8:6949
Change-Id: I01cb7180fbeea0a86e4fddc913311d6ece1aa5e7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1876065
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64540}

This makes sure that functions constructed via {WebAssembly.Function}
can be properly stored in globals of type "funcref". For now it is not
possible to call functions in such globals, but values can be loaded and
stored.

R=ahaas@chromium.org
TEST=mjsunit/wasm/type-reflection-with-anyref
BUG=v8:7742

Change-Id: I88ad1b5a57fd50e28723430803c528e674a94321
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1876815Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64539}

This method should be reused for compiled frames, hence this CL moves
it to the top-level in wasm-debug.cc, and makes it externally available
via wasm-debug.h.

R=mstarzinger@chromium.org

Bug: v8:9676
Change-Id: If2fbcad1d0911efe4c2169e8a5bd85b598ac335f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1876060Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64538}

This rearranges the TurboProp pipeline to avoid the need for a second
schedule of the graph. To do this, it moves the final schedule creation
before effect-control-linearization (which used a temporary schedule
previously, and with TurboFan). It then enables the block updater in the
graph assembler for effect control linearization and does select and
memory lowering in a new ScheduledMachineLowering phase to maintain
this existing schedule during these lowering passes.

BUG=v8:9684

Change-Id: I6a7790b010f8b152dd01d85aa95ee5d4f99087a5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1847351
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64537}

The Torque formatter script did a hack to put spaces arount the | of
union types. This was broken when the inserted comment ended up on the
end of a line. For this reason, and since it doesn't make sense to
fight the Google-wide TypeScript style for union types, this CL reverts
to not putting spaces around union types.

Bug: v8:7793
Change-Id: Ic0acf9e1da82540432a8e21b58497a6a7d523b9c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1871604
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Joshua Litt <joshualitt@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64536}

This extends the scope info test to also contain a compiled frame.
Currently, no scope info is shown for this frame. This will change in
the future, and the expected output will be extended accordingly.

R=yangguo@chromium.org
CC=mstarzinger@chromium.org

Bug: v8:9676
Change-Id: Ie57c1fec5f7cbec737d40b18d091fc2d9a00f493
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1876063
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64535}

This will allow us to reuse this method in other contexts.
This CL also contains smaller refactorings that helped to move the
code. E.g. the WASMVALUE_CTYPES macro (defined in value-type.h)
replaces the WASM_CTYPES macro (from wasm-interpreter.cc).

R=mstarzinger@chromium.org

Bug: v8:9676
Change-Id: Id788f843af9a09eb940593afa1639f12b652c514
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1876054
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64534}

This expands the existing mechanism for generic structs to also cover
abstract types. This involves:
- Moving the SpecializationKey from StructType to Type, so that it's
  also available to AbstractType.
- Moving the generic parameters out of the StructDeclaration AST node
  and using the existing GenericDeclaration AST node for generic structs
  and abstract types too.
- The GenericStructType declarable gets generalized to GenericType.

This will be useful for defining a Weak<T> type for weak pointers.

Bug: v8:7793
Change-Id: I183b3a038a143cf0ae5888150104c4a025fd736c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1859623
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64533}

This is the second porting of 0089006f

The first not fully porting is da0ef75f

Change-Id: Ia7e51a492df2fcab7da0cd8b2ff4d436c28563e4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1877794
Auto-Submit: Mu Tao <pamilty@gmail.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Mu Tao <pamilty@gmail.com>
Cr-Commit-Position: refs/heads/master@{#64532}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/e9c43f1..b293e4f

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/9f6271e..bf69ed0

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/db1e79c..ea98ebb

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: I8f3b4d7b302d63b7dc812cbba38e4ecd065d2e6f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1876524Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#64531}

Currently if the argument to matchAll has a null or undefined .flags
property, the error message will read "String.prototype.matchAll called
on null or undefined", which is very confusing.

Drive-by fix: Remove the related and unused
MethodInvokedOnNullOrUndefined error.

Bug: v8:9895
Change-Id: I3644545282ac8d2156c7a51086e37a0ab7f97a78
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1874619
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64530}

This adds avx for extractps, insertps, and cvtdq2ps. These require
SSE4_1, so modified AvxHelper to take another template arg for sse4
operations, and open the proper cpu scope before calling this arg.

Bug: v8:9561
Change-Id: Iad2be7ebab41b96f7eb74f4e2bd9776002e6a76c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1874378
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64529}

Updates the EffectControlLinerizer to feed all nodes it processes
through the GraphAssembler. This is required to enable the GraphAssembler
to maintain the schedule for TurboProp, but also means we can avoid
keeping track of the current effect and control nodes in the
EffectControlLinearizer and use the GraphAssembler for that instead.

Also modifies EffectControlLinearizer to avoid accessing the basic block
while lowering nodes, since a basic block updating GraphAssembler could
modify the current block. Once lowered, we finalizes GraphAssembler to
provide the updated basic block for which the original control should be
processed.

BUG=v8:9684

Change-Id: Ibe7f396e15f8bebf35b9c50d56c245cbc92547f5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1842453
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64528}

Specifically string, object, proxy & regexp.
With this CL, the pattern is removed from all torque files.

R=tebbi@chromium.org

Change-Id: Ifcc1efda6053df8f02fc730825055f6cd5644e84
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1873691
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64527}

This is a reland of 5d57f4e1

Breakage addressed by
https://chromium-review.googlesource.com/c/chromium/src/+/1874491

Original change's description:
> [Intl] Ship calendar and numberingSystem options
>
> Ship the "calendar" and "numberingSystem" options for
> Intl.DateTimeFormat (both options) and Intl.NumberFormat (only the later
> one) and support other calendar. Also consider the calendar while
> choosing calendar pattern.
>
> I2L: http://shorturl.at/bgkAH
> I2S: http://shorturl.at/nuKUV
>
> Flags: --harmony-intl-add-calendar-numbering-system
>        --harmony-intl-other-calendars
>
> API owner approvals: chrishtr@ yoav@yoav.ws bratell.d@gmail.com
>
> Plan to land into m80 tree and only merge after 10/17 m79 branch off.
>
> Bug: v8:9154, v8:9155, v8:9320
> Change-Id: Ifa209919a40db60465f99405f3620a3b73b10204
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1838436
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Frank Tang <ftang@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#64437}

Bug: v8:9154, v8:9155, v8:9320, chromium:1016909
Change-Id: Ie8eac6283042cb66fc4a98fd2230385c068fa759
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1874089Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64526}

Bug: chromium:1010272
Change-Id: Ieff61089255ee088fad45f15a0f1a8f93eeec94b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1869077
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64525}

The immediate value was incorrect and-ed with 3.

Also, for palignr, if the immediate is larger that 32
(for 128-bit) or 16 (for 64-bit), it produces a zero result.
In the case of disasm, I don't think we need to do anything.

Change-Id: I258fd16fbe57fa7e00ab306d0fbf1b1b73950566
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1876660Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64524}

Crashkeys are static and non-refcounted, so when one thread clears
a crashkey, it affects all other threads. This means, we cannot set
them in parallel running jobs such as ScavengePage. This change moves
the crashkey about heap collection up the stack into the main thread.

Change-Id: I28f16eaadd9b122c06a68d1d4207f27319994509
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1874384Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Irina Yatsenko <irinayat@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#64523}

Port 5e7de6aa

R=mstarzinger@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:9872
LOG=N

Change-Id: I2d2048643a4aba82b2f0e368afcf88c7e629c3d8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1876510Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#64522}

This reverts commit 9cca9eec.

Reason for revert: UBSan is not happy

Original change's description:
> [diagnostics] Adapt printing logic for huge TypedArrays
> 
> 1) don't print off-heap TypedArray elements with --mock-arraybuffer-allocator
> 2) print integer HeapNumbers with max precision
> 
> Bug: v8:4153
> Change-Id: I4ae00b5044e3a9b2dd641aba0e06496042d6ff76
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1875095
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Commit-Queue: Igor Sheludko <ishell@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#64520}

TBR=ishell@chromium.org,verwaest@chromium.org

Change-Id: I064efb3ca06cc56fff209bc1c6fb6fb518af4f83
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:4153
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1876066Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64521}

1) don't print off-heap TypedArray elements with --mock-arraybuffer-allocator
2) print integer HeapNumbers with max precision

Bug: v8:4153
Change-Id: I4ae00b5044e3a9b2dd641aba0e06496042d6ff76
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1875095Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64520}

Adds the ability for the GraphAssembler to operate on, and maintain, a
scheduled graph. This will be used by TurboProp to maintain the initial
schedule created before effect-control-linearization, by updating this schedule
during effect-control, select and memory lowering stages rather than doing a
later reschedule.

In order to do this, an internal BlockUpdater is added to GraphAssembler,
which is enabled by passing the schedule to the GraphAssembler. The
GraphAssembler is modified to call into the block updater when nodes are added
and updates the schedule with new basic blocks when new control flow is updated.

BUG=v8:9684

Change-Id: I6d428ad21d869c472bb20f43cc8caf44722f090a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1841355
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64519}

This function was only used for the write barrier since the store
buffer only stored slots and needed a way to get to the object's start.
Now that we insert into the remembered set directly from the write
barrier this isn't an issue anymore: the write barrier knows the
object start.

Change-Id: I701465ea40b7c4ee20404ecbcf3750e5fa6fd219
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1876049Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64518}

Bug: v8:9899
Change-Id: Ia67d19e4b213db44a62c559a24a29ee6dd687810
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1876056Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64517}

Port 26afd8f3

R=zhin@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I04f0237f608aad0e426cebfca4e8d4e9ff8cd5ae
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1875391Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#64516}

The CL fixes the following builtins:
  %TypedArray%.prototype.map

Bug: v8:4153
Change-Id: I1db5716d5044788da8a792e4449d501ac7507823
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1876047
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64515}

The size/length limits are still at kSmiMaxValue.

Bug: v8:4153
Change-Id: I6ffda50a3b9f235b97a3718e86df7deadce9f6f8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1874346
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64514}

Added the opcodes kWord32Equal and kChangeTaggedToCompressed to
DecompressionOptimizer.

Currently  TaggedEqual node generates ChangeTaggedToCompressed
nodes before the Word32Equal inputs. This means we need to also
propagate kOnly32BitsObserved from kChangeTaggedToCompressed.

Bug: v8:7703
Change-Id: I61fee07269696c60e065e1bbfee3a65c1b1537fc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1871911Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64513}

This changes the way {SaveFPRegsMode} is stored in a {CallDescriptor}.
The value is now encoded in the flags field, similar to all other
boolean properties. It removes the last mutable field from the call
descriptor, making the struct fully immutable.

R=neis@chromium.org

Change-Id: I6bca118c7ce0c5bc77e7aa2fcc6541439bd27b3b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1868616
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64512}

These accessors do not make any use of the interpreter, hence we can
define them on the WasmInstanceObject alone. This will allow to reuse
them for other (non-interpreted) frames.

R=mstarzinger@chromium.org

Bug: v8:9676
Change-Id: Iff8b665a4c25581b934c25b66a13cebe044cb02c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1875097Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64511}

Bug: v8:9899
Change-Id: I7509b376b33ab7a36106ed3af322ec4058fcdcfe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1876048Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64510}

Add a new PagedSpace called OffThreadSpace. This space will be used for
off-thread allocation -- it never marks or sweeps, and always expands
into fresh pages. Once allocation completes, this space's pages can be
merged into the old space.

The space is similar to the CompactionSpace, and merging for both is
identical, so we intrduce a new LocalSpace base class that both extend.
They differ in interaction with the sweeper and in how new pages are
acquired.

This patch adds the new space and uses it in a few unittests. Future
work will use it in the main source code.

Bug: chromium:1011762
Change-Id: Ia008cc95c6e1ef1d1e7ae305fa80fbfc1ff4be2d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1873690
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64509}

Previously, embedders had to fetch the 'exec' property off the RegExp
prototype in order to call exec (and such calls involve two
transitions between C++ and JS).

This CL exposes a convenient RegExp::Exec method through the API.

Bug: v8:9695
Change-Id: I57a9174626143d26f2ea34676b8e55fef64932cf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1864940
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64508}

R=neis@chromium.org,miladfar@ca.ibm.com
BUG=v8:9872

Change-Id: Ia8b0da9a6026f7933503ecd9e735d7fc3fdff364
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1869190Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64507}

The new ToIndex() must eventually replace ToSmiIndex().

The CL fixes the following abstract operations:
  GetViewValue(view, requestIndex, isLittleEndian, type)
  SetViewValue(view, requestIndex, isLittleEndian, type, value)

and the following builtins:
  DataView.prototype.getXXX
  DataView.prototype.setXXX

where XXX are all typed elements.

Bug: v8:4153
Change-Id: Ic2f33e91b59426deb0efa28bb4c15253e80a299c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1874345
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64506}

Port f22837db

R=xwafish@gmail.com

Change-Id: Iece021bb832618cac0d111639b388d94f7da7028
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1868773
Commit-Queue: Mu Tao <pamilty@gmail.com>
Auto-Submit: Mu Tao <pamilty@gmail.com>
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64505}

R=mstarzinger@chromium.org

Bug: v8:9810
Change-Id: Ib08647b5d6c4238732eed5a2ed1f1d0eea010076
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1875099Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64504}

The {InstructionCode} is only used to store plain (non-negative) values
of the {ArchOpcode} enum, or additionally encodes {BitField} values. The
underlying base type 'U' of a {BitField} is uint32_t. To avoid all the
numerous implicit conversions between int32_t and uint32_t, this is
changing the {InstructionCode} so that uint32_t is used exclusively.

R=neis@chromium.org
BUG=v8:9872

Change-Id: If64107ad9298011e219b4827735eafb51465beb0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1869193Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64503}