This is a reland of 9284ad57, after
adding a missing speculation mode check in ReduceCallApiFunction.

Original change's description:
> [turbofan] Avoid raw InferReceiverMaps in JSCallReducer
>
> Instead provide an abstraction that makes it hard to forget
> dealing with unreliable maps.
>
> This also fixes a deopt loop in Function.prototype.bind and
> one in Array.prototype.reduce.
>
> Bug: v8:9137
> Change-Id: If6a51182c8693a62e9fb6d302cec19b4d48e25cb
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1578501
> Commit-Queue: Georg Neis <neis@chromium.org>
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#61106}

Tbr: jarin@chromium.org
Bug: v8:9137, v8:9197
Change-Id: I0db68d267055969553c0c1b85fad7b909075c062
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1589976
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61140}

Bug: v8:5367, v8:5368
Change-Id: I86f25f9f658e21a05604f3014e6ebf74f1a8a1f7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1590164Reviewed-by: Mathias Bynens <mathias@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61139}

New Rev: 8c3f1afc2dc5b8588bc2dc5f12a93255383d7236

Change-Id: I88fcc74b969d114cc6c491c9d1aa5872245f8f5c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1590624Reviewed-by: Alexei Filippov <alph@chromium.org>
Commit-Queue: Johannes Henkel <johannes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61138}

This reverts commit 36dd2bca.

Reason for revert: msan still failing https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/26453


Original change's description:
> Reland "[json] Speed up json parsing"
> 
> This is a reland of de8aaef5
> 
> Original change's description:
> > [json] Speed up json parsing
> >
> > - scan using raw data pointers + GC callback
> > - scan using scanner tables
> > - cap internalizing large string values
> > - inline fast transitioning logic
> >
> > Change-Id: I545620017b38b80e4193dfaf19381411adf5ff89
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1584320
> > Commit-Queue: Toon Verwaest <verwaest@chromium.org>
> > Reviewed-by: Igor Sheludko <ishell@chromium.org>
> > Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#61132}
> 
> Tbr: ulan@chromium.org
> Change-Id: Iafd5e7c750a9f3eae706baf51dc4c9237c916132
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1588887
> Commit-Queue: Toon Verwaest <verwaest@chromium.org>
> Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#61136}

TBR=ulan@chromium.org,gsathya@chromium.org,ishell@chromium.org,verwaest@chromium.org

Change-Id: If0a34e017fed7688873c21f4b65f62b246820732
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1590626Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61137}

This is a reland of de8aaef5

Original change's description:
> [json] Speed up json parsing
>
> - scan using raw data pointers + GC callback
> - scan using scanner tables
> - cap internalizing large string values
> - inline fast transitioning logic
>
> Change-Id: I545620017b38b80e4193dfaf19381411adf5ff89
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1584320
> Commit-Queue: Toon Verwaest <verwaest@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#61132}

Tbr: ulan@chromium.org
Change-Id: Iafd5e7c750a9f3eae706baf51dc4c9237c916132
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1588887
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61136}

R=binji@chromium.org

Change-Id: I936d906be90c0c6d3b84b5ad4e8cb574ab8cd970
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1585851
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Ben Smith <binji@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61135}

This reverts commit de8aaef5.

Reason for revert: breaks MSAN https://logs.chromium.org/logs/v8/buildbucket/cr-buildbucket.appspot.com/8914730548828313776/+/steps/Check/0/logs/json/0

Original change's description:
> [json] Speed up json parsing
> 
> - scan using raw data pointers + GC callback
> - scan using scanner tables
> - cap internalizing large string values
> - inline fast transitioning logic
> 
> Change-Id: I545620017b38b80e4193dfaf19381411adf5ff89
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1584320
> Commit-Queue: Toon Verwaest <verwaest@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#61132}

TBR=ulan@chromium.org,ishell@chromium.org,verwaest@chromium.org

Change-Id: I870c82f6f2a5bc3d2dfea57d5d6306cdccbbe935
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1590384Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61134}

Wasm compilation units got smaller and smaller with recent refactorings
(https://crrev.com/c/1587386, https://crrev.com/c/1587387,
https://crrev.com/c/1587388, plus previous CLs).
They now only store a function index and the requested compilation
tier. Hence there is no reason any more to heap-allocate them.
This CL changes the compilation unit queues and interfaces to store and
pass compilation units by value. Methods that could return an empty
{unique_ptr} before are now returning a {base::Optional}.

R=mstarzinger@chromium.org

Bug: v8:8343
Change-Id: I63037156b1a700095c13010450e5fedb51544401
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1588456
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61133}

- scan using raw data pointers + GC callback
- scan using scanner tables
- cap internalizing large string values
- inline fast transitioning logic

Change-Id: I545620017b38b80e4193dfaf19381411adf5ff89
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1584320
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61132}

This is an extension of 138d2dfc.

Change-Id: Icb10aab6e6799ab4f45dcbd26fc69206dbef29bb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1588430
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61131}

Remove extra allocation observer.
Minor tweaks.

Change-Id: Ic7e6e2f8cb39ff960960cca6cc3ece46438a4bd5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1588405Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Alexei Filippov <alph@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61130}

R=clemensh@chromium.org

Bug: v8:7581
Change-Id: I6b20698e556ed3808f8b190f88cb700301825b54
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1588432
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61129}

This reverts commit 7c426286.

Reason for revert: Compile error on cfi: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20-%20cfi/20196

Original change's description:
> [heap] Use normal marking write barrier for fixed array elements
> 
> This simplifies the marking write barrier for elements to mark the
> values instead of revisiting the array.
> 
> Bug: chromium:918485
> 
> Change-Id: Id5da0d5b9ff8385a256fe14f4bf7171f9f6343e1
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1588459
> Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Hannes Payer <hpayer@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#61125}

TBR=ulan@chromium.org,hpayer@chromium.org,mlippautz@chromium.org

Change-Id: I8576fe00b19db906aa80ca9cb54c3b8cc95e3d97
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:918485
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1590076Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61128}

BUG=v8:8801

Change-Id: I20e1b343f33293a5de3a8953650a26852126533a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1588466
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Auto-Submit: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61127}

TraceIC always expects a valid feedback vector to check for state
transitions. With lazy feedback allocations, it is possible that we don't
have feedback vectors. This cl fixes TraceIC to also work when there is no
feedback vector.

Bug: v8:8394
Change-Id: If7e40a9f16de7415e04a812440ccc0cfcf1cbc07
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1584322Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61126}

This simplifies the marking write barrier for elements to mark the
values instead of revisiting the array.

Bug: chromium:918485

Change-Id: Id5da0d5b9ff8385a256fe14f4bf7171f9f6343e1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1588459
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61125}

Remove unused function {UseLazyStubs}. Lazy compile stubs are now set on
a per function basis. This made the function {UseLazyStubs} redundant.

Change-Id: I8e715d6a9774c39841219c04c42364fc2e964569
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1588473
Commit-Queue: Frederik Gossen <frgossen@google.com>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61124}

Port ed319e84

Original Commit Message:

    Failure addressed by not exposing the new test to the jitless environment.
    (jgruber@ on TBR).

    New enum RelocInfo::COMPRESSED_EMBEDDED_OBJECT created to support
    compressed pointers in generated code. Enum name EMBEDDED_OBJECT
    changed to FULL_EMBEDDED_OBJECT.

    RelocInfo::[set_]target_object() abstract away the difference between
    FULL_EMBEDDED_OBJECT and COMPRESSED_EMBEDDED_OBJECT.

    Compressed embedded objects can only be created at this time on
    x64 with pointer compression turned on. Arm64 constant pools don't
    support compressed objects at this time.

R=mvstanton@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I8bdb5391fd2b2565d2fcaf6c806fcdbe1a1f27b2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1589862Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#61123}

With bytecode flushing and lazy feedback allocation, we need to call
%PrepareForOptimization before we call %OptimizeFunctionOnNextCall

Bug: v8:8801, v8:8394
Change-Id: I81918f174b2f97cbaa8b8ef2e459080c2581f535
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1588415
Commit-Queue: Mythri Alle <mythria@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61122}

Relative code targets are emitted as pc-relative jumps. The
relocation delta must be subtracted (not added) from the branch
offset.

Before GC:

        |-------- branch offset --->|
 [host code object]                 [target code object]

After GC:

 |- delta ->|      |- new offset -->|
            [host code object]      [target code object]

See also the similar fix for mips in https://crrev.com/c/1581239.

Bug: v8:6666
Change-Id: Ie0867d98906d4a8daa7e335884f7a4d814333872
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1581260Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61121}

Fix several small compile problems which causes by
https://crrev.com/c/1585737.

Change-Id: I78a07d597db9d81d4a99aac08e257f380be8f7e6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1589202Reviewed-by: Dan Elphick <delphick@chromium.org>
Commit-Queue: Yu Yin <xwafish@gmail.com>
Cr-Commit-Position: refs/heads/master@{#61120}

Change-Id: Ifbf1b49d7caad9b050945b07065ee5ecb9d9f9e4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1588470Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61119}

This reverts commit 9284ad57.

Reason for revert: breaks blink tests:
https://ci.chromium.org/p/v8/builders/ci/V8-Blink%20Win/16839

Original change's description:
> [turbofan] Avoid raw InferReceiverMaps in JSCallReducer
> 
> Instead provide an abstraction that makes it hard to forget
> dealing with unreliable maps.
> 
> This also fixes a deopt loop in Function.prototype.bind and
> one in Array.prototype.reduce.
> 
> Bug: v8:9137
> Change-Id: If6a51182c8693a62e9fb6d302cec19b4d48e25cb
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1578501
> Commit-Queue: Georg Neis <neis@chromium.org>
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#61106}

TBR=jarin@chromium.org,neis@chromium.org

Change-Id: I97e0f47fb82eda76656905a3f7cc494babd92be6
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:9137
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1588433Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61118}

We enable this feature to collect performance data; revert at will.

Bug: v8:9088
Change-Id: I57cd79707fe56ec5a2d6d5ee65b7ce24bda57773
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1585726
Auto-Submit: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61117}

Treat lazy functions the same no matter whether they are lazy due to
compilation hints or flags ({--wasm-lazy-compilation},
{--asm-wasm-lazy-compilation}). Test coverage is given by regression
tests 956771 and 956771b.

Bug: v8:9003
Change-Id: I123f83636f055fb142cd71f6cde88480f3c141bd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1585846
Commit-Queue: Frederik Gossen <frgossen@google.com>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61116}

This just adds the same case we already added in
https://chromium-review.googlesource.com/c/v8/v8/+/1478192
for conversions to tagged representation.

Bug: chromium:957559
Change-Id: I62a388ba47bd72d65fa07d0141362d7f1383c96e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1588428Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61115}

Fix recognition of lazy functions when {--wasm-lazy-compilation} is
used.

Bug: chromium:956771
Change-Id: I3f9bb25ccf3920a6c3d266876faace8841dcdc61
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1585843Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Frederik Gossen <frgossen@google.com>
Cr-Commit-Position: refs/heads/master@{#61114}

Bug: chromium:951322
Change-Id: Ibbc656c4a22adffc7d7df305541d4264a3b199ab
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1583760
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61113}

This CL refactors WasmTableObject::Grow to make it usable for the
table.grow instruction of WebAssembly.

The refactored version of WasmTableObject::Grow does additionally:
* Check if growing is possible
* Grow the FixedArray backing store of the table and initialize the new
  fields.
* Calculate the return value of WasmTableObject::Grow.

R=jkummerow@chromium.org

Bug: v8:7581
Change-Id: Ic6c867b96c30bd987ea281d5b3515a04bc5a3900
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1588136
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61112}

This reverts commit e632f8f4.

Reason for revert: Seems to cause some timeouts to trigger failures: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20TSAN/26129

Original change's description:
> [test] Remove longer timeout on bots
> 
> CQ_INCLUDE_TRYBOTS=luci.v8.try:v8_linux_gc_stress_dbg
> CQ_INCLUDE_TRYBOTS=luci.v8.try:v8_linux_gcc_rel
> CQ_INCLUDE_TRYBOTS=luci.v8.try:v8_linux64_msan_rel
> CQ_INCLUDE_TRYBOTS=luci.v8.try:v8_linux64_tsan_rel
> CQ_INCLUDE_TRYBOTS=luci.v8.try:v8_linux_arm64_dbg
> CQ_INCLUDE_TRYBOTS=luci.v8.try:v8_mac64_asan_rel
> CQ_INCLUDE_TRYBOTS=luci.v8.try:v8_win64_dbg
> CQ_INCLUDE_TRYBOTS=luci.v8.try:v8_android_arm64_n5x_rel_ng
> CQ_INCLUDE_TRYBOTS=luci.v8.try:v8_linux64_cfi_rel_ng
> CQ_INCLUDE_TRYBOTS=luci.v8.try:v8_linux64_ubsan_rel_ng
> CQ_INCLUDE_TRYBOTS=luci.v8.try:v8_linux_arm_lite_rel_ng
> CQ_INCLUDE_TRYBOTS=luci.v8.try:v8_linux_noi18n_rel_ng
> CQ_INCLUDE_TRYBOTS=luci.v8.try:v8_mac64_dbg_ng
> 
> Bug: v8:9145
> Change-Id: I6efee8579d9d9e0aad0431f6b87c152141d4ec7f
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1581261
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Reviewed-by: Tamer Tas <tmrts@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#61107}

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: I5e23aebc41e6ab15baa57093f7f056cdabd58f21
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:9145
Cq-Include-Trybots: luci.v8.try:v8_linux_gc_stress_dbg, luci.v8.try:v8_linux_gcc_rel, luci.v8.try:v8_linux64_msan_rel, luci.v8.try:v8_linux64_tsan_rel, luci.v8.try:v8_linux_arm64_dbg, luci.v8.try:v8_mac64_asan_rel, luci.v8.try:v8_win64_dbg, luci.v8.try:v8_android_arm64_n5x_rel_ng, luci.v8.try:v8_linux64_cfi_rel_ng, luci.v8.try:v8_linux64_ubsan_rel_ng, luci.v8.try:v8_linux_arm_lite_rel_ng, luci.v8.try:v8_linux_noi18n_rel_ng, luci.v8.try:v8_mac64_dbg_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1588425Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61111}

Change-Id: Ie44615daa6e0bef13a969cfb4fa62654ce31f448
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1581239
Commit-Queue: peng fei <pfgenyun@gmail.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61110}

Instead, use std::sort and std::stable_sort at the 3 (!) call sites
directly. This also removes the weird comparer adaptors from Vector,
which are only used in ZoneList.

R=jkummerow@chromium.org

Bug: v8:9183
Change-Id: I4d0377976fb0a965cb68a21d4307df9ba09fd55d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1587394Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61109}

New RelocInfo test needs to adapt to the new pattern.

Change-Id: I09e531d099541511f94b929de647a3e3510f748f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1588465Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61108}

CQ_INCLUDE_TRYBOTS=luci.v8.try:v8_linux_gc_stress_dbg
CQ_INCLUDE_TRYBOTS=luci.v8.try:v8_linux_gcc_rel
CQ_INCLUDE_TRYBOTS=luci.v8.try:v8_linux64_msan_rel
CQ_INCLUDE_TRYBOTS=luci.v8.try:v8_linux64_tsan_rel
CQ_INCLUDE_TRYBOTS=luci.v8.try:v8_linux_arm64_dbg
CQ_INCLUDE_TRYBOTS=luci.v8.try:v8_mac64_asan_rel
CQ_INCLUDE_TRYBOTS=luci.v8.try:v8_win64_dbg
CQ_INCLUDE_TRYBOTS=luci.v8.try:v8_android_arm64_n5x_rel_ng
CQ_INCLUDE_TRYBOTS=luci.v8.try:v8_linux64_cfi_rel_ng
CQ_INCLUDE_TRYBOTS=luci.v8.try:v8_linux64_ubsan_rel_ng
CQ_INCLUDE_TRYBOTS=luci.v8.try:v8_linux_arm_lite_rel_ng
CQ_INCLUDE_TRYBOTS=luci.v8.try:v8_linux_noi18n_rel_ng
CQ_INCLUDE_TRYBOTS=luci.v8.try:v8_mac64_dbg_ng

Bug: v8:9145
Change-Id: I6efee8579d9d9e0aad0431f6b87c152141d4ec7f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1581261
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Tamer Tas <tmrts@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61107}

Instead provide an abstraction that makes it hard to forget
dealing with unreliable maps.

This also fixes a deopt loop in Function.prototype.bind and
one in Array.prototype.reduce.

Bug: v8:9137
Change-Id: If6a51182c8693a62e9fb6d302cec19b4d48e25cb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1578501
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61106}

Ignore the error type in {assertThrows} only if it was not passed as an
argument. If users do not care about the error type they can user the
generic type {Error}. Before this change, an undefined error type would
simply be ignored. A simple typo could therefore disable the error type
assertion without being recognized.

Change-Id: I9becfd0bf14dcaa511854e65ff94f94481cc79b0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1585855
Commit-Queue: Frederik Gossen <frgossen@google.com>
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61105}

Failure addressed by not exposing the new test to the jitless environment.
(jgruber@ on TBR).

New enum RelocInfo::COMPRESSED_EMBEDDED_OBJECT created to support
compressed pointers in generated code. Enum name EMBEDDED_OBJECT
changed to FULL_EMBEDDED_OBJECT.

RelocInfo::[set_]target_object() abstract away the difference between
FULL_EMBEDDED_OBJECT and COMPRESSED_EMBEDDED_OBJECT.

Compressed embedded objects can only be created at this time on
x64 with pointer compression turned on. Arm64 constant pools don't
support compressed objects at this time.

NOPRESUBMIT=true

Bug: v8:7703
TBR: jgruber@chromium.org
Change-Id: Ifff53b041bab09b4b8c3e16085e5df4aa2b99f4f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1588461Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61104}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/c185a34..4087d63

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/d235eb2..5b26b37

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/6837707..e49aed3

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/396602c..210f1dc

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: I7844de2802808ecbcc98c5ca80ebe8b0613b4395
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1588730Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#61103}

Port 4b0f9c85

Original Commit Message:

    Our {Vector} template provides both {start} and {begin} methods. They
    return exactly the same value. Since the {begin} method is needed for
    iteration, and is also what standard containers provide, this CL
    switches all uses of the {start} method to use {begin} instead.

    Patchset 1 was auto-generated by using this clang AST matcher:
        callExpr(
            callee(
              cxxMethodDecl(
                hasName("start"),
                ofClass(hasName("v8::internal::Vector")))
            ),
            argumentCountIs(0))

    Patchset 2 was created by running clang-format. Patchset 3 then
    removes the now unused {Vector::start} method.

R=clemensh@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I119532691af31a3db1107c47de8b6f0c84697b5c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1588226Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#61102}

Similar issue as crbug.com/933103, so the fix follows the same
pattern too.

No regression test, because it will OOM anyway.

Bug: chromium:957015
Change-Id: Ic5b67d84aa1c44609e6c96485974af9ecab2ed0e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1585854
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61101}