Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/256e629..1c34f36

Rolling v8/buildtools/third_party/libc++abi/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi/+log/ac1834f..ecff200

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/406c287..d1ddc12

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/1bc3cd2..31bfd51

Rolling v8/third_party/fuchsia-sdk/sdk: version:8.20220509.2.1..version:8.20220510.2.1

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/cd2b9e3..9da9510

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: Ide529df4fdc042606e784122148ad1593893b8f0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3640523
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#80460}

Upon destroying a v8::TracedReference while concurrent marking is
running, we merely reset the object pointer but do not get rid of the
global handle.

We were also restting the parameter which would read the internal
state for a DCHECK. Remove this clearing as the parameter field is not
used for v8::TracedReference.

Bug: chromium:1324074
Change-Id: Ic21bad78deba0925e12c3fc1215b087d0ef5dd7a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3637796Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Auto-Submit: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80459}

This prevents "ambiguous call" warnings when compiling in C++20 mode.

Bug: chromium:1284275
Change-Id: I52f782aaddfad1920e4b2df5e916b2c292cc7cff
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3630346
Auto-Submit: Peter Kasting <pkasting@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Peter Kasting <pkasting@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80458}

UnsafePointerAdd is unnecessary as long as a proper bitcast is used
before the addition. The bitcast is already in the effect chain and
prevents the addition from floating before a GC operation.

Change-Id: Ieadb8a51d2d24eaa1132a62c77c674954f7e2644
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3616727Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80457}

Deprecate the existing parameter to treat global objects as roots as
this is implied by exposing internals.

Bug: chromium:1321620
Change-Id: I73a8124d63f87599dee7080980844c418eb3b5e4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3637797
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80456}

Private brand checks have shipped since M91.

Bug: v8:11374
Change-Id: Ifd2f8e9904cdb25b45b2e4019da13b3cfc9efdc5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3622266Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Auto-Submit: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80455}

Bug: chromium:1284275
Change-Id: I727950c0bed499050ff550e90b9da07404057abe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3630348
Auto-Submit: Peter Kasting <pkasting@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80454}

Deprecate the OOMErrorCallback such that we can add a new parameter for
OOM details.

R=mlippautz@chromium.org

Bug: chromium:1323177
Change-Id: I72c931ad0d1b75cda46e8815387098acbe091c68
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3632106Reviewed-by: Lutz Vahl <vahl@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80453}

Bug: v8:11111, chromium:1307340
Change-Id: I7c68d4985c080bf5c595a4ae3360fc924b1bdefb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3627595
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80452}

Change-Id: I16a090fc9af5447c5d36e7bbd4bece1537724678
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3637792
Auto-Submit: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80451}

This is a reland of commit e8cac377
Broken jitless mode is fixed in a separate CL.

Original change's description:
> [rwx][mac] Enable fast W^X on Apple Silicon (M1)
>
> Bug: v8:12797
> Change-Id: I53bb803dd77db5bdd42b1a1b4b568e63857adf31
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3598861
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Commit-Queue: Igor Sheludko <ishell@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#80396}

Bug: v8:12797
Change-Id: I5436ceced5d4673f3b80d9cacdb3d6e84012c6e7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3635720Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80450}

This CL adds the array type flag to distinguish between
sparse array and dense array and adds serialization
and deserialization for sparse array.

Bug: v8:11525
Change-Id: Ia302af017d6f52924256a2b3fa9e3d2b34caa442
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3629739
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80449}

Bug: v8:12797
Change-Id: I93c786ac4b4a9b44d17f20e8d79544c4718d8fe6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3637790Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80448}

Since we now promote all young objects into old space on full GCs, we
don't need to sweep pages for iterability anymore in new space.

Minor MC doesn't need to make a page iterable when promoting the full
page into the new space. This is because maps are not reclaimed during
a minor GC.

Bug: v8:12760
Change-Id: I16d666e417d00ebf450453864cbd87afd6606afc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3635723Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80447}

Objects might be in a partially initialized state during deserialization
which makes collecting gc-stats tricky.

Bug: v8:12678
Change-Id: I154328adda432bf8e3588c96455c1bd8d527ef43
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3635722Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80446}

Bug: v8:11525
Change-Id: I226ba870cee7df20a7960defb0c03607d64e27b0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3634962Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80445}

Add support to atomically load (untagged) values from objects to CSA.

Bug: v8:12007
Change-Id: If0c4f20f20e021ace3b1e3a874c0405574d313e1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3627513
Commit-Queue: Patrick Thier <pthier@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80444}

Doc: https://bit.ly/revive-restart-frame

This CL implements support for the Debugger's "restart frame"
functionality in the unwinder. When the debugger wants to restart
a frame, we throw a termination exception. The unwinder checks if we
are currently in "restart frame mode", and if so, drops execution
into a special builtin instead of trying to find a catch handler.

Optimized frames are handled similarly, but the deoptimizer has to
materialize the frames first before also dropping into the
special builtin.

Drive-by: Rename `ShouldRestartFrame` to `IsRestartFrameScheduled`, so
we can reuse the name `ShouldRestartFrame` as a query method to check
if a specific frame is the frame we want to restart.

R=jarin@chromium.org, tebbi@chromium.org

Bug: chromium:1303521
Change-Id: Iff4f5761f970b65e22485f78ee0fd85da620ce66
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3613397Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80443}

In some cases we were still trying to change permissions of RWX pages
which is not allowed.

Bug: v8:12797
Change-Id: I9f4ca319d842c524fc6f60bfd3bb3726f8d3029d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3635719
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80442}

This is a reland of commit 31d78380

Issues related to GWP-ASan were fixed in https://crrev.com/c/3632490

Original change's description:
> Reland "[sandbox] Enable sandboxed pointers on Desktop"
>
> This is a reland of commit 48481a67
>
> Original change's description:
> > [sandbox] Enable sandboxed pointers on Desktop
> >
> > Bug: chromium:1218005
> > Change-Id: I3df750ee9101779952d8b1ae630c4d3b7563084b
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3578645
> > Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> > Commit-Queue: Samuel Groß <saelo@chromium.org>
> > Cr-Commit-Position: refs/heads/main@{#80376}
>
> Bug: chromium:1218005
> Change-Id: Iaf7bc81393da5c1381a361a9de129affaa019670
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3629348
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Commit-Queue: Samuel Groß <saelo@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#80394}

Bug: chromium:1218005
Change-Id: I98422c2577539e7025f3d6047855a63452ce3786
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3632306Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Samuel Groß <saelo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80441}

This reverts commit b8b7a3a2.

Reason for revert:
https://crbug.com/1324097
https://crbug.com/v8/12859

Let's maybe only reland the clusterfuzz_trials part until the rest
is sorted out.

Original change's description:
> [maglev] Turn on fuzzing for --maglev
>
> Turn on fuzzing for Maglev to get additional test coverage.
>
> Bug: v8:7700
> Change-Id: I5b72d851639e31dff1bd91361cd81ad448c2d69e
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3629334
> Auto-Submit: Jakob Linke <jgruber@chromium.org>
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#80416}

Bug: v8:7700, chromium:1324097, v8:12859
Change-Id: I926319988c3b9a2bc6dd083c69691a6536838782
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3634963
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#80440}

URLs can be fairly long and the original 512 char limit is not enough
for many google pages.

Change-Id: Id4f81214e3fedebc80f26c49034c0997397e10fb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3634779Reviewed-by: Marja Hölttä <marja@chromium.org>
Auto-Submit: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80439}

Avoid zapping freed memory in NotifyObjectSizeChange. This fixes the
linked performance regression introduced with
https://crrrev.com/c/3607992. Beginning with that CL we would always
zap freed memory on the main thread, while previously we only did this
in CreateFillerForArray when the FixedArray could actually contain
references.

While we could restore the previous behaviour as well, we simply stop
zapping freed memory in NotifyObjectSizeChange altogether for better
throughput. The reason for zapping was to reduce floating garbage.
However this is only relevant for incremental marking which is only
enabled for about <1% of the overall runtime.

Bug: v8:12578, chromium:1322882
Change-Id: I004ee712b924c53edac87810504d04aa7f4a50d8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3634960Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80438}

This way we can use it later in the pipeline for optimizations.

Change-Id: I0e97d061fd3d474ca7033ed2b68f43b52617d3e8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3634961
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80437}

Rolling v8/third_party/icu: https://chromium.googlesource.com/chromium/deps/icu/+log/85814e1..585942f

Cherry-pick PR2084 fix C++20 enum issues (Frank Tang)
https://chromium.googlesource.com/chromium/deps/icu/+/585942f

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com,ftang@chromium.org

Change-Id: I390adb38bca23243559916323c966b90b1995b29
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3634549
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#80436}

Bug: v8:11544
Change-Id: I16b1fb2cb4f6f4104b2f972a06b8fe0798ac6835
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3632675
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80435}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/9c02936..256e629

Rolling v8/buildtools/linux64: git_revision:53ef169800760fdc09f0773bf380fe99eaeab339..git_revision:bf4e17dc67b2a2007475415e3f9e1d1cf32f6e35

Rolling v8/buildtools/third_party/libc++abi/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi/+log/fb82ddb..ac1834f

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/0f76f22..406c287

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/6a1494e..1bc3cd2

Rolling v8/third_party/fuchsia-sdk/sdk: version:8.20220508.2.1..version:8.20220509.2.1

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: Ifc4c0c973afd69f66ae1a96e6e20f7d0e7a8c97b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3634547
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#80434}

Sync to spec changes in
PR2028 Consistently call observable operations with undefined options
https://github.com/tc39/proposal-temporal/pull/2028

Bug: v8:11544
Change-Id: I850761e76ba1bb33f6c3b655a71163d1b68bb4c8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3633618Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80433}

Add new opcode numbers for relaxed-simd opcodes as in:
https://github.com/WebAssembly/relaxed-simd/pull/61, and updates
for decoded opcodes larger than two bytes.

Bug: v8:12284
Change-Id: I0bff22812243a39599bfeee3c0bc69171dd3c7d2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3625835Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80432}

Port 3e43010a

Original Commit Message:

    New trace events:

    - finished OSR compilation.
    - entry into OSR code.

    Since the latter now happens without a trip into runtime, tracing is a
    bit more involved - we need to check FLAG_trace_osr in generated code,
    and call a runtime function if it is set.

R=jgruber@chromium.org, joransiu@ca.ibm.com, junyan@redhat.com, midawson@redhat.com
BUG=
LOG=N

Change-Id: I2f09eb755dd5986d94f736280ad38574129085e2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3635717Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#80431}

Builtins are not snapshotted, but instead we insert "builtin wrappers"
into the snapshot, and create references to the corresponding builtin
when deserializing.

Subclassing builtins will be implemented in a follow-up CL.

First version: https://chromium-review.googlesource.com/c/v8/v8/+/3630080
Fix: initialize builtin_objects_handle_

Bug: v8:11525,v8:12820
Change-Id: Ia2b5d41af5d7f577f1b02356b22a8760963009e4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3635718Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80430}

Bug: v8:11043
Change-Id: I8cbdd8a5f68bdadbe7fc44414c6d46cdd57e6802
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3627512Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Henrik Andreasson <henrika@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80429}

Many uses of "volatile" are deprecated in C++20 because they don't
actually do anything.  Remove "volatile" in these cases.

Bug: chromium:1284275
Change-Id: I64a3989d73f25e0cd933375dd6fa0b3f2b3acb54
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3630343
Auto-Submit: Peter Kasting <pkasting@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80428}

In preparation of renaming i::CodeEventDispatcher to i::Logger

Bug: v8:12795, chromium:1316443
Change-Id: I28e129130852d41cf5e464e083bc27cff97a0fff
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3623543Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80427}

In the previous refactoring --filter was accidentally filtering out
paths that matched <regexp>. This CL restores the original behavior
where only the matching paths are kept.

Bug: v8:12821, v8:11113
Change-Id: I7e7d7b793107fbf9b4944b1674874150803f4bb4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3623539
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80426}

Multiple code spaces are cheaper on 32-bit systems, because we can
directly call between them. Over-reservation on the other hand increases
the chance for OOMs. Hence reduce the code space estimation (used for
the initial reservation) on 32-bit systems.

Numbers were obtained from an older Epic module, Photoshop, and AutoCAD.
I'll keep an eye on the {V8.WasmModuleNumberOfCodeSpaces} counter.

R=ahaas@chromium.org

Change-Id: Ide804eaf46e8ba9bb48fcb41f23f1facc910645e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3634778
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80425}

This adds a typedef for LegacyOOMErrorCallback, which is identical to
OOMErrorCallback. Embedders will need to switch to
LegacyOOMErrorCallback so that we can change the definition of
OOMErrorCallback (see https://crbug.com/1323177).

R=mlippautz@chromium.org

Bug: chromium:1323177
Change-Id: I92312a577ca49e0174f2bb6b914cc11c3a0b0fc1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3632305Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80424}

This is a reland of https://chromium-review.googlesource.com/c/v8/v8/+/3607389.
The previous revert is https://chromium-review.googlesource.com/c/v8/v8/+/3610448.
Reason for revert: https://crbug.com/v8/12838.

The original CL has merge conflicts and cannot be relanded,
so this CL is newly opened.

This CL moves cctest/test-log to unittests/logging/log-unittest
, fixes the flaky tests in https://bugs.chromium.org/p/v8/issues/detail?id=12838 and updates the unittests status for log-unittest.


Flaky Tests:
- https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20TSAN%20-%20stress-incremental-marking/7287/overview
  - flaky LogTest.Issue539892 is caused by in stress-incremental-marking
    mode, Heap::MarkCompact will trigger CodeMovingGCEvent in https://source.chromium.org/chromium/chromium/src/+/main:v8/src/heap/heap.cc;l=2586;drc=52f06e6b43ff95eccf79e0a5df8d4d83c029130a for
    FakeCodeEventLogger which was already destructed
    when Heap::PerformGarbageCollection task was handled in
    DefaultPlatform::PumpMessageLoop. This should be fixed by removing
    FakeCodeEventLogger in LogTest.Issue539892.

  - flaky LogTest.LogAccessorCallbacks is caused by the data race in
    Sampler::DoSample. This should be fixed in https://chromium-
    review.googlesource.com/c/v8/v8/+/3616429.

-https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20TSAN/41327/overview
  - flaky LogTest.ExternalLogEventListenerWithInterpretedFramesNativeStack
    is caused by the data race of i::FLAG_* which were written again after
    setting up the isolate. This should be fixed by only writting
    i::FLAG_* before setting up the Isolate.

- https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64/47277/overview
  - flaky LogTest.BuiltinsNotLoggedAsLazyCompile is caused by the data
    race in Sampler::DoSample. This should be fixed in https://chromium-
    review.googlesource.com/c/v8/v8/+/3616429.

Bug: v8:12781
Change-Id: I3f736d4ffb3b8f147006bebe92285684b0c3952a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3616424Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Cr-Commit-Position: refs/heads/main@{#80423}

This reverts commit 71dbb03e.

Reason for revert: gc-stress failures: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20gc%20stress/38357

Original change's description:
> [web snapshot] Recognize builtins
>
> Builtins are not snapshotted, but instead we insert "builtin wrappers"
> into the snapshot, and create references to the corresponding builtin
> when deserializing.
>
> Subclassing builtins will be implemented in a follow-up CL.
>
> Bug: v8:11525,v8:12820
> Change-Id: If72695d46bdfc8bf7e477471be1264b668551854
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3630080
> Reviewed-by: Camillo Bruni <cbruni@chromium.org>
> Commit-Queue: Marja Hölttä <marja@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#80419}

Bug: v8:11525,v8:12820
Change-Id: I49f65103ad7b367c5bccb498f698e9afb29b1fec
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3634799
Auto-Submit: Clemens Backes <clemensb@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Owners-Override: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80422}

... Profiler::Remove.

In Profiler::Insert and Profiler::Remove, TSAN cannot
figure out that when head_ and tail_ equals, Profiler::Insert
will always execute before Profiler::Remove, and tsan
will report data race between buffer_[head] write and
buffer_[base::Relaxed_Load(&tail_)]. This CL changes the
tail_ atomic load and store memory order to gurantee that
buffer_ read and write always after and before tail_ load
and store, which gives tsan more constraint.

Bug: v8:12838
Change-Id: I50296ffa4606b288e9ad9edc15d42f21ca1c7d2a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3626454Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Cr-Commit-Position: refs/heads/main@{#80421}