Change-Id: I04bab17c1636e99f7486987bc777bea73997a0c6
Bug: v8:10201
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2387579
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69716}

The new helper function allows us to write tests for log parsing
without the need to first generating a log file. This makes it easier
to spot errors when the log format changes.

- Add d8 global variable
- Add file_name accessor to Logger and Log classes
- Change OS::LogFileOpenMode to w+ / wb+
- Use separate Log::WriteLogHeader method
- Remove unused logger_ instance variable from Log

Bug: v8:10644
Change-Id: Ifc7e35aa4e91b3f01f0847843263946e085944c3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2387563
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69715}

When the interface descriptor of a builtin uses DEFINE_JS_PARAMETERS, the extra stack arguments must be positioned just above the return address, otherwise we would need to calculate its offset depending on the actual number of the arguments, we currently use a fixed offset to access them in CSA.

Therefore, these extra arguments are either the first arguments when V8_REVERSE_JSARGS is enabled or otherwise the last arguments.

Change-Id: If38ac7fd7f0079fc0e4fdccdb6cfb26e0425eb84
Bug: v8:10825
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2379854Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69714}

Normalize the target object if we're guaranteed to end up in
dicionary mode after copying over all enumerable properties from the
source object.

This partially addresses performance issues when using the spread
operator on large dict-mode objects.

Change-Id: I5be7cbc6e6a7e4b1b59412779db9b651f5f68b45
Bug: v8:10763
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2362961Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69713}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/2b8377b..fc95b89

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: Ic59889e29560c4a2d8b91fbe04e4fd1101f4b924
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2394857Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#69712}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/a9ca728..2b8377b

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/5dba9c9..a070dd1

Rolling v8/third_party/zlib: https://chromium.googlesource.com/chromium/src/third_party/zlib/+log/59187e1..aec16ef

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I03c0e9bb1562243c059175d4e09cb5b03655a7fa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2393889Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#69711}

Port 5c0f7219

Original Commit Message:

    The 64-bit instruction selectors check whether the input value to
    a ChangeUint32ToUint64 node was produced by a node that sets the upper
    32 bits to zero, and if so, they avoid emitting an extra instruction to
    clear the upper bits. This change:

    1. Extends that existing mechanism to also include phi values: if all of
       the inputs to a phi value guarantee that the upper 32 bits are zero,
       then the phi value does too.
    2. Updates x64 to include non-negative int32 constants in the list of
       nodes that always clear the upper bits. I didn't add this to any
       other architecture because I'm less certain of how they resolve moves
       from constants.

    This change improves the speed of the Mono interpreter on x64 by about
    5%.

R=seth.brenith@microsoft.com, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: Ic515a254025b518c767fb64c5b1282cdf226f5ff
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2393742Reviewed-by: Seth Brenith <seth.brenith@microsoft.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#69710}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/7cbd827..a9ca728

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/56048e6..5dba9c9

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: Ic9a9215b971e8e2de9eeb5d8d2f58972c49a24a5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2393535Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#69709}

Bug: chromium:1124085
Change-Id: I92bea75caad4ffc99d3890440295115f6d65e849
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2393216Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Reviewed-by: Nico Weber <thakis@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Auto-Submit: Zequan Wu <zequanwu@google.com>
Cr-Commit-Position: refs/heads/master@{#69708}

Some comparison ops are missing from the list, so an incorrect
replacement type was set on those instructions.

Bug: v8:10507
Change-Id: I1ebee298261a33863fe09e62e94336a792966a47
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2393099Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69707}

The 64-bit instruction selectors check whether the input value to
a ChangeUint32ToUint64 node was produced by a node that sets the upper
32 bits to zero, and if so, they avoid emitting an extra instruction to
clear the upper bits. This change:

1. Extends that existing mechanism to also include phi values: if all of
   the inputs to a phi value guarantee that the upper 32 bits are zero,
   then the phi value does too.
2. Updates x64 to include non-negative int32 constants in the list of
   nodes that always clear the upper bits. I didn't add this to any
   other architecture because I'm less certain of how they resolve moves
   from constants.

This change improves the speed of the Mono interpreter on x64 by about
5%.

Bug: v8:10606
Change-Id: Ife8ce9c7330524e0b2fad836209a81180b4870e8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2382509Reviewed-by: Bill Budge <bbudge@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#69706}

Functions with v128 in their signatures are always lowered to 4 word32.
So if a return happens to be have an input that is a f32x4 operation, we
get a register allocator error because it tries to fit a float into a
general register. To fix that we need to do some checks when lowering
kReturn, and for each input node, if we are returning a v128, and it is
to be lowered into 4 f32 nodes, we bitcast the floats to ints.

Bug: v8:10507
Change-Id: Iea2fdfc4057304ebf0898e6f7091124629c589f0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2391331
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69705}

Tests do not expect concurrent allocation and are simply skipped in that
configuration.

Bug: v8:10315
Change-Id: Ia371efa3c27e1f8b76fab47abcce2d7c218224bc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2390774Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69704}

This reverts commit 825c61d8.

Reason for revert: Processing interrupts triggers a DisallowHeapAllocation scope failure.

Original change's description:
> Check interrupts in runtime BigInt parser
> 
> The BigInt constructor has quadratic complexity while parsing strings,
> and the input is unbounded. Interrupts should be checked during this
> operation to ensure the host has control over runaway execution.
> 
> Change-Id: I15db9adeeafadc7b866a395dd8263aa8c2109ce8
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2384166
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69679}

TBR=jkummerow@chromium.org,leszeks@chromium.org,marcel@laverdet.com

Bug: chromium:1124477
# Not skipping CQ checks because original CL landed > 1 day ago.

Change-Id: I1ba8c1de1f809f71a1c4fae9b56a8bd40f9f7e7f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2392815Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69703}

We are comparing equals to 0, we can remove this equality comparison,
and invert the phi outputs. This saves 1 op/node for every lowered
comparision.

Bug: v8:10824
Change-Id: I4957bed635c34d47fff98c5556ab55754d3fd91e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2391911Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69702}

There are some objects that are serialized with concurrent inlining off
even when they are part of HEAP_BROKER_NEVER_SERIALIZED_OBJECT_LIST.

Bug: v8:7790
Change-Id: I91aa0e9d93cf86e2765f1f56bcfb8456c4b7685e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2382310
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69701}

The generic wrapper can be used for Wasm functions with int32 parameters
and 0 or 1 int32 return values.

Added tests for cases when the return value can & cannot be converted to
a Smi.

Bug: v8:10701
Change-Id: I470954ed0aced0e4ec6e65a9f38caac19c576549
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2390141
Commit-Queue: Eva Herencsárová <evih@google.com>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69700}

Do not use the already existing always_allocate() method for allowing
all allocations after tear down was started. Use explicit checks
of gc_state() == TEAR_DOWN instead.

This ensures that background threads extend the heap beyond its limits
only when tearing down the isolate. always_allocate() is also used
during regular execution in C++ code.

Bug: v8:10315
Change-Id: I66b5bfb06fa854048f37305a5d0cb7d60fadb30f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2390764
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69699}

PagedSpace::CommittedPhysicalMemory() needs to use mutex when iterating
chunks due to concurrent allocations.

Also reorder sampling of memory statistics according to this order:

1) used memory
2) committed physical memory
3) committed memory

That way, used <= committed physical <= committed should hold.

Bug: v8:10315
Change-Id: Ie922ecc4846f724a09c71667a898bf74a8652220
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2390768
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69698}

Port: a2fd94f0

Change-Id: I174ef5523806d23a0425e546ffe557b2c21defe7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2390828Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#69697}

HeapWithPointerCompressionTest.HeapLayout sometimes raced with
background threads. When iterating chunks, background threads might add
chunks concurrently. Prevent this by enforcing safepoint during
iteration.

Bug: v8:10315
Change-Id: I2852ec3ea18905b669e60eadc660d9343ea35f48
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2390767
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69696}

There is an int version that will be TNodified in a follow-up CL.

Bug: v8:9708, v8:6949
Change-Id: I3a47cb352396dfe9dea426b6396216c06e0e3254
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2387963
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69695}

This is a reland of 9eb090d2

The android-pie-arm64-dbg compiler error was fixed in:
https://chromium-review.googlesource.com/c/v8/v8/+/2381450

Original change's description:
> [heap] Add concurrent typed slot recording
>
> Since the typed slot set is not thread-safe, each concurrent marking
> barrier collects typed slots locally and publishes them to the main
> typed slot set in safepoints.
> Bug: v8:10315
>
> Change-Id: If1f5c5df786df88aac7bc27088afe91a4173c826
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2370302
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69576}

Bug: v8:10315
Change-Id: Iae2882bad1cd0ffcae28c96318ba5fd7937f2215
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2390763Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69694}

Tests that use SimulateFullSpace and SealCurrentObjects do not work
if there is a background thread allocating concurrently.

Bug: v8:10315
Change-Id: I73a4c9db8eb32fdf3e07fcb8f5dda309de797709
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2390765Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69693}

This used to break x64 no embed bot due to it being Large code objects
but no embed no longer exists so this isn't a problem anymore.

Bug: v8:9708, v8:6949, v8:9637
Change-Id: I83836a94ff1747841315d46ca0e7ec5c73bbaf0d
Fix: v8:9637
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2387962Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69692}

ManualGCScope is used in tests that perform GC manually. Stressing
concurrent allocation interferes with that and may trigger more GCs
than the test expects.

Bug: v8:10315
Change-Id: I6705f0b7cc555074b319a41d29810936b5a2a556
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2392242Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69691}

This is a reland of 453cf219

Original change's description:
> [compiler] Add a StartNode wrapper class
>
> .. to make implicit semantics of output nodes explicit.
>
> Bug: v8:8888
> Change-Id: I2ea5f5fa02f3d1f51196ea1e1e46b526dd9dc7d6
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2388117
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69681}

Tbr: tebbi@chromium.org
Bug: v8:8888
Change-Id: I7ff3fc64c607a5289981a0762ad3a2b1de5a284d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2392241
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69690}

JSFunctions with an attached InterpreterEntryTrampoline should also be
reset to CompileLazy, but this was recently broken by
https://crrev.com/c/2345966.

This CL introduces a new JSFunction::CanDiscardCompiled helper to
mirror SFI::CanDiscardCompiled, and uses it during serialization.

Bug: v8:10869
Change-Id: I176b77278d2d40d34db671638232faec4dda1d9c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2390145Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69689}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/6d55754..7cbd827

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/156bfc1..8584a9d

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/ed15af5..56048e6

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I64ddc2caa6feae1432aa3a7cba4e854de98acf38
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2391803Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#69688}

Due to the way SSE flags work, we need to enable all versions prior to
SSE 4.1 as well.

Bug: v8:10863
Change-Id: I50ddd3f486641e7bf22c651fc2c9a8a4ccbc2b46
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2391325Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69687}

The type of m is long in 64 bits build, and results implicit conversion
loses integer precision, which was found by improved clang warning
(-Wshorten-64-to-32)

Bug: chromium:1124085
Change-Id: Ic9f22508bd817a06d5c90162b1ac3554a7171529
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2391323
Commit-Queue: Zequan Wu <zequanwu@google.com>
Auto-Submit: Zequan Wu <zequanwu@google.com>
Reviewed-by: Nico Weber <thakis@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69686}

This was added to try and skip tests when run on platforms without
sse41, but it doesn't work fuzz tests, since they add the flags on
command line. With https://crrev.com/c/2389982 we are now adding the
flag in the js test file itself.

Remove this condition since it's likely to be confusing and not work
correctly for all tests.

Bug: v8:10863
Change-Id: Ieeadade05dfc04ce250710d09a6a272775ce98c9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2391321Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69685}

With https://crrev.com/c/2389982 we are now forcing the sse flag in this
test, so we no longer need the flag check. Keep it around for the other
archs.

The nosse41 condition will be removed from the test runner in the next
patch.

Bug: v8:10863
Change-Id: I7eacb21803e6cc810384d3e4881d2a965dc1ad69
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2391320Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69684}

- JobHandle::IsCompleted()
- JobDelegate::GetTaskId()
- worker_count passed as argument to GetMaxConcurrency().
  Jobs implementation must call the new GetMaxConcurrency(), but Jobs
  users aren't migrated yet.

Bug: chromium:1114823
Change-Id: Ie09a8847d1cb884b1e388903370e49f33fa25a64
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2374308Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Etienne Pierre-Doray <etiennep@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69683}

This reverts commit 453cf219.

Reason for revert: Multiple compile errors, e.g. https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20debug%20builder/45301

Original change's description:
> [compiler] Add a StartNode wrapper class
> 
> .. to make implicit semantics of output nodes explicit.
> 
> Bug: v8:8888
> Change-Id: I2ea5f5fa02f3d1f51196ea1e1e46b526dd9dc7d6
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2388117
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69681}

TBR=jgruber@chromium.org,tebbi@chromium.org

Change-Id: Ic81321960da36e8ddcdc8e0072b2e9cd41206478
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:8888
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2390646Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69682}

.. to make implicit semantics of output nodes explicit.

Bug: v8:8888
Change-Id: I2ea5f5fa02f3d1f51196ea1e1e46b526dd9dc7d6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2388117
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69681}

Pass this flag to print all generated nci code.

Bug: v8:8888
Change-Id: I12a5e7433278c72da4a973c5890b2fb2d7857e70
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2388115
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69680}

The BigInt constructor has quadratic complexity while parsing strings,
and the input is unbounded. Interrupts should be checked during this
operation to ensure the host has control over runaway execution.

Change-Id: I15db9adeeafadc7b866a395dd8263aa8c2109ce8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2384166Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69679}

Bug: v8:10641
Change-Id: I9248c6877ead34e622b94cd32959b6570f824e15
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2390442Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Auto-Submit: Jeremy Roman <jbroman@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69678}

During spread operation, after VisitForAccumulatorValue,
set the position of the current expression again

Bug: chromium:929844
Change-Id: I6e9ca87587789f9cb21e939d4405414c8170b232
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2379531
Commit-Queue: HyeockJin Kim <kherootz@gmail.com>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69677}