With lazy feedback allocaiton functions may not have feedback vectors.
This causes crashes with clusterfuzz when it uses OptimizeOSR without
ensuring feedback vector. This cl ensures we have a feedback vector
before OSRing.

Bug: v8:8394
Change-Id: I5470c45cec2f6916d142f3bb4a385737083de25c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1611809
Auto-Submit: Mythri Alle <mythria@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61568}

NOTRY=true

Bug: v8:9260
Change-Id: I818e69bb69ba88835a6cc6934263f48dfdbe22c4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1615178Reviewed-by: Sergiy Belozorov <sergiyb@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61567}

This stores a type alias in the global class list, so we can get
to the declarable and figure out namespace / file.

R=szuend@chromium.org

Bug: v8:7793
Change-Id: I2164b77e559d28fa18da12192a34e0a7264b858e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1613989
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61566}

This is a reland of 91415227

Original change's description:
> Add test to show the crashing of TimeZone::AdoptDefault
> 
> The ICU DEPS for chromium is landing in
> https://chromium-review.googlesource.com/c/chromium/src/+/1607506
> 
> Bug: chromium:950851
> Change-Id: If16e82d70c319108ead06dd095b22ecda5408a6b
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1601370
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Frank Tang <ftang@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#61550}

Bug: chromium:950851
Change-Id: I427eba86bb5d4017a43b6767a1da4280d87297eb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1613896Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61565}

Bug: v8:7793
Change-Id: I390b4b5e1f486c53c122f7ebf8dd4106c9bbd10e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1607650
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61564}

This changes the contract of the CallFunctionTemplate builtins such that
the receiver must always be a JSReceiver, which simplifies the logic and
also makes it possible to have TurboFan completely optimize away the
ConvertReceiver operation, while at the same time ensuring that we
always pass the correct receiver to API functions.

Bug: chromium:961199, v8:8820
Change-Id: Ied9dee3f504bd5b711c29f1e2c00f0434c731d19
Cq-Include-Trybots: luci.chromium.try:linux-rel,win7-rel
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1611803
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61563}

This reverts commit e7e512da.

Reason for revert: chromium:963687, chromium:963731

Original change's description:
> [turbofan] Add fast path for single-character String#startsWith()
>
> This CL adds a fast path to String#startsWith(s) if s is a
> single character string.
>
> Bug: v8:8400
> Change-Id: Ibd6a9d1e46d98f41c198d2b579208e25003eedb0
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1525362
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
> Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#61504}

TBR=sigurds@chromium.org,bmeurer@chromium.org,usharma1998@gmail.com

Change-Id: Ie09a96557102063ab15c3900563cf16ec57a47e3
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:8400
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1614605Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61562}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/9f8db49..333f822

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/578d0b9..d84db82

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/b77f2db..99fe071

TBR=machenbach@chromium.org,sergiyb@chromium.org,tmrts@chromium.org

Change-Id: I60fc4ec964c581a96fd17ef65139cb6654d3bfcf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1614276Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#61561}

Performance impact measured by
$ python -u tools/run_perf.py --binary-override-path \
    out/x64.release/d8 --filter "JSTests/Intl"  \
    test/js-perf-test/JSTests5.json

Look for NewIntlLocaleWithOptions-Intl & NewIntlLocale-Intl (3 runs):
BEFORE . 465 / 473 / 438                 1717 / 1677 / 1719
AFTER    553 / 520 / 463                 2706 / 2530 / 2758
Speed up      x1.12                            x1.56

Bug: v8:9121

Change-Id: I0f88a712203639972c0c90fcfc0a89f01da90d73
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1570581Reviewed-by: Frank Tang <ftang@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61560}

This is a reland of d61a9347

6th attempt. Relanding after fixing TSan/UBSan issues.

Original change's description:
> [ptr-compr][x64] Temporarily enable pointer compression on x64
>
> ... and make sure that the x64 ptr-compr bots proceed testing V8 without
> pointer compression in order to keep testing the full pointer mode.
>
> Bug: v8:7703
> Change-Id: Ib1498609603cb03be2464043658131d5a2f1e012
> Cq-Include-Trybots: luci.v8.try:v8_linux64_ubsan_rel_ng,v8_linux64_tsan_rel
> Cq-Include-Trybots: luci.chromium.try:fuchsia_x64,linux-rel,mac-rel
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1559850
> Commit-Queue: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#61416}

Bug: v8:7703
Change-Id: I1fa0989aef9ea08e54fd6dfd32d6989367332ce3
Cq-Include-Trybots: luci.v8.try:v8_linux64_ubsan_rel_ng,v8_linux64_tsan_rel
Cq-Include-Trybots: luci.v8.try:v8_linux64_cfi_rel_ng
Cq-Include-Trybots: luci.chromium.try:fuchsia_x64,linux-rel,mac-rel
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1607654
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61559}

Bug: v8:8996
Change-Id: I712f7eea934581f8d0889889a8737548ef8fa255
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1611752
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Peter Wong <peter.wm.wong@gmail.com>
Cr-Commit-Position: refs/heads/master@{#61558}

R=bmeurer@chromium.org, clemensh@chromium.org, jkummerow@chromium.org, sigurds@chromium.org, ulan@chromium.org, verwaest@chromium.org

Bug: v8:9247
Change-Id: I153a6bbfc55989fe7a86c052f95c5cb8ee61e841
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1613244
Commit-Queue: Yang Guo <yangguo@chromium.org>
Auto-Submit: Yang Guo <yangguo@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61557}

This change adds a flag v8_enable_fast_torque, which follows the pattern
of v8_enable_fast_mksnapshot and can improve build times by running an
optimized Torque compiler during debug builds. On my machine, this
change improves rebuild time after changing a .tq file by about 7
seconds.

Change-Id: I7c91d1059c614fe34eefe7ee8c3cba7c931d5a50
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1612160
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61556}

R=danno@chromium.org

Bug: v8:9247
Change-Id: I0541f68d4a285df0bdae4ef8b8ee7698f897c4ce
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1612901
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Daniel Clifford <danno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61555}

This reverts commit 91415227.

Reason for revert: This fails on multiple bots, infra bug let this land - https://logs.chromium.org/logs/v8/buildbucket/cr-buildbucket.appspot.com/8913373605803837584/+/steps/build/0/steps/compile/0/logs/raw_io.output_failure_summary_/0

Original change's description:
> Add test to show the crashing of TimeZone::AdoptDefault
> 
> The ICU DEPS for chromium is landing in
> https://chromium-review.googlesource.com/c/chromium/src/+/1607506
> 
> Bug: chromium:950851
> Change-Id: If16e82d70c319108ead06dd095b22ecda5408a6b
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1601370
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Frank Tang <ftang@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#61550}

TBR=adamk@chromium.org,jkummerow@chromium.org,jshin@chromium.org,mathias@chromium.org,ftang@chromium.org

Change-Id: I682119db77c569ad7b619375e54309a4ff530273
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:950851
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1613697Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61554}

This reverts commit 3e118baf.

Reason for revert: Reverting as ftang@'s CL here will be reverted. 
https://chromium-review.googlesource.com/c/v8/v8/+/1601370, and this was a fix for a bad landing.

Original change's description:
> Update include path to date.h which was moved in the meanwhile
> 
> No-Presubmit: true
> No-Tree-Checks: true
> No-Try: true
> Bug: chromium:950851
> Change-Id: Ia5e547e7cd7947f91814cb24de3dcf3b822905da
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1611811
> Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
> Commit-Queue: Igor Sheludko <ishell@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#61552}

TBR=gdeepti@chromium.org,ishell@chromium.org

Change-Id: Ibe1671b1973afae8db6180d3f5471763786bd23d
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:950851
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1613637Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61553}

No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:950851
Change-Id: Ia5e547e7cd7947f91814cb24de3dcf3b822905da
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1611811Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61552}

Somehow the "bad" CL managed to pass the CQ:
  https://chromium-review.googlesource.com/c/v8/v8/+/1484461

No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Change-Id: I86d78f75c3430d01c814948815c7b3501929a52a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1611810Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61551}

The ICU DEPS for chromium is landing in
https://chromium-review.googlesource.com/c/chromium/src/+/1607506

Bug: chromium:950851
Change-Id: If16e82d70c319108ead06dd095b22ecda5408a6b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1601370Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61550}

Bug: v8:9153
Change-Id: I48adc554736b19507da318a157ef2f23bf7cbd52
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1610216Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61549}

Permit individual calls to CpuProfiler::StartSampling to provide their
own requested sampling interval, to be snapped to the profiler's
sampling interval. Use the greatest common divisor of all sample rates
to determine what sample rate should be chosen for the sampling thread,
and dispatch samples to attached profilers based on their requested
sample periodicity.

Change-Id: I0b076d09761d7176f31725e112578b68ab5da54c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1484461Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Alexei Filippov <alph@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Andrew Comminos <acomminos@fb.com>
Cr-Commit-Position: refs/heads/master@{#61548}

Additionally pass WriteBarrierMode while building the object

Change-Id: Ibc8ad592f822ee3b046406013cc36ae64f6b099b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1613251Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61547}

Refactor CheckHasTrapResult as well.

Spec: https://tc39.github.io/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-hasproperty-p
Bug: v8:6664
Change-Id: Iaa9c1cb46ab4f7c8139dfe1380b3ec807a4719ee
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1610215Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#61546}

Bug: v8:6831
Change-Id: If3084304b4759f0c1a6e930d66a45f6c9d51eabd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1612166Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#61545}

The main change here is that in isolate-data.h, I'm switching from stateJSON to state.
This routine returns a CBOR encoded state cookie, which is also what we already
use in Chromium (blink).

In inspector-test.cc, I then put this byte vector into a V8 String,
and to make this roundtrip, change the extraction routine to get the
bytes. It's a little weird to store arbitrary bytes inside a v8 string,
but it appears to work fine because these bytes end up in the 8 bit portion,
much like isolatin characters would.

Change-Id: I72a0bdefd85a290f4e91db79be67d86952831685
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1610478Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Alexei Filippov <alph@chromium.org>
Commit-Queue: Johannes Henkel <johannes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61544}

NOTRY=true

Bug: v8:9257
Change-Id: I4713fd90c2a8b544def09d7305fe84d789ed60c4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1613250
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61543}

R=ishell@chromium.org

Bug: v8:7703
Change-Id: Iba0ad7d6c6e9c772fc9d9bc081b0c2bf31e23565
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1613249Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61542}

Bug: v8:9247
Change-Id: Idb67869f3562e8afc7a744a939402db82bdb1bbd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1611806
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Auto-Submit: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61541}

All macros defined in "format-macros.h" are dead now (after
https://crrev.com/c/1613243). This CL removes this header, and includes
<cinttypes> instead wherever we use format macros for the types defined
in <cstdint>.

Plus some drive-by cleanup of includes.

R=mlippautz@chromium.org

Bug: v8:9183
Change-Id: Ic379759b79edb50e38833defb1577cc3af7c8150
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1611800
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61540}

Internalizing is useful if we expect the string to reoccur many times.
Internalizing too long strings will cost due to hashing, and the resulting
strings will be kept alive for longer. Drop the limit to 10 to be more
conservative.

Change-Id: I2ac2109ca03ab05dbc5c01d4efe6f912b12f65b7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1611805
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61539}

Use feedback from adjecent array elements to speed up object creation.

Change-Id: Ib5c1b07cc63afb1a4b0cf194144a0ecd31139cb6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1612898
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61538}

This CL adds a check and a more descriptive error message when no "map"
is passed when constructing an extern class:

extern class Foo extends HeapObject {...}
const f = new Foo {};

R=sigurds@chromium.org

Bug: v8:7793
Change-Id: I0dfa6d5976e98d572bafcf7a87f701ea97cd6a73
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1611804
Commit-Queue: Simon Zünd <szuend@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61537}

The 'z' length modifier for {size_t} in format strings was introduced
with C99, hence it is available in all environments we support.

R=jgruber@chromium.org, mlippautz@chromium.org

Bug: v8:9183
Change-Id: I1bc2abec3f9c7b38186128202fef4719853de7d4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1613243Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61536}

Add torque implementation of GetDerivedMap

Bug: v8:9240
Change-Id: I9f2203f5c79fad84f67894c9cbaf28e6f7685f58
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1609804
Commit-Queue: Nico Hartmann <nicohartmann@google.com>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61535}

This CL adds support for all kinds of Types to "textDocument/symbol"
requests. While LSP has support for classes and structs, it does not
have support for generic types. Only classes are marked as such,
while all other types are marked as structs in terms of the LSP.

Special care has to be taken with TypeAliases. Generic call sites
introduce a new scope (similar to namespace scopes), where new
TypeAliases are created for Generic type arguments. These TypeAliases
then point to the specialized type inside this call-site specific
scope. To omit the specialized TypeAliaes from the symbols list,
they are marked using the "is_user_defined" flag.

R=sigurds@chromium.org

Bug: v8:8880
Change-Id: I576d1c677a5255d54f7774aa053f431608a4cd0c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1613240
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Auto-Submit: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61534}

This avoids the need to throw range errors when we run out of stack, limiting
us only by available memory.

The main parser loop is implemented by two subloops.

The first subloop finishes whenever it generates primitive values, empty
arrays, or empty objects. If a non-empty object or array is started, the loop
continues to parse its first member.

The second subloop consumes produced values and either adds them to the parent
array or object, or returns it. The second loop finishes whenever a next value
needs to be produced. When the loop itself produces a finished array or object,
the loop continues.

Exceptions are handled by moving the cursor to end-of-input. Upon end-of-input,
the first loop sets the continuation to "kFail". That causes the second loop to
tear down continuation stack and related handle scopes, resulting in an empty
handle.

The CL additionally buffers all named properties and elements so we can
immediately allocate a correctly shaped object. For object elements we'll take
flat array or dictionary encoding depending on what is more efficient.

This means that element handles are now allocated in their parent HandleScope,
rather than having local handlescopes per-property (of big objects); which is
why I've adjusted the handle-count test to not allocate as many properties. In
the future it would be nice to not have to allocate (as many) handles since
almost everything in the JSON graph will survive JSON parsing...

Bug: chromium:710383
Change-Id: Ia3a7fd0ac260fb1c0e5f929276792b2f8e5fc0ca
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1609802Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61533}

R=bmeurer@chromium.org, ishell@chromium.org, jshin@chromium.org, ulan@chromium.org

Bug: v8:9247
Change-Id: I67b591b613dd066f441e63fd61952728f4036636
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1613247Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61532}

Bug: v8:9247
Change-Id: I404e34a013b95c6a7cf03dd9ec0732d9ad796bdc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1613238
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61531}

This is a reland of 200a594a.
The failing DCHECK was wrong, which is fixed now.

Original change's description:
> [wasm][gc] Reenable discarding system pages
>
> On windows, the range to be discarded needs to be split by the
> reservations, analogous to committing. This CL reuses the same logic,
> and reenables discarding pages on all platforms.
>
> R=mstarzinger@chromium.org
>
> Bug: v8:8217
> Change-Id: I11716d6381f765bdfe4cf48502b5cdc1f42cf8ab
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1611682
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#61526}

Bug: v8:8217
No-Try: true
Change-Id: I293c638a5bc4678591a9c02704770ab54af39bdb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1613248
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61530}

Bug: v8:8880
Change-Id: I5bd99ca56dfafa71718b12078224bdc90bcfed14
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1613246
Commit-Queue: Nico Hartmann <nicohartmann@google.com>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61529}