Fix delegation to the specific slow-path bailout.

Note: This was not an issue in Blink production code but only when
using `cppgc_enable_object_names = true`.

Bug: chromium:1056170
Change-Id: I00db63f015b60ac2ccd9f80eca80728bc78e9187
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3144911Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76692}

This is a reland of 4936628e

Original change's description:
> [wasm][eh] Ship exception handling
>
> R=ahaas@chromium.org
> CC=ecmziegler@chromium.org
>
> Cq-Include-Trybots: luci.v8.try:v8_linux_blink_rel
> Bug: chromium:1173515
> Change-Id: Id487ec32de7ec10ba1f61f77414565949b8d3dc7
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3138203
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#76672}

Bug: chromium:1173515, v8:12173
Change-Id: I61a216207e4aadfd00a716e3296af2f7c3e8df88
Cq-Include-Trybots: luci.v8.try:v8_linux_blink_rel
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3141609Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76691}

Bug: chromium:1136844
Change-Id: I635978a308eed2be33c1147f8007abb199bf195e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3143998Reviewed-by: Almothana Athamneh <almuthanna@chromium.org>
Reviewed-by: Liviu Rau <liviurau@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76690}

We introduce basic wasm inlining infrastructure behind a flag. The
implementation is currently incomplete. Additionally, we always inline
the function at index 0; proper inlining heuristics will be added later.

Changes:
- Rename WasmInliningPhase -> JSWasmInliningPhase
- Introduce WasmInliningPhase and WasmInliner.
- Pass additional parameters as needed to GenerateCodeForWasmFunction.
- Remove EnsureEnd in WasmGraphAssembler. Create end node at the start
  of compilation.
- Add a simple test.

Bug: v8:12166
Change-Id: Ifd7006ba378e9f74cd248b71e16869fbbb8a82be
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3141575
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76689}

Port: 787bec09

Change-Id: I40055181a3b14929559672845215ec560906ca8a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3144790
Auto-Submit: Liu yu <liuyu@loongson.cn>
Reviewed-by: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/main@{#76688}

No-Try: true
Bug: v8:12172
Change-Id: I4bace3c91e71e4529ac8d75df3297036c6ca9756
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3141588
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76687}

... by only depending on "relevant" results for predicates.

Bug: v8:7790, v8:12173
Change-Id: I60b33a3a05197ca7e6d6a36e85c63fd7a48ee931
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3143994Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76686}

... as the main thread might change its contents.

Bug: v8:12174, v8:7790
Change-Id: I66b2cafc7ddc9b387223693595a9d810b272d7b9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3141586Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76685}

Rolling v8/third_party/google_benchmark/src: https://chromium.googlesource.com/external/github.com/google/benchmark/+log/45b194e..4f80705

COnsole reporter: if statistic produces percents, format it as such (#1221) (Roman Lebedev)
https://chromium.googlesource.com/external/github.com/google/benchmark/+/4f80705

TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com,mlippautz@chromium.org

Change-Id: I7461c9450c75ad308d26ab478b0d5cc6e5303a64
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3144353Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#76684}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/c6c14d2..03a089b

TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I2e17cd400ac5a22a977d78d29e35e223488c41c5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3142000Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#76683}

Change-Id: I1937469fdd3aed9cba6ef13b22c5d6f507df4174
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3144114
Commit-Queue: Yahan Lu <yahan@iscas.ac.cn>
Commit-Queue: Ji Qiu <qiuji@iscas.ac.cn>
Auto-Submit: Yahan Lu <yahan@iscas.ac.cn>
Reviewed-by: Ji Qiu <qiuji@iscas.ac.cn>
Cr-Commit-Position: refs/heads/main@{#76682}

Bug: v8:12180
Change-Id: Id3cc3a78da73b10854fd21f2760b25de91ca5966
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3143811Reviewed-by: Ji Qiu <qiuji@iscas.ac.cn>
Commit-Queue: Ji Qiu <qiuji@iscas.ac.cn>
Cr-Commit-Position: refs/heads/main@{#76681}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/db65769..c6c14d2

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/4b2a96e..d579cbc

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/403247e..749fd8e

Rolling v8/tools/luci-go: git_revision:7f42370cb3b75398bdb9ae0aabe215a70d40cd31..git_revision:3e1f1f7a109ed8aefc7feba94fa737f0b5b4847e

Rolling v8/tools/luci-go: git_revision:7f42370cb3b75398bdb9ae0aabe215a70d40cd31..git_revision:3e1f1f7a109ed8aefc7feba94fa737f0b5b4847e

Rolling v8/tools/luci-go: git_revision:7f42370cb3b75398bdb9ae0aabe215a70d40cd31..git_revision:3e1f1f7a109ed8aefc7feba94fa737f0b5b4847e

TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I9dfca5f1aedb89819bb65458db57de42a0313eea
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3142337Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#76680}

In order to deprecate different default flags, this sets the flag
passed on the standard runner now also on numfuzz.

No-Try: true
Bug: v8:12177
Change-Id: I3fb6872643f5bfad71362f22a804d22907641c84
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3143992Reviewed-by: Almothana Athamneh <almuthanna@chromium.org>
Commit-Queue: Almothana Athamneh <almuthanna@chromium.org>
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76679}

We need to check whether ephemeron key is fully constructed to sync the
mark bit before checking it.

Bug: chromium:1246730
Change-Id: I3ba69898202c1df94833a0bc7442b2be0e61694e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3143993Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76678}

Update the behavior of 'delegate' according to:
https://github.com/WebAssembly/exception-handling/issues/176

Summary: delegate can target any block, which just rethrows to the next
outer try/catch.

R=clemensb@chromium.org

Bug: v8:8091
Change-Id: I967db9ab1cbb1a15b2c5e0a1a20f64fa19a3f769
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3140603
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76677}

Bug: v8:11954
Change-Id: I4886109edf5a732736051205076bed78fe78d5e2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3141582
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76676}

Remove the BaselineData intermediate structure for baseline code, and
write the baseline Code object into the SharedFunctionInfo directly. We
still need a pointer to the BytecodeArray/InterpreterData, so re-use the
Code object's deoptimization data slot for this (baseline code doesn't
have deoptimization data).

A consequence of this is that the BytecodeArray pointer becomes
immutable when there is baseline code. This means that we cannot install
a debug BytecodeArray while baseline code is active (we have to flush it
first), and we can't tier-up code with debug BytecodeArray to baseline.

Change-Id: I53b93ec4d4c64b833603d7992f246982fcd97596
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3118548
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76675}

This reverts commit 4936628e.

Reason for revert: Seems to be making completely unrelated tests flake: https://crbug.com/v8/12173

Original change's description:
> [wasm][eh] Ship exception handling
>
> R=​ahaas@chromium.org
> CC=​ecmziegler@chromium.org
>
> Cq-Include-Trybots: luci.v8.try:v8_linux_blink_rel
> Bug: chromium:1173515
> Change-Id: Id487ec32de7ec10ba1f61f77414565949b8d3dc7
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3138203
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#76672}

Bug: chromium:1173515
Change-Id: Ibc447a8d73f81d938f6ae378a684111611d9fde5
Cq-Include-Trybots: luci.v8.try:v8_linux_blink_rel
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3141604
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#76674}

Change-Id: Ib43602065122806e8cecc0fa810888f9d0ff52c8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3141603
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76673}

R=ahaas@chromium.org
CC=ecmziegler@chromium.org

Cq-Include-Trybots: luci.v8.try:v8_linux_blink_rel
Bug: chromium:1173515
Change-Id: Id487ec32de7ec10ba1f61f77414565949b8d3dc7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3138203Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76672}

Adds a USE(...) around a std::accumulate which appears to have nodiscard
on it in MSVC builds. Probably only manifests with debug flags on as
otherwise code is not compiled.

Change-Id: I78f4f2c07161598336fedcdd4a204379c4deb81b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3141579
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76671}

See https://github.com/nodejs/node/pull/39945

Bug: v8:11111
Change-Id: I7271a907bf036c18a014b2a13ff5746db622456a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3141581Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76670}

It works like --stress-concurrent-inlining but instead of throwing
away the produced code it attaches it to the function as usual. This
mode will be used for fuzzing.

Bug: v8:7790
Change-Id: I010cbb7ab7ec29fccfa561eaff72e66c7444239f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3140602Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76669}

.. another MakeRef vs. MakeRefAssumeMemoryFence spot.

Bug: v8:7790,chromium:1246465
Change-Id: I587538f5756896036aad5db4939a462c01d4cc2f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3141580
Commit-Queue: Georg Neis <neis@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76668}

The test should be enabled once reentrancy is supported.

Bug: v8:11382
Change-Id: Ifb90d8a6fd8bf9f05e9ca2405d4e04e013ce7ee3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3138201
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76667}

Bug: v8:12171
Change-Id: Icb50d5438f657f6d3c75cbc3409ccf6f1f880303
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3141263
Commit-Queue: Yahan Lu <yahan@iscas.ac.cn>
Commit-Queue: Ji Qiu <qiuji@iscas.ac.cn>
Auto-Submit: Yahan Lu <yahan@iscas.ac.cn>
Reviewed-by: Ji Qiu <qiuji@iscas.ac.cn>
Cr-Commit-Position: refs/heads/main@{#76666}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/adea09b..db65769

TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: Idbb6916b590967b86602005fe6a9836ec70f950e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3138947Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#76665}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/e5ab797..adea09b

TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I38b6465121760e5a5106abf71c38f53d87cad45e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3142953Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#76664}

Rolling v8/third_party/google_benchmark/src: https://chromium.googlesource.com/external/github.com/google/benchmark/+log/e7a8415..45b194e

Introduce Coefficient of variation aggregate (#1220) (Roman Lebedev)
https://chromium.googlesource.com/external/github.com/google/benchmark/+/45b194e

Statistics: add support for percentage unit in addition to time (#1219) (Roman Lebedev)
https://chromium.googlesource.com/external/github.com/google/benchmark/+/12dc5ee

report.py: adjust expected u-test values for tests (Roman Lebedev)
https://chromium.googlesource.com/external/github.com/google/benchmark/+/67b77da

TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com,mlippautz@chromium.org

Change-Id: Ide3df922b882bfc02510f8d763c9a9451d94955b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3142457Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#76663}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/5c32531..e5ab797

Rolling v8/buildtools/third_party/libc++abi/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi/+log/7de86cb..fc37619

Rolling v8/third_party/aemu-linux-x64: zV70YxspSldB66kzaPKeo6zR_1yozZLp4bpWWR8dWRQC..aSVGWUgGw-Nuh-08X80jtqA2bVKylBoNa1h7D-6Kzf0C

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/8d07f5a..4b2a96e

TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: If8834859c1e21cb6a6ed7bde6d84d8f4f2cc9bbf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3142452Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#76662}

We use BuildCCall over CallBuiltin. This improves the performance of
array.copy by up to 2x for small arrays.

Bug: v8:7748
Change-Id: Ibbd6a69267edb229beda1f6de4ff1c48eb38b729
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3135580
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76661}

The WebAssembly.Table constructor supports a second parameter that was
not supported by V8 so far.

R=thibaudm@chromium.org

Bug: v8:7581
Change-Id: Id74c53a6b1bde7f49a4edea8397d1cab253e1a0e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3141571
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76660}

HeapBase::Terminate must consider newly created CrossThreadPersistent
when evaluating whether to conitnue the loop. This allows for catching
one off creations in destructors but will still crash for
>kMaxTerminationGCs chains.

Bug: chromium:1245519
Change-Id: I264f1b8f0de9f0bfeb66ca6b14c41faf15e4340c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3140606
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76659}

Before this patch, both key and value of an ephemeron pair was always
considered to be GarbageCollected objects.

This patch adjusts the snapshotting mechanism to accomodate that
values may not be GarbageCollected objects and must thus be eagerly
traced for visibility and edge creation.

In practice this only shows up in Blink when associating an existing
wrappable with a wrapper in a non-main world, e.g., through an
extension. In this case, DOMWrapperMap keeps the wrapper value through
a TracedReference in the ephemeron map with the existing wrappable as
key. The semantics are intended to be general ephemeron semantics,
i.e., value needs to be kept alive when the key is alive.  This is
visualized in DevTools as the main wrapper/wrappable pair (which is
merged into a single node for the snapshot) retaining the non-main
world wrapper.

Bug: chromium:1245894
Change-Id: Ibfa6722f20c76f94c310f9a040f0d3d4b9083bbb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3140601Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76658}

R=thibaudm@chromium.org

Change-Id: Id123af24456ee6a6388085e9168766f45321fa49
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3141570Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76657}

PretenureAllocationSite didn't check whether the given object is in new
space or not. Once given an object in old space, PretenureAllocationSite
tried to find a memento for it which didn't exist and crashed.

This CL adds a bailout for objects not in new space as there is no
memento and nothing to be done.

Bug: chromium:1244333
Change-Id: Ic26a6f5994ef9942decda69bb8a23fb730bf945c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3140604Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76656}

After concurrent inlining is true by default we keep testing the
negated version on the main linux bots and drop testing the
variant on FYI, which is a no-op now.

Bug: v8:7790
Change-Id: I604838a45f3de242db82b42b93afdb56804152b5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3140599
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76655}

ParserBase::ParseClassLiteral and BaseConsumedPreparseData::RestoreDataForScope
both declare the class variable, but the logic is so complex
that they sometimes ended up both declaring it.

This is further complicated by some of the variable values (esp.
inner_scope_calls_eval_) potentially changing in between, so we can't
just redo the same logic any more.

Forcefully make it work by making RestoreDataForScope declare the variable
iff ParseClassLiteral didn't.

Bug: chromium:1245870
Change-Id: I777fd9d78145240448fc25709d2b118977d91056
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3140596
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76654}

.. since it is now enabled by default.

Bug: v8:7790,v8:12142
Change-Id: Ia13e5ef9c1224b02dfe635c5fcd91e7a0346f5ff
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3138196Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76653}