... when external code space is enabled.

Bug: v8:11880, v8:12689
Change-Id: I0efa09a27d636df3d36d2da13ac26c7f2fedb94c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3650744Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80594}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/1c34f36..5b615fa

Rolling v8/buildtools/third_party/libc++abi/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi/+log/ecff200..b682786

Rolling v8/buildtools/third_party/libunwind/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind/+log/3d54d41..44c86bb

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/d1ddc12..ecd2da3

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/31bfd51..8fb649c

Rolling v8/third_party/fuchsia-sdk/sdk: version:8.20220510.2.1..version:8.20220516.3.1

Rolling v8/third_party/jsoncpp/source: https://chromium.googlesource.com/external/github.com/open-source-parsers/jsoncpp/+log/9059f5c..42e892d

Rolling v8/third_party/zlib: https://chromium.googlesource.com/chromium/src/third_party/zlib/+log/9979c19..7085d03

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/9da9510..56af55b

Rolling v8/tools/luci-go: git_revision:2aa3d7e5e8662c5193059a490f07b7d91331933e..git_revision:d3db74920e35147955be43f62b5f4ed0cf84c614

Rolling v8/tools/luci-go: git_revision:2aa3d7e5e8662c5193059a490f07b7d91331933e..git_revision:d3db74920e35147955be43f62b5f4ed0cf84c614

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I39db0aad04f28cc202fc7fa6bb31c2517b47f407
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3649375
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Liviu Rau <liviurau@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80593}

Split off a TurbofanFrame from OptimizedFrame, and make MaglevFrame a
subclass of OptimizedFrame. This allows it to be treated as an optimized
frame by code that is looking at deoptimization data.

Bug: v8:7700
Change-Id: Ia38e0f1c2cd73f054f63be81dff187d9197c1202
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3644798
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80592}

Bug: chromium:1306416
Change-Id: Idebb83998a0d2e9e4034bc5d138d9f52a1215dc3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3644955
Auto-Submit: Almothana Athamneh <almuthanna@chromium.org>
Commit-Queue: Almothana Athamneh <almuthanna@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80591}

Bug: v8:12755
Change-Id: I7c693c07640fd5952047666063f23b4be77692bd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3644954
Commit-Queue: Almothana Athamneh <almuthanna@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Auto-Submit: Almothana Athamneh <almuthanna@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80590}

NumFuzz passes various flags to V8 testing randomly, which can lead to
various flag contradictions with existing flags. Up to now the system
ignored the check for contradictions and kept running the test cases,
leading to false positives.

This change adds a new v8 flag --exit-on-contradictory-flags that
exists gracefully when a contradiction is detected. On the numfuzz
side we now filter simple contradictions beforehand.

Measurements showed that ~2% of all numfuzz tests ran into
contradictions. Around half of them are simple contradictions
(repetitions and inversions), which are now filtered beforehand.
The remaining ones (redundant or contradictory implications) are
now ignored.

Bug: v8:11826
Change-Id: I9942e203ba9668a097fabe1343dd1365c9da94c1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3650746
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Almothana Athamneh <almuthanna@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80589}

This CL moves cctest/parsing/{test-parse-decision,
test-scanner-streams, test-scanner} to unittests/{
parse-decision-unittest, scanner-streams-unittest,
scanner-unittest}.

Bug: v8:12781
Change-Id: I2adfeaf2ccc796f17d6b7010c77b1f65c6ce593e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3612668
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80588}

Loading from/storing to the same field with incompatible mutabilities
is possible in unreachable code, specifically when a value is cast to
two different types with incompatible mutability for the same field
offset. Therefore, we allow this pattern in CsaLoadElimination.
When we detect it, we emit an Unreachable node to immediately crash the
program in case this unreachable code is somehow executed.

Bug: v8:7748, v8:12874
Change-Id: Ieb359d3e1b9f7bc4a91c556af2bba0507526d20e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3644806
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80587}

This CL removes GCTracer::AssertMainThread and adds the more general
methods Heap::IsMainThread and Heap::IsSharedMainThread, to be used
in DCHECKs and elsewhere. It also introduces some const qualifiers.

Bug: v8:12425
Change-Id: Ibdec39ce77be704598ca0c8b440005dc27bd6997
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3650600Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80586}

Change-Id: I5144d8315b5c1aca751d138e4d87240b703dc9e3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3650359
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Auto-Submit: Yu Liu <liuyu@loongson.cn>
Reviewed-by: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/main@{#80585}

Bug: v8:12868
Change-Id: I955155db468b2ecd86fa6c5a73c616b0e4c66446
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3644949Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Andy Wingo <wingo@igalia.com>
Cr-Commit-Position: refs/heads/main@{#80584}

Bug: v8:11111, chromium:1321013
Change-Id: Iec45b885e844ab02059470dd514f47133b0a6efe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3650596Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80583}

Change-Id: I3d3b1f0b86714e0d654ed18c055d394002dbec2c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3650832
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80582}

This Cl moves cctest/libsampler/{test-sampler, test-signals-and-mutexes}
to unittests/libsampler/{sampler-unittest, signals-and-mutexes-unittest}.

Bug: v8:12781
Change-Id: I106e709a66d00d23df76c6868d0843dd0ac1887e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3612666
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80581}

Bug: v8:12868
Change-Id: Ib4540352c7db4b4bdbf88b559da44b08e71dd483
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3650603Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Andy Wingo <wingo@igalia.com>
Cr-Commit-Position: refs/heads/main@{#80580}

... /objects/roots-unittest.

Bug: v8:12781
Change-Id: Id76a0e1ffaea18849866fa0f55c9a056dbdf6e2b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3612670
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80579}

Add lazy deopts for generic operations (binops, loads, stores).

Bug: v8:7700
Change-Id: I6f9abba5c57cd3d271552080927199e9dbd92322
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3644799Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80578}

... api/accessor-unittest.cc.

- Add IsInt32, IsString, IsUndefined matcher in
testing/gmock-support.h.

Bug: v8:12781
Change-Id: I764491d7643e35fb8bc1621e857873aa24f64ccd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3593573Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80577}

This reverts commit 24286b8e.

Reason for revert: Re-staging the experimental flag for fuzzing

Original change's description:
> Revert "[rab/gsab] Temporarily stage --harmony-rab-gsab to enable fuzzing"
>
> This reverts commit b8f88be0.
>
> Reason: disabling an experimental feature in release branch
>
> Bug: v8:11111,v8:12870
> Change-Id: I6fbd6bdb318c0d25e69c04db208a0d5f2b9ebbd7
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3647357
> Auto-Submit: Marja Hölttä <marja@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#80520}

Bug: v8:11111,v8:12870
Change-Id: I0a45ed5ce53010196949dda23773d152aa605846
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3647836
Commit-Queue: Marja Hölttä <marja@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#80576}

With the flag --always-use-string-forwarding-table (only used for
testing), we can have young generation strings in the
StringForwardingTable.
We need to update references to these strings when they are evacuated
during mark compact (previously this was only done after scavenge).

Bug: v8:12877, v8:12007
Change-Id: Ie108add176f71dcdf296bd94bdffa664cb75ae02
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3650719Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80575}

Port commit d2a8bdec

Bug: v8:12284
Change-Id: Ia011008d1e7695601fce78d60018e473079e9d0f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3650332
Auto-Submit: Yu Liu <liuyu@loongson.cn>
Reviewed-by: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/main@{#80574}

Port commit d2a8bdec
Bug: v8:12284

Change-Id: I8ec0c2270d85d8068823e241e1c326aa90caad8c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3651507
Auto-Submit: Yahan Lu <yahan@iscas.ac.cn>
Commit-Queue: Yahan Lu <yahan@iscas.ac.cn>
Commit-Queue: ji qiu <qiuji@iscas.ac.cn>
Reviewed-by: ji qiu <qiuji@iscas.ac.cn>
Cr-Commit-Position: refs/heads/main@{#80573}

... ,test-fast-dtoa, test-fixed-dtoa} to unittests/base/
{bignum-dtoa-unittest, dtoa-unittest, fast-dtoa-unittest,
fixed-dtoa-unittest}.

This CL also moves cctest/{gay-fixed, gay-precision,
gay-shortest} to unittest/{gay-fixed, gay-precision,
gay-shortest}.

Bug: v8:12781
Change-Id: Id6072f92908ad3abfe683c69dac041227de2553f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3607114
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80572}

1) In copy/move ctors and operator=() we can just copy raw compressed
   value;
2) For null check we don't need to decompress the value;
3) Same for operator==().
4) Hashing can also be optimized in a followup.

Bug: chromium:1325007
Change-Id: Ic1bf2c5049802c078b3e0121dcbe62d9ecea83b3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3647359Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80571}

Port d2a8bdec

R=gdeepti@chromium.org, joransiu@ca.ibm.com, junyan@redhat.com, midawson@redhat.com
BUG=
LOG=N

Change-Id: I5fceb4b75529e2f24762630b4091332c56461e07
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3650606
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80570}

Change-Id: Ib8ca0c771b50b712e5fd6acb470213235f69a99b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3650833Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Solomon Kinard <solomonkinard@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80569}

Bug: v8:12284
Change-Id: I75d550e0cec4a4cf68296f3634329a7d97ae99fb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3646076Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80568}

Part of the improve error messages initiative.

Based on a resource of JSON.parse() errors found at
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Errors/JSON_bad_parse

Previously JSON.parse(NaN) would output:
SyntaxError: Unexpected token N in JSON at position 0
Now the output is:
SyntaxError: "NaN" is not valid JSON

Previously JSON.parse("{a:1}") would output:
SyntaxError: Unexpected token a in JSON at position 1
Now the output is:
SyntaxError: Expected property name or '}' in JSON at position 1

Bug: v8:6551
Change-Id: Ic9fad1fdbd295e1302805b81e6603fc526121960
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3513684Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Issack John <issackjohn@microsoft.com>
Cr-Commit-Position: refs/heads/main@{#80567}

The check whether worklists are empty sits after marking the
transitive closure, when it is guaranteed that no concurrent marker is
running anymore.

Bug: chromium:1325628
Change-Id: Ibfa7278df2181a0aa6c7e0f1d53d51e8afaa3352
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3647830
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80566}

This adds a new struct "OOMDetails" which is passed to the
OOMErrorCallback. It currently holds the "is_heap_oom" bool that was
also passed before, plus an optional "detail" string.
The struct can later be extended without having to change the signature
of the OOMErrorCallback. Removing fields will have to follow the
standard deprecation rules, but this is also easily possible without the
hassle for this initial change.

We modify the deprecated OOMErrorCallback definition and un-deprecate it,
which can be seen as removing a deprecated API and adding a new one in
one CL.

R=mlippautz@chromium.org, jkummerow@chromium.org

Bug: chromium:1323177
Change-Id: Ic4c2cb5856906ebd664626fe463d8e96cb99b0a5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3647827Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80565}

Return empty optional instead of optional with empty Map on failure.

Bug: v8:7790, chromium:1323119
Change-Id: I1e6e9e2361d12d0f8d106a7929221d3116d0d547
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3650715
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80564}

This includes:
1) Inline UncommintFromSpace into Shrink (always called together)
2) Replace ZapFromSpace with virtual ZapUnusedMemory
3) Replace EnsureFromSpaceIsCommited with virtual Prologue

Bug: v8:12612
Change-Id: I934479761c877e10734f54e6d5896a4741b92ef7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3650738Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80563}

Mostly in comments, not much to be said...

Bug: v8:12425
Change-Id: Ib1e4d3913f9b91eeafefbef13330fd1388223c06
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3650597
Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80562}

Calls to Flip and ResetLinearAllocationArea of SemiSpaceNewSpace are
(almost) always called together, and always at the start of evacuation.
Introducing NewSpace::EvacuatePrologue, allows removing these methods
from SemiSpaceNewSpace public interface and reduces future branches
between the semi space and paged new space cases.

Bug: v8:12612
Change-Id: Ic589a48c1e7751631603da757f4f5f7edb69e571
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3650599Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80561}

This fixes a flaky crash when running with --turbo-stats or
--turbo-stats-wasm.
With dynamic tiering, it can happen that a compilation job is started
shortly before the program/test/benchmark terminates and the main thread
goes through its teardown sequence. When such a late job finishes, it
still wants to report its statistics, which currently crashes due to
UAF if the CompilationStats object, which is owned by the main thread,
has already been deleted.

Change-Id: Ie25a97299fdf40ece8f286487063feadcfa2eea9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3645410
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80560}

Otherwise opening a HandleScope nested in a SHS also wouldn't allow PHS. This
currently happens in maglev..

Bug: v8:7700
Change-Id: Id279cf7ad8c83f68a3ba0050a0df718892636e9f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3650601Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80559}

This patch adds a side table to the MachineGraph that stores the
previously observed call count for the Call nodes used for Wasm
direct calls. This replaces a more convoluted system that accessed
processed feedback during compilation, keyed on source position.

Bug: v8:12166
Change-Id: I06109918030b8f256c5f170da5853394c1a69cc2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3644803Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80558}

... /objects/representation-unittest.

Bug: v8:12781
Change-Id: I3ae39df619ac6920c5ff722ed481bed20b5a5c6d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3612669
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80557}

... /base/double-unittest.

Bug: v8:12781
Change-Id: I13817728735a53fbc28a4e2d1babdcbd9bbf419d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3607113
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80556}

Record old-to-shared references in the C++ write barrier. When
an old-to-shared reference is created, this particular slot will be
atomically inserted into the old-to-new remembered set.

We already stopped clearing the old-to-new-remembered set after a
shared GC, so we already need to be able to handle such slots when
invalidating objects and in the sweeper.

Bug: v8:11708
Change-Id: I1b5854d58f6496228f3a3d9eb7acfd9492f09e68
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3557232Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80555}