With this change we can easily track and filter unsupported objects
for full-page snapshots.

Bug: v8:11525
Change-Id: Id75b6f4edf68b47d6dfbe79aed2b686aeec61068
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3484320Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79252}

Bug: v8:7700
Change-Id: I221d77ddc43b5956e0b873900d1e92ec7c037103
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3487550
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79251}

Bug: v8:12142
Change-Id: I700bae611cecb8bc26b476e35a1df407efd30331
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3487549
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79250}

R=machenbach@chromium.org

Change-Id: I9866742528d47210d39fcdeda522dcf29bdba38e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3486679Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79249}

{FreePages} is never expected to fail, and each caller wraps the call in
a CHECK macro. In order to learn more about failures, this CL moves the
CHECK inside of {::FreePages}, to fail whenever the {PageAllocator}
fails to free pages.

As a next step, I'll audit our {PageAllocator} implementations to ensure
that none of them return {false} for {FreePages}. Note that this is
already the case for the gin platform (chromium).

R=mlippautz@chromium.org

Bug: v8:12656, chromium:1299735
Change-Id: Ib61be6cc8da0110ead2db1ad005728bd061e0243
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3484321Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79248}

Maglev is mid-tier optimising compiler designed mainly for compilation
speed that can still generate good code for straightforward JS.

This initial commit is an MVP for Maglev which can compile and run some
very simple code, and sets up a framework that we can build upon.

Design:
https://docs.google.com/document/d/13CwgSL4yawxuYg3iNlM-4ZPCB8RgJya6b8H_E2F-Aek/edit#

Bug: v8:7700
Change-Id: I5ae074ae099126c2c0d50864ac9b3d6fa5c9e85a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3483664Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79247}

Bug: v8:12655
Change-Id: I1ae4d546b7232fe30f716c5a9913f895637761f0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3487546
Auto-Submit: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79246}

Port commit c7e47c30

Bug: v8:7700
Change-Id: I59d5e483867118fa8efc50cc52e00bd3321fa01a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3487428
Auto-Submit: Yu Liu <liuyu@loongson.cn>
Reviewed-by: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/main@{#79245}

Bug: chromium:1300105
Change-Id: I89d08662a81bec6da7f1565c8fc582edc69781d5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3485682
Auto-Submit: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79244}

Rolling v8/third_party/icu: https://chromium.googlesource.com/chromium/deps/icu/+log/b867f20..901474b

Add an option to not add the stubdata.cpp file. (Harry Terkelsen)
https://chromium.googlesource.com/chromium/deps/icu/+/901474b

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com,ftang@chromium.org

Change-Id: I2f3b4c2123e86c42c5f2916101539dcbeb3dda04
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3487130
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#79243}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/51ff1c6..9a383ac

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/src/buildtools/+log/93c1552..893aa03

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/4ac0eac..08a8050

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/64f5f26..36d41ce

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: Ie040ea1c181ff59228fda9639943958e16404007
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3486677
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#79242}

Unlike regular marking code we can encounter client references in a
shared GC, so we need a bail out here as well.

Bug: v8:11708, v8:12647
Change-Id: Ie5ccb66206a8dca7d7bb08c75c90ce4999ed5a78
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3483663Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Auto-Submit: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79241}

The external project is effectively abandoned. Fork and move it in-tree
for easier maintenance and Python 3 migration.

Bug: chromium:1296209
Change-Id: I4ff97749acb2895bd8433c08b2a4ff109c90cda2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3475086Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79240}

Bug: v8:12484
Change-Id: I44c2028efadbd70e7711f01d107995e0462f05d4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3477094Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Darius Mercadier <dmercadier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79239}

Negative offsets from the stack pointer are prohibited by the
simulator so add a check to catch this at compile time.

This DCHECK is currently tripped by the
v8_enable_builtins_profiling and
--turbo_force_mid_tier_regalloc flags
causing the mid-tier register allocator to be used.

Bug: chromium:1299793
Change-Id: I0d11e584178cc08a500e563fa213737a93b10bad
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3483660Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Martyn Capewell <martyn.capewell@arm.com>
Cr-Commit-Position: refs/heads/main@{#79238}

Port c7e47c30

Original Commit Message:

    A collection of smallish cleanups and improvements for safepoints.

    Maintainability:
    - The class names were not very clear; move Safepoint inside
      SafepointTableBuilder to clarify that this wrapper class is used
      during codegen.
    - Rename DefinePointerSlot/DefineRegister to
      DefineTaggedStackSlot/DefineTaggedRegister for clarity.
    - Use named constants instead of -1.
    - DefineTaggedRegister has no connection to kNoDeoptIndex, remove
      the DCHECK and comment.
    - Remove the unused kNumSafepointRegisters constant + other dead code.
    - Small clarifications in CommonFrame::IterateCompiledFrame.
    - Rename has_safepoint_info to uses_safepoint_table and refactor s.t.
      `stack_slots` can be used when `uses_safepoint_table == false`. In
      this case it just returns 0.

    Perf:
    - During codegen, represent stack slots as a growable bit vector
      instead of a list of int indices. Extend GrowableBitVector
      functionality to support the above.
    - Track the minimum index instead of iterating all stack slots in
      all safepoints before encoding.

R=jgruber@chromium.org, joransiu@ca.ibm.com, junyan@redhat.com, midawson@redhat.com
BUG=
LOG=N

Change-Id: Ifef2d95f1e4a064d85d4ce437b1d12ae9796336f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3484701Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#79237}

This is a reland of dec62c2d

Revert was not necessary as test was independently flaking.

Original change's description:
> heap: Factor out raw allocation functions into HeapAllocator
>
> This CL is mostly mechanic and provides runtime and static
> dispatch for allocation of objects using HeapAllocator.
>
> Future CLs will remove the Heap bottelenecks.
>
> Bug: v8:12615
> Change-Id: Id2becf7da4bd5273f96abc0e1a4ac6c04bddb1cb
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3474674
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#79229}

Bug: v8:12615
Change-Id: I505ebde7afd2b0d03e11ef4cbcf1d4d09c6826a1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3484322
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Auto-Submit: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79236}

It's no longer needed.

Bug: v8:12552
Change-Id: I3522ab621001ee07ce7037888934279e4050dea9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3484318
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79235}

To avoid leaking VMState cross origin leverage existing FilterContext
to filter out VMSTates.
GC State is the exception as it is not coupled to any native context and
is always included.

Bug: chromium:1263871
Change-Id: I5cab8620460f4db24fa183c891cb0c43996e95c4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3465735
Auto-Submit: Corentin Pescheloche <cpescheloche@fb.com>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79234}

A collection of smallish cleanups and improvements for safepoints.

Maintainability:
- The class names were not very clear; move Safepoint inside
  SafepointTableBuilder to clarify that this wrapper class is used
  during codegen.
- Rename DefinePointerSlot/DefineRegister to
  DefineTaggedStackSlot/DefineTaggedRegister for clarity.
- Use named constants instead of -1.
- DefineTaggedRegister has no connection to kNoDeoptIndex, remove
  the DCHECK and comment.
- Remove the unused kNumSafepointRegisters constant + other dead code.
- Small clarifications in CommonFrame::IterateCompiledFrame.
- Rename has_safepoint_info to uses_safepoint_table and refactor s.t.
  `stack_slots` can be used when `uses_safepoint_table == false`. In
  this case it just returns 0.

Perf:
- During codegen, represent stack slots as a growable bit vector
  instead of a list of int indices. Extend GrowableBitVector
  functionality to support the above.
- Track the minimum index instead of iterating all stack slots in
  all safepoints before encoding.

Bug: v8:7700
Change-Id: If409bc42c825d47fc0074fce51e3b963fd080806
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3483659Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79233}

This is a follow-up fix for
  https://chromium-review.googlesource.com/c/v8/v8/+/3482436
which introduced a new check to Map verification.

Bug: v8:10391
Cq-Include-Trybots: luci.v8.try:v8_linux_gc_stress_dbg_ng
Change-Id: I8c02354bc159259c7157b296939790d0fc2c31c4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3483662Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79232}

This reverts commit dec62c2d.

Reason for revert: bot failures

Original change's description:
> heap: Factor out raw allocation functions into HeapAllocator
>
> This CL is mostly mechanic and provides runtime and static
> dispatch for allocation of objects using HeapAllocator.
>
> Future CLs will remove the Heap bottelenecks.
>
> Bug: v8:12615
> Change-Id: Id2becf7da4bd5273f96abc0e1a4ac6c04bddb1cb
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3474674
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#79229}

Bug: v8:12615
Change-Id: I55bf6c6a857d853462b11251e767c44fc6fa2edd
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3483665
Auto-Submit: Tobias Tebbi <tebbi@chromium.org>
Owners-Override: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#79231}

- std::memory_order is no longer an enum, remove the double
  qualification. P0439R0.
- `icu::StringPiece(nullptr, 0)` is now ambiguous due to char8_t no
  longer being equal to char. Use the default constructor. P0482R6.
- WasmGlobal is aggregate initialized, remove the default ctor. It's
  move-only anyways because some of its members are. P1008R1.
- Remove stray `inline` keyword Clang warns about.

Change-Id: I63dca25350a4e560779dc637c3bf637a385dd0c8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3472497
Auto-Submit: Benjamin Kramer <kramerb@google.com>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79230}

This CL is mostly mechanic and provides runtime and static
dispatch for allocation of objects using HeapAllocator.

Future CLs will remove the Heap bottelenecks.

Bug: v8:12615
Change-Id: Id2becf7da4bd5273f96abc0e1a4ac6c04bddb1cb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3474674Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79229}

Use class instead of lambda for static constexpr comparator (looks like
a bug in gcc).

Bug: chromium:1029379
Change-Id: I5caebacba2550bb206514f6e989d44361995f368
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3484315Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79228}

Embedder fields are located between JSObject header and inobject fields
and there must be no gaps.
This CL adds respective check to Map verification and fixes existing
issues.

Bug: v8:10391
Change-Id: If55652095588f8704c9a375fb86be1599816aa86
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3482436
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79227}

When triggering a step out action, we check whether we already
are at a return or suspend location. If not, we first flood all
return positions with breakpoints, set the fast_forward_to_return_
flag and continue.

With the new way of reporting instrumentation breakpoints, we now
may get into the situation where we stopped on an instrumentation,
but may still need to continue until we reach the return point for
the step out. This CL fixes a bug in which we ran into a DCHECK
that expected us to stop on a return location (since
fast_forward_to_return_ is set to true), but we didn't.

Drive-by: adapt other stepping tests to properly wait for all pauses

Bug: chromium:1229541
Change-Id: Ie5fd358922f4cdaf1f8584bb0b35e87b0e221fb8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3480094Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Kim-Anh Tran <kimanh@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79226}

For the purpose of graph verification, a SandboxedPointer is equivalent
to a Word64. The SandboxedPointer representation only affects lowering,
which needs to perform encoding/decoding of the pointer when
storing/loading it to/from the heap. As such, this CL promotes
kSandboxedPointer to kWord64 representation for graph verification.

Bug: v8:10391
Change-Id: I466f03dc7bbe9ed8f7b4f431aee5b14bd6db3d31
Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3483658Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Samuel Groß <saelo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79225}

This generates snapshots which are quicker to deserialize since
there are less forward references (item referring to another item with
a greater ID).

Bug: v8:11525
Change-Id: Ib5dce296fca57dae4c0d9bc98f97fe8440c9be8a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3483657Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79224}

Port commit b8b32f6b

Change-Id: I5592b4027715d5d3544435718c9e1161cf69f3e2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3482480
Auto-Submit: Yu Liu <liuyu@loongson.cn>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79223}

- List the current v8 version
- Minor code cleanup

Change-Id: Ic7a89e42d27465cc5df8e2249eaeacf8ca1eb6a7
No-Try: true
No-Presubmit: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3477034
Auto-Submit: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79222}

Custom callbacks assume that untraced pointers always point to valid,
not freed objects. They must make sure that upon callback completion no
UntracedMembers point to an unreachable object. This may not hold true
if a custom callback for an old object operates with a reference to a
young object that was freed on a minor collection cycle. To maintain
the mentioned invariant, the CL calls custom callbacks for old objects
on every minor collection cycle.

The alternative options could be:
1) Replacing all UntracedMembers with WeakMembers, since WeakMember
   supports tracing and the barrier.
2) Emitting the generational barrier for UntracedMember + tracing
   UntracedMember on minor collection cycles.
The first option requires changing multiple use sites and can bring some
performance regression. The second option requires changing the GC logic
and the semantics of UntracedMember.

Bug: chromium:1029379
Change-Id: I9bb89e4787daf05990feed374dceca940be7be63
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3472499Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79221}

- Move feedback / SP into TieringManager.
- Rename OnInterruptTickFromBytecode to OnInterruptTick (it's called
  from both Code and Bytecode).
- Remove the SealHandleScope / HandleScope dance.

Bug: v8:7700
Change-Id: I800542deb3805097a589b7766907efb6f40c7dae
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3467875Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79220}

Port commit 1b437aa8

Bug: v8:11708
Change-Id: I717ef7a7cb270580c14114d19f976f999f095185
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3482489
Auto-Submit: Yu Liu <liuyu@loongson.cn>
Reviewed-by: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/main@{#79219}

Change-Id: I4b83907b735994a729b57b9c4a75d3672ce78b15
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3482916Reviewed-by: ji qiu <qiuji@iscas.ac.cn>
Auto-Submit: Yahan Lu <yahan@iscas.ac.cn>
Reviewed-by: Yahan Lu <yahan@iscas.ac.cn>
Commit-Queue: Yahan Lu <yahan@iscas.ac.cn>
Cr-Commit-Position: refs/heads/main@{#79218}

Previously we'd hold on to Script objects strongly after they are
considered unreachable by V8 itself, and keep them around for the
V8DebuggerAgent cache (whose upper limit can be controlled with a
parameter to `Debugger.enable`).

This CL changes that to instead copy out the script source and the
WebAssembly bytecode (depending on whether it's JavaScript or Wasm)
to the C++ heap and keep it cached there.

Fixed: chromium:1295659
Bug: chromium:1246884
Change-Id: Idfcd7172715eafca6b011826ae03a573d58803f2
Doc: https://bit.ly/v8-inspector-script-caching
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3472082Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79217}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/eaff712..51ff1c6

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/b718bf9..4ac0eac

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/42cf2ac..64f5f26

Rolling v8/third_party/zlib: https://chromium.googlesource.com/chromium/src/third_party/zlib/+log/cd494c4..4823a85

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I2f68fd86dfdd7468f20f54f40696a792bc0b0d38
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3481266
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#79216}

This is a reland of 1025bf26

Changes since revert:

- TSAN issue fixed by https://crrev.com/c/3475084
- Skip the shared-struct-workers test until shared GC deadlock is fixed,
  being tracked in v8:12645

Original change's description:
> [shared-struct] Prototype JS shared structs
>
> Unlike the Stage 1 proposal, for simplicity the prototype does not add
> any new syntax, instead opting for exposing a SharedStructType
> constructor which takes an array of field names. This type constructor
> returns constructors for shared structs.
>
> Shared structs can be shared across Isolates, are fixed layout, have no
> prototype, have no .constructor, and can only store primitives and
> other shared structs.
>
> The initial prototype does not have TurboFan support.
>
> Bug: v8:12547
> Change-Id: I23bdd819940b42139692bcdb53d372099b0d4426
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3390643
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Marja Hölttä <marja@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Commit-Queue: Shu-yu Guo <syg@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#79156}

Bug: v8:12547
Change-Id: Ic1f5cf9fa9791ae2d5d5dc7c110614ca10b5d98e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3475078Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79215}

Port 1b437aa8

Original Commit Message:

    When we know that the value in a write barrier is a map, we know that
    we are not going to have an old-to-new reference (maps are always in
    old generation). Therefore we also don't really need the generational
    barrier in RecordWrite. While this is technically correct, we don't
    gain much from this optimization. The inline and out-of-line generated
    code for the barrier is still the same as in all other cases. Which
    means that outside marking we don't even reach the RecordWrite builtin.
    Most write barrier executions happen outside incremental marking, hence
    performance of the incremental marking barrier isn't critical. This CL
    always uses the full RecordWrite builtin using a flag in order to
    allow for an easy revert.

    This CL is motivated by the shared heap work, which needs an additional
    always-on barrier in the future (similar to OLD_TO_NEW) to keep a
    OLD_TO_SHARED remembered set up-to-date. While maps are always in the
    old generation, they maybe by located in the shared heap.

R=dinfuehr@chromium.org, joransiu@ca.ibm.com, junyan@redhat.com, midawson@redhat.com
BUG=
LOG=N

Change-Id: I4e763419b3b007a668073e1577cbff9127d15940
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3481263Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#79214}

Originally, the check "if (orientation == ULOC_LAYOUT_LTR)" lead dir
to be "rtl" when orientation is "ltr". Fix it to correct check
"if (orientation == ULOC_LAYOUT_RTL)"

Bug: v8:12531
Change-Id: I5fba29466c66b4fd05e31ddbe4083c16c19e9005
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3459928Reviewed-by: Frank Tang <ftang@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79213}