Call Intl function which call ICU TimeZone for the calculation
of timezone other than UTC

Bug: v8:11544
Change-Id: Idc355aaeccc0bed026a7117bb366ee914fa29733
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3783074
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81983}

Rolling v8/third_party/android_sdk/public: gMHhUuoQRKfxr-MBn3fNNXZtkAVXtOwMwT7kfx8jkIgC..9lGp8nTUCRRWGMnI_96HcKfzjnxEJKUcfvfwmA3wXNkC

Rolling v8/third_party/android_sdk/public: g7n_-r6yJd_SGRklujGB1wEt8iyr77FZTUJVS9w6O34C..RSI3iwryh7URLGRgJHsCvUxj092woTPnKt4pwFcJ6L8C

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/03071f1..b1e3787

Rolling v8/third_party/fuchsia-sdk/sdk: version:9.20220722.3.1..version:9.20220726.1.1

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: Ie0ff2ae7222f3d29ba8d00dbd39be56d3f7ddd7a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3788884
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#81982}

This reverts commit 33043888.

Reason for revert: Test262 fails on UBSan: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20UBSan/22371/overview

Original change's description:
> [test262] Roll test262
>
> https://chromium.googlesource.com/external/github.com/tc39/test262/+log/3ddfa0cd..e41d581c
>
> Bug: v8:7834
> Change-Id: Id1c5b07f109ab6f60498eb7185becc508d16af1e
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3786907
> Reviewed-by: Shu-yu Guo <syg@chromium.org>
> Commit-Queue: Frank Tang <ftang@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#81980}

Bug: v8:7834
Change-Id: I34d4b36209226d32b416608fbf2ab4c0f8702566
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3788426
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Owners-Override: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Auto-Submit: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81981}

https://chromium.googlesource.com/external/github.com/tc39/test262/+log/3ddfa0cd..e41d581c

Bug: v8:7834
Change-Id: Id1c5b07f109ab6f60498eb7185becc508d16af1e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3786907Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81980}

Using the external pointer table when compressing pointers lets us ease
the alignment requirement for the state field from 8-byte-aligned to
4-byte-aligned, as 8-byte alignment is not supported during compaction.

Bug: v8:12547
Change-Id: Ibbcb0d71f09f9bac66acc81459ab71e354ea405f
Cq-Include-Trybots: luci.v8.try:v8_linux64_pointer_compression_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3783077Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81979}

This is a reland of commit efac35f3

The LSan issues have been fixed in https://crrev.com/c/3779915

Original change's description:
> [sandbox] Sandboxify JSExternalObject external pointer
>
> Bug: v8:10391
> Change-Id: I6075a8fe3c201f9221149e0c54edf4fb191088da
> Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3757342
> Commit-Queue: Samuel Groß <saelo@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#81924}

Bug: v8:10391
Change-Id: I954520ee324c9aa4c4ccc4941ae30d19676be2ba
Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3780501Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Samuel Groß <saelo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81978}

This CL moves the external pointer table out of V8_ENABLE_SANDBOX and
into V8_COMPRESS_POINTERS. The external pointer table is also useful
even when not sandboxing external pointers to ease alignment
requirements under pointer compression.

It is onerous for the allocator to support non-tagged-size alignment.
Under pointer compression, tagged is 4 bytes while system pointers are
8 bytes. Because external pointer table indices are 4-bytes, fields that
require natural alignment (e.g. the state field in JSAtomicsMutex) when
the system pointer size is 8-bytes can use an indirection via the
pointer table to ease the alignment restriction back to 4-bytes under
pointer compression.

Bug: v8:10391
Change-Id: Iac1200e40c987128cd6a227cd279ba4dac0e5c56
Cq-Include-Trybots: luci.v8.try:v8_linux64_pointer_compression_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3783076Reviewed-by: Samuel Groß <saelo@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81977}

Similar to the FullGC marking hierarchy (MarkingVisitorBase, with
derived classes MainMarkingVisitor and ConcurrentMarkingVisitor),
this CL introduces YoungGenerationMarkingVisitorBase +
YoungGenerationConcurrentMarkingVisitor, and refactors
YoungGenerationMarkingVisitor to inherit from
YoungGenerationMarkingVisitorBase.

YoungGenerationConcurrentMarkingVisitor dispatches to functions
refactored to ConcurrentMarkingVisitorUtility by the previous CL.

Bug: v8:13012
Change-Id: I0e827eb95732ed9ddf027fe68e25a0839cdda773
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3780524Reviewed-by: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Leon Bettscheider <bettscheider@google.com>
Cr-Commit-Position: refs/heads/main@{#81976}

This is a reland of commit 60e9b503

Original change's description:
> cppgc: Consistently treat sentinel pointer as live
>
> Sentinel pointers would be treated as live by the GC (through
> `HandleWeak()` but would be treated as dead when checked explicitly
> through the `LivenessBroker` in e.g. custom callbacks.
>
> Treat sentinel pointers as live consistently across all callsites
> and weak types.
>
> Change-Id: I9a4c096ddac1a111df808f3683325b55e7597eea
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3782800
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Omer Katz <omerkatz@chromium.org>
> Reviewed-by: Anton Bikineev <bikineev@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#81916}

Change-Id: Ie2476345b9ea8406015a3b07bd6880c1159ede08
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3779913Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81975}

Handle the case where getting a value in the iterable object that
encodes the values throws an exception.

R=ahaas@chromium.org

Bug: chromium:1347073
Change-Id: Ie660ab04148d5fd3508397ae6e08130496f61b74
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3788097
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81974}

Bug: v8:10391
Change-Id: I4e7d4937ac4c6332da3c63c9e8c15e75fa951f2f
Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3757343Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Samuel Groß <saelo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81973}

When the LeakSanitizer (LSan) runs, it scans all reachable memory
looking for pointers to other (live) objects, then reports all objects
that are still allocated but not reachable as leaked.
When the external pointer table is used, the pointers stored in it do
unfortunately not look like pointers to LSan as they will have some of
the top bits set. As such, LSan ignores them and may afterwards
incorrectly report some referenced objects as leaked.
To fix this, we now use a "shadow table" when LSan is active which
contains the raw pointer for every (tagged) pointer stored in the real
table. LSan can then scan this table and find all references.

Bug: v8:10391
Change-Id: If0c8b042fdd775ac3c8025d5688e62df37532ec3
Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3779915
Commit-Queue: Samuel Groß <saelo@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81972}

This is a follow-up to https://chromium-review.googlesource.com/c/v8/v8/+/3776693
The previous CL accidentally didn't manage to enable
the PGO build because `v8_optimized_debug` is true in
release builds.

Bug: v8:10470
Change-Id: I66ec74e71eb697aa48b981d78ad526f4b8c5a917
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3784989
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81971}

{NativeModule::GetJumpTableOffset} is totally independent of the
{NativeModule}, hence should be an independent function. It's now
defined in wasm-module.h, and works only on the WasmModule and the
function index.
{NativeModule::GetCallTargetForFunction} only has a single caller, which
is the wasm instance object, which already has direct access to the jump
table start. Hence we can just add the jump table offset there, and do
not need another helper method. This also makes it more clear that we
are returning a jump table slot.

R=jkummerow@chromium.org

Change-Id: If2e4eb4b3622df08ba905bd10783199bbb59d50a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3781348Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81970}

Bug: v8:7700
Change-Id: I91246b8ef75ca75d8d9c4b8367c433e9d2a2cbc3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3782795
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81969}

Bug: v8:9407
Change-Id: I55da6d54bf0ad55e7b16cbf997637743d96d03d1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3785004Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Qifan Pan <panq@google.com>
Cr-Commit-Position: refs/heads/main@{#81968}

pt.1

Compiler generates the below instructions for compressed pointer:

  [ DecompressTaggedPointer
  movl r8,[r8+0x13]
  REX.W addq r8,r14
  ]
  addl [r8+0x7],0xe6

This CL optimizes the pointer decompression by using complex
addressing mode in x64:

  movl r8,[r8+0x13]
  addl [r14+r8*1+0x7],0xe6

Bug: v8:13056, v8:7703
Change-Id: I755cdac407bab4ff2e78d4a6a164f13385f7c361
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3765067Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Hao A Xu <hao.a.xu@intel.com>
Cr-Commit-Position: refs/heads/main@{#81967}

This extends the ExpectedOutProc runner to print a diff between the
expected and actual output. The behavior of other runners is unchanged.

Change-Id: If2b89d39cf98b8d257b1a209b5471a79ec3868ff
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3771641Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Liviu Rau <liviurau@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Auto-Submit: Matthias Liedtke <mliedtke@google.com>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81966}

Rolling v8/buildtools/third_party/libc++/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxx/+log/476d5ae..6c8f712

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/192679c..03071f1

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I951bb6a9aa30a5cc1b774547db18af824eed5a84
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3787495
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#81965}

This CL adds "(x + x) & 1 => 0" reduction to WordAnd, which helps to
eliminate the branch in below codes:

  5191: Int32Constant(1)
  1725: Int32Add(1724, 1724)
  1726: ChangeUint32ToUint64(1725)
  1729: TruncateInt64ToInt32(1726)
  1730: Word32And(1729, 5191)
  1732: Branch(1730, 1721)

Change-Id: I0dbcd97f8edf27b766a023116409d8ed1524e369
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3787318
Commit-Queue: Hao A Xu <hao.a.xu@intel.com>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81964}

C++17 was fully enabled [1] a few days after the last try to remove the
workaround [2]. Let's try again now.

[1] https://crrev.com/c/3316556
[2] https://crrev.com/c/3306429

R=leszeks@chromium.org

Change-Id: I63696b69d8d47deead03b86822ad04fbe065d7d3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3785144Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81963}

The implicit copy constructor triggers a deprecation warning if the
struct contains a deprecated field. We can fix this by explicitly
declaring the copy and move constructors and assignment operators
with the deprecation warning disabled.

This CL also adds a test to check that we can indeed call the
constructors and assignment operators, which did not work before.

R=leszeks@chromium.org

Bug: v8:13092
Change-Id: Ia63ff9375de13fc6e5b5a8d59d827a742c99fb39
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3785145Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81962}

This is a reland of commit 0609bb83

Original change's description:
> cppgc: Move forward Trace(T*) deprecation
>
> Bug: v8:13089
> Change-Id: I271addd3a80feaa40520ab2768a2380c3d7ab62f
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3780821
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Anton Bikineev <bikineev@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#81939}

Bug: v8:13089
Change-Id: I34eaa119bea1d515c942bbb654ec05adb1ef2836
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3787873Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81961}

This breaks up the existing {max_mem_pages()} method and the
{kSpecMaxMemoryPages} and {kV8MaxWasmMemoryPages} constants into two
versions for memory32 and memory64, respectively.

For now, the limits are still the same.

Some checks and clamping is moved to earlier places where we still have
the information whether a memory is 32 or 64 bit.
We also store that information in the WasmMemoryObject and use this for
knowing the maximum for growing.

This CL is not supposed to change any observable behaviour.

R=jkummerow@chromium.org

Bug: v8:10949
Change-Id: Ieaca0596d1a24ef2746842954a75188494103eb2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3782677Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81960}

All its uses are followed by more specific type checks anyway.

Change-Id: Ib3c0ca49d3c9fda672273edbe16e1ec363254e9c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3784592Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81959}

Allow calls to not specify a safepoint. When we look up the safepoint
for such a location, we return a default safepoint which just has the
stack slots and no deopt info or pushed registers. This is different to
the TF safepoint elision, which tries to find the _next_ safepoint for a
PC. This allows us to let most calls not specify a safepoint at all, at
the cost of not being able to deduplicate safepoints anymore.

Bug: v8:7700
Change-Id: Ia119f56f40b5af426e0daa521801e6386b28ddb0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3770106Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81958}

This CL refactors WasmInternalFunction to no longer inherit from Foreign
but instead contain a (sandboxed) ExternalPointer field for the call target.

Bug: v8:10391
Change-Id: Iaaf25e635a275d7570e09699be3c8dec6108d4b3
Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3782675Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Samuel Groß <saelo@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81957}

See https://github.com/WebAssembly/function-references/pull/65.

Drive-by: Lower gc nodes also if typed-funcref is enabled.

Bug: v8:9495
Change-Id: I19cb67cdbdedae24b9460bc7d5b280a21a946b21
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3784590Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81956}

Bug: v8:7700
Change-Id: Ie39c1d0bec0ea51839e5ca7c7efac46cab878178
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3785304
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81955}

Avoid allocating dead (zero live range) phis, or their inputs. We should
figure out a way to remove them from the graph entirely, e.g. in a
separate DCE phase, but for now the easiest thing to do is to skip over
them.

Note that we can't eliminate them as part of the current node processing
pass, since that's the thing that records live ranges in the first
place.

Bug: v8:7700
Change-Id: I3e7f1f2214100def9ccc2b3f008852d5d69f548f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3784985Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81954}

This is a reland of commit 6925bc09

Original change's description:
> [heap] Refactor methods and nested class of ConcurrentMarkingVisitor
>
> This CL moves a few methods and nested class SlotSnapshottingVisitor
> from ConcurrentMarkingVisitor to ConcurrentMarkingVisitorUtility.
>
> Methods in ConcurrentMarkingVisitorUtility are now static and instead have a Visitor parameter.
>
> This is preparatory work for adding a
> YoungGenerationConcurrentMarkingVisitor class, which will be able to
> reuse members of ConcurrentMarkingVisitorUtility.
>
> Bug: v8:13012
> Change-Id: I503c20e655578031018a2e37dd92c1d61bbe1686
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3779677
> Commit-Queue: Leon Bettscheider <bettscheider@google.com>
> Reviewed-by: Omer Katz <omerkatz@chromium.org>
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#81931}

Bug: v8:13012
Change-Id: I05063263d831ef4f3e297289e4210850029f7607
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3780500Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Leon Bettscheider <bettscheider@google.com>
Cr-Commit-Position: refs/heads/main@{#81953}

This CL refactors the mechanism for testing the implementation of inner
pointer resolution using the marking bitmap. It allows for more than one
page, where objects can be allocated. It also keeps a list of allocated
objects that are automatically tested.

Bug: v8:12851
Change-Id: I470dc1154aca1ebc3d8526872717747829f83396
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3784605Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81952}

This CL allows the PagedNewSpace to be used with flag
v8_enable_inner_pointer_resolution_osb.

Bug: v8:12612
Bug: v8:12851
Change-Id: I63eea4e75398ffec38e562cce245394c0d2a637c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3782670Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81951}

The intial version of the API was replaced with a more ergonomic one
recently.

We can also safely remove the test as the new API guarantees that
tasks are always finished and cancelled.

Bug: chromium:1334585
Change-Id: I9ff8b92fcd73ef821c86de52c40a1d04b15ea918
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3780539Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81950}

This reverts commit 4e935c7f.

Reason for revert: Breaking on mac arm64: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Mac%20-%20arm64%20-%20release/10926/overview

Original change's description:
> [pku][wasm] Refactor PKU usage in Wasm
>
> RwxMemoryWriteScope becomes the bottleneck for both MAP_JIT and PKU
> machinery.
> Wasm and V8 code space will use the same memory protection key.
>
> This is a next step towards adding PKU support for V8 code space.
>
> Bug: v8:13023
> Change-Id: I647f8c09bc41e5ef8a1d74b58a48a43e08454e0d
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3702213
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Commit-Queue: Wenqin Yang <wenqin.yang@intel.com>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#81947}

Bug: v8:13023
Change-Id: I11c52ac101804ab75b1bb1d4814f083cb1083d5b
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3780498
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Owners-Override: Leszek Swirski <leszeks@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#81949}

This reverts commit efac35f3.

Reason for revert: Seems to be causing memory leaks: https://ci.chromium.org/ui/p/chromium/builders/try/linux_chromium_asan_rel_ng/1234545/overview

Original change's description:
> [sandbox] Sandboxify JSExternalObject external pointer
>
> Bug: v8:10391
> Change-Id: I6075a8fe3c201f9221149e0c54edf4fb191088da
> Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3757342
> Commit-Queue: Samuel Groß <saelo@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#81924}

Bug: v8:10391
Change-Id: I8cd64fd0a85182781b04cd1e4619b69dfa512210
Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3780497
Auto-Submit: Samuel Groß <saelo@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81948}

RwxMemoryWriteScope becomes the bottleneck for both MAP_JIT and PKU
machinery.
Wasm and V8 code space will use the same memory protection key.

This is a next step towards adding PKU support for V8 code space.

Bug: v8:13023
Change-Id: I647f8c09bc41e5ef8a1d74b58a48a43e08454e0d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3702213Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Wenqin Yang <wenqin.yang@intel.com>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81947}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/d580717..8ec71a4

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/3d8d88e..184bc29

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I822b94e47328d55016919ea4e0c320fc4d34d628
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3787496
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#81946}

This reverts commit 6925bc09.

Reason for revert: Speculative revert for roll failures: https://ci.chromium.org/ui/p/chromium/builders/try/linux_optional_gpu_tests_rel/85744/overview

Original change's description:
> [heap] Refactor methods and nested class of ConcurrentMarkingVisitor
>
> This CL moves a few methods and nested class SlotSnapshottingVisitor
> from ConcurrentMarkingVisitor to ConcurrentMarkingVisitorUtility.
>
> Methods in ConcurrentMarkingVisitorUtility are now static and instead have a Visitor parameter.
>
> This is preparatory work for adding a
> YoungGenerationConcurrentMarkingVisitor class, which will be able to
> reuse members of ConcurrentMarkingVisitorUtility.
>
> Bug: v8:13012
> Change-Id: I503c20e655578031018a2e37dd92c1d61bbe1686
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3779677
> Commit-Queue: Leon Bettscheider <bettscheider@google.com>
> Reviewed-by: Omer Katz <omerkatz@chromium.org>
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#81931}

Bug: v8:13012
Change-Id: If2240b2e0769b04d752caefceb95609c6b950bb2
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3787373
Owners-Override: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Auto-Submit: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81945}

This reverts commit 0609bb83.

Reason for revert: Speculative revert for roll fails: https://ci.chromium.org/ui/p/chromium/builders/try/linux_optional_gpu_tests_rel/85744/overview

Original change's description:
> cppgc: Move forward Trace(T*) deprecation
>
> Bug: v8:13089
> Change-Id: I271addd3a80feaa40520ab2768a2380c3d7ab62f
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3780821
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Anton Bikineev <bikineev@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#81939}

Bug: v8:13089
Change-Id: Ic9c0389b1b579821f089dddee7e604d81244a108
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3785446
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Auto-Submit: Deepti Gandluri <gdeepti@chromium.org>
Owners-Override: Deepti Gandluri <gdeepti@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#81944}