Also implement AOs: ToRelativeTemporalObject, AddDuration, AddDurationToOrSubtractDurationFromDuration,
 ParseTemporalRelativeToString, DefaultTemporalLargestUnit,
DifferenceZonedDateTime

Spec Text:
https://tc39.es/proposal-temporal/#sec-temporal.duration.prototype.add
https://tc39.es/proposal-temporal/#sec-temporal.duration.prototype.subtract
https://tc39.es/proposal-temporal/#sec-temporal-adddurationtoorsubtractdurationfromduration
https://tc39.es/proposal-temporal/#sec-temporal-addduration
https://tc39.es/proposal-temporal/#sec-temporal-torelativetemporalobject
https://tc39.es/proposal-temporal/#sec-temporal-parsetemporalrelativetostring
https://tc39.es/proposal-temporal/#sec-temporal-defaulttemporallargestunit
https://tc39.es/proposal-temporal/#sec-temporal-differencezoneddatetime

Bug: v8:11544
Change-Id: Id2eff50d7f810042e1b7c53c49a09f9e489d5460
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3699301
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81650}

Also change InterpretISODateTimeOffset parameter type.
Add AOs: ToTemporalDateTimeRoundingIncrement
Spec Text:
https://tc39.es/proposal-temporal/#sec-temporal.zoneddatetime.prototype.round
https://tc39.es/proposal-temporal/#sec-temporal.plaindatetime.prototype.round
https://tc39.es/proposal-temporal/#sec-temporal-totemporaldatetimeroundingincrement

Bug: v8:11544
Change-Id: I1a74ed165b3643467d8d894fd16fd59217ba8063
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3749374Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81649}

With pointer compression enabled the compiler may not inline some Member
functions on some platforms, because Member stores and loads become
slightly more expensive. Inlining is however important with pointer
compression - it allows to further optimize the code by eliminating
the global load.

Bug: chromium:1325007
Change-Id: Ia37d223e78853a8218e0b2732a3f08aa58929000
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3756141Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81648}

1. Add `toISOString` to `v8::Date`.
2. Switch serialization to `ISOString`.

Bug: v8:13043
Change-Id: I8a852f4a4a46bb3b8e5d52ef3cdffde7a408b403
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3749203
Auto-Submit: Maksim Sadym <sadym@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81647}

This CL is part of an effort to enable concurrent marking in MinorMC.

For this purpose we plan to reuse the IncrementalMarking class which
already implements a part of the concurrent marking code for MajorMC.
IncrementalMarking internally uses the MarkingWorklists class.

This CL adapts the stop-the-world marking implementation of
MinorMC to use the MarkingWorklists class.

Bug: v8:13012
Change-Id: I3c4eb33142f2630e89aa3771b6065b9f82dc0847
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3747862Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Leon Bettscheider <bettscheider@google.com>
Cr-Commit-Position: refs/heads/main@{#81646}

Bytecode generation already emits a manual runtime call for
CreateFunctionContext in the case where the slot count exceeds the
maximum, so we don't need to check for this case in Sparkplug.

Change-Id: I228bc710c5093f7c752dc7bda7912e3af1547371
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3755118
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81645}

Previously SnapshotCreator demanded a blob to be created before
it can be destructed in debug build, this patch removes the
DCHECK so that the embedder can choose not to create the blob
when e.g. the snapshot building isn't successful due to errors.

Change-Id: I72939be1e0d79b257b9761f48a72e45325a1f6d8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3716682Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Joyee Cheung <joyee@igalia.com>
Cr-Commit-Position: refs/heads/main@{#81644}

There seem to be some issues with sandboxed external references in the
serializer which cause the --stress-snapshot mode to fail. This CL
changes the serializer to serialize external pointers that are
unsandboxed (currently all of them) as "regular" external references,
not "sandboxed" ones. This should fix the issues on the bots.

Bug: v8:10391
Change-Id: I2f889e1d0aa9c5958d4f4337e114423b650c1bb2
Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3755148Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Samuel Groß <saelo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81643}

For Smi values.

Bug: v8:7700
Change-Id: I903ef8aae818d64c3800206022c421c97e21a6f8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3755143Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81642}

Change-Id: I462af434a695a09c9b65b11759e01aace463b414
No-Try: True
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3755147
Auto-Submit: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81641}

Change StoreField to StoreTaggedField, which, similar to the move of
LoadField to LoadTaggedField, operates on an offset and not a full Smi
handler. Then, add support for stores to a property array by emitting a
LoadTaggedField of the property array.

As a drive-by, fix support for const fields and HeapObject fields with
a class field type.

Bug: v8:7700
Change-Id: Iff1fec35b82d3999ff273b069e9935166f43b98f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3752802
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81640}

Suspender.{returnPromiseOnSuspend,suspendOnReturnedPromise}
are not tied to a specific suspender anymore, so move them to
WebAssembly.{returnPRomiseOnSuspend,suspendOnReturnedPromise}.

With this change, the suspender property is not needed anymore on the
function data. Convert it to a boolean flag that just indicates whether
a function uses the JS Promise Integration API.

R=ahaas@chromium.org

Bug: v8:12191
Change-Id: I1b6d8e3190ebf5049dbc7eedee448999cf077509
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3748660Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81639}

The comment was right but the actual condition wasn't. We should check
whether the value is _not_ loadable.

Bug: v8:7700
Change-Id: I1c721a56da5860c73c8179406abb1d3a8b9d08f6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3755111
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81638}

Bug: v8:11111
Change-Id: I4e96e5440b7cfc61758a595dfdcf534c00a24358
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3755109Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81637}

This CL does the following:
- It enables (i.e. allocates and initializes) the per-Isolate
  ExternalPointerTable when the sandbox is enabled.
- It refactors the list of external pointer tags to mark them as
  "sandboxed" or "unsandboxed". An unsandboxed external pointer has a
  null tag.
- It changes V8_SANDBOXED_EXTERNAL_POINTERS to now essentially just
  enable sandboxing for all available tags.
- It modifies all low-level external pointer accessors to perform the
  ExternalPointerLookup only if the tag is non-zero and otherwise treat
  the slot as containing a raw pointer.

This now allows rolling out external pointer sandboxing incrementally
(separately for each external pointer type), which will in turn allow
for more precise performance measurements of the impact of the sandbox.

Note: when an external pointer tag is now marked as sandboxed (and
V8_SANDBOXED_EXTERNAL_POINTERS is not enabled), the underlying slots are
still 64-bits in size. This simplifies the implementation as we would
otherwise need to deal with variably-sized external pointer slots. Local
benchmarking suggests that the benefits from 32-bit external pointer
slots are insignificant on typical benchmarks, so this should be ok.

Drive-by: rename kExternalPointerSize to kExternalPointerSlotSize to
make it more clear what it refers to (the on-heap storage size). Also
delete CodeStubAssembler::InitializeExternalPointerField as it is not
currently used and the implementation is fairly inefficient.

Bug: v8:10391
Change-Id: I7c38729c7e9048d737a1a8ced84749f5b1f7feab
Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3736447Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Samuel Groß <saelo@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81636}

Run Maglev on the Linux64 bots -- eventually we'll want to move it to
the extra variant, but for now the flag is x64-only.

Bug: v8:7700, v8:12727
Change-Id: I8b8329720ac96ab1655aef9e210a52092f81cc91
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3752979
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81635}

Previously, the d8 prompt was printed without flushing stdout. This
relies on the platform's libc to flush stdout when reading from stdin.
This behavior is not portable and breaks the prompt on some platforms.

Change-Id: Ieddf7ec5a6eab15796e69742bb4c9546ceb54c37
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3752006Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81634}

This CL is the first step towards the 'static API':
https://github.com/WebAssembly/js-promise-integration/pull/1/files

The limitation of the previous API is that the stack-switching wrappers
are tied to a particular suspender. Since a suspender cannot be
re-entered until the corresponding computation has completed, this
prevents creating multiple concurrent instances of the same export.

Multiple APIs have been proposed and are still under discussion to
solve that, but the core idea is the same: the suspender should become a
runtime argument of the export and the import. This CL implements that.

For now, the suspender is still explicit everywhere: it is created in JS
and passed to the export, and forwarded to the JS import. Eventually,
the suspender may be completely hidden from JS: it would be materialized
by the export wrapper, and "swallowed" by the import wrapper, as
proposed in the PR above.

R=ahaas@chromium.org

Bug: v8:12191
Change-Id: Ic425a3fd920c7ad03874c636cd835d31c0e04994
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3748655Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81633}

Change-Id: I87d9d9a86edfed6112cdc5c7576e85bd5ae5f047
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3755141Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81632}

Print script's host_defined_options and source_mapping_url
in DebugPrint.

Change-Id: Ibd0b50e23f4d6f40eb4efbc6c4f384de24c401c6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3751943Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Chengzhong Wu <legendecas@gmail.com>
Cr-Commit-Position: refs/heads/main@{#81631}

SynchronizePageAccess is used to synchronize between page initialization
and reads from that page. It was not used for main thread reads because
it was assumed that all pages are initialized on the main thread. With
concurrent allocations, pages may be concurrently initialized, thus
requiring a fence for main threads reads as well.

Bug: v8:13041
Change-Id: I93e5162243ef5458579f239b131094d7171e8615
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3752804Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81630}

In this part: slice

Bug: v8:11111
Change-Id: I66236039454ba50899a7c600b9a3df5fb5f7fc6f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3749582Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81629}

No-Try: true
Bug: v8:7700
Change-Id: I66288693034bd501fece756916d0ef9a31e45e07
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3752798Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81628}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/b8e09c1..0b8f9f6

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/8bd72d6..0ca99b7

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: Ie77aaa20bbe44ba38a2a9b4e30e19363e3f6a02d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3754186
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#81627}

Rolling v8/third_party/fuchsia-sdk/sdk: version:8.20220709.2.1..version:8.20220710.3.1

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I1bea8266d8505addc527c37d6228e11b908ea321
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3754185
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#81626}

Change-Id: I9cc2df6108b08aacf0b017f85128a9475022cedf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3754286
Auto-Submit: Yahan Lu <yahan@iscas.ac.cn>
Commit-Queue: ji qiu <qiuji@iscas.ac.cn>
Reviewed-by: ji qiu <qiuji@iscas.ac.cn>
Commit-Queue: Yahan Lu <yahan@iscas.ac.cn>
Cr-Commit-Position: refs/heads/main@{#81625}

Port commit 0ed101e0

Bug: v8:13006
Change-Id: I4e0cba2e9a6cbef6ce01fbc81ce1b1ee71303474
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3754284
Auto-Submit: Liu Yu <liuyu@loongson.cn>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Reviewed-by: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/main@{#81624}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/e822edc..b8e09c1

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I8e8106ef0ef093a5b25e927f7554e527cd27cca2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3754183
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#81623}

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/7542172..1dee059

Rolling v8/third_party/fuchsia-sdk/sdk: version:8.20220708.2.1..version:8.20220709.2.1

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I4c552eb934374467f7c125a1cf38006b3b401bfc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3754182
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#81622}

This reverts commit d34170f2.

Reason for revert: "The (hopefully) last issue in chromium is fixed"
  Narrator: It wasn't -- https://ci.chromium.org/ui/p/chromium/builders/try/cast_shell_linux/1260757/overview

Original change's description:
> Reland "[flags] Enable freezing of flags"
>
> This is a reland of commit 1ed7d0b8.
> The (hopefully) last issue in chromium is fixed in https://crrev.com/c/3745533.
>
> Original change's description:
> > [flags] Enable freezing of flags
> >
> > This enables the --freeze-flags-after-init flag globally. Note that
> > tests, fuzzers, Node and other still explicitly disable the flag. The
> > chrome renderer process and default d8 execution will have it enabled
> > though.
> >
> > R=cbruni@chromium.org
> >
> > Bug: v8:12887
> > Change-Id: I9a15ef64227e5e6e04779d8d671a2c50d99c9097
> > Cq-Include-Trybots: luci.v8.try:v8_linux_blink_rel
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3695264
> > Reviewed-by: Camillo Bruni <cbruni@chromium.org>
> > Commit-Queue: Clemens Backes <clemensb@chromium.org>
> > Cr-Commit-Position: refs/heads/main@{#81214}
>
> Bug: v8:12887
> Change-Id: I6445c04abc55242d6e2f204d45ec9ce22c6ece34
> Cq-Include-Trybots: luci.v8.try:v8_linux_blink_rel
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3707284
> Reviewed-by: Camillo Bruni <cbruni@chromium.org>
> Commit-Queue: Clemens Backes <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#81603}

No-try: true
Bug: v8:12887
Change-Id: I73e0a52974a2730386e805b7de98de8d87e2d208
Cq-Include-Trybots: luci.v8.try:v8_linux_blink_rel
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3749584
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81621}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/85604a1..e822edc

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I10795518d8ee4aa479cbe438e6f45435efa06e75
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3752927
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#81620}

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/d7cbf23..7542172

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/bb07d9e..1601b3e

Rolling v8/third_party/fuchsia-sdk/sdk: version:8.20220707.3.1..version:8.20220708.2.1

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: Icd70e3227156255a46109d7c6a855e42c172880c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3752926
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#81619}

https://chromium.googlesource.com/external/github.com/tc39/test262/+log/b458b9f0..3ddfa0cd

Bug: v8:7834
Change-Id: Ic60850ed5d5a2126b76c09747a969002781f17f8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3752614Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81618}

Rolling v8/third_party/google_benchmark/src: https://chromium.googlesource.com/external/github.com/google/benchmark/+log/ac8a6d3..1531ee0

Correct typo in Passing Arguments section (Dominic Hamon)
https://chromium.googlesource.com/external/github.com/google/benchmark/+/1531ee0

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com,mlippautz@chromium.org

Change-Id: I555facbfc372fe7736042efb4234a4d35aec2ff0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3752346Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81617}

This adds "annotated hexdump" as a disassembly output format, as a
first step only for individual functions:

$ out/x64.release/wami my_module.wasm --single-hexdump 17

"Annotated hexdump" format is useful for debugging/inspecting module
wire bytes, and for creating array literals for regression tests.

Change-Id: Iabfb4f9c6f68f3328910c1225a23b424e9315d4f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3748652
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81616}

Bug: v8:12783
Change-Id: Ib23aa682054bfcf35efe1adef64fc97afe8f9619
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3743642Reviewed-by: Darius Mercadier <dmercadier@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81615}

Add a concept of "register snapshots" which snapshot the end-state
of the register allocation for a node (i.e. the state of the register
allocation when the node's code completes). These can be requested by
nodes, so that they know which registers need to be kept alive by the
node, and which of those are tagged.

Nodes can then use this information to temporarily spill registers
across a deferred call, without requiring the register allocator to
spill them unconditionally on the non-deferred path. The maglev
safepoint table has support for these additional spilled registers.

Bug: v8:7700
Change-Id: Id0052b5da86dd263f9019b1433fe5994a472a5b1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3751203
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81614}

Mostly src/codegen, src/compiler, src/interpreter, src/libplatform.

Drive-by: Remove some unreachable code.

Bug: v8:13006
Change-Id: I1a9467f7e42531c545f660d35416c388e8ef9d3c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3749193
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81613}

It is currently incorrect and causing issues, put it behind a flag so
that we can fix these issues while working on the rest of maglev in
parallel.

Bug: v8:7700
Change-Id: Idab7056db1236366410c30c06473016842aee5ab
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3748659
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81612}

Merging register values can encounter constants, which are loadable but
don't have spill slots. Add support for these (in practice this is the
same behaviour, we're just fixing a DCHECK).

Bug: v8:7700
Change-Id: I9ab8ba1fc3a3a64fe16668bb317ad02f878f5849
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3749579
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81611}