This prevents ambiguity errors in C++20 due to ADL when casting types in
std::, which gains std::bit_cast<>().

Bug: chromium:1284275
Change-Id: I25046d1952a9304852e481ad8b84049c6769c289
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3625838
Auto-Submit: Peter Kasting <pkasting@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80378}

The write protection of code memory with mprotect is too expensive for
lazy compilation. As the usefulness of this memory protection is
limited anyways, this CL disables the memory protection in case lazy
compilation is enabled.

Bug: v8:12852
Change-Id: I4c56d4021a7b594e24a4d3d28a130a309c56de38
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3627596Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80377}

Bug: chromium:1218005
Change-Id: I3df750ee9101779952d8b1ae630c4d3b7563084b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3578645Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Samuel Groß <saelo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80376}

NOTRY=true

Bug: v8:12842
Change-Id: If3cac473407fc60523de5924170b7c3b99074d54
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3629546
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Auto-Submit: Almothana Athamneh <almuthanna@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80375}

This is a reland of commit 507fa4d7

This CL moves the NewJSObjectFromMap after deserializing object properties with dictionary map and fixes the DCHECK failure in JSReceiver::HasFastProperties when triggering GC.

Original change's description:
> [web snapshot] Add support for object with dictionary mode
>
> This CL adds the serialization support for object properties
> with dictionary map. Shape id is used to distinguish between if the object has dictionary map. And add TODO to support “no map objects” which can have fast map and “objects with map” which needs to be turned to dictionary mode.
>
> Bug: v8:11525
> Change-Id: If3eb4195115a41d4a3f6cc7372924b982ca96fc1
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3621593
> Commit-Queue: 王澳 <wangao.james@bytedance.com>
> Reviewed-by: Marja Hölttä <marja@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#80366}

Bug: v8:11525
Change-Id: I88422d698aa03fb7d3b21b5709eec2d0cf306256
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3629738
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80374}

Based on the robust test suite for checking property "has/in" queries, with the intention
of measuring the performance of accessing getOwnPropertyDescriptor.

Background: getOwnPropertyDescriptor and defineProperty were identified as hot code taking up
a significant chunk of startup time in a customer application. This benchmark aims to measure
the difference made by a modifying Object.getOwnPropertyDescriptor.

By current measurements, the geometric mean time of the new version is typically 1/6 that of
the current upstream implementation, using this test specifically (however, only on arm64 /
Apple M1... On Linux/x64, the results look more reasonable at a roughly 5-12% improvement in
score).

In its current form, this benchmark does very little to attempt to verify the results of the
object, which may result in branches being discarded in Turbofan (but given the enormous
difference between x64 and arm64, I'm not positive this is what is happening, and have not yet
verified this).

BUG=

Change-Id: I0f10735315313ed97efd00fcccaedc1272d4d314
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3624979
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80373}

NOTRY=true

Bug: v8:12826
Change-Id: Ibe1bad5837221903a7a47af7f2cc49963952a67e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3629335Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Auto-Submit: Almothana Athamneh <almuthanna@chromium.org>
Commit-Queue: Almothana Athamneh <almuthanna@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80372}

Consider the following

  * A ValueNode has inputs A and B
  * Input A has later uses, input B doesn't
  * The ValueNode's result must be in the same register as A

It can then happen that UpdateUses frees B, and the result allocation
emits a gap move from A's register to B's old register (now free) to
preserve the value of A when the ValueNode writes into its register.
This gap move is emmitted before the ValueNode start, which means that
it clobbers B.

Now, UpdateUses only clears registers _after_ node result allocation, so
that the known free registers are still the ones before updating uses.

Done naively, this would have bad consequences -- in the case where A
has no later uses, it would still force the regalloc to save its value
thinking that it is still live. So, this patch also introduces a concept
of "AllocationStage" where we're either allocating at the start or end
of a Node. Inputs are allocated at the start, results at the end. When
walking registers during an allocation, nodes whose lifetimes end at the
current node are considered to be dead at the "end" allocation stage,
and we are allowed to a) use their registers, and b) drop them without
preserving their value.

Bug: v8:7700
Change-Id: I5ca764ed04b12269f189577e81eb7e2a27cd1b09
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3625978
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80371}

Change-Id: I6dec06936cb12f2d6da69c1f147bea344c32cf73
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3629129Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Stephen Röttger <sroettger@google.com>
Cr-Commit-Position: refs/heads/main@{#80370}

NOTRY=true

Bug: v8:12826
Change-Id: I08be2980f92c69504290bb6152e48595e6a6c9aa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3629540
Auto-Submit: Almothana Athamneh <almuthanna@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80369}

This reverts commit 507fa4d7.

Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux%20-%20gc%20stress/38308/overview

Original change's description:
> [web snapshot] Add support for object with dictionary mode
>
> This CL adds the serialization support for object properties
> with dictionary map. Shape id is used to distinguish between if the object has dictionary map. And add TODO to support “no map objects” which can have fast map and “objects with map” which needs to be turned to dictionary mode.
>
> Bug: v8:11525
> Change-Id: If3eb4195115a41d4a3f6cc7372924b982ca96fc1
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3621593
> Commit-Queue: 王澳 <wangao.james@bytedance.com>
> Reviewed-by: Marja Hölttä <marja@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#80366}

Bug: v8:11525
Change-Id: I0d236a9937a5942b387553a61991716321b063e6
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3629541
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Owners-Override: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80368}

Bug: v8:7700
Change-Id: I6e77592e6a3603533414971b59ef1fb9b2f89657
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3629150Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80367}

This CL adds the serialization support for object properties
with dictionary map. Shape id is used to distinguish between if the object has dictionary map. And add TODO to support “no map objects” which can have fast map and “objects with map” which needs to be turned to dictionary mode.

Bug: v8:11525
Change-Id: If3eb4195115a41d4a3f6cc7372924b982ca96fc1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3621593
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80366}

This CL cleans up the existing experimental implementation of
conservative stack scanning. It retains the object start bitmap, to
evaluate it as a mechanism for resolving inner pointers, and the
conservative stack scanning visitor (which is currently not used).

The flag v8_enable_conservative_stack_scanning is kept and will be
used for experimental purposes. It currently does not imply any
other flag.

Bug: v8:10614
Bug: v8:12851

Change-Id: Id0ae0f437ed2601eed9ec634d2d1dd2f030d814e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3602516Reviewed-by: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Jakob Linke <jgruber@chromium.org>
Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80365}

Spec Text:
https://tc39.es/proposal-temporal/#sec-temporal.calendar.prototype.dateadd

is not yet implemented.

Note: The intl version stated in
https: //tc39.es/proposal-temporal/#sup-temporal.calendar.prototype.dateadd
Bug: v8:11544
Change-Id: Id7fd043d234f559c0e03bdf3f0f31d8bc91da27f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3609208Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80364}

Also change the macro to pass method name directly to CHECK_RECEIVER()
Remove MACROs which has up to only two usage.
Sync with changes in
https://github.com/tc39/proposal-temporal/pull/1693

Spec Text:
https://tc39.es/proposal-temporal/#sec-temporal.calendar.prototype.tojson
https://tc39.es/proposal-temporal/#sec-temporal.timezone.prototype.tojson

Bug: v8:11544
Change-Id: I31f4ef6f725462da885893f1266d30590098b031
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3438378Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80363}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/c812b8d..0c83e78

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/src/buildtools/+log/113378f..7208edd

Rolling v8/buildtools/third_party/libunwind/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind/+log/393e3ee..f1108b6

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/d3c4414..58f3286

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/13acea3..443d913

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/75625c6..3e15bc0

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: Ifb09ed901ef782997b4674b40d74edc013750482
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3626176
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#80362}

WASM only supports simd128, but modern CPUs support
up to 256 bit vector register or more, we will add an
experimental feature to do 256 bit re-vectorization
in Turbofan pipeline, this patch add simd256 machine
representation.

Bug: v8:12716
Change-Id: I1e6a3f2afa0a457fca2c261216f4113d0ed5b818
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3534456Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Jie Pan <jie.pan@intel.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80361}

Add AO: ISOMonthDayFromFields
Spec Text:
https://tc39.es/proposal-temporal/#sec-temporal.calendar.prototype.monthdayfromfields
https://tc39.es/proposal-temporal/#sec-temporal-isomonthdayfromfields

Bug: v8:11544
Change-Id: I8a04a8e61af8abdb902de33efbf5635b8e8300aa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3408576
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80360}

Spec Text:
https://tc39.es/proposal-temporal/#sec-temporal.calendar.prototype.month

Note- this is only the non-intl version. intl version in
https://tc39.es/proposal-temporal/#sup-temporal.calendar.prototype.month
will be implemented in later cl.

Bug: v8:11544
Change-Id: Ibbbb00faa0bdb4d49784cd9aae69fb779d95f924
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3531554
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80359}

Change-Id: I4003b30ec4f1e29a7c5d55a51cbf82fa3a7487e7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3585856
Commit-Queue: Vasili Skurydzin <vasili.skurydzin@ibm.com>
Reviewed-by: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/main@{#80358}

This reverts commit 2b79eefe.

Reason for revert: Speculative revert because of https://crbug.com/1322305

Original change's description:
> Reland^2: [heap] Store size with invalidated object
>
> This is a reland of commit 23b2d571
>
> When updating pointers during a full GC, a page might not be swept
> already. In such cases there might be invalid objects and slots
> recorded in free memory. Updating tagged slots in free memory is fine
> even though not strictly necessary.
>
> However, the GC also needs to calculate the size of potentially dead
> invalid objects in order to be able to check whether a slot is within
> that object. But since that object is dead, its map might be dead as
> well which makes size calculation impossible on such objects. The CL
> changes this to cache the size of invalid objects. A follow-up CL will
> also check the marking bit of invalid objects.
>
> Reason for reverts:
>
> Revert #2: In-object slack tracking on JSObjects doesn't update the
> cached size of invalidated objects. The fix here was to stop
> invalidating recorded slots on JSObjects at all and avoid that problem
> completely (see https://crrev.com/c/3620274).
>
> Revert #1: Not all size changes go through NotifyObjectLayoutChange, so
> https://crrev.com/c/3607992 introduced NotifyObjectSizeChange as a
> bottleneck for object size changes/right-trimming. This method is
> now used to update the size of invalidated objects.
>
> Bug: v8:12578, chromium:1316289
> Change-Id: I0478d04601c0270ddb39419ca6cf98719951eb4d
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3623542
> Reviewed-by: Jakob Linke <jgruber@chromium.org>
> Reviewed-by: Patrick Thier <pthier@chromium.org>
> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#80344}

Bug: v8:12578, chromium:1316289
Change-Id: I6dd2dd13583123b9cb7933b15e2113fddc0c0b0b
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3627511
Owners-Override: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80357}

Old gcc versions (< gcc-8) have problems with parameter packs in
capture-lists wrapped in fold-expressions.

Bug: chromium:1029379
Change-Id: I0c0ee7caa2d750f551e93fdfeb2667328bee4acb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3627594
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Anton Bikineev <bikineev@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80356}

This is temporary until we update our infra to always use --turbofan

Change-Id: Ie1ca8ce2cae6744515d9810ae4f57f00c8670e36
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3625977
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80355}

In the future we may want to cache this in a separate slot to turbofan
code, but for now cache maglev code in the same optimized code slot on
the feedback vector.

Bug: v8:7700
Change-Id: Idd40a024cc9beb9b4da06a88a3789d822ddd4ab7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3622916Reviewed-by: Jakob Linke <jgruber@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80354}

Bug: chromium:1322318
Change-Id: Id3899a493eb1519e2f7498dcad1e607cc2b6a5db
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3627509Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80353}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/c8ec41b..c812b8d

Rolling v8/buildtools/linux64: git_revision:48b013c9d9debc0f5fc1dd71a257b3c38c5acb43..git_revision:53ef169800760fdc09f0773bf380fe99eaeab339

Rolling v8/buildtools/third_party/libc++abi/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi/+log/c7888dd..ce96725

Rolling v8/buildtools/third_party/libunwind/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind/+log/d8a4746..393e3ee

Rolling v8/third_party/android_platform: https://chromium.googlesource.com/chromium/src/third_party/android_platform/+log/36c1580..5ecb463

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/9ba02ee..d3c4414

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/fccf35c..13acea3

Rolling v8/third_party/zlib: https://chromium.googlesource.com/chromium/src/third_party/zlib/+log/961141d..9979c19

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: Id96be288b2f8076e646031be4f3e2a72f4cca8e7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3626171
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#80352}

1. Retun value w/ newly added movable Maybe<>
2. Change arg passing from pointer to const ref.
3. Change some CHECK to DCHECK

Change-Id: Ia4e6c6031d8873c86df7ec178165dd23e75c571b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3606390
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Frank Tang <ftang@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80351}

Spec Text:
https://tc39.es/proposal-temporal/#sec-temporal-totemporaldatetime
https://tc39.es/proposal-temporal/#sec-temporal-totemporaldisambiguation

Bug: v8:11544
Change-Id: Ibb38f807386c4e213bfd2bb568911a96a17cf1be
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3623196Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80350}

Bug: chromium:1321078
Change-Id: I426327ffc3d7eebdb562c01a87039a93dfb79a88
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3620836
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80349}

Spec Text:
https://tc39.es/proposal-temporal/#sec-temporal.calendar.prototype.monthcode

Note- this is only the non-intl version. intl version in
https://tc39.es/proposal-temporal/#sup-temporal.calendar.prototype.monthcode
will be implemented in later cl.

Bug: v8:11544
Change-Id: I52dfc1bda6d2ed8c0aba735c64d7ae8227844ed1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3531555Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80348}

Spec Text:
https://tc39.es/proposal-temporal/#sec-temporal.calendar.prototype.day

Note- this is only the non-intl version. intl version in
https://tc39.es/proposal-temporal/#sup-temporal.calendar.prototype.day
will be implemented in later cl.

Bug: v8:11544
Change-Id: If56182cf65b3b8cc91ed843f0e20edeb6a065954
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3531556Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80347}

This reverts commit 0a5fcd8a.

Reason for revert: reenable TSAN test after moving best_fit out from stage

Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_isolates_rel_ng,v8_linux64_tsan_no_cm_rel_ng,v8_linux64_tsan_rel_ng,v8_numfuzz_tsan_ng;luci.chromium.try:linux_chromium_tsan_rel_ng,linux_chromium_tsan_rel_ng-compilator

Original change's description:
> [test] Skip flaking test
>
> Bug: v8:12697
> Change-Id: I124f2f0fd3c98d6a5233a0e2a8236a2b15d791fd
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3532261
> Auto-Submit: Manos Koukoutos <manoskouk@chromium.org>
> Reviewed-by: Victor Gomes <victorgomes@chromium.org>
> Commit-Queue: Victor Gomes <victorgomes@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#79518}

Bug: v8:12697
Change-Id: I53d109674ecd938d8be915099c412d174600edfc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3624464
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80346}

Relative indexing methods have shipped since M92.

Bug: v8:10961
Change-Id: I4346a3bed443c9cc48924e5ef23ec012eeeecab1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3622134Reviewed-by: Patrick Thier <pthier@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80345}

This is a reland of commit 23b2d571

When updating pointers during a full GC, a page might not be swept
already. In such cases there might be invalid objects and slots
recorded in free memory. Updating tagged slots in free memory is fine
even though not strictly necessary.

However, the GC also needs to calculate the size of potentially dead
invalid objects in order to be able to check whether a slot is within
that object. But since that object is dead, its map might be dead as
well which makes size calculation impossible on such objects. The CL
changes this to cache the size of invalid objects. A follow-up CL will
also check the marking bit of invalid objects.

Reason for reverts:

Revert #2: In-object slack tracking on JSObjects doesn't update the
cached size of invalidated objects. The fix here was to stop
invalidating recorded slots on JSObjects at all and avoid that problem
completely (see https://crrev.com/c/3620274).

Revert #1: Not all size changes go through NotifyObjectLayoutChange, so
https://crrev.com/c/3607992 introduced NotifyObjectSizeChange as a
bottleneck for object size changes/right-trimming. This method is
now used to update the size of invalidated objects.

Bug: v8:12578, chromium:1316289
Change-Id: I0478d04601c0270ddb39419ca6cf98719951eb4d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3623542Reviewed-by: Jakob Linke <jgruber@chromium.org>
Reviewed-by: Patrick Thier <pthier@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80344}

Also manually reformat some files with the clang-format change.

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/e10cf1a..c8ec41b

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/src/buildtools/+log/c2e4795..113378f

Rolling v8/buildtools/linux64: git_revision:7c8e511229f0fc06f6250367d51156bb6f578258..git_revision:48b013c9d9debc0f5fc1dd71a257b3c38c5acb43

Rolling v8/buildtools/third_party/libc++abi/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi/+log/518fd76..c7888dd

Rolling v8/buildtools/third_party/libunwind/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind/+log/705543f..d8a4746

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/88422dc..9ba02ee

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/dc8ca44..fccf35c

Rolling v8/third_party/zlib: https://chromium.googlesource.com/chromium/src/third_party/zlib/+log/32e65ef..961141d

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/3c4a622..75625c6

Rolling v8/tools/luci-go: git_revision:6da0608e4fa8a3c6d1fa4f855485c0038b05bf72..git_revision:2aa3d7e5e8662c5193059a490f07b7d91331933e

Rolling v8/tools/luci-go: git_revision:6da0608e4fa8a3c6d1fa4f855485c0038b05bf72..git_revision:2aa3d7e5e8662c5193059a490f07b7d91331933e

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I00a09d42cf91f226c661e97915d5a95fff84b079
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3615245Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Owners-Override: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80343}

Bug: v8:11525
Change-Id: Ifd24e32dac905d47af233fa01b93206ee9ebdb8c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3623739
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80342}

Bug: v8:11525,v8:12820
Change-Id: I58bde48322c89bf33f3b28080659387a3c14de91
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3620277
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80341}

Distinguish untrusted clients in v8 inspector and disable Profiler, HeapProfiler and Schema CDP domains for them.

Bug: chromium:1313437
Change-Id: I7544c64acb4bc368392ba5f6a87ed62176828304
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3616517Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Danil Somsikov <dsv@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80340}

No-Try: true
Bug: v8:12847, v8:11111
Change-Id: Id0c2749970333b82650b33c9cddcb028ac03709c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3623541
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80339}