The validation was too strong in the case where the incrementation
produces type None.

Bug: chromium:1236716
Change-Id: I948b370594fa7dad1ba6e5b951f473855bf1346b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3097865Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76338}

Bug: v8:12060
Change-Id: Ie78329cd6e9f8b19e3be0ccc0c14ae4a1995fb9d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3098189Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76337}

Bug: v8:12111
Change-Id: Iaee1f4273c9e7f273bd76ffba5fc60d7507a833d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3097450Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76336}

- Use early return
- Add exception_string read-only root

Change-Id: Iba935a4a0308d21ced2693047fdf217b7f9e62f4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3097884Reviewed-by: Patrick Thier <pthier@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76335}

Namely:
%kDisableOptimizationFinalization
%WaitForBackgroundOptimization
%kFinalizeOptimization

Bug: v8:12091
Change-Id: Iea6c5e1d0c88b62fd02b240b20b0fca0fb79451f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3097878Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Auto-Submit: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76334}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/a0d5191..536c882

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/src/buildtools/+log/6810b87..6f9b470

Rolling v8/third_party/aemu-linux-x64: kjigTwWNxlU1rn_26vpSH5hoVlSnC4w1rFJHyivz5PQC..JV2fBSeIQc_xaqKsVDvLIvDmvx2ejeL-Y75N37PloLMC

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/126f6a8..77a7089

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/0c42eff..c4e2b36

TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I798a7427a6708d38f65b675fffa6c9f6bc521553
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3098690Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#76333}

Stage 3 proposal
R4T: https://groups.google.com/a/chromium.org/g/blink-dev/c/e4Ict1TT9FE/m/aq69ne3rBAAJ
I2S: https://groups.google.com/a/chromium.org/g/blink-dev/c/-6bANPdHR7c/m/netwFVfEAQAJ
Spec: https://tc39.es/proposal-intl-extend-timezonename/
https://chromestatus.com/guide/edit/4506375298220032
LGTM1:bratell.d@gmail.com
LGTM2:chrishtr@chromium.org
LGTM3:tkent@chromium.org

Bug: v8:11661
Change-Id: I1e92ac473dd42f6238feebe9ac8dad6be96ac210
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3088518
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76332}

Fix build failed with:
is_component_build = true
use_goma = true

Change-Id: Ia06175c091e94e36aa71c134b056b4d6b88e5c96
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3098826Reviewed-by: Ji Qiu <qiuji@iscas.ac.cn>
Reviewed-by: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/master@{#76331}

Stage 3 proposal
Spec: https://tc39.es/intl-displaynames-v2/
R2T: https://groups.google.com/a/chromium.org/g/blink-dev/c/XOJE7zVlxnI/m/cnkuazxHAwAJ
I2S: https://groups.google.com/a/chromium.org/g/blink-dev/c/uld_YkbzL0Q/m/L7VjjNTDAQAJ
Design Doc: https://docs.google.com/document/d/17hQz4nOC7PJYhxc_MU-BRoT6BnYGZv66XlU1iGX0ywQ
LGTM1:bratell.d@gmail.com
LGTM2:chrishtr@chromium.org
LGTM3:tkent@chromium.org

Bug: v8:11637
Change-Id: I555c5425ff5ee5854a43608aa56ee5399651408a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3087976Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76330}

Change-Id: If641c8a4a466f6f9ea1dc9d8c15184fab17f52c7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3098008
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76329}

Change-Id: I6f0bdcedb55bc673ac7381ac94bca3e17e360e21
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3097449
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Reviewed-by: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/master@{#76328}

This is a reland of a3b2c4ec

The fix is in PS3, for UBSan. We use WriteUnalignedValue for
potentially unaligned memory writes.

Original change's description:
> [wasm][diagnostics] Support WasmCode in gdb JIT integration
>
> - Add new enum WASM_CODE to JitCodeEvent::CodeType
> - Use AddressRegion instead of AddressRange (remove the latter)
> - Change CodeDescription constructor to take an AddressRegion,
>   both JIT_CODE and WASM_CODE use this
> - Add a simple mjsunit test that sets --gdbjit to check that
>   we don't crash.
> - Add a api test for adding WASM_CODE
>
> Bug: v8:11908
> Change-Id: I6e87fadc2df67978144d78caf9800c3982bc3705
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3067754
> Reviewed-by: Adam Klein <adamk@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Zhi An Ng <zhin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#76271}

Bug: v8:11908
Change-Id: I5ded6d01cff40803b2f70525163f760edcf97165
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3093506Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76327}

When the ToString Torque builtin has already found and called a
`toString` or `valueOf` method on a JSReceiver, and still needs
to call the runtime afterwards, it should do so with the result
of that first step, as opposed to the original input.

Fixed: v8:11689
Change-Id: I672249f9a6c230c3e61921b043f372c25a0178cf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3097270Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76326}

Adds a heap verification GN arg to gate the marking verifier and live
bytes verification on. The flag may be used in future for other more
expensive checks as well.

Currently, the flag is automatically enabled in dcheck_is_on and debug
builds.

The change enables live bytes verification for the library in regular
debug builds which may flush out issues.

Bug: v8:11785
Change-Id: I0f41bc0d76ebea9f6a8c9315c947598015ee5d68
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3097868
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76325}

Change-Id: I1fec4575a84d22488fb6d572b302810655c78240
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3097811Reviewed-by: Milad Fa <mfarazma@redhat.com>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/master@{#76324}

This ensures that we have enough slack to land or merge important fixes
(and temporarily coming closer to the limit).
If the static assertion is ever violated, we should immediately create a
tracking bug to free some opcode space. Temporarily reducing the
required slack (16 in this CL) is OK then.

R=zhin@chromium.org

Bug: v8:12093
Change-Id: I0934061c38cefb713ae83ccc4d81791dc4b2d312
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3097281Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76323}

This is a reland of e2016cf0. The fix is
in PS2, with a comment why it is needed.

Original change's description:
> [d8] Use predictable platform if --predictable is passed
>
> We currently only use the predictable platform if --verify-predictable
> is passed, which is confusing and not following the comment on the
> --predictable flag ("enable predictable mode").
>
> This CL fixes that and makes --verify-predictable imply --predictable to
> also allow to only pass --verify-predictable.
>
> R=ahaas@chromium.org
> CC=mlippautz@chromium.org
>
> Bug: v8:11879
> Change-Id: Ifb9683ddc4fab374ce519169533c90244175bb48
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3094010
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Commit-Queue: Clemens Backes <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#76305}

Bug: v8:11879
Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_isolates_rel_ng
Change-Id: I7bb7a6af722ee1cc447bc668385543dd72fd309b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3097867
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76322}

Change-Id: I908854415c0d86d44f3b2b011c8b72df707421e5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3097810Reviewed-by: Milad Fa <mfarazma@redhat.com>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/master@{#76321}

In this particular case, a comment in the code provides sufficient
protection against regressions.

No-Try: true
Fixed: v8:12087
Change-Id: If9cad800bcc822b7b5ab91669ccda8b4314009f7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3098185
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76320}

Bug: v8:7790, chromium:1239122
Change-Id: Id2f72035c968fba859be8b4685385b3f543eee2a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3094008
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76319}

We can reuse part of ConcurrentLookupIterator::TryGetOwnConstantElement
to read a char from a string concurrently.

Bug: v8:7790, v8:11012
Change-Id: Iaa75e0cdb457963e89e6bbbdb79766502286cc2d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3097277
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76318}

Change-Id: I7826df99d08cd8732fa1db0b1540457971428efa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3097873Reviewed-by: Milad Fa <mfarazma@redhat.com>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/master@{#76317}

Change-Id: Idcb68ad86edbd1855c41532f776d0e7f42b7223b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3097872Reviewed-by: Milad Fa <mfarazma@redhat.com>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/master@{#76316}

Change-Id: I65a96957216856d334303968f954c035b355f547
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3097871Reviewed-by: Milad Fa <mfarazma@redhat.com>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/master@{#76315}

Change-Id: I3d166575a5828b4ac1a1a7d11e5f67460428a00c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3097870Reviewed-by: Milad Fa <mfarazma@redhat.com>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/master@{#76314}

Also remove remnants of x87 port.

Change-Id: I3376539504d2a04c9f918ab39d0976eaca31782f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3097866
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76313}

Change-Id: I6573caaead1c402265469ce7ec4e14f51d770e79
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3097386Reviewed-by: Milad Fa <mfarazma@redhat.com>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/master@{#76312}

The {CodeSpaceWriteScope} in {InstanceBuilder::Build} was kept open
while processing imports, which could compile another wasm module via
{compiler::ResolveWasmImportCall} and
{WasmEngine::SyncCompileTranslatedAsmJs}. This leads to errors since
{CodeSpaceWriteScope}s for different modules cannot be held open at the
same time.

This CL fixes that by only opening the {CodeSpaceWriteScope} for the
actual compilation of import wrappers.

Drive-by: Only call {ProcessImports} if there are imports to be
processed, to avoid some of the overhead of {ProcessImports} and
{CompileImportWrappers}.

R=jkummerow@chromium.org

Bug: chromium:1239522
Change-Id: Ifbaf64a4be92088ae4a3fd7e9700a33397b2a967
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3097283
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76311}

This commit updates the comment for the AddData methods which currently
refer to GetDataFromSnapshot, and changes them to
GetDataFromSnapshotOnce instead.

Change-Id: Id09d187eccf645338e2c75b8b692c15a904c8357
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2301929Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76310}

No-Try: true
Change-Id: Icfcf3c264968b6577165a6ef591892dd35c6f3dd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3097272
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76309}

Bug: v8:12008
Change-Id: I2e1d918a1370dae1e15919fbf02d69cbe48f63bf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3089095Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76308}

Allows atomic loading of an unsigned 32bit value from 64bit widths.

Bug: v8:12093
Change-Id: Ib6ca2f3f44d4e82e5e41bf1ca0494e48ca90a21a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3096888Reviewed-by: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Auto-Submit: Liu yu <liuyu@loongson.cn>
Cr-Commit-Position: refs/heads/master@{#76307}

This reverts commit e2016cf0.

Reason for revert: TSan issues: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20TSAN%20-%20isolates/16209

Original change's description:
> [d8] Use predictable platform if --predictable is passed
>
> We currently only use the predictable platform if --verify-predictable
> is passed, which is confusing and not following the comment on the
> --predictable flag ("enable predictable mode").
>
> This CL fixes that and makes --verify-predictable imply --predictable to
> also allow to only pass --verify-predictable.
>
> R=​ahaas@chromium.org
> CC=​mlippautz@chromium.org
>
> Bug: v8:11879
> Change-Id: Ifb9683ddc4fab374ce519169533c90244175bb48
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3094010
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Commit-Queue: Clemens Backes <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#76305}

Bug: v8:11879
Change-Id: I8a76c1d1dcfefd296b9cca959192af63aa1219bb
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3097282
Auto-Submit: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#76306}

We currently only use the predictable platform if --verify-predictable
is passed, which is confusing and not following the comment on the
--predictable flag ("enable predictable mode").

This CL fixes that and makes --verify-predictable imply --predictable to
also allow to only pass --verify-predictable.

R=ahaas@chromium.org
CC=mlippautz@chromium.org

Bug: v8:11879
Change-Id: Ifb9683ddc4fab374ce519169533c90244175bb48
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3094010Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76305}

We need to drop the object and the rtt from the liftoff stack before
loading the result.

Bug: v8:7748
Change-Id: Idbd4878ededc35892c951cafb3f8a8298133adff
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3094015Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76304}

The static limit didn't account for possible S128 elements.
This patch makes the limit element type specific.

Fixed: chromium:1237024
Change-Id: Ic1e37656e2882c0eb7ea6400c83e4094eb747e88
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3097269Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76303}

This reverts commit a4a152ec.

Reason for revert: We haven't seen the flakes in a while, we can re-enable functionality

Original change's description:
> Reland "[debugger] Try to trigger pause-on-oom flakes with an extra printf"
>
> This is a reland of 8f7e9158
>
> Original change's description:
> > [debugger] Try to trigger pause-on-oom flakes with an extra printf
> >
> > We have an issue that we can't repro locally. Enable back the
> > pause-on-oom tests with an extra printf with DEBUG. We will be able to
> > better assess the failures when they appear on the bot.
> >
> > Bug: v8:10876
> > Change-Id: I066539c4b5865ecb6f2e589e9543e8c9ebd4830b
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2474782
> > Reviewed-by: Peter Marshall <petermarshall@chromium.org>
> > Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> > Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#70558}
>
> Bug: v8:10876
> Change-Id: Ice31c9455830da320ab057293c341f69e1f0c510
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2484799
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Reviewed-by: Peter Marshall <petermarshall@chromium.org>
> Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70643}

Bug: v8:10876
Change-Id: I901d31e1e92bfef0b2917ea611354618e5cda585
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3071404Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76302}

The snapshot merges nodes with their back ref if one exists.
The implementation assumed that the back ref state already has its node
set. However it's possible for the node to be set later.
If the node is not set yet, we stash the back ref and update it after
setting the node.

Bug: chromium:1239144
Change-Id: If6e18cdc0e25ff13bd09218791e3f1052ea0dda8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3094009
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76301}

Bug: v8:12092
Change-Id: Ibca6082c28cfd5b23680d554b692bc8ab60cb416
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3094013Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76300}

The assumption doesn't necessarily hold on linux and Android either.

Bug: chromium:1056170, chromium:1239287
Change-Id: Ibb0d8f5f814580bff4e8a7dce9a3397df1385896
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3097273Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76299}