This CL fixed cmpq in TestMoveSmi by using cmp_tagged and further
optimizes Move(Register, Smi) for 31-bit negative Smi.

To move a Smi of -1 to register, the disassembly before the commit is as:
48c7c0feffffff    REX.W movq rax, 0xfffffffe

The disassembly after the commit is as:
b8feffffff        movl rax, 0xfffffffe

Bug: v8:12696
Change-Id: I6fafeec7959491ba8b084acf797c58910c2928fa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3514654Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Haoyu Zhang <haoyu.zhang@intel.com>
Cr-Commit-Position: refs/heads/main@{#79475}

This reverts commit 6e2c9bb2.

Reason for revert: Fails layout test: external/wpt/wasm/serialization/arraybuffer/transfer.window.html

Original change's description:
> [serialize] copy bytes for non detachable array_buffer
> in WriteJSArrayBuffer when array_buffer is not in
> array_buffer_transfer_map_
>
> According to https://html.spec.whatwg.org/multipage/structured-data.html#structuredserializeinternal
> steps 13.3.2-4, should normally serialize array buffer which
> is not detachable
>
> Bug: v8:12703
> Change-Id: I4554c5d07ae85e1a96a728ebba04c6a071575f6f
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3518910
> Reviewed-by: Marja Hölttä <marja@chromium.org>
> Commit-Queue: Marja Hölttä <marja@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#79466}

Bug: v8:12703
Change-Id: I548ab191ab7d0f8fa699958396a5e32e34d39568
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3524742
Auto-Submit: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#79474}

Rolling v8/third_party/google_benchmark/src: https://chromium.googlesource.com/external/github.com/google/benchmark/+log/4f77cf9..9a71e5d

Add BENCHMARK_STATIC_DEFINE to the Python bindings' `cc_binary` local defines. (#1369) (Nicholas Junge)
https://chromium.googlesource.com/external/github.com/google/benchmark/+/9a71e5d

Update LICENSE file to clearly state which file needs BSD 3 (#1366) (Vy Nguyen)
https://chromium.googlesource.com/external/github.com/google/benchmark/+/4a1943d

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com,mlippautz@chromium.org

Change-Id: Ib3d07292d03783c5c473df650011c4acb867449a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3524089
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#79473}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/5d2dc59..18a1f19

Rolling v8/buildtools/linux64: git_revision:f27bae882b2178ccc3c24f314c88db9a34118992..git_revision:bd99dbf98cbdefe18a4128189665c5761263bcfb

Rolling v8/buildtools/third_party/libc++abi/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi/+log/289d52c..a897d0f

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/b326cac..63a615b

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/c848a4e..3481645

Rolling v8/third_party/googletest/src: https://chromium.googlesource.com/external/github.com/google/googletest/+log/ae1b7ad..ae5e06d

Rolling v8/third_party/zlib: https://chromium.googlesource.com/chromium/src/third_party/zlib/+log/85bdd64..b0676a1

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I7178731823e068efe7bd23b862d60b4f4f701bc6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3524088
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#79472}

Port: c69b0c80

Change-Id: Ie29079f976c7ab6fa14e5edc1da296a9e75b1bcf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3523822Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#79471}

This CL moves the call to GCTracer::StopCycle for the full GC from
Heap::CompleteSweeping full, which is called to force sweeping to
finish, to GCTracer::NotifySweepingComplete, which is called as soon
as sweeping finishes --- and symmetrically to a new method
GCTracer::NotifyCppGCCompleted, which is called as soon as sweeping
of the managed C++ heap finishes. In this way, a full GC cycle is
reported as soon as sweeping is finished both for the V8 and the C++
managed heap.

The changes introduced in this CL are essentially a partial revert of
https://crrev.com/c/3456563, fixed in such a way that when the full
GC cycle is reported, the current tracer event will be the correct
one corresponding to that cycle.

Bug: v8:12503
Bug: chromium:1154636
Change-Id: Icea07cf35a9565994e798b0500e9da72cd95f9ac
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3497318Reviewed-by: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79470}

This reverts commit 3d5d99ff.

Reason for revert: causes this crash: https://bugs.chromium.org/p/chromium/issues/detail?id=1303458

Original change's description:
> [compiler] let InstructionSelector duplicate branch conditions
>
> Bug: v8:12484
> Change-Id: I44c2028efadbd70e7711f01d107995e0462f05d4
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3477094
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Commit-Queue: Darius Mercadier <dmercadier@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#79239}

Bug: chromium:1303458, v8:12484
Change-Id: I129467bcb2507f2fba894f5dd58304eb139f739c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3522069Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Darius Mercadier <dmercadier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79469}

strict parameters error before parse parentheses expression
in ParsePrimaryExpression

clear last next_arrow_function_info tracked strict
parameters error, avoid throw syntax error when parse
arrow function nested in a parentheses expression.

Bug: v8:12688
Change-Id: Ib190ff5e04c9a83329c59421e9dd44f5a5907b07
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3516729Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79468}

Bug: v8:7700
Change-Id: Ib3b3f453e162e0913b8077ac8f8b9e2273deaed9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3521783
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79467}

in WriteJSArrayBuffer when array_buffer is not in
array_buffer_transfer_map_

According to https://html.spec.whatwg.org/multipage/structured-data.html#structuredserializeinternal
steps 13.3.2-4, should normally serialize array buffer which
is not detachable

Bug: v8:12703
Change-Id: I4554c5d07ae85e1a96a728ebba04c6a071575f6f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3518910Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79466}

Running `OS::AllocatePageSize()` on PPC simulator (which
runs on x64 Linux) will make a `sysconf(_SC_PAGESIZE)` call
which returns the native x64 Linux page size and not the PPC
specific page size.

This can cause a problem if used along side the current value of
`kPageSizeBits` which is set to use PPC value even on Sim.
As an example a newly added DHCECK under https://crrev.com/c/3497363
was failing on PPC Sim as a call to `AllocatableMemoryInDataPage`
was being made which used kPageSizeBits on Sim.

Meanwhile another function was using the `page_size_bits` value which
gets set by _SC_PAGESIZE. The mismatch caused an incorrect final value
being generated which failed the DCHECK.

Change-Id: Iaf2d9cff16bbe5f6be5f3ec6a13b99be94776f48
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3519758Reviewed-by: Junliang Yan <junyan@redhat.com>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#79465}

The fuzzers were passing the flag --es-staging which doesn't exist. This
CL updates them to pass the flag --harmony which does exist.

Change-Id: I02c83026e5b9bdf49e51e700f16702bf56cd49e8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3522064Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79464}

If a value is in multiple registers, pick one of them to be freed.

Bug: v8:7700
Change-Id: I1886b977187b4d8e939ff106edde4ccf716661d7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3522063
Auto-Submit: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79463}

The CL implements binary operations bytecodes as generic nodes that
call the correspondent runtime builtin.

Bug: v8:7700
Change-Id: I82c5e20e4103d4ef367184af1242bae7f7f93fe0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3509392Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79462}

- inline Array.prototype.indexOf in js-call-reducer
- inline Array.prototype.includes in js-call-reducer

Bug: v8:12390
Change-Id: Idb5669da3019f0f56af0084fccd1d616d4c5098e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3473994Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79461}

Modernise the RegList interface to be a proper class, rather than a
typedef to an integer, and add proper methods onto it rather than ad-hoc
bit manipulation.

In particular, this makes RegList typesafe, adding a DoubleRegList for
DoubleRegisters.

The Arm64 CPURegList isn't updated to use (or extend) the new RegList
interface, because of its weird type-erasing semantics (it can store
Registers and VRegisters). Maybe in the future we'll want to get rid of
CPURegList entirely and use RegList/DoubleRegList directly.

Change-Id: I3cb2a4d386cb92a4dcd2edbdd3fba9ef71f354d6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3516747
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79460}

Instead of implementing ExternalObjects as plain JSObjects with a single
EmbedderDataSlot pointing to a Foreign containing the actual raw
pointer, this CL now creates a new JSExternalObject type that directly
contains the external pointer.

As a side-effect of this refactoring, nullptr values are now no longer
valid for ExternalObjects.

Change-Id: Ic8ff334681c966e823ca70f34dd1efaaa21a0789
Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3513234Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Samuel Groß <saelo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79459}

Bug: v8:11525
Change-Id: I582f17d6ecfa47394bc29692f788c5119aac5ce9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3516745Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79458}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/43a4f0e..5d2dc59

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/271796d..b326cac

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I1c8b08d850885bbadbd471a770211f1e98f8ba21
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3517971
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#79457}

This CL fixes a deopt loop that might happen in case of mixing
Number with BigInt in bitwise binary operations.

Bug: v8:12693
Change-Id: Ib6a08d0c74a954ade3719bd6bd49ca2988d88e69
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3505542Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Jianxiao Lu <jianxiao.lu@intel.com>
Cr-Commit-Position: refs/heads/main@{#79456}

Rolling v8/third_party/google_benchmark/src: https://chromium.googlesource.com/external/github.com/google/benchmark/+log/705202d..4f77cf9

Fix float comparaison and add float comparison warning (#1368) (Bensuperpc)
https://chromium.googlesource.com/external/github.com/google/benchmark/+/4f77cf9

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com,mlippautz@chromium.org

Change-Id: Ibe4d4953920ea1415fadaca1a636750f9590c881
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3520366
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#79455}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/6bce1d6..43a4f0e

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I03b8c3002da073209e092ba1204646ad7f856aeb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3520362
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#79454}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/797674d..6bce1d6

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I9f375f81935d563070e636468cf483b9fff66f46
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3517461
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#79453}

Change-Id: I4378e4f99c6b034f7b29782218896d5485178109
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3514656
Auto-Submit: Yu Liu <liuyu@loongson.cn>
Reviewed-by: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/main@{#79452}

Change-Id: I23b76ec7bdf0f1997815f4928d903a9807413129
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3516829Reviewed-by: ji qiu <qiuji@iscas.ac.cn>
Auto-Submit: Yahan Lu <yahan@iscas.ac.cn>
Commit-Queue: Yahan Lu <yahan@iscas.ac.cn>
Cr-Commit-Position: refs/heads/main@{#79451}

Rolling v8/third_party/google_benchmark/src: https://chromium.googlesource.com/external/github.com/google/benchmark/+log/a25f3cd..705202d

Add PyPI upload job to wheel building workflow (#1359) (Nicholas Junge)
https://chromium.googlesource.com/external/github.com/google/benchmark/+/705202d

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com,mlippautz@chromium.org

Change-Id: Ib5833d20ced99bd3b949e2df848a300511087df1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3517453
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#79450}

vector register has different register file from float register in Risc64 rvv extension.
So this cl add third FPalising kind INDEPENDENT to allocate independently simd register.

Bug: v8:11976

doc: https://docs.google.com/document/d/1UwmUwOI3eeIMYzZFRmeXmfyNXRFHNZAQ4BcN0ODdMmo/edit?usp=sharing

Change-Id: I0fb8901294b4bc44b0bee55e630b60460e42bef2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3383513Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Auto-Submit: Yahan Lu <yahan@iscas.ac.cn>
Commit-Queue: Yahan Lu <yahan@iscas.ac.cn>
Cr-Commit-Position: refs/heads/main@{#79449}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/ea42de6..797674d

Rolling v8/buildtools/linux64: git_revision:46f94b5a7f5527b5d7ef57271d3e9447a65e22ac..git_revision:f27bae882b2178ccc3c24f314c88db9a34118992

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/5b79b29..271796d

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/37db69d..c848a4e

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/548c235..85f3c90

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I296568003a80edfc45f05bd7af9ccf1715df1103
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3517449
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#79448}

when BuildCreateArrayLiteral

In spread calls, create array literal boilerplates for
BuildCreateArrayLiteral rather than emit array literals
without any boilerplates

Bug: v8:11582
Change-Id: Ia0538bd043eab040c3059440e982c7f0037d1a3f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3507126Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79447}

Explicitly #include climits header for CHAR_BIT.

Bug: v8:12691
Change-Id: I9d7a28543883a5387e006c4b6ee4491243a06207
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3516925
Auto-Submit: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79446}

The scope can be (and is) used by compiler threads, i.e. not just by the
main thread; update the comment.

Change-Id: Ifbeb414761cee4ab12dd953f0cd544f35c92fc8a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3516037
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79445}

Store the total committed physical memory in
SemiSpace::committed_physical_memory_ and keep it up-to-date when
adding/removing pages from it, similar to the PagedSpace.
So far we were iterating all pages in the SemiSpace to calculate this
value.

Bug: v8:12691
Change-Id: Iaf3c5eadd60db561a6ddb06014f82703b0df6873
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3513836Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79444}

This is a reland of 2dc40370

Original change's description:
> [compiler] Improve code generated for patterns like "x >> 1 == 0"
>
> Change-Id: I79575ba61a3bdea93468f48d66a3cb3edd0e1442
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3506504
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Commit-Queue: Darius Mercadier <dmercadier@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#79419}

Change-Id: Iad111f8d4bb40a295903dd67f66c8ecd9c4eadd9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3514072Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Darius Mercadier <dmercadier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79443}

Move the check for whether an object is live or dead out of the
prefinalizer trampoline. Moving it into the backend allows for
inlining the check which avoids a call to the trampoline for live
objects.

On catapult benchmarks (e.g. cnn:2021, nytimes:2020), there's often
~2k finalizers registered. In order to avoid memory overhead in the
range of a few KB, we store the fact whether the object points to the
base object payload in the LSB of the pointer. For caged builds this
is replaced with just storing the index into the cage for both object
and base object payload.

Locally saves around ~10% of atomic sweeping processing time which is
in the order of .05ms.

Bug: v8:12698
Change-Id: I198205a6b1d57fc2df821ee4e73e53dc6f825ff5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3497764Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79442}

Bug: v8:11525
Change-Id: I0580787252ab235222e9b9fb2d677015794207eb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3506485Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79441}

The CL runs Oilpan minor GCs after each Scavenger cycle.

Bug: chromium:1029379
Change-Id: Ic67cf4dc9158759207f0209640f1720bf188cc1d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3472500Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79440}

When the Isolate is already available, there is no need to fetch it
through GetIsolate.

Change-Id: I3ddc3d46924b401f154360564b203406a9b9e8e5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3510389
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79439}

Drive-by-fix:
- Use explicit casts to HeapNumber in NumberToXXX methods

Bug: v8:11263
Change-Id: If99af3ccee33a299d9f42cd39b87b6935a555f83
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3512618Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79438}

... for 32-bit Windows.

When the TLS value is not set the TlsExpansionSlots field of the TEB
struct might be NULL in which case the InternalGetExistingThreadLocal
should return NULL too.

Bug: v8:12653
Change-Id: Ic6c6d8e51e2447551c372720fad0967e9201f3dc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3513835
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79437}

When compiled with `target_cpu = "x86"` several
VirtualAddressSpaceTest's crashed with segmentation fault when calling
VirtualAlloc2. Explicitly specifying calling convention fixed the issue.

Change-Id: Ie505006be0d44525c935c89b84caa2c373cea566
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3501836Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Auto-Submit: Dmitrii Tsykunov <dtsykunov1@yandex-team.ru>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79436}