Since next() comes from ThreadedListTraits, the users of this class
can modify the list by modifying the next pointer. This however breaks
the invariant that `tail_` points to the last element of the list.

We ensure this invariant lazily. This should be _almost_ no effect
for users that do not manually modify the next pointer.

Change-Id: If46283ab4fc5036a81f353b25823b0fd39b3e232
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3578803Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80042}

This is a reland of commit 6819f75d

Original change's description:
> Reland "Reland "[baseline] Enable concurrent sparkplug""
>
> This reverts commit 5d6a16fb.
>
> Reason for revert: it was a flake
>
> Original change's description:
> > Revert "Reland "[baseline] Enable concurrent sparkplug""
> >
> > This reverts commit fee91f9a.
> >
> > Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Mac64/44699/overview
> >
> > Original change's description:
> > > Reland "[baseline] Enable concurrent sparkplug"
> > >
> > > Issue that cause the revert was fixed: v8:12713
> > > https://bugs.chromium.org/p/v8/issues/detail?id=12713
> > >
> > > This is a reland of commit f01a6098
> > >
> > > Original change's description:
> > > > [baseline] Enable concurrent sparkplug
> > > >
> > > > Bug: v8:12054
> > > > Change-Id: I1b0ee1a9541a75412b882b259e421aa6e88317da
> > > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3259658
> > > > Auto-Submit: Victor Gomes <victorgomes@chromium.org>
> > > > Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> > > > Commit-Queue: Toon Verwaest <verwaest@chromium.org>
> > > > Cr-Commit-Position: refs/heads/main@{#79485}
> > >
> > > Bug: v8:12054
> > > Change-Id: Iafba22e3fa3b38eddb226db6cd5afdb7e3e6b435
> > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3528992
> > > Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> > > Commit-Queue: Victor Gomes <victorgomes@chromium.org>
> > > Cr-Commit-Position: refs/heads/main@{#79618}
> >
> > Bug: v8:12054
> > Change-Id: I3ba60433fdbb5617900c83d022e4dd6f830695f9
> > No-Presubmit: true
> > No-Tree-Checks: true
> > No-Try: true
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3550271
> > Auto-Submit: Tobias Tebbi <tebbi@chromium.org>
> > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > Owners-Override: Tobias Tebbi <tebbi@chromium.org>
> > Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
> > Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
> > Cr-Commit-Position: refs/heads/main@{#79619}
>
> Bug: v8:12054
> Change-Id: Ia0fe1df00f5e715ceda46fbcdc48aed0f0190362
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3550272
> Owners-Override: Tobias Tebbi <tebbi@chromium.org>
> Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Victor Gomes <victorgomes@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#79622}

Bug: v8:12054
Change-Id: I43bf2d8aa25a8dcf286c46be18c372aadfb55701
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3563559Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80041}

R=manoskouk@chromium.org

Change-Id: I931e8ab0847db5126c2895412b4b357d482dfeb1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3593782Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80040}

This CL speeds up one of the slowest builders on the CQ to improve overall CQ time.

R=machenbach@chromium.org,liviurau@chromium.org,alexschulze@chromium.org

Bug: v8:12810
Change-Id: I80adfb3abdea1ef7e14abf0a8c2dc2cc2b4d77d9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3593134
Auto-Submit: Tamer Tas <tmrts@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80039}

R=bmeurer@chromium.org

Bug: chromium:1303521
Change-Id: Iff7247fda94037ff4f9d37f334d386eb4e63ce62
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3595819
Commit-Queue: Simon Zünd <szuend@chromium.org>
Auto-Submit: Simon Zünd <szuend@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80038}

Doc: https://bit.ly/revive-restart-frame
Context: https://crrev.com/c/3582395 (whole feature)

This CL adds the second batch of inspector tests for the upcoming
"Restart frame" feature. Landing the tests upfront allows us to
better discuss the proposed API as well as think early about
corner cases we should test.

The tests check for the functionality of `Debugger.restartFrame`, as
well as the newly added parameter `canBeRestarted` in
the `Debugger.paused` event.

Bug: chromium:1303521
Change-Id: Ie9dda100cdc5217a4e4cc2f0cf7019a33d124120
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3585947Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Kim-Anh Tran <kimanh@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80037}

Bug: v8:12795, chromium:1316443
Change-Id: Ib4cbbad42da80dfb566e559e70db30a670cc4326
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3593221
Auto-Submit: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Jakob Linke <jgruber@chromium.org>
Commit-Queue: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80036}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/7aeed11..3dce554

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/28b8ede..e356f14

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/7d2693a..89ccf4a

Rolling v8/third_party/zlib: https://chromium.googlesource.com/chromium/src/third_party/zlib/+log/a6d209a..be2c378

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I27acb5fb4e6158fc69c0ec5b0ea225e1227a4782
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3595619
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#80035}

Port 4ae5a813

Original Commit Message:

    Having it around is an invitation to use it in new places. This CL
    removes the generic Dummy descriptor and replaces it by other existing
    descriptors if possible, and defines specialized dummies otherwise.

    In the future, every builtin should have a real descriptor. Especially
    new ASM builtins should define descriptors and use them in their
    implementation (use Descriptor::FooRegister() instead of documenting
    the calling convention as comments).

R=jgruber@chromium.org, joransiu@ca.ibm.com, junyan@redhat.com, midawson@redhat.com
BUG=
LOG=N

Change-Id: Ied285739f8ab017f17341c9c3bbbb1217be947e2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3594539Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#80034}

Bug: chromium:1316121, v8:12612
Change-Id: I83d1b580e2bfd03ed36b174ff4503976c8bd1922
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3593115Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80033}

{LiftoffOptions} already contains many (optional) parameters for Liftoff
compilation, but not all of them.
This CL moves the function index and the {for_debugging} field also into
that struct, to further reduce the number of parameters to
{ExecuteLiftoffCompilation} and to improve readability by having a
factory-like initialization of the {LiftoffOptions} struct.
That struct is now also passed down to the LiftoffCompiler directly
instead of unpacking the fields again.

R=thibaudm@chromium.org

Bug: v8:12809
Change-Id: I8824a1908f214cbf4c21f113934fef3ece1bf88b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3513894Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80032}

Bug: v8:12793
Change-Id: Ic5e414b5081f4eff95c34910f97dccbb16a9339b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3593785
Auto-Submit: Alexander Schulze <alexschulze@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80031}

Having it around is an invitation to use it in new places. This CL
removes the generic Dummy descriptor and replaces it by other existing
descriptors if possible, and defines specialized dummies otherwise.

In the future, every builtin should have a real descriptor. Especially
new ASM builtins should define descriptors and use them in their
implementation (use Descriptor::FooRegister() instead of documenting
the calling convention as comments).

Change-Id: Ib577aa03b5e5a522460d1084cc9605c55cd29d6c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3585945
Auto-Submit: Jakob Linke <jgruber@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80030}

This reverts commit dec4bb06.

Reason for revert: https://ci.chromium.org/p/v8/builders/ci/Linux%20V8%20FYI%20Release%20(NVIDIA)

Original change's description:
> [turbofan] Support additional operators in SLVerifier
>
> This CL extends SimplifiedLoweringVerifier by a few additional operators.
>
> It fixes the missing type on a LoadElement node generated during
> js-typed-lowering, that was detected by the verifier.
>
> Bug: v8:12619
> Change-Id: I14e3ece15f6a90e6906c140696dcd2e6b74a2527
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3557510
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#80014}

Bug: v8:12619
Change-Id: I79caa97bba1f29b549d494a747d0f65a85d60315
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3593135
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80029}

This reverts commit b1dd8287.

Reason for revert: Breaking fuschia build https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Fuchsia%20-%20builder/13592/overview

Original change's description:
> [builtins] Remap builtins on Linux
>
> This is a CL similar to
> https://chromium-review.googlesource.com/c/v8/v8/+/3553006, but on Linux
> rather than macOS. The goal is to allow builtins to use short builtin
> calls without paying a memory cost, by remapping rather than copying
> them.
>
> However, while macOS has a system call making this easier, on Linux we
> don't have one on most kernels. There is the recently-introduced
> mremap(MREMAP_DONTUNMMAP), which is available in 5.7, but only works on
> anonymous mappings until 5.13, which is too recent for most Android
> devices.
>
> Instead, we open() the file containing the builtins, and mmap() it at
> the desired location.
>
> Change-Id: I4524f349948b8f48c4536cf392a1cd179662a6cc
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3570426
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Jakob Linke <jgruber@chromium.org>
> Commit-Queue: Benoit Lize <lizeb@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#80022}

Change-Id: I0093fe84216f8c8fd1a8691c53817e578d92fa40
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3594009
Auto-Submit: Shu-yu Guo <syg@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Owners-Override: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80028}

A GC can happen while we allocate the resume callback, and before the
suspender is fully initialized. We cannot just change the order of
allocation, because they both reference each other. So temporarily set a
default value for the "resume" property to make the GC happy.

R=jkummerow@chromium.org

Bug: v8:12803
Change-Id: Ieecc5182b8dcf7a159713c9400d65da59c4b2af6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3586989Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80027}

These tools haven't been used in a while and are unmaintained.
We can use pprof with stack-filtering to achieve similar results.

Change-Id: I84392c066dffc6b0d9efba27a8fdfb31091796bb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3593786Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80026}

- Add RunJSNoChecked to run the script which possibly throws.
- Add CompileRun to run the script outside TEST_F, e.g., in
FunctionTemplate and helpers etc.

Bug: v8:12781
Change-Id: Ibab2e19cf1f7c76f7a81a90fc5894e7e6bfb7cdf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3586770Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Cr-Commit-Position: refs/heads/main@{#80025}

This CL is the first step towards creating a paged new sapce.
The CL creates a base class for new space that holds all fields not
specific to the semi space based implementation, and methods that do not
interact with the semi spaces. Methods are moved as is to the new base
class.

Future CLs will rename the classes, split/refactor additional methods,
and make other methods virtual.

Bug: v8:12612
Change-Id: Ibd8ec5135d66daf0fd025493bfaff537d61e049f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3584120Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80024}

This CL splits the stack frame into tagged and untagged slots, and allows reuse
of slots for values that are also tagged/untagged.

Bug: v8:7700
Change-Id: Id068807d1cd9bcd8c9e41d330f44acf346b16685
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3585959Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80023}

This is a CL similar to
https://chromium-review.googlesource.com/c/v8/v8/+/3553006, but on Linux
rather than macOS. The goal is to allow builtins to use short builtin
calls without paying a memory cost, by remapping rather than copying
them.

However, while macOS has a system call making this easier, on Linux we
don't have one on most kernels. There is the recently-introduced
mremap(MREMAP_DONTUNMMAP), which is available in 5.7, but only works on
anonymous mappings until 5.13, which is too recent for most Android
devices.

Instead, we open() the file containing the builtins, and mmap() it at
the desired location.

Change-Id: I4524f349948b8f48c4536cf392a1cd179662a6cc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3570426Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jakob Linke <jgruber@chromium.org>
Commit-Queue: Benoit Lize <lizeb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80022}

Since https://crrev.com/c/3486556, several old metrics related to GC
have disappeared from chromeperf, showing very small (near zero) values,
e.g., v8-gc-scavenger, v8-gc-full-mark-compactor,
v8-gc-latency-mark-compactor. This CL fixes this issue.

Bug: chromium:1315527
Bug: chromium:1154636
Change-Id: I5ee7167a6d4a6a54b2272bb63588990db17dabbc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3585565Reviewed-by: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80021}

The SSE2_UNOP instructions have various src and dst register types for
256-bit AVX. One of them, the ucomisd instruction does not support YMM.
Other two: vcvtpd2ps and vcvttpd2dq use XMM as dst register. We extend
the Operand type to Operand256 to represent m256 to distiguish with the
128-bit AVX instruction.

Since this is a small suite, we explicitly specify the operand type for
each instruction.

Bug: v8:12228
Change-Id: I07c8168bd49f75eb8e4df8d6adfcfb37c1d34fff
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3518423Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Yolanda Chen <yolanda.chen@intel.com>
Cr-Commit-Position: refs/heads/main@{#80020}

Isolates all have difference perf_output_handle_ for perf dump file,
which will corrupt when perfing multiple isolate within one process.
And we could use the same perf_output_handle_ between isolates
within one process to avoid the corrupt. We also use the mutex to protect the perf_output_handle_ change.

Bug: v8:10278
Change-Id: If10a677e4df7d4cd577bbb85bcefe75d76aaf26b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3585491
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80019}

With this CL OLD_TO_SHARED slots aren't removed at the end of full GC
anymore. In order to allow for this, invalidated slots need to be
filtered out when iterating the OLD_TO_SHARED remembered set.

* When invalidating slots in an object, that object also needs to be
  recorded for OLD_TO_SHARED.
* The sweeper has to remove invalidated objects in free memory when
  sweeping during a full GC.
* OLD_TO_SHARED slots need to be removed in the evacuated start of
  a page when evacuation fails.
* While local GCs don't need OLD_TO_SHARED, slots need to be filtered
  in order to be able to delete the set of invalidated objects during
  a GC.

Bug: v8:11708
Change-Id: I594307289a797bc0d68edf6793b914805d1285df
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3584113Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80018}

AtomicWord will either alias Atomic32 or Atomic64, depending on the
platform. By slightly changing the definition to encode this directly
instead of relying on intptr_t, we can get rid of a number of
compatibility helpers that cast between pointers to equally sized
atomics.

R=mlippautz@chromium.org

Bug: v8:12425
Change-Id: I04e8433cba5af8cf398d75d7832b84680109cf8b
Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3586988Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80017}

i::Logger          => i::V8Log
i::PerfJitLogger   => i::LinuxPerfJitLogger
i::PerfBasicLogger => i::LinuxPerfBasicLogger

Note: V8Log is currently still managing instances of other loggers,
this functionality will be moved to a separate class in the future.

Bug: v8:12795, chromium:1316443
Change-Id: Id1b44e65abb7819eb6d6c718a1baa9ed61ad51aa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3593133Reviewed-by: Jakob Linke <jgruber@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80016}

Immediate version of the Bitclear instruction can be used for logical
And with some immediates. It can also be used to implement
And(x, Not(imm)) in a single instruction. This patch gives ~0.5% runtime
improvement in one benchmark on Neoverse N1.

Change-Id: Ia926c6746f0c252f81626c6fca21c4dfb41679d9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3160667Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Martyn Capewell <martyn.capewell@arm.com>
Cr-Commit-Position: refs/heads/main@{#80015}

This CL extends SimplifiedLoweringVerifier by a few additional operators.

It fixes the missing type on a LoadElement node generated during
js-typed-lowering, that was detected by the verifier.

Bug: v8:12619
Change-Id: I14e3ece15f6a90e6906c140696dcd2e6b74a2527
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3557510Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80014}

Doc: https://bit.ly/revive-restart-frame
Context: https://crrev.com/c/3582395 (whole feature)

This CL adds the first batch of inspector tests for the upcoming
"Restart frame" feature. Landing the tests upfront allows us to
better discuss the proposed API as well as think early about
corner cases we should test.

The tests check for the functionality of `Debugger.restartFrame`, as
well as the newly added parameter `canBeRestarted` in
the `Debugger.paused` event.

Bug: chromium:1303521
Change-Id: Ibda6d8b6110fce893e0844f8902fbd5d901ae01d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3585946Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Kim-Anh Tran <kimanh@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80013}

Turn on fuzzing for disabled map space to get additional test coverage.

Bug: v8:12578
Change-Id: I82c577c8c24b51df627c873fde95fb239e16d36f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3592892Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80012}

This is a reland of commit 4d8e1846
One of the Mac arm64 bots failed to link an exported thread_local
static variable (crbug/1316800).

Original change's description:
> [rwx][mac] Introduce RwxMemoryWriteScope
>
> ... as a single bottleneck that encapsulates the semantics and
> implementation of fast per-thread W^X permission switching supported
> by Apple Silicon (arm64 M1).
> On other architectures this class is a no-op.
>
> Bug: v8:12797
> Change-Id: Ica842ff9f843e20b7f61fd7e80591e7a1fd29771
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3586986
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Igor Sheludko <ishell@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#79994}

Bug: v8:12797
Change-Id: Ifbd15c233bb343f11daa89b1328b5bf65c4806f4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3591332Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80011}

This reverts commit 62632c08.

Reason for revert: Performance regressions crbug.com/1315724

Original change's description:
> [interpreter] Optimize strict equal boolean
>
> For strict equal boolean literal like "a===true"
> or "a===false", we could generate TestReferenceEqual
> rather than TestStrictEqual. And in `execution_result()->IsTest()`
> case, we could directly emit JumpIfTrue/JumpIfFalse.
>
> E.g.
> ```
> a === true
> ```
> Generated Bytecode From:
> ```
> LdaGlobal
> Star1
> LdaTrue
> TestEqualStrict
> ```
> To:
> ```
> LdaGlobal
> Star1
> LdaTrue
> TestReferenceEqual
> ```
>
> E.g.
> ```
> if (a === true)
> ```
> Generated Bytecode From:
> ```
> LdaGlobal
> Star1
> LdaTrue
> TestEqualStrict
> JumpIfFalse
> ```
> To
> ```
> LdaGlobal
> JumpIfTrue
> Jump
> ```
>
>
> Bug: v8:6403
> Change-Id: Ieaca147acd2d523ac0d2466e7861afb2d29a1310
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3568923
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Commit-Queue: 王澳 <wangao.james@bytedance.com>
> Cr-Commit-Position: refs/heads/main@{#79935}

Bug: v8:6403, chromium:1315724
Change-Id: I65c520590093724e838f738c795d229687efb9de
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3592752Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Jakob Linke <jgruber@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#80010}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/cdced0c..7aeed11

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/b3baa6a..28b8ede

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/ab2e7f8..7d2693a

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: Idf76a50daf7cde760a220096b34949b565ccd47a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3591624
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#80009}

harmony_intl_best_fit_matcher is on stage for a while and we
found a lot of regression issue that not likely to be address soon
in ICU. Remove it from stage for now so our testing will be under
the configuration without it.

Bug: chromium:1307515
Change-Id: Id051e276ac630ed7b1d05e0ab766c46641bdc199
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3585355Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80008}

This reverts commit 4d8e1846.

Reason for revert: Blocks V8 roll, crbug.com/1316800

Original change's description:
> [rwx][mac] Introduce RwxMemoryWriteScope
>
> ... as a single bottleneck that encapsulates the semantics and
> implementation of fast per-thread W^X permission switching supported
> by Apple Silicon (arm64 M1).
> On other architectures this class is a no-op.
>
> Bug: v8:12797
> Change-Id: Ica842ff9f843e20b7f61fd7e80591e7a1fd29771
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3586986
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Igor Sheludko <ishell@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#79994}

Bug: v8:12797
Change-Id: I81792567839e72b4147d009c0845b0c0de003eb0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3590752
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Owners-Override: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80007}

https://chromium.googlesource.com/external/github.com/tc39/test262/+log/d7c0a207..33a5433d

Bug: v8:7834
Change-Id: I2c10e4470bf02de864666fa7410ce472a42b8359
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3585357Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80006}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/d1e4a47..cdced0c

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I520013988862e502330041e09b1b811dcd78e581
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3588778
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#80005}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/9eb2c63..d1e4a47

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: Ib78105e60f3b34cd19c8b0382a0ab19390f4c766
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3588776
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#80004}

Access of forwarded map isn't allowed without synchronization. The fix
is to not invoke IsMap() on the forwarded map. If we would want that we
would need a release-store when setting the forwarding pointer on an
evacuated object.

Bug: chromium:1315622, v8:12578
Change-Id: I2f03c810c39875e565bc769c57452af75849044f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3585567Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80003}