This reverts commit 6b690a6b.

Reason for revert: causes a few regressions here https://chromeperf.appspot.com/group_report?rev=79528

Original change's description:
> Reland [compiler] Simplify "==0" branches in MachineOperatorReducer
>
> This is a reland of 48b443f6.
>
> While fixing the initial CL, we stumbled upon a few bugs that
> we had to fix:
>
>  - CommonOperatorReducer and SimplifiedOperatorReducer were applied
>    before and after SimplifiedLowering, but always assumed that it
>    was before SimplifiedLowering, and thus had the wrong semantics
>    for branches in some cases. They now have an added parameter to
>    know which semantics of branch they should use.
>
>  - The lowering of StaticAssert was wrong and could leave kHeapConstant
>    in the assert (instead of machine Booleans).
>
> Original change's description:
> > [compiler] Simplify "==0" branches in MachineOperatorReducer
> >
> > Bug: v8:12484
> > Change-Id: I0667c7464c0dd71338bc199a24a69248a7a0a525
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3497303
> > Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> > Owners-Override: Tobias Tebbi <tebbi@chromium.org>
> > Commit-Queue: Darius Mercadier <dmercadier@chromium.org>
> > Cr-Commit-Position: refs/heads/main@{#79379}
>
> Bug: v8:12484
> Change-Id: Ibbf5df96fce5ccb04868dc517539479bf69f5703
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3516869
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Commit-Queue: Darius Mercadier <dmercadier@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#79528}

Bug: v8:12484
Change-Id: I457464d793e9c5af8448564aa3b46be863b96fbb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3540148
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Darius Mercadier <dmercadier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79552}

Port b2978927

Original Commit Message:

    This CL removes:

    - Dynamic map checks aka minimorphic property loads (TF support,
      builtins).
    - "Bailout" deopts (= drop to the interpreter once, but don't
      throw out optimized code).
    - "EagerWithResume" deopts (= part of dynamic map check
      functionality, we call a builtin for the deopt check and deopt
      or resume based on the result).

R=jgruber@chromium.org, joransiu@ca.ibm.com, junyan@redhat.com, midawson@redhat.com
BUG=
LOG=N

Change-Id: I64476f73810774c2c592231d82c4a2cbfa2bf94e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3537881Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#79551}

Access to the object start bitmap is only safe during marking until
sweeping is started as the concurrent sweeper may clear and rebuild
the bitmap at any time during sweeping.

Adds a DCHECK and an additional test for a previously broken
pre-finalizer scenario.

Bug: chromium:1307471
Change-Id: If67ade43f7cdad6de4720c0efeac11bfe8c22b3c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3535782Reviewed-by: Nikolaos Papaspyrou <nikolaos@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79550}

This way Blink will not sanitize error events coming from JavaScript
entered via the DevTools console, and instead forward the original error
event as-is, which is more likely to match the developers' expectations.

Bug: chromium:1295750
Change-Id: Id02c048e4af21d0c232d8e44d11115f6b61c0bf1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3540145
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79549}

When cross realm invoke PromiseConstructor and realm not
allowed to CrossRealmAccess, PromiseConstructor will
silently return undefined, which will cause crash in
ConstructJSWithTarget type cast, Change to throw type
error when HasAccessCheck failed.

Bug: v8:12705
Change-Id: I18f697a1897c31163dd60522db12449033419f9a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3521174Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79548}

Originally, 'Promise()' without 'new' will throw "undefined is not a
promise". Now it will throw "Promise constructor cannot be invoked
without 'new'".

Bug: v8:10817
Change-Id: Ic8b72a902ed395e44dbb32ccf96a2130a4a9422f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3459924Reviewed-by: Nikolaos Papaspyrou <nikolaos@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79547}

Change-Id: I8b879b79bfa596f778c904e0e7f0c4c788407356
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3539463Reviewed-by: Milad Farazmand <mfarazma@redhat.com>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/main@{#79546}

This CL adds Babel, ForLoop, DestructuringAssignment perf tests
for object destructuring assignment.

Bug: v8:11614
Change-Id: Iab922f9d79dbb7888b6583e6bf2930e229ad6f38
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3538280Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79545}

This CL removes:

- Dynamic map checks aka minimorphic property loads (TF support,
  builtins).
- "Bailout" deopts (= drop to the interpreter once, but don't
  throw out optimized code).
- "EagerWithResume" deopts (= part of dynamic map check
  functionality, we call a builtin for the deopt check and deopt
  or resume based on the result).

Fixed: v8:12552
Change-Id: I492cf1667e0f54586690b2f72a65ea804224b840
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3401585
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79544}

Reporting messages can trigger termination in case of `inspector-test`,
which we need to be able to deal with gracefully for the fuzzer.

Fixed: chromium:1307449
Change-Id: I88ba2b13d920134a1670b808adc4ace4ca6d1dff
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3540260
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79543}

Adding some DCHECKs to document invariants and correctness properties
(e.g. pages with live objects aren't freed).

Bug: v8:12612
Change-Id: I543e4846c791320f3965561ae9d0b54739f5df03
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3507993Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79542}

Bug: v8:10009
Change-Id: I1f71b2783cd07331a65f46c316e87a46396e7eda
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3516153Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79541}

- Avoid redrawing property-link tables if the contents don't change
- Don't update timeline legends if the selection doesn't change
- Use shorter class names for the flamechart for faster parsing
- Round positions in flamechart to avoid long strings that would be
  created from raw double positions
- Don't redraw the tooltip if the content is the same

Change-Id: I925f1708400286c7c9f8db62f75c3b5fe8a16b12
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3521945Reviewed-by: Patrick Thier <pthier@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79540}

This implements the last bits of basic concurrent Maglev compilation.
When jobs have been processed, schedule an interrupt to trigger codegen
and building the Code object on the main thread.

Changed since the initial version:
- Put the include behind V8_ENABLE_MAGLEV.
- Skip 18.js until we have deterministic test helpers for concurrent
  tiering.

Bug: v8:7700
Change-Id: Ibc103f097fe00f7df93a33a785939e43901f3734
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3536662Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79539}

Bug: chromium:1307610
Change-Id: I60aaa0e58e13b705b5eff4b57411a0ad4a2e9b3f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3534849Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79538}

Avoid instruction selector to emit sign extension instruction after most
`xxx.w` instructions in RV64I and RV64M, because `xxx.w` instructions
will automatically sign-extend the result

Change-Id: Ia4291242dc3e51f49be1e6dda2d5a3365b5e7bfa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3536845Reviewed-by: Yahan Lu <yahan@iscas.ac.cn>
Commit-Queue: Yahan Lu <yahan@iscas.ac.cn>
Cr-Commit-Position: refs/heads/main@{#79537}

Rolling v8/third_party/icu: https://chromium.googlesource.com/chromium/deps/icu/+log/ea8c08d..a9359a8

Move back to single android icu data file. (Mohamed Heikal)
https://chromium.googlesource.com/chromium/deps/icu/+/a9359a8

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com,ftang@chromium.org

Change-Id: I14c6e7b436a98555a4e1ba9e8a0958aaa0d43d57
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3538221
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#79536}

Rolling v8/third_party/google_benchmark/src: https://chromium.googlesource.com/external/github.com/google/benchmark/+log/a480a08..60b16f1

Promote inclusive language. (#1360) (Brad Messer)
https://chromium.googlesource.com/external/github.com/google/benchmark/+/60b16f1

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com,mlippautz@chromium.org

Change-Id: Ic01a08e37caf270d99e3898c8a83b72f56c6ddbc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3538220
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#79535}

Also add AO: ToTemporalInstant, ParseTemporalInstant,
ParseTemporalInstantString,

Spec Text:
https://tc39.es/proposal-temporal/#sec-temporal.instant.from
https://tc39.es/proposal-temporal/#sec-temporal-totemporalinstant
https://tc39.es/proposal-temporal/#sec-temporal-parsetemporalinstant
https://tc39.es/proposal-temporal/#sec-temporal-parsetemporalinstantstring

Bug: v8:11544
Change-Id: Ie78f7389eef15795f276291ba99e18a72566f9bc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3382056Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79534}

Will re-enable once a few issues have been resolved.

Change-Id: Ieed60efcb6d59cc5ca10931913dd4d9ffea8b9f1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3532202Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#79533}

Spec Text:
https://tc39.es/proposal-temporal/#sec-temporal.instant.fromepochseconds
https://tc39.es/proposal-temporal/#sec-temporal.instant.fromepochmilliseconds
https://tc39.es/proposal-temporal/#sec-temporal.instant.fromepochmicroseconds
https://tc39.es/proposal-temporal/#sec-temporal.instant.fromepochnanoseconds

Bug: v8:11544
Change-Id: I254ef66faf5e6a49bfc389f2952ffab3d5c0bed2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3382054
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79532}

Bug: v8:11525
Change-Id: I74190f2136e91107deea2c31f750a2d1a43dc18a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3528502Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79531}

Fixes bazel bot issue:
https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20-%20bazel%20-%20builder/1279/overview

Bug: v8:7700
Change-Id: I4a7b43517574fc99bed2fe2bd75c126d06fcfad8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3535790
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79530}

No-Try: True
Change-Id: I14986d7eb1e24faef2d6d4f1decde613b2454f1f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3535788Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79529}

This is a reland of 48b443f6.

While fixing the initial CL, we stumbled upon a few bugs that
we had to fix:

 - CommonOperatorReducer and SimplifiedOperatorReducer were applied
   before and after SimplifiedLowering, but always assumed that it
   was before SimplifiedLowering, and thus had the wrong semantics
   for branches in some cases. They now have an added parameter to
   know which semantics of branch they should use.

 - The lowering of StaticAssert was wrong and could leave kHeapConstant
   in the assert (instead of machine Booleans).

Original change's description:
> [compiler] Simplify "==0" branches in MachineOperatorReducer
>
> Bug: v8:12484
> Change-Id: I0667c7464c0dd71338bc199a24a69248a7a0a525
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3497303
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Owners-Override: Tobias Tebbi <tebbi@chromium.org>
> Commit-Queue: Darius Mercadier <dmercadier@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#79379}

Bug: v8:12484
Change-Id: Ibbf5df96fce5ccb04868dc517539479bf69f5703
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3516869Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Darius Mercadier <dmercadier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79528}

This reverts commit cf25b3bc.

Reason for revert: https://crbug.com/1307471. TraceTrait must only be used during marking.

Original change's description:
> cppgc: Rework prefinalizers
>
> Move the check for whether an object is live or dead out of the
> prefinalizer trampoline. Moving it into the backend allows for
> inlining the check which avoids a call to the trampoline for live
> objects.
>
> On catapult benchmarks (e.g. cnn:2021, nytimes:2020), there's often
> ~2k finalizers registered. In order to avoid memory overhead in the
> range of a few KB, we store the fact whether the object points to the
> base object payload in the LSB of the pointer. For caged builds this
> is replaced with just storing the index into the cage for both object
> and base object payload.
>
> Locally saves around ~10% of atomic sweeping processing time which is
> in the order of .05ms.
>
> Bug: v8:12698
> Change-Id: I198205a6b1d57fc2df821ee4e73e53dc6f825ff5
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3497764
> Reviewed-by: Omer Katz <omerkatz@chromium.org>
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#79442}

Bug: v8:12698, chromium:1307471
Change-Id: I5c4e70d46cb99af66c77f0c013625b6af6c6eb8e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3535781
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79527}

Bug: chromium:1304658

Change-Id: I6a82603a7c5de5ae8f5a895990c1a904bbdd39b2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3532263
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79526}

There are problems calling WaitForRunningWorkers when we
call quit().
First, suppose the main thread first calls quit(),
and the worker thread calls quit() after the main
thread calls quit(), then sched_yield to wait for
quit_once_ updated to ONCE_STATE_DONE. However
the main thread is WaitForRunningWorkers to wait
for the worker thread to join, thus causing deadlock.

Second, suppose the worker thread calls quit() and empty
the running_workers_ by WaitForRunningWorkers, then
the main thread calls `onExit(isolate, true)` to dispose
the platform and other global data, which will crash other
running workers.

Bug: v8:12219
Change-Id: I333e5aad431daefb1c163f69e66d8e9d5e9bf754
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3518908Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79525}

This reverts commit f198f35d.

Reason for revert: Got enough fuzzer bugs to work on

Original change's description:
> [rab/gsab] Temporarily stage --harmony-rab-gsab to enable fuzzing
>
> Please revert this CL if it causes any trouble!
>
> Bug: v8:11111
> Change-Id: I6061fdc0aed82952f093ede9ecd252be1ac99519
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3528495
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Marja Hölttä <marja@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#79499}

Bug: v8:11111
Change-Id: I9eef57eeba72116cc97c347abe2b56277855b797
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3535779
Commit-Queue: Marja Hölttä <marja@chromium.org>
Auto-Submit: Marja Hölttä <marja@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#79524}

Bug: v8:11544
Change-Id: I134b8c786a8dfaef2f4f2509ec5f6c6a009852f3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3379232Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79523}

Rolling v8/third_party/icu: https://chromium.googlesource.com/chromium/deps/icu/+log/8a5b728..ea8c08d

Fix android filter by changing filter type (Frank Tang)
https://chromium.googlesource.com/chromium/deps/icu/+/ea8c08d

Add "-Wno-deprecated-pragma" (Mark Schott)
https://chromium.googlesource.com/chromium/deps/icu/+/11138de

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com,ftang@chromium.org

Change-Id: I86b0e16691dedd48e35c4aa79fee5feeb7701329
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3534847
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#79522}

Rolling v8/third_party/google_benchmark/src: https://chromium.googlesource.com/external/github.com/google/benchmark/+log/5704cd4..a480a08

[nfc] Reformat doc-string in generate_export_header (#1376) (Vy Nguyen)
https://chromium.googlesource.com/external/github.com/google/benchmark/+/a480a08

Fix Bazel build breakage caused by commit 6a894bd. (#1374) (Paul Wankadia)
https://chromium.googlesource.com/external/github.com/google/benchmark/+/808571a

Build `//:benchmark` as a static library only. (#1373) (Paul Wankadia)
https://chromium.googlesource.com/external/github.com/google/benchmark/+/6a894bd

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com,mlippautz@chromium.org

Change-Id: Ic2015e271f35597f3b78de84fbe88e5ae1f02d79
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3534848
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#79521}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/3d95907..3444906

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/src/buildtools/+log/113dd1b..d8c3754

Rolling v8/buildtools/third_party/libc++abi/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi/+log/a897d0f..93b8dcd

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/b3fe2c1..389f33b

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/b199f54..76979da

Rolling v8/third_party/googletest/src: https://chromium.googlesource.com/external/github.com/google/googletest/+log/ae5e06d..b007c54

Rolling v8/third_party/zlib: https://chromium.googlesource.com/chromium/src/third_party/zlib/+log/b0676a1..923f5eb

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/b60d34c..a15c2df

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: Ifd7ec0fcb5f51d4fb1560ba5ff7e7db544348ad1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3534846
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#79520}

Bug: v8:12717
Change-Id: I0ffe277dda3eed2073f166f2b93a2f2c611c6d01
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3532232Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79519}

Bug: v8:12697
Change-Id: I124f2f0fd3c98d6a5233a0e2a8236a2b15d791fd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3532261
Auto-Submit: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79518}

This reverts commit 406bcd69.

Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64/46797/overview

Original change's description:
> [maglev] Finish & enable basic Maglev concurrent tierups
>
> This implements the last bits of basic concurrent Maglev compilation.
> When jobs have been processed, schedule an interrupt to trigger codegen
> and building the Code object on the main thread.
>
> Bug: v8:7700
> Change-Id: I348ade4777ddddf7c3a6b0575d9f51e5fa00c9fb
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3528494
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#79516}

Bug: v8:7700
Change-Id: I1faa092b96e56149b4db2e271680f39c7af61554
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3532231
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79517}

This implements the last bits of basic concurrent Maglev compilation.
When jobs have been processed, schedule an interrupt to trigger codegen
and building the Code object on the main thread.

Bug: v8:7700
Change-Id: I348ade4777ddddf7c3a6b0575d9f51e5fa00c9fb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3528494Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79516}

.. into new virtual subclass TurbofanCompilationJob. Update all TF code
to derive from this class. Specifically, the OptimizedCompilationInfo is
TF-specific and now lives in TurbofanCompilationJob.

The motivation behind this is that Maglev now also uses this
infrastructure.

Drive-by: Replace CompilationMode with ConcurrencyMode.

Bug: v8:7700
Change-Id: Iae6d1ffd1c810e2e45cad6c9b4e43d4c82ac54a7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3528493Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79515}

In JSCallReducer::ReduceArrayPrototypeShift, add Unsigned32
TypeGuard for index Node used in fast path, avoid representing
kRepFloat64 (Range(1, inf)) to kRepWord64 when converting
input for kLoadElement.

Bug: v8:12632
Change-Id: I2e4b00840dc5462e4351e13a372c33b6272b9ea1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3528373Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79514}

Fixes wrong conditional logic in BaselineCompilerTask::Install.
Removes is_compiled(), since CanCompileWithBaseline already
checks for HasBytecodeArray.

Bug: chromium:1307072
Change-Id: I4cc61e2bab8d1fb5a5b253d291c7079b82c3fa44
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3532230
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79513}