R=clemensb@chromium.org
CC=gdeepti@chromium.org

Bug: v8:12284
Change-Id: Ied63b2c7b57210f2cf2e1580520405ce1be5dc33
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3625979Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80400}

This is a reland of commit 2b140a9f

Original change's description:
> [Temporal] Add Calendar.prototype.yearMonthFromFields
>
> Add AO: IsValidISOMonth, RegulateISOYearMonth, ISOYearMonthFromFields
> Spec Text:
> https://tc39.es/proposal-temporal/#sec-temporal-isvalidisomonth
> https://tc39.es/proposal-temporal/#sec-temporal-regulateisoyearmonth
> https://tc39.es/proposal-temporal/#sec-temporal-isoyearmonthfromfields
> https://tc39.es/proposal-temporal/#sec-temporal.calendar.prototype.yearmonthfromfields
>
>
> Bug: v8:11544
> Change-Id: I1baadbbe54fb0c3fd45750eddb13b790465c3a3b
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3408773
> Commit-Queue: Frank Tang <ftang@chromium.org>
> Reviewed-by: Adam Klein <adamk@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#80384}

Bug: v8:11544
Change-Id: Ic5831c7094cd235526d93010cd722110f2951d77
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3631706Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80399}

This reverts commit e8cac377.

Reason for revert: breaking Mac arm64 bots

Original change's description:
> [rwx][mac] Enable fast W^X on Apple Silicon (M1)
>
> Bug: v8:12797
> Change-Id: I53bb803dd77db5bdd42b1a1b4b568e63857adf31
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3598861
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Commit-Queue: Igor Sheludko <ishell@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#80396}

Bug: v8:12797
Change-Id: Ieb31d44d40a3b7c4e0b8f3914fcb89346ee3e2f8
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3630083
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#80398}

The no_condition / kNoCondition not only has the flaw that it's a
special case which represents an illegal / nonexisting condition, and
thus needs special handling in all methods which get a condition as
input (this check is often missing), it is also weird in that every
negative condition value must be considered a "no condition".

It turns out that this "no condition" is rarely used, and can easily be
avoided by duplicating methods, or storing a {base::Optional<Condition>}
instead (not needed anywhere yet).

This is a follow-up to https://crrev.com/c/3629553.

R=tebbi@chromium.org, pthier@chromium.org

Bug: v8:12425
Change-Id: Id2270b1660fcb0aff0a8460961b57068ed1c3c73
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3632102Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80397}

Bug: v8:12797
Change-Id: I53bb803dd77db5bdd42b1a1b4b568e63857adf31
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3598861Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80396}

Those conditions are rarely used and not properly supported everywhere.
If needed, we should duplicate methods instead, or pass a
{base::Optional<Condition>}.

This is a follow-up to https://crrev.com/c/3629129.

R=tebbi@chromium.org
CC=sroettger@chromium.org

Bug: v8:12425
Change-Id: Ia67c3d4f575b0f7dd0ae125971959cf68f2fefc7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3629553Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80395}

This is a reland of commit 48481a67

Original change's description:
> [sandbox] Enable sandboxed pointers on Desktop
>
> Bug: chromium:1218005
> Change-Id: I3df750ee9101779952d8b1ae630c4d3b7563084b
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3578645
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Commit-Queue: Samuel Groß <saelo@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#80376}

Bug: chromium:1218005
Change-Id: Iaf7bc81393da5c1381a361a9de129affaa019670
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3629348Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Samuel Groß <saelo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80394}

Added IR members:
For updating the interrupt budget: Jump, JumpLoop, Return and
JumpFromInlined apply a delta to the interrupt budget.  For OSR:
JumpLoop needs its loop depth and the feedback slot (where cached OSR
code lives).

This CL also adds code to maintain the interrupt budget in ML code.

Future tasks are documented in TODOs.

Bug: v8:7700
Change-Id: I240dc3ea76a1e60fda45e1d39b0b5f57dd9c566b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3610423
Auto-Submit: Jakob Linke <jgruber@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80393}

This is deprecated in C++20.  Use constexprs and explicit casts to work
around.

Bug: chromium:1284275
Change-Id: I6a3974f3c678cb797081938622036a12a99c5d1b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3630349
Auto-Submit: Peter Kasting <pkasting@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80392}

- Repurpose flag `treat_global_objects_as_roots` when taking a heap
  snapshot for toggling whether internals should be exposed (to
  `hide_internals`).
- Use the toggle in creating heap snapshots for exposing class names
  as object names for C++ objects that have not explicitly been given a
  name.

Change-Id: I77d71babfdfe53269964fe81ed985037a431c28b
Bug: chromium:1321620
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3623740Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80391}

Change-Id: I88a1bbddc7604fc5e557ae875ca196cf9c46574c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3626453Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Auto-Submit: Neden Wang <nedenwang@tencent.com>
Cr-Commit-Position: refs/heads/main@{#80390}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/0c83e78..a1147fb

Rolling v8/buildtools/third_party/libc++abi/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi/+log/ce96725..fb82ddb

Rolling v8/buildtools/third_party/libunwind/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind/+log/f1108b6..3d54d41

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/58f3286..7979ffe

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/443d913..6a1494e

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I9e313473644596c6723f733b4347e7f22e6454ec
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3629690
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#80389}

This reverts commit 48481a67.

Reason for revert: Fails roll into Chromium due to Asan, Android, and Fuchsia bots. See https://crrev.com/c/3631159

Original change's description:
> [sandbox] Enable sandboxed pointers on Desktop
>
> Bug: chromium:1218005
> Change-Id: I3df750ee9101779952d8b1ae630c4d3b7563084b
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3578645
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Commit-Queue: Samuel Groß <saelo@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#80376}

Bug: chromium:1218005
Change-Id: I646f09947b5a32d1ada60887352cc3989e66ada3
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3632099
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Auto-Submit: Samuel Groß <saelo@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80388}

Remove unused variable reported by gcc.

Change-Id: I02b37a41524d2c2d8e3ab1158bd0fd816c7124f1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3629601Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80387}

This reverts commit 4251c285.

Reason for revert: Fails on CI bots:
https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux/46503/overview

Original change's description:
> [Temporal] Add TimeZone get*Transition and getPlainDateTimeFor
>
> Also add non-intl (only support UTC) version of AO:
> GetIANATimeZoneNextTransition, GetIANATimeZonePreviousTransition
> (support of other timezone in Intl will come later)
>
> Spec Text:
> https://tc39.es/proposal-temporal/#sec-temporal.timezone.prototype.getplaindatetimefor
> https://tc39.es/proposal-temporal/#sec-temporal.timezone.prototype.getnexttransition
> https://tc39.es/proposal-temporal/#sec-temporal.timezone.prototype.getprevioustransition
> https://tc39.es/proposal-temporal/#sec-temporal-getianatimezonenexttransition
> https://tc39.es/proposal-temporal/#sec-temporal-getianatimezoneprevioustransition
>
>
> Bug: v8:11544
> Change-Id: I17d5a60638dcd8543e5d9f22c6560b311f2f402a
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3534450
> Commit-Queue: Frank Tang <ftang@chromium.org>
> Reviewed-by: Adam Klein <adamk@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#80383}

Bug: v8:11544
Change-Id: Icfbb643578ac028b06aa07c3ac6bbce030f49390
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3630079
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#80386}

This reverts commit 2b140a9f.

Reason for revert: Need to revert parent CL.

Original change's description:
> [Temporal] Add Calendar.prototype.yearMonthFromFields
>
> Add AO: IsValidISOMonth, RegulateISOYearMonth, ISOYearMonthFromFields
> Spec Text:
> https://tc39.es/proposal-temporal/#sec-temporal-isvalidisomonth
> https://tc39.es/proposal-temporal/#sec-temporal-regulateisoyearmonth
> https://tc39.es/proposal-temporal/#sec-temporal-isoyearmonthfromfields
> https://tc39.es/proposal-temporal/#sec-temporal.calendar.prototype.yearmonthfromfields
>
>
> Bug: v8:11544
> Change-Id: I1baadbbe54fb0c3fd45750eddb13b790465c3a3b
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3408773
> Commit-Queue: Frank Tang <ftang@chromium.org>
> Reviewed-by: Adam Klein <adamk@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#80384}

Bug: v8:11544
Change-Id: I1d93a25ee36b08d7a0bc86937d5b0a18ab6cdf86
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3632098
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#80385}

Add AO: IsValidISOMonth, RegulateISOYearMonth, ISOYearMonthFromFields
Spec Text:
https://tc39.es/proposal-temporal/#sec-temporal-isvalidisomonth
https://tc39.es/proposal-temporal/#sec-temporal-regulateisoyearmonth
https://tc39.es/proposal-temporal/#sec-temporal-isoyearmonthfromfields
https://tc39.es/proposal-temporal/#sec-temporal.calendar.prototype.yearmonthfromfields


Bug: v8:11544
Change-Id: I1baadbbe54fb0c3fd45750eddb13b790465c3a3b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3408773
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80384}

Also add non-intl (only support UTC) version of AO:
GetIANATimeZoneNextTransition, GetIANATimeZonePreviousTransition
(support of other timezone in Intl will come later)

Spec Text:
https://tc39.es/proposal-temporal/#sec-temporal.timezone.prototype.getplaindatetimefor
https://tc39.es/proposal-temporal/#sec-temporal.timezone.prototype.getnexttransition
https://tc39.es/proposal-temporal/#sec-temporal.timezone.prototype.getprevioustransition
https://tc39.es/proposal-temporal/#sec-temporal-getianatimezonenexttransition
https://tc39.es/proposal-temporal/#sec-temporal-getianatimezoneprevioustransition


Bug: v8:11544
Change-Id: I17d5a60638dcd8543e5d9f22c6560b311f2f402a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3534450
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80383}

In C++20, u8"" generates a const char8_t*, not a const char*.  Since ""
accepts UTF-8 already, just switch to it.

Bug: chromium:1284275
Change-Id: I873321a62a4d9e32b3b463913a3bc10231db3db3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3630347Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Auto-Submit: Peter Kasting <pkasting@chromium.org>
Commit-Queue: Peter Kasting <pkasting@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80382}

This CL adds prefixed store scalar and floating point
instructions to the assembler and uses it during code generation
if the processor supports it. They have also been added to the disassembler and the simulator.

Change-Id: I0b9e0758f17ca6b86d4f2f2bb36be87fba14ecb7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3626173Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#80381}

`ldu` requires offset to be 4 byte aligned.
Moving it under `GenerateMemoryOperationWithAlign`.

Change-Id: I9f15a3e4d04f5381d0fb74abdd2f4d9160bc7243
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3629345Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#80380}

1. Move the use of MAYBE_RETURN to MAYBE_ASSIGN_RETURN_ON_EXCEPTION_VALUE
if possible.
2. Remove some MYABE_RETURN in the wrong spot and therefore fix some tests.
3. Change Intl::GetTimeZoneIndex() to return Maybe<int32_t> as index and use
< 0 value to indicate not getting index to make the function signature
simpler.

Bug: v8:11544
Change-Id: I685cbff142e9dea69ef316a1bc180730aef5aec8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3625839Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80379}

This prevents ambiguity errors in C++20 due to ADL when casting types in
std::, which gains std::bit_cast<>().

Bug: chromium:1284275
Change-Id: I25046d1952a9304852e481ad8b84049c6769c289
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3625838
Auto-Submit: Peter Kasting <pkasting@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80378}

The write protection of code memory with mprotect is too expensive for
lazy compilation. As the usefulness of this memory protection is
limited anyways, this CL disables the memory protection in case lazy
compilation is enabled.

Bug: v8:12852
Change-Id: I4c56d4021a7b594e24a4d3d28a130a309c56de38
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3627596Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80377}

Bug: chromium:1218005
Change-Id: I3df750ee9101779952d8b1ae630c4d3b7563084b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3578645Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Samuel Groß <saelo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80376}

NOTRY=true

Bug: v8:12842
Change-Id: If3cac473407fc60523de5924170b7c3b99074d54
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3629546
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Auto-Submit: Almothana Athamneh <almuthanna@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80375}

This is a reland of commit 507fa4d7

This CL moves the NewJSObjectFromMap after deserializing object properties with dictionary map and fixes the DCHECK failure in JSReceiver::HasFastProperties when triggering GC.

Original change's description:
> [web snapshot] Add support for object with dictionary mode
>
> This CL adds the serialization support for object properties
> with dictionary map. Shape id is used to distinguish between if the object has dictionary map. And add TODO to support “no map objects” which can have fast map and “objects with map” which needs to be turned to dictionary mode.
>
> Bug: v8:11525
> Change-Id: If3eb4195115a41d4a3f6cc7372924b982ca96fc1
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3621593
> Commit-Queue: 王澳 <wangao.james@bytedance.com>
> Reviewed-by: Marja Hölttä <marja@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#80366}

Bug: v8:11525
Change-Id: I88422d698aa03fb7d3b21b5709eec2d0cf306256
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3629738
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80374}

Based on the robust test suite for checking property "has/in" queries, with the intention
of measuring the performance of accessing getOwnPropertyDescriptor.

Background: getOwnPropertyDescriptor and defineProperty were identified as hot code taking up
a significant chunk of startup time in a customer application. This benchmark aims to measure
the difference made by a modifying Object.getOwnPropertyDescriptor.

By current measurements, the geometric mean time of the new version is typically 1/6 that of
the current upstream implementation, using this test specifically (however, only on arm64 /
Apple M1... On Linux/x64, the results look more reasonable at a roughly 5-12% improvement in
score).

In its current form, this benchmark does very little to attempt to verify the results of the
object, which may result in branches being discarded in Turbofan (but given the enormous
difference between x64 and arm64, I'm not positive this is what is happening, and have not yet
verified this).

BUG=

Change-Id: I0f10735315313ed97efd00fcccaedc1272d4d314
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3624979
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80373}

NOTRY=true

Bug: v8:12826
Change-Id: Ibe1bad5837221903a7a47af7f2cc49963952a67e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3629335Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Auto-Submit: Almothana Athamneh <almuthanna@chromium.org>
Commit-Queue: Almothana Athamneh <almuthanna@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80372}

Consider the following

  * A ValueNode has inputs A and B
  * Input A has later uses, input B doesn't
  * The ValueNode's result must be in the same register as A

It can then happen that UpdateUses frees B, and the result allocation
emits a gap move from A's register to B's old register (now free) to
preserve the value of A when the ValueNode writes into its register.
This gap move is emmitted before the ValueNode start, which means that
it clobbers B.

Now, UpdateUses only clears registers _after_ node result allocation, so
that the known free registers are still the ones before updating uses.

Done naively, this would have bad consequences -- in the case where A
has no later uses, it would still force the regalloc to save its value
thinking that it is still live. So, this patch also introduces a concept
of "AllocationStage" where we're either allocating at the start or end
of a Node. Inputs are allocated at the start, results at the end. When
walking registers during an allocation, nodes whose lifetimes end at the
current node are considered to be dead at the "end" allocation stage,
and we are allowed to a) use their registers, and b) drop them without
preserving their value.

Bug: v8:7700
Change-Id: I5ca764ed04b12269f189577e81eb7e2a27cd1b09
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3625978
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80371}

Change-Id: I6dec06936cb12f2d6da69c1f147bea344c32cf73
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3629129Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Stephen Röttger <sroettger@google.com>
Cr-Commit-Position: refs/heads/main@{#80370}

NOTRY=true

Bug: v8:12826
Change-Id: I08be2980f92c69504290bb6152e48595e6a6c9aa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3629540
Auto-Submit: Almothana Athamneh <almuthanna@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80369}

This reverts commit 507fa4d7.

Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux%20-%20gc%20stress/38308/overview

Original change's description:
> [web snapshot] Add support for object with dictionary mode
>
> This CL adds the serialization support for object properties
> with dictionary map. Shape id is used to distinguish between if the object has dictionary map. And add TODO to support “no map objects” which can have fast map and “objects with map” which needs to be turned to dictionary mode.
>
> Bug: v8:11525
> Change-Id: If3eb4195115a41d4a3f6cc7372924b982ca96fc1
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3621593
> Commit-Queue: 王澳 <wangao.james@bytedance.com>
> Reviewed-by: Marja Hölttä <marja@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#80366}

Bug: v8:11525
Change-Id: I0d236a9937a5942b387553a61991716321b063e6
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3629541
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Owners-Override: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80368}

Bug: v8:7700
Change-Id: I6e77592e6a3603533414971b59ef1fb9b2f89657
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3629150Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80367}

This CL adds the serialization support for object properties
with dictionary map. Shape id is used to distinguish between if the object has dictionary map. And add TODO to support “no map objects” which can have fast map and “objects with map” which needs to be turned to dictionary mode.

Bug: v8:11525
Change-Id: If3eb4195115a41d4a3f6cc7372924b982ca96fc1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3621593
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80366}

This CL cleans up the existing experimental implementation of
conservative stack scanning. It retains the object start bitmap, to
evaluate it as a mechanism for resolving inner pointers, and the
conservative stack scanning visitor (which is currently not used).

The flag v8_enable_conservative_stack_scanning is kept and will be
used for experimental purposes. It currently does not imply any
other flag.

Bug: v8:10614
Bug: v8:12851

Change-Id: Id0ae0f437ed2601eed9ec634d2d1dd2f030d814e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3602516Reviewed-by: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Jakob Linke <jgruber@chromium.org>
Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80365}

Spec Text:
https://tc39.es/proposal-temporal/#sec-temporal.calendar.prototype.dateadd

is not yet implemented.

Note: The intl version stated in
https: //tc39.es/proposal-temporal/#sup-temporal.calendar.prototype.dateadd
Bug: v8:11544
Change-Id: Id7fd043d234f559c0e03bdf3f0f31d8bc91da27f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3609208Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80364}

Also change the macro to pass method name directly to CHECK_RECEIVER()
Remove MACROs which has up to only two usage.
Sync with changes in
https://github.com/tc39/proposal-temporal/pull/1693

Spec Text:
https://tc39.es/proposal-temporal/#sec-temporal.calendar.prototype.tojson
https://tc39.es/proposal-temporal/#sec-temporal.timezone.prototype.tojson

Bug: v8:11544
Change-Id: I31f4ef6f725462da885893f1266d30590098b031
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3438378Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80363}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/c812b8d..0c83e78

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/src/buildtools/+log/113378f..7208edd

Rolling v8/buildtools/third_party/libunwind/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind/+log/393e3ee..f1108b6

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/d3c4414..58f3286

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/13acea3..443d913

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/75625c6..3e15bc0

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: Ifb09ed901ef782997b4674b40d74edc013750482
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3626176
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#80362}

WASM only supports simd128, but modern CPUs support
up to 256 bit vector register or more, we will add an
experimental feature to do 256 bit re-vectorization
in Turbofan pipeline, this patch add simd256 machine
representation.

Bug: v8:12716
Change-Id: I1e6a3f2afa0a457fca2c261216f4113d0ed5b818
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3534456Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Jie Pan <jie.pan@intel.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80361}