Recommended by clang-tidy's modernize-use-nullptr.

Bug: v8:10488
Change-Id: I7cf26f7bda69b9b1a6bdabe274399b494f6d49ed
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2211155Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67979}

See
https://clang.llvm.org/extra/clang-tidy/checks/modernize-use-override.html
for more on this warning.

Bug: v8:10488
Change-Id: I66efe295b8a3372bc2e99516447f70d258520090
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2211185Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67978}

This reverts commit a35d0e8c.

The original CL is likely not a culprit for the infra failures.

Bug: chromium:1056170
Change-Id: I8fa85db8a737fb01328021782f0c43626fa52b0d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2215826Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67977}

Bug: v8:7793
Change-Id: I5eac73a2b437e5e2d4005f79b7807ae7a9ed78e8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2214829Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67976}

Change-Id: I5a93231b16c8291c87fce57062837dce886bc2f8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2216231Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#67975}

Several tests were using them and we can dedup code.

Change-Id: I4ef5ae5772856d1f36e965b6b62ff5895b4e04fb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2215173Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67974}

Bug: v8:9975
Change-Id: I51cbc83adecfa52959c991ed3c6f26cf4929c297
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2215175Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67973}

This reverts commit 4e5fabae.

Reason for revert: performance regressions chromium:1085305, chromium:1084978

Original change's description:
> [torque][cleanup] Use more precise field types in a few classes
> 
> This change updates some Torque-defined classes to include more precise
> field types where possible. It also updates those classes to use
> @generateCppClass. One field was removed because it's unused
> (PrototypeInfo::validity_cell), and two fields in StackFrameInfo
> actually became less precise because they're based on Script::name,
> which is an embedder-provided untyped Local<Value>. (Automatically
> generated accessors pointed out this bug easily.)
> 
> This change also includes a couple of minor fixes in Torque.
> 
> Change-Id: Ib2bc6c7165bb3612b6d344c0686a94165a568277
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2199640
> Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#67907}

TBR=ulan@chromium.org,tebbi@chromium.org,verwaest@chromium.org,seth.brenith@microsoft.com

Change-Id: I720821d8dc84ea0d79eb137f1c2507f75df9a107
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2211322Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67972}

This CL is a step towards reversing JS stack arguments for TurboFan.

It does the following:
1. Add StackOrder to CallInterfaceDescriptor
2. Reverse arguments in TF backend for JS calls.
3. Cleanup TFJ builtins interface descriptors, since calls for these builtins already reverse the arguments, we don't need to reverse the interface descriptor anymore.

Change-Id: Ie840b1757bf023aa381a7fa01cbe66e7cf90778f
Bug: v8:10201
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2213440Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67971}

This reverts commit 9a0e6bd5.

Reason for revert: Speculative revert for https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20-%20builder/47777

Original change's description:
> cppgc: Port concurrent sweeper
> 
> This moves concurrent and incremental sweeping from Blink. This also
> adds TestPlatform that makes it easier to test concurrent and
> incremental sweeping.
> 
> Drive-by: fix unmarking of large pages.
> 
> Bug: chromium:1056170
> Change-Id: Ifd50ff67b9df17ff117a5f4d4eb5a2937d3023be
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2207132
> Commit-Queue: Anton Bikineev <bikineev@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Omer Katz <omerkatz@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#67969}

TBR=ulan@chromium.org,mlippautz@chromium.org,bikineev@chromium.org,omerkatz@chromium.org

Change-Id: I5530f11f7b8560116324bb156ba98e426c0feb35
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:1056170
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2215057Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67970}

This moves concurrent and incremental sweeping from Blink. This also
adds TestPlatform that makes it easier to test concurrent and
incremental sweeping.

Drive-by: fix unmarking of large pages.

Bug: chromium:1056170
Change-Id: Ifd50ff67b9df17ff117a5f4d4eb5a2937d3023be
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2207132
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67969}

With --stress-incremental-marking we want to start concurrent marking
faster by also sweeping pages on incremental marking steps.

Bug: v8:10315
Change-Id: Ie3fa04acc5e59a4b81c3351f4b522c78368bb1a6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2210247
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67968}

Objects allocated on the background thread during incremental marking, need to be allocated black. This prevents concurrent marking to observe uninitialized objects.

Bug: v8:10315
Change-Id: Ia4b05a2a72e4142c79b31a01cbf162a6599a18c0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2196347
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67967}

The Isolate is only used to access the wasm engine, and the accounting
allocating. The latter is also linked directly from the wasm engine, and
the engine is linked from the native module, to which the DebugInfoImpl
already has access.
Hence, this CL removes the redundant Isolate pointers, and just accesses
the engine and the allocator via the NativeModule.

R=thibaudm@chromium.org

Change-Id: Ib51cee2d166443a34e22fa02e8ad1549328aaa7f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2214827Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67966}

Triggering recompilation can reduce the number of outstanding
recompilation functions. If it gets reduced to zero, we also need to
trigger other callbacks waiting for recompilation to finish.
This situation can happen if all recompiled code was already
installed in the native module, but the compilation state was not
updated yet via {OnFinishedUnits}.

R=thibaudm@chromium.org

Bug: v8:10557, chromium:1084369, v8:10359
Change-Id: Ib80ff110776cf284632303b0b23e4c6e63426411
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2214828Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67965}

The interpreter is still used for testing, but frame inspection is not
wired any more. Hence this CL removes it.

R=thibaudm@chromium.org

Bug: v8:10389
Change-Id: If93928dd3996a19c1251a93d843034574d4c43ce
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2215165Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67964}

... and CallParameters::arity().

The construct arity contains the actual argument count, plus 2 for the
target  (the first input) and new target (the last input). This CL adds
a named constant and a helper method for accessing arity without extra
args. In the future we may want to remove the extra args from arity()
altogether.

Call arity is similar but includes the target and receiver.

Bug: v8:10542,v8:8888
Change-Id: I850fa314f88c2bee9d4dcd87eac9295b2bf88281
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2208850
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67963}

If --turbo-nci is enabled, use unary op builtins with feedback
collection during generic lowering.

Bug: v8:8888
Change-Id: Ie32cfe1558a7fbada2ac69a99ef969097558bc89
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2209067
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67962}

This adds the wasm instance to the module scope. The instance
contains the exported entities that can now be inspected.

Bug: chromium:1043034
Change-Id: I9236ac9c126f3bc4b1e056990fe34956bbe8ed6b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2213433
Commit-Queue: Kim-Anh Tran <kimanh@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67961}

After all struct/array definitions are parsed, we need to check if all
reference type indices are legal. We need to do it at the end because
types can be mutually recursive.

Bug: v8:7748
Change-Id: I5e6b5185e7d0c5e8d905b6833a2b9026ab630c01
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2214821
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67960}

Bug: v8:10552
Change-Id: I1160ff0f9d2c91bb3c2ad3e0d5e1f36953538420
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2211402Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67959}

The interpreter is not used for debugging any more. Hence any breakpoint
support and related functionality is dead code.

This CL removes
- the {SetBreakpoint} and {GetBreakpoint} methods,
- the {break_pc_} field which holds the current pause position,
- the {break_flags_} field which is used to break at function entry and
  after calls,
- functions to modify {break_flags_},
- the dead {kInternalBreakpoint} and {kInvalidPc} constants (plus
  respective macros and enums),
- the {orig_start} and {orig_end} fields (code is not being modified any
  more, so we just use {start} and {end} now),
- the {PrepareStepIn} method,
- the unimplemented {SetTracing} method, and
- two tests that test breakpoints in the interpreter.

R=thibaudm@chromium.org

Bug: v8:10389
Change-Id: I52103c37516446e40d3dfa365d6b480a7c623577
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2215163
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67958}

If multiple isolates share the same module, and the debugger gets
enabled, then we trigger tier down in each isolate separately. To avoid
generating too much code, we only recompile functions that are not
already in the right tier.

This CL is only the first step towards an actual fix. Since we only
check already installed code (and ignore compilations that are already
scheduled), we might still compile the same functions multiple times. A
second CL will make sure that only one recompilation is running at the
same time.

R=thibaudm@chromium.org

Bug: chromium:1084369, v8:10359
Change-Id: Ic4f9afac1add0fe8ad9e5d68f22d3d41ba2e52be
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2213438Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67957}

This CL adds the new _WithFeedback variant of unary, binary, and
compare operation builtins. Existing logic to do these operations is
refactored s.t. it can be used by both ignition bytecode handlers and
the new builtins.

Note that the new builtins are not yet used. Follow-up CLs will hook
them into generic lowering.

Bug: v8:8888
Change-Id: Id77dbe74bdf3b3806b2aefdf1abe52c3d165a3a3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2208862
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67956}

This CL introduces the SyncStreamingDecoder to support
streaming compilation when --single-threaded is set. The
SyncStreamingDecoder buffers all bytes it receives over
{OnBytesReceived}, and compiles them synchronously upon {Finish}.

In addition to introducing SyncStreamingDecoder, this CL does
the following changes:
* Redirect streaming compilation to the new streaming decoder if
  --no-wasm-async-compilation is set. This flag is set if
  --single-threaded is set.
* Extend the test-streaming-compilation.cc tests to test also the new
  streaming decoder.

R=thibaudm@chromium.org

Bug: v8:10548
Change-Id: I807e291a6060067c9835de4adf82bcb00321d995
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2209053
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67955}

Change-Id: I092c0d70bf517b4c714f5958b188d54030dd9774
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1932838
Commit-Queue: Daniel Clifford <danno@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67954}

We can't consistently rewire the successor blocks of an unreachable node to
disconnect them from the graph when we are trying to maintain the schedule.
Instead simply leave the code there. As a future optimization we could add a
proper scheduled dead code elimination phase which can deal with this.

As a side-effect, one of the tests sees a int64 DeadValue, so add support for that
in the instruction selector.

BUG=chromium:1083272,chromium:1083763,chromium:1084953,v8:9684

Change-Id: I69a6feaeef4eae62110392e27ea848b28bccf787
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2209061
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Auto-Submit: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67953}

Failing to do so results in an error when generating the respective
ValueType, since the index has to be encoded in 24 bits.

Bug: v8:7748, chromium:1080444
Change-Id: Ifd1ce9744388b65f91dbd9eaeb497726c6cd207e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2214823
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67952}

This patch added an IsValid method to StartupData which returns a
boolean upon verifying a given snapshot matches the v8 version.
Embedders can use this API now to check snapshots' versions.

This was originally done by Snapshot::CheckVersion, which now simply
runs Startup::IsValid.

Bug: v8:8104
Change-Id: If555bcc55de4a05adf61798cd58d9ea8c8a71302
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2178091
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Auto-Submit: Junha Park <jpark3@scu.edu>
Cr-Commit-Position: refs/heads/master@{#67951}

- Add button to select top-10 instance types per category
- Right align category selection buttons
- Lazily draw the graph for snappier UI
- Pre-init instance variables in details-selection

Change-Id: I61ea80d523c49215b9d418e66698a12cbc050316
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2210681
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67950}

This CL also fixes a small bug in the update-wasm-spec-tests.sh script,
as it was not able to handle proposals without additional core spec
tests. It also disables a lot of tests.

R=jkummerow@chromium.org
bug:v8:10556

Change-Id: Ibd885350478de935dc67edb664715cfa64f1d8e1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2210248
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67949}

Sometimes CSA code carefully constructs a mask to check several
bitfields at once. Thus far, such a check has been very awkward to write
in Torque. This change adds a way to do so, using the
non-short-circuiting binary `&` operator. So now you can write an
expression that depends on several bitfields from a bitfield struct,
like `x.a == 5 & x.b & !x.c & x.d == 2` (assuming b is a one-bit value),
and it will be reduced to a single mask and equality check. To
demonstrate a usage of this new reduction, this change ports the trivial
macro IsSimpleObjectMap to Torque. I manually verified that the
generated code for the builtin SetDataProperties, which uses that macro,
is unchanged.

Bug: v8:7793
Change-Id: I4a23e0005d738a6699ea0f2a63f9fd67b01e7026
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2183276
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67948}

From 10 to 8 instructions (each). We do this by using mi (instead of lt)
and ls (instead of le), which check for strictly less than and greater
than or unordered. That way we don't have to have an extra mov for NaN.

Change-Id: I18ff876ac12b7097d73d6cbbb64de6c2a1148e43
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2208934Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67947}

These were changed in the renumbering
https://github.com/WebAssembly/simd/blob/master/proposals/simd/NewOpcodes.md

Bug: v8:10501
Change-Id: I4e98b0a482e18208b63f11a1675a90c9367a6d93
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2212682Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67946}

The proposal uses the lane shape, e.g. i64x2.anytrue, and we were using
s1x2.anytrue in our opcodes. This was a legacy naming, because we were
trying to bitpack the booleans. Now that we aren't doing that, rename
these to be more consistent with the proposal.

This was done with a straightforward sed script, changing both cpp code
and also some comments in mjsunit test files.

Bug: v8:10506
Change-Id: If077ed805de23520d8580d6b3b1906c80f67b94f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2207915
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67945}

Currently, if d8 is run with the --turbo-profiling flag, it prints info
about every TurboFan-compiled function. This info includes the number of
times that each basic block in the function was run. It also includes
text representations of the function's schedule and code, so that the
person reading the output can associate counters with blocks of code.

The data about each function is currently stored in a
BasicBlockProfiler::Data instance, which is attached to a list owned by
the singleton BasicBlockProfiler. Each Data contains an
std::vector<uint32_t> which represents how many times each block in the
function has executed. The generated code for each block uses a raw
pointer into the storage of that vector to implement incrementing the
counter.

With this change, if you compile with v8_enable_builtins_profiling and
then run with --turbo-profiling, d8 will print that same info about
builtins too.

In order to generate code that can survive being serialized to a
snapshot and reloaded, this change uses counters in the JS heap instead
of a std::vector outside the JS heap. The steps for instrumentation are
as follows:

1. Between scheduling and instruction selection, add code to increment
   the counter for each block. The counters array doesn't yet exist at
   this point, and allocation is disallowed, so at this point the code
   refers to a special marker value.
2. During finalization of the code, allocate a BasicBlockProfilingData
   object on the JS heap containing data equivalent to what is stored in
   BasicBlockProfiler::Data. This includes a ByteArray that is big
   enough to store the counters for each block.
3. Patch the reference in the BuiltinsConstantsTableBuilder so that
   instead of referring to the marker object, it now refers to this
   ByteArray. Also add the BasicBlockProfilingData object to a list that
   is attached to the heap roots so it can be easily accessed for
   printing.

Because these steps include modifying the BuiltinsConstantsTableBuilder,
this procedure is only applicable to builtins. Runtime-generated code
still uses raw pointers into std::vector instances. In order to keep
divergence between these code paths to a minimum, most work is done
referring to instances of BasicBlockProfiler::Data (the C++ class), and
functions are provided to copy back and forth between that type and
BasicBlockProfilingData (the JS heap object).

This change is intended only to make --turbo-profiling work consistently
on more kinds of functions, but with some further work, this data could
form the basis for:
- code coverage info for fuzzers, and/or
- hot-path info for profile-guided optimization.

Bug: v8:10470, v8:9119
Change-Id: Ib556a5bc3abe67cdaa2e3ee62702a2a08b11cb61
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2159738
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67944}

Some non-templated uses remain until further TNodification.

Bug: v8:9708, v8:6949
Change-Id: Ica841f95a6ddfbdea78589f9db47c5b4126497f5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2212263
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67943}

Bug: v8:9708, v8:6949
Change-Id: Ia57ba7e0e24f5f402147246981ba1a1c30295abf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2212262Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67942}

Bug: v8:9708, v8:6949
Change-Id: I60237b03a474a9d8e30bf48b6d9196a07fb81171
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2212261Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67941}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/1a96233..99ffd3c

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/src/buildtools/+log/c8f5482..7a0ebcc

Rolling v8/third_party/aemu-linux-x64: wCYE7BPak_YwqYwMPrwRw1mwSyAzsuX3tth_UvhHUEUC..4xEEbuyLmLA-dGdzewQlaM2km7fPUiGEEdIQJhIK8v4C

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/503f81b..ae2ed9f

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/d8c6146..8f6bfe3

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/a0ee3ce..e34638c

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I0d238afaaeec823e1be91bfe7f75e741f622e27e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2208123Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#67940}