CrossThreadPersistent and friends are the followup.

Bug: chromium:1056170
Change-Id: Ide910062d80952da73b922398c281162b1861f47
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2144957
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67153}

Soft-deopt for mono/polymorphic property accesses that don't have any
maps, and only allow zero-map feedback to be monomorphic. This makes
sure we only emit a megamorphic LoadIC builtin call if the IC was
actually megamorphic.

JSGenericLowering assumed that zero maps meant that a load site is
megamorphic. However, it can be the case that the call-site is
monomorphic or polymorphic, and the maps had died. In this case we don't
want to call the megamorphic IC builtin, as on a stub cache miss we
fallback to a normal LoadIC miss, which can record mono/polymorphic
feedback in the IC. After this, we'll enter a miss loop in the
megamorphic load builtin, and worse the LoadIC assumes that there's
something "wrong" with the feedback, so it'll keep trying to reconfigure
the handler (possibly allocating new load handlers if this is a
prototype field access).

As a drive-by, rewrite GetRelevantReceiverMaps to be an in-place
filtering of the maps rather than copying them.

Change-Id: I0c25bfa606367fa81c43223bbd56cdadb5e789ef
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2150586Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67152}

In strict mode stores to non-existent properties throw. We should not
install a handler with the property cell for such stores. These handlers
would expect that the value exists when they see a property cell. If
this property cell gets invalidated later, it appears as if it is a
valid property cell with undefined value. This leads to an incorrect
behaviour. This cl checks if we are in strict mode and uses a slow
stub in such cases.

Bug: chromium:1067757
Change-Id: I543c6a6931530bfb13cc9a33d1dabaa756489fd1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2142255
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67151}

Add ConcurrentAllocator which can be used for concurrent allocation from a background thread in the old space. ConcurrentAllocator doesn't request a GC yet when an allocation fails. This will be implemented in later CLs.

Bug: v8:10315
Change-Id: I81260ebbd8863c143e93aedb93c66d0e7c28bddb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2144066
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67150}

... to make real world protector invalidations measurable.

Chromium CL: https://crrev.com/c/2149324

Drive-by: Add missing newline in protector tracing.
Drive-by: Consistent naming for the regexp species protector.

Bug: v8:9496
Change-Id: I3c7238aa8024e03ea9e89daf83345b8ec4f0d768
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2149428Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67149}

This commit removes the explicit namespace in FunctionCallbackArguments
constructor. They are not needed and this change seems to be consistent
with other CustomArguments classes like PropertyCallbackArguments.

Change-Id: If18371fbb2e6a7161ea4a1633f4219f3498cdc8c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2141740Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67148}

Bug: chromium:1070890
Change-Id: I62ad81b8d5bcb9934c7eda4eae595d41339adfdf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2149425Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Auto-Submit: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67147}

Bug: v8:9909
Change-Id: I5afad8ef0c5bf2ccad61d71fcc0c89db48851e24
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2147148
Commit-Queue: Fanchen Kong <fanchen.kong@intel.com>
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67146}

The underlying issue was fixed in https://crrev.com/c/2144116 and
https://crrev.com/c/2142259. This reenabled the test generally. Note
that it's still skipped in special configurations. I will reevaluate
which of those can also be unskipped via separate CLs.

Drive-by: Fix the order of "expected" and "actual" values.

R=thibaudm@chromium.org

Bug: v8:10410
Change-Id: Idbdcc73d641661e96e12110dcf10b060e0cf47a1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2144070Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67145}

Bug: v8:10416
Change-Id: I80e3d5565ce4b89f39d1a08691b0e91a7a67e5a7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2149424Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67144}

R=jgruber@chromium.org

Bug: v8:6071
Change-Id: I346775e827fe9b2f24409dbba642c97622e9ea7e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2149423Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67143}

Port 325e3290
https://crrev.com/c/2147594

Change-Id: If453f75dbf632d84817eca254d0b31e095d5bebb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2147590Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/master@{#67142}

https://chromium.googlesource.com/infra/luci/client-py.git/+log/cc958279ffd6..99e00d65632b

$ git log cc958279f..99e00d656 --date=short --no-merges --format='%ad %ae %s'
2020-04-15 tikuta client: update isolated client
2020-04-15 tikuta swarming/client: set client and version in User-Agent
2020-04-15 tikuta net: add set_user_agent
2020-04-14 yekuang [swarming] Add user-agent header to the client requests
2020-04-14 tikuta Revert "client: add filename and line in logging"
2020-04-10 yekuang run_isolated.py: Propagate the exceptions from upload_items() to the main thread
2020-04-09 qyearsley Run spellchecker on luci-py.
2020-04-09 tikuta client: add verify_push flag to archive_files_to_storage
2020-04-09 jwata [swarming-client] evict corrupted files in local cache
2020-04-09 yekuang Send SIGTERM to the isolated download process when it times out
2020-04-08 tikuta client: update isolated client
2020-04-08 tikuta client: include relevant logs only in update_isolated.sh
2020-04-01 tikuta client: update isolated client
2020-04-01 tikuta client: update isolated client
2020-04-01 tikuta client: add script to update isolated in run_isolated.py
2020-03-31 tikuta client: check hash of uploaded file
2020-03-30 tikuta client: add filename and line in logging
2020-03-30 yekuang client: update isolated client
2020-03-27 tikuta client: update isolated client
2020-03-27 leilei Update luci_context.py, otherwise it is failed to get LUCI context in Python3.
2020-03-23 leilei Reland "Update Swarming client code to make it work with Python3."
2020-03-23 tikuta Reland "client: remove --extra-variable flag from isolate.py"
2020-03-19 tikuta client: show exception when failed to run command
2020-03-19 mattkot Re-cache free disk space when _load fails
2020-03-18 tikuta Revert "client: remove --extra-variable flag from isolate.py"
2020-03-17 tikuta Revert "Update Swarming client code to make it work with Python3."
2020-03-17 leilei Update Swarming client code to make it work with Python3.
2020-03-12 tikuta swarming: show account id when failed to get oauth_token

Created with:
  roll-dep v8/tools/swarming_client

Bug: chromium:1070487
Change-Id: Ib8bc82a02d799d2756268243ba6d53b3508762ce
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2147591
Auto-Submit: Ye Kuang <yekuang@google.com>
Commit-Queue: Ye Kuang <yekuang@google.com>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67141}

--incremental-marking-soft-trigger is a percentage of (limit - size)
at which incremental marking starts via a task.

--incremental-marking-hard-trigger is a percentage of (limit - size)
at which incremental marking starts immediately.

E.g. --incremental-marking-soft-trigger=50 and
--incremental-marking-soft-trigger=100 will start a task half-way to
the limit and start incremental marking at the limit.

Change-Id: I14be992c8552dc47de401b376b815f693564cb74
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2144069Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67140}

Location information doesn't reveal interesting bugs, but leads to
tedious duplicates when the location information deviates.

Bug: chromium:1068003
Change-Id: I0b6d0ee28e1a3f370d19e5593484ee250fd6928f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2148781
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67139}

https://chromium.googlesource.com/external/github.com/google/googletest.git/+log/10b1902d893e..e3f0319d89f4

This CL also removes references to gmock-generated-matchers.h, which was
removed from googletest in commit
41b5f149ab306e96b5b2faf523505d75acffd98a, and to
gmock-generated-function-mockers.h, which was removed from googletest in
commit fbf67a70d07543f40832d0cd7a58f304bc6ab1d1.

$ git log 10b1902d8..e3f0319d8 --date=short --no-merges --format='%ad %ae %s'
2020-04-01 absl-team Googletest export
2020-03-30 absl-team Googletest export
2020-03-23 absl-team Googletest export
2020-03-24 krystian.kuzniarek remove chapters on Autotools, Meson and plain Makefiles
2020-03-24 krystian.kuzniarek remove dead code in googletest-output-test
2020-03-24 pkryger Swap settimer and sigaction calls to avoid SIGPROF
2020-03-20 absl-team Googletest export
2019-07-11 adam.f.badura Add support for std::function in MockFunction (#2277)
2019-12-26 adam.f.badura Add tests for MockFunction deduction (#2277)
2020-03-17 absl-team Googletest export
2020-03-16 dmauro Googletest export
2020-03-13 absl-team Googletest export
2020-03-06 absl-team Googletest export
2020-03-03 absl-team Googletest export
2020-03-03 absl-team Googletest export
2020-03-11 romain.geissler Make sure IsATTY does not clobber errno.
2020-02-27 absl-team Googletest export
2020-02-25 absl-team Googletest export
2020-02-19 absl-team Googletest export
2020-02-21 johan.mabille Fixed warnings
2020-02-12 absl-team Googletest export
2020-02-11 absl-team Googletest export
2020-02-11 absl-team Googletest export
2020-02-10 absl-team Googletest export
2020-02-10 absl-team Googletest export
2020-02-07 absl-team Googletest export
2020-02-07 absl-team Googletest export
2020-02-06 durandal Googletest export
2020-02-05 absl-team Googletest export
2020-02-05 absl-team Googletest export
2020-02-03 absl-team Googletest export
2020-02-03 absl-team Googletest export
2020-01-31 absl-team Googletest export
2020-01-31 absl-team Googletest export
2020-01-29 absl-team Googletest export
2020-01-27 absl-team Googletest export
2020-01-27 absl-team Googletest export
2020-01-27 absl-team Googletest export
2020-01-24 absl-team Googletest export
2020-01-24 absl-team Googletest export
2020-01-23 absl-team Googletest export
2020-01-29 krystian.kuzniarek remove a dead reference to the Autotools script
2019-11-11 krystian.kuzniarek add documentation for the premature-exit-file protocol

Created with:
  roll-dep v8/third_party/googletest/src

Bug: chromium:1070043
Change-Id: If63ebef3355a8e9da53cfa131c50ba03a0ea650d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2150068Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Victor Costan <pwnall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67138}

Bug: v8:9909
Change-Id: I04e50b02f52c24dd39ff3edb26cbaf8843b6910a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2147594Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Jing Bao <jing.bao@intel.com>
Cr-Commit-Position: refs/heads/master@{#67137}

Port 4558c1df
https://crrev.com/c/2141654

Original Commit Message:

  As a drive-by, the order of rounding_average_u is adjusted according to
  src/wasm/wasm-opcodes.h.

Change-Id: Ia2d39753f618f10e0795f83daa7e5a63f49f554a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2147578Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/master@{#67136}

When memory.grow was executed concurrently on multiple threads a data
race could happen such that two memory.grow operations result in the
same return value. With this CL the return value of memory.grow is
unique, given that memory.grow actually grows the memory.

As a concrete example, assume a shared WebAssembly memory initially has
a size of 100. Assume two threads call memory.grow concurrently with a
parameter `10`. Then with the existing code, memory would grow correctly
to a size of 120, but the data race may cause both memory.grow
operations to return 100. With the change in this CL one memory.grow
operation would return 100, the other would return 110.

R=gdeepti@chromium.org
CC=rreverser@google.com

Bug: chromium:1067621
Change-Id: Ib22b5135714a56799e0818ccb39e5dce327e5f8e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2144113Reviewed-by: Ben Smith <binji@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67135}

AIX default page size is 4096 bytes hence
PlatformUsesGuardPages returns true. Power Linux however
has a default page size of 65536 bytes and the above function
is expected to return false. More info is available
at https://crrev.com/c/2144060.

Change-Id: I35a13ada5bd1b18729cfa039a0bc699a409fbc2c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2147634Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#67134}

older gcc compilers (tested on PPC gcc 6) may throw
a compilation error if std::pair is not constructed explicitly.

<algorithm> header also needs to be included to avoid the following
error:

error: 'remove_if' is not a member of 'std'


Change-Id: Ia7919185614fee1e2e35f2fb25f5fdf05b90e27f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2149565Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#67133}

Bug: v8:9909
Change-Id: I9145ac93392073f01e2df9fec8eeae0b6e75dd00
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2145238
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67132}

Bug: v8:9909
Change-Id: I38e3a8d8915148107b7ff810e1e28c97351da65a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2145237Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67131}

[1] has changed the layering between JavaScript and HTML substantially
with regards to queuing promise-related microtasks. This fixes up the
comments and parameter orders so that they match up with the current
spec.

[1]: https://github.com/tc39/ecma262/commit/c59502090e2c250cd7e457b5506b92db6b21d153

Change-Id: I75650f7dc1c0b1d1c2b67aaf19d9791a0391a06d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2106997Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Timothy Gu <timothygu@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67130}

A few notes:
1) Oilpan is a generic library, meaning that it can work with arbitrary
user types. The library is split in type-aware (include/) and
type-erased (src/) parts. The former comprises a lot of code that still
needs to be defended with dchecks;
2) Macros are prefixed with CPPGC_, so that they don't clash in the user
code with similar macros from other libraries;
3) The macros simply forward requests to V8 so that dcheck handlers can
be configured uniformly;
4) The CL doesn't contain CHECK_EQ and friends, but they can be added
later if needed.

Bug: chromium:1056170
Change-Id: I68e6f663247705233eaf030384164d81e53071e1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2148774
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67129}

Change-Id: Id55edb409f64b8dfd72530c95a3a5ca001d176b5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2144750Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#67128}

R=ahaas@chromium.org

Bug: v8:10328
Change-Id: I19ecad9161ea61b4c8a22f80f8ac10ebf23dee53
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2148783
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67127}

The CL also mooves the {ClearRegister} function to the
platform-independent LiftoffAssembler code.

R=clemensb@chromium.org

Bug: v8:10108
Change-Id: Ibf9f1829a525c859ad004636f678b82aa72d39ae
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2129637
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Jacob Bramley <jacob.bramley@arm.com>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67126}

This CL adds:
- Declaring and invoking prefinalizers
- NoAllocationScope

Bug: chromium:1056170
Change-Id: Ib0f688fa4a8bb5fde44b36597ce2d6d2664fdff5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2139588
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67125}

This reverts commit f2ea42d6.

Reason for revert: Makes UBSan unhappy: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20UBSan/10634

Original change's description:
> [wasm-debug-eval] Implement additional evaluator API methods
> 
> This CL implements the __getLocal and __sbrk APIs of the evaluator
> interface.  Also includes a drive-by fix of the imports' module: put
> them on the "env" module.
> 
> Change-Id: Ie16d1b1cf924b88734eda184d1ce98d52f32f828
> Bug: chromium:1020120
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2132786
> Commit-Queue: Philip Pfaffe <pfaffe@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#67122}

TBR=jkummerow@chromium.org,pfaffe@chromium.org

Change-Id: I23b078d37971e083c08c9b83994bbf38ac13f103
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:1020120
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2148787Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67124}

We were still occasionally failing tests because sometimes non-debug
Liftoff code was published *after* debug Liftoff code. This would
overwrite the debug code and we would not stop on function entry then.
This fixes this by only preferring Liftoff code in publishing if it has
been compiled for debugging.
As a side effect, this will also prefer TurboFan code which has been
compiled for debugging (i.e. Liftoff bailed out), but this would only
happen for experimental features and in this case we will just overwrite
TurboFan code with TurboFan code, which is fine.

R=thibaudm@chromium.org

Bug: v8:10410
Change-Id: I6516e9f474f6118f0f0c077e6789f604ca128e74
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2144122Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67123}

This CL implements the __getLocal and __sbrk APIs of the evaluator
interface.  Also includes a drive-by fix of the imports' module: put
them on the "env" module.

Change-Id: Ie16d1b1cf924b88734eda184d1ce98d52f32f828
Bug: chromium:1020120
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2132786
Commit-Queue: Philip Pfaffe <pfaffe@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67122}

For example, when --fuzzing is off, %OptimizeFunctionOnNextCall now
crashes when given a non-function argument.

The following behaviors remain unchanged for now:
- %DeoptimizeFunction continues to do nothing if the function is not
  optimized.
- %DeoptimizeNow continues to do nothing if the top-most JS function
  is not optimized.
- %OptimizeOSR continues to do nothing if the function already has
  optimized code.

Bug: v8:10249
Change-Id: I35d2f3d50ce3f94c8ffccabe50fb4df2b70ce028
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2137406
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67121}

Change-Id: I2183b08596874d41eece64d6bdecc8f174cd738e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2144547Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67120}

This adds a flag to {WasmCode} objects to store whether this code was
generated for debugging. This flag can be set for Liftoff code (in which
case the code will e.g. have an extended prologue for debugging), but it
can also be set for TurboFan, in case Liftoff bailed out when producing
the debugging code.

Having this flag allows us to remove the hack to pass the compilation
results to {OnFinishedUnits} just to check whether we actually wanted to
compile Liftoff functions.

Drive-by: Replace the {ReachedRecompilationTierField} by a
{MissingRecompilationField}, because all we need to know is if we are
still waiting for that function to get recompiled.

R=ahaas@chromium.org

Bug: v8:10330,v8:10410
Change-Id: Ia023df8955a60d9f5595a6cb2737e14d83baf716
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2142259
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67119}

Bug: v8:9891
Change-Id: I5e561e1ef93f0ed6712ea6477cbee0205f72e1c1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2145192Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67118}

This is a port of src/components/gc that was added recently.

Differences:
- Added back bucketing to the page pool, as that guarantees that
  arenas used for specific types do not have their pages used by other
  arenas.
- Replaced base::flat_map with std::map. This may cause performance
  regressions when using PageMemoryRegionTree in hot paths. A
  vector-like representation may be used to fix such a regression

This reverts commit a056cea5.

Bug: chromium:1056170
Change-Id: Iffb8b0d91c8cca1815d7a1cda9486e7716aea75f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2144060
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67117}

v8::V8::Initialize() will fail with meaningful error upon build
configuration mismatch.

Bug: v8:10041
Change-Id: Ic69ba68ef1764b356beef0f204fe58b45bae3c49
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2144953
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67116}

Before the "debug" flag was stored on the {CompilationEnv}. But each
background compilation task only gets the {CompilationEnv} once when
starting compilation, so by the time it picks up the "Liftoff for
debugging" compilation jobs, it might still compile them without the
debug flag being set. This leads to flakes in the "debug-step-into-wasm"
test, because we won't stop in the function prologue when stepping in
(because the function prologue does not check the "hook on function
call" flag if debug mode was not enabled).

This CL does not increase the size of a compilation unit, since both the
tier and the debug flag only need a single byte each.

As a nice side effect, this change allows us to remove the lock in
{CreateCompilationEnv}, because no modifyable flag is read any more.

R=thibaudm@chromium.org

Bug: v8:10410
Change-Id: Ic296ea0c4dd1d4dedde119f0536e87e5d301b5a1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2144116Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67115}

ArrayBuffer instances are serialized by first re-assigning a index
to the backing store field, then serializing the object, and then
storing the actual backing store address again (and the same for the
ArrayBufferExtension). If serialization of the object itself is deferred,
the real backing store address is written into the snapshot, which cannot be
processed when deserializing, leading to a crash.

This fixes this by not deferring ArrayBuffer serialization and adding a DCHECK
for the crash that previously occurred.

Change-Id: Id9bea8268061bd0770cde7bfeb6695248978f994
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2144123
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67114}