This reverts commit 7b7df7db.

Reason for revert: Still breaks gc-stress bots: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20gc%20stress/24466

Original change's description:
> Reland "[Heap] Create a fast path for young allocations."
> 
> Disable a flaky test.
> 
> This is a reland of cbf028e8
> 
> Original change's description:
> > [Heap] Create a fast path for young allocations.
> >
> > Bug: v8:9714
> > Change-Id: I3be6ea615142c8282bb67370626c7596cedf826c
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1800304
> > Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> > Commit-Queue: Victor Gomes <victorgomes@google.com>
> > Auto-Submit: Victor Gomes <victorgomes@google.com>
> > Cr-Commit-Position: refs/heads/master@{#63729}
> 
> Bug: v8:9714
> Change-Id: Ifbd8617be1b8c58cb1552fe88c52eafd9d6e9c7d
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1801840
> Commit-Queue: Victor Gomes <victorgomes@google.com>
> Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
> Auto-Submit: Victor Gomes <victorgomes@google.com>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#63744}

TBR=ulan@chromium.org,verwaest@chromium.org,victorgomes@google.com

Change-Id: Ie041a7ff25adb9edc7c44ebb259912e66dfb9da1
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:9714
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1801852Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63747}

NewTuple3 is not used anywhere in the source code.

Bug: v8:9714
Change-Id: Iac3b3c17eafa01f5bb3de12a50afb4da0215e923
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1801843
Commit-Queue: Victor Gomes <victorgomes@google.com>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@google.com>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63746}

For minified files especially, the line number alone isn't enough to
identify an IC site.

Change-Id: I93f54f8fca1002072af0d702c155768fa2a8dbcb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1800566Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63745}

Disable a flaky test.

This is a reland of cbf028e8

Original change's description:
> [Heap] Create a fast path for young allocations.
>
> Bug: v8:9714
> Change-Id: I3be6ea615142c8282bb67370626c7596cedf826c
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1800304
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Commit-Queue: Victor Gomes <victorgomes@google.com>
> Auto-Submit: Victor Gomes <victorgomes@google.com>
> Cr-Commit-Position: refs/heads/master@{#63729}

Bug: v8:9714
Change-Id: Ifbd8617be1b8c58cb1552fe88c52eafd9d6e9c7d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1801840
Commit-Queue: Victor Gomes <victorgomes@google.com>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@google.com>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63744}

This reverts commit 9ce67926.

Reason for revert: This was never intended to stay.

Original change's description:
> [turbofan] temporarily disable const-based load elimination
> 
> This is a safe to merge hot-fix to tackle https://crbug.com/983764.
> To be reverted after merging to M77.
> 
> Bug: chromium:983764
> Change-Id: I3cd27481f224b352ef6bcf9dde21a8f77616acff
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1786285
> Reviewed-by: Maya Lekova <mslekova@chromium.org>
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#63570}

TBR=tebbi@chromium.org,mslekova@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: chromium:983764
Change-Id: I9c07eab384818aaeecab0224cec0f6b5310e9e09
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1801839Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63743}

This reverts commit ce421122.

Reason for revert: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20debug/27535

Original change's description:
> [turbofan] Temporarily disable future=>concurrent_inlining
> 
> ... in order to reset the benchmarks now that we are actually running
> in the background.
> 
> Bug: v8:7790
> Change-Id: Ifa811fbcc51eccef790e6215d330f8b45c31a492
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1801836
> Reviewed-by: Georg Neis <neis@chromium.org>
> Commit-Queue: Georg Neis <neis@chromium.org>
> Auto-Submit: Maya Lekova <mslekova@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#63741}

TBR=neis@chromium.org,mslekova@chromium.org

Change-Id: Ia36bc6a600c78b370a29964fabd215f853e048f9
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7790
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1803234Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63742}

... in order to reset the benchmarks now that we are actually running
in the background.

Bug: v8:7790
Change-Id: Ifa811fbcc51eccef790e6215d330f8b45c31a492
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1801836Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63741}

Bug: v8:9708
Change-Id: I91e429e478ad70dc2212f9f78830d10941fa47e6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1800581Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63740}

Bug: chromium:1003664, v8:7790
Change-Id: Ib80ae624e7a5e92cc5032b9098df141a9bf2ce25
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1801835
Commit-Queue: Georg Neis <neis@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63739}

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/src/buildtools/+log/74cfb57..cf454b2

Rolling v8/buildtools/linux64: git_revision:152c5144ceed9592c20f0c8fd55769646077569b..git_revision:ad9e442d92dcd9ee73a557428cfc336b55cbd533

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/884c81e..3732ed1

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/e5641be..2d75cf6

Rolling v8/third_party/googletest/src: https://chromium.googlesource.com/external/github.com/google/googletest/+log/3a45039..c7a03da

Rolling v8/third_party/icu: https://chromium.googlesource.com/chromium/deps/icu/+log/53f6b23..faee8bc

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/51c4acf..6706ebf

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: Ieb13189e6868e15233489bd045e9995ee06e59af
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1802148Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#63738}

Currently, debugger pauses on async call schedule and then waits for Debugger.pauseOnAsyncCall
with parentStackTraceId to actually schedule the pause.

This CL combines these two steps:
- For local async tasks, it just stores m_taskWithScheduledBreak at the time of schedule,
  to be able to pause once this task is run.
- For external async tasks, it plumbs "should_pause" boolean in V8StackTraceId from
  the point of schedule to the point of execution, and schedules a pause once
  externalAsyncTaskStarted is called with "should_pause" set to true.

This approach greatly simplifies the implementation, and reduced frontend to a single
"breakOnAsyncCall: true" parameter in Debugger.stepInto.

Drive-by: introduce hasScheduledBreakOnNextFunctionCall() to make
SetBreakOnNextFunctionCall management more robust.

Note: artificial pauses at async call schedule time are gone from test expectations -
we now only pause when user actually wants to pause, which makes protocol much simpler.

See also design doc linked in the bug.

BUG=chromium:1000475

Change-Id: I2d16f79c599fe196b2aaeca8223c63437a2954a9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1783724
Commit-Queue: Dmitry Gozman <dgozman@chromium.org>
Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63737}

  harmony_intl_bigint shipped in m76
  harmony_intl_date_format_range shipped in m76
  harmony_intl_datetime_style shipped in m76
  harmony_intl_numberformat_unified shipped in m77

Bug: v8:9272, v8:9273, v8:9274
Change-Id: Icc640e011021e691373bc61725013578b7185e50
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1799263
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63736}

Bug: v8:9708
Change-Id: I305cc007a4e7302c8587b999cbb11f23ced4cfd3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1800579
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63735}

Bug: v8:9464
Change-Id: I3252de850bbaa5fdb15f5fc2103f1ebb7be3e1ea
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1799396
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63734}

Bug: v8:8976
Change-Id: I1ffc6637e26ee217750d099d758fd67ed2130131
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1796316
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63733}

This reverts commit cbf028e8.

Reason for revert: Broke Mac64 GC Stress https://ci.chromium.org/p/v8/builders/ci/V8%20Mac64%20GC%20Stress/9148

Original change's description:
> [Heap] Create a fast path for young allocations.
> 
> Bug: v8:9714
> Change-Id: I3be6ea615142c8282bb67370626c7596cedf826c
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1800304
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Commit-Queue: Victor Gomes <victorgomes@google.com>
> Auto-Submit: Victor Gomes <victorgomes@google.com>
> Cr-Commit-Position: refs/heads/master@{#63729}

TBR=ulan@chromium.org,verwaest@chromium.org,victorgomes@google.com

Change-Id: I687de68a0413c62df304030deafd04661028f156
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:9714
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1801681Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63732}

Change-Id: I162b3cac024fba180ff191c8497da9a958c38167
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1797657
Commit-Queue: Irina Yatsenko <irinayat@microsoft.com>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63731}

I was using a regex to find VARIABLE (with upper case) so I missed cases where
the macro was not used, but still was an untyped variable.

Bug: v8:6949, v8:9396
Change-Id: I39e3090410b3ac49a4eaaf6fafa32b33ba0f1543
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1800569
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63730}

Bug: v8:9714
Change-Id: I3be6ea615142c8282bb67370626c7596cedf826c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1800304Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@google.com>
Auto-Submit: Victor Gomes <victorgomes@google.com>
Cr-Commit-Position: refs/heads/master@{#63729}

Bug: v8:6949, v8:9396
Change-Id: I2d8c252d97aae95f8368eb8e6566e52ffce9e957
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1796063
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63728}

Drive by fix of type of expected value in a test

Bug: v8:9626
Change-Id: I1bb44082b873383ea75e7089828bc68c9d4e0df0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1757503Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63727}

The point of this test is to check for OOB access traps, the read/write
of the entire backing buffer is not useful to this test, and causes the
test to be really slow, especially on arm simulator. This change cuts
the runtime of the test from ~7.5min to ~1.5min.

Bug: v8:7783
Bug: v8:9396
Change-Id: Id57648e920b7631d8c481d2a43ded1c16cd2d1d3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1793905
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63726}

TNodified:
 * EmitCreateShallowArrayLiteral
 * EmitCreateShallowObjectLiteral

Also propagated the TNodification of AllocationSite. Previously it was
used a lot with nullptr, and that changed to {}.

Bug: v8:6949, v8:9396
Change-Id: I8ed04d2d346f5960bba23a233c3dd244ad7f122a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1795346
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63725}

Bug: v8:9429
Change-Id: I2b1bc81f72e7cc7657330bd778586f608d62809b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1797659Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Francis McCabe <fgm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63724}

Port 2304c194

R=neis@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: Iadb240b15a081c3f0df4a5b513e54d0c7a4a2634
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1801494Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#63723}

Sort inactive live ranges by their assigned register and by their next
start. This allows {FindFreeRegistersForRange} to stop the search earlier
and significantly reduces compile time for some test cases.

R=sigurds@chromium.org
CC=neis@chromium.org

Bug: chromium:974804, v8:9529
Change-Id: I85e2ff8acf2c02ea0539c89daae5a427da775c2c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1795350
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63722}

This enables using TNode types without including code-assembler.h,
which is useful when generating CallInterfaceDescriptors.

As a drive-by, this moves TNode from v8::internal::compiler to
v8::internal. It's only used outside of the compiler anyway.

Change-Id: I3d938c22366a3570315041683094f77b0d1096a2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1798425
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63721}

Bug: v8:7790
Change-Id: Ifb0de3ca0a300734f2dcc8c104c8186367ca520b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1800573
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63720}

Case statements have a list of statements associated with them, but are
not blocks, and were hence not fixed-up correctly for code coverage.
This CL also applies the fix-up to the "body" of case statements,
in this way removing ranges reported as uncovered between the final
break/return in a case and the next case (or end of function).

Drive-by: Add optional pretty printing to code coverage test results.

Change-Id: I5f4002d4e17b7253ed516d99f7c389ab2264be10
Bug: v8:9705
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1798426Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63719}

Bug: v8:9708
Change-Id: I73cbe14437f596b805084ba61bc669556ac34289
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1798642Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63718}

Bug: v8:9714
Change-Id: I70c28c3bc2aae6234e55e8a3b176da2035520a67
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1800567
Commit-Queue: Victor Gomes <victorgomes@google.com>
Auto-Submit: Victor Gomes <victorgomes@google.com>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63717}

Port 2304c194

Change-Id: I0e46424ddb647355d21b1e54cf96b1e5503627ce
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1800572
Auto-Submit: Mu Tao <pamilty@gmail.com>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63716}

Bug: chromium:913887
Change-Id: If533bb85675456b674f79486b06a44e447f40aee
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1739371Reviewed-by: Simon Zünd <szuend@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63715}

Bug: v8:7790
Change-Id: Ief620bc24b59c2a4e0c823a7f7cebf5df114b9a6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1787430
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63714}

TNodify:
 * EmitFastNewFunctionContext
 * EmitCreateRegExpLiteral
 * EmitCreateEmptyArrayLiteral
 * EmitCreateEmptyObjectLiteral

Bug: v8:6949, v8:9396
Change-Id: I2a06e0a43feca42cf89d154b8fa9e84573676b4a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1793142Reviewed-by: Mythri Alle <mythria@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63713}

Since https://chromium-review.googlesource.com/c/v8/v8/+/1791632 sped it
up, there is no need to mark it as SLOW.

Bug: v8:7783
Change-Id: I24d1b2f1e56dff4c820d397288ab3ad7662ae06b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1800564Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63712}

This was missed during a file move and can cause build bugs.

Bug: chromium:991547
Change-Id: I157e7bb656956c08293c205c0d00884aecc7adee
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1798430
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Auto-Submit: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63711}

Bug: v8:7790
Change-Id: I1abffc574b1d9964940625b1f15fc4d98f170b7b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1798682
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63710}

This fixes the case where a table entry contains a function constructed
via {WebAssembly.Function} and is then read out via a runtime function
from the table.

R=ahaas@chromium.org
TEST=mjsunit/regress/wasm/regress-crbug-1002388
BUG=chromium:1002388

Change-Id: Ic0a9a544baaf37e68cd22eb91f2ef0bdf5fa5842
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1795352Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63709}

Currently the dispatch table could be accessed out of bounds if something
is wrong with the generated bytecode.
OOB access of the dispatch table can lead to jumps to arbitrary addresses
in the code space.

This CL prevents this issue by changing the following:
BYTECODE_MASK now filters out all bits not currently used for bytecodes.
All unused slots between the last actually defined bytecode and
BYTECODE_MASK are now filled with BREAK Bytecodes (invalid operation).
This way we can not access out of bounds of the dispatch table if
something is broken/tampered with, preventing jumps to arbitrary code.

Bug: v8:9699
Change-Id: Ibce591ae94b52472ba74a9fd0666e55185af7b2c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1795349
Commit-Queue: Patrick Thier <pthier@google.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63708}