Remove AstConsString "internalization", and instead make the conversion
to heap String be on-demand with an Allocate method. We never actually
need the heapified cons string more than once, so there's no need to do
the internalization walk or do the next/string union dance in the
AstConsString class.

This also allows us to specify how we want to allocate the String at the
call site. In particular, it allows us to allocate a flat SeqString rather
rather than a ConsString. This allows us to avoid allocating ConsStrings
which will just be passed to a flatten call, and especially avoid
allocating dead ConsStrings in the off-thread old space.

Bug: chromium:1011762
Bug: chromium:1043168
Change-Id: Id851f2f7529d92ad7e5388eb22823fd6d1959cd0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2020953Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66042}

'resumed' events are sent to the renderer from V8 and stored in a queue.
We didn't flush this queue previously, meaning these events would sit in
the queue until another message coincidentally flushed the queue.

Under some circumstances, the resumed event would not get flushed and
the UI would still be in a paused state, even when JS had resumed.

Bug: chromium:1044989
Change-Id: I5d92fcc0a40d4e3816501da98f6be8a46f227e0f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2023563Reviewed-by: Simon Zünd <szuend@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66041}

We will be able to collect test duration and later upload them in BQ.


Change-Id: Ie5610d4e872259857bf3f26ba698fa65d23058be
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2020952Reviewed-by: Tamer Tas <tmrts@chromium.org>
Commit-Queue: Liviu Rau <liviurau@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66040}

- Debugger stepping assumes that the pc points to the instruction
  that should get executed next, so we need to increment it when
  we hit a stop or a bkpt instruction or else we'll end up in an
  infinite loop.
- The "break" and the "stop unstop" command write into code space, so
  they need to temporarily make code space writable or else they
  just crash. (Note that this doesn't work for embedded builtins.)

Bug: v8:10164
Change-Id: Id77f5e97892076a9fdf8de0230632e0ce979da43
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2026732
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66039}

When the file begins with a hashbang, the scanner is in a failed state
when SkipHashbang() is called. This is usually not an issue but when
the parser encounters an ILLEGAL token, it will reset the SyntaxError
location because of it.

Bug: v8:10110
Change-Id: I1c7344bf5ad20079cff80130c991f3bff4d7e9a8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1995312Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66038}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/2f17606..25075ce

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/2e0a0cb..707a874

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/ea8b58b..1a0daf7

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/535dbf1..953ea7a

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: Ic908ce11f46097bf4b21189879220c21a90b7578
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2028530Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#66037}

Bug: v8:9909
Change-Id: I53d3b95e1f22e0194ac1a2ed7b556189acb8f9ad
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2023399Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66036}

Change-Id: I78a33d10b2c73d2fa0cb364a7a4b23de0c01d94c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2028516Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66035}

This reverts commit e8832647.

Reason for revert: Causes flaky fails on the tree, reverting as this test should be deterministic pass/fail.

https://logs.chromium.org/logs/v8/buildbucket/cr-buildbucket.appspot.com/8889903130443940000/+/steps/Check_-_nosse3__flakes_/0/logs/simd-call/0

Original change's description:
> [wasm-simd] Fix scalar lowering of kParameter
> 
> Lowers the call descriptor of a wasm function if it contains simd.
> 
> Also fixes a couple of issues with the lowering of kParameter:
> - the old_index == new_index check is incorrect, it would only work if
> the s128 parameter is the first parameter
> - the old_index was also not adjusted to account for Parameter[0] being
> the wasm instance object
> - new_index needs to be adjusted to account for the instance object too
> 
> These fixes make it more similar to the lowering of kParameter in
> int64-lowering.c.
> 
> Also add a new mjsunit test to exercise this logic.
> 
> Bug: v8:10154
> Change-Id: Ia767a464c26a6a78fd931eab9e6897890a0904e8
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2020521
> Commit-Queue: Zhi An Ng <zhin@chromium.org>
> Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#66032}

TBR=gdeepti@chromium.org,ahaas@chromium.org,zhin@chromium.org

Change-Id: I69589e2331c857c0f197ac53b8fb8a241376c632
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10154
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2028830Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66034}

This data is duplicated across the code map, and not actually required
for some esoteric types of CodeEntry objects (e.g. inline stacks). Unify
sourcing of this data from the code map instead.

Change-Id: I75fddc03221d1d6b7dab77d16fa05ad6eb3dd2a9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2026416Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Andrew Comminos <acomminos@fb.com>
Cr-Commit-Position: refs/heads/master@{#66033}

Lowers the call descriptor of a wasm function if it contains simd.

Also fixes a couple of issues with the lowering of kParameter:
- the old_index == new_index check is incorrect, it would only work if
the s128 parameter is the first parameter
- the old_index was also not adjusted to account for Parameter[0] being
the wasm instance object
- new_index needs to be adjusted to account for the instance object too

These fixes make it more similar to the lowering of kParameter in
int64-lowering.c.

Also add a new mjsunit test to exercise this logic.

Bug: v8:10154
Change-Id: Ia767a464c26a6a78fd931eab9e6897890a0904e8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2020521
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66032}

Bug: v8:9838
Change-Id: Idc6bda122354a54dd24e39b0356f35b0f54ef089
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2012596
Commit-Queue: Joshua Litt <joshualitt@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66031}

Bug: chromium:1044942
Change-Id: I6bc5f9a83e56a67996bb23ff46e1c58c719a2dfb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2027988
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66030}

Bug: chromium:1045937
Change-Id: Ic30db61ec77cb684f927bae0ed45446abcb2e426
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2027989Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66029}

Tests need to be disable until liftoff is fully implemented.

Change-Id: Ib906b7d4ef2abae1359fbfb1a61031eeb5d5e70c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2028289
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66028}

Copying one object's named properties is always fine, even if one of
the names could be a large index on a TypedArray. Mark the LookupIterator
as OWN_SKIP_INTERCEPTOR to avoid the DCHECK.

Bug: chromium:1044909
Change-Id: I6918186a4b50df7865de3572cb674fd7d6eadb78
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2023558
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66027}

Bumping the max TypedArray length caused the typer to make different
representation decisions, which caused inefficient back-and-forth
conversions. This patch repairs the microbenchmark where this was
most significant.
There might be additional future work to ensure that TypedArray
accesses that actually use huge indices remain on the fast path as well.

Bug: chromium:1045934
Change-Id: Ic6dccaae35fcdf74a26d47388477a1969bf0aa9f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2026728
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66026}

In the case of function names, we allocate ConsStrings only to flatten
them during finalization. Allocating these ConsStrings in old space
appears to have regressed some benchmarks (especially memory benchmarks),
but is necessary for off-thread allocation which doesn't have a young
space.

Ideally, we would avoid allocating these ConsStrings in the first place,
and would flatten the data directly from the AstConsString. For now, we
make them allocate in old space for off-thread allocation only, to
revert the regressions. In the future we can investigate smarter
flattening.

Bug: chromium:1011762
Bug: chromium:1044477, chromium:1044147, chromium:1043573, chromium:1043168
Change-Id: If24b738d6f2eeb8c0fea042a711deb2a19015fbd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2020948
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66025}

... using up-to-date git cl format.

Bug: v8:10155
Change-Id: Ie29b492a7831fe2d7c0de247d16f9b7be9e42a5b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2026730Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66024}

... which didn't check writability of array length on appending
a new element to an array.

Bug: chromium:1041251
Change-Id: I6935e505a4844e5b22abe9d4a42786619499daa6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2023551Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66023}

This reverts commit 7d1f95d6.

Reason for revert: Speculative revert for https://crbug.com/1046678

Original change's description:
> [regexp] Correctly escape a backslash-newline sequence
> 
> When printing the source string, a backslash-newline sequence ('\\\n',
> '\\\r', '\\\u2028', '\\\u2029') should be formatted as '\n', '\r',
> '\u2028', '\u2029', respectively. Prior to this CL it was formatted as
> a backslash followed by the literal newline character.
> 
> Bug: v8:8615
> Change-Id: Iac90195c56ea1707ea8469066b0cc967ea87fc73
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2016583
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Auto-Submit: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#65986}

TBR=neis@chromium.org,jgruber@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:8615,chromium:1046678
Change-Id: If28626a1c6868ed848310c0d30cf61a73326f2c1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2027452Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66022}

The compiler assumes (for loads) that the property cell of a
non-configurable global property never gets invalidated.

Bug: chromium:1044919
Change-Id: I27f6ce30fb9a21e2c1e5310f25e9bb973ebbc266
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2023562Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66021}

Converting an object to an array length can freeze the array whose
length is being set, but SetLength for the frozen elements accessor
is supposedly unreachable. This fix extends the existing special
handling for suddenly-readonly lengths to cover this case as well.
Prior art: https://codereview.chromium.org/2543553002

Bug: chromium:1044911
Change-Id: I85d2e79446a8d9c1d22cd86ddf828328bf51a1a1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2023555
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66020}

Currently objects that belong to the untracked contexts (i.e. contexts
for which measurement was not requested) are accounted in the shared
context. This CL introduces a dummy kOtherContext and attributes such
objects to that context.

Bug: chromium:973627
Change-Id: I9801ab317d95b944336b79a5e17721511d4897c3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2025370Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66019}

The existing legacy performance.memory API accounts external string
and array buffer backing store bytes. This CL adds per-context tracking
of external bytes

Bug: chromium:973627
Change-Id: I2b308dc540454e7b0b66406b83a18bf8f8d55d8e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2025369Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66018}

Put a logic in Wasm Engine to tier down all existing modules per isolate
when debugger is enabled. This CL does not handle new module added after
debugger is enabled yet.

Bug: v8:9654
Change-Id: I87060f5c416506543fcaf231bff9999d06ba4c0d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2013692
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66017}

Rolling v8/base/trace_event/common: https://chromium.googlesource.com/chromium/src/base/trace_event/common/+log/e327c63..bd79231

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/fd02540..2f17606

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/src/buildtools/+log/73414d5..afc5b79

Rolling v8/buildtools/linux64: git_revision:0c5557d173ce217cea095086a9c9610068123503..git_revision:97cc440d84f050f99ff0161f9414bfa2ffa38f65

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/251c765..2e0a0cb

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/05b001c..ea8b58b

Rolling v8/third_party/zlib: https://chromium.googlesource.com/chromium/src/third_party/zlib/+log/94485d9..b9b9a5a

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/42fbdfe..535dbf1

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: Ie4dd3f3acb98c7fd3bbba0d5425a2791bf94567e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2027147Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#66016}

These conversion instructions were removed from the proposal in
https://github.com/WebAssembly/simd/pull/178.

Change-Id: I212ca2f923362bf08e178f6d28cc2338cf6f5927
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2016006Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66015}

R=clemensb@chromium.org

Bug: v8:10108
Change-Id: I1a0546b4a5b754dcf35c66594ac7c5c37d940001
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2019484
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66014}

Added the new dependency pointing to head of this repo:
https://chromium.googlesource.com/chromium/src/third_party/android_platform/

A more relevant dry run can be found below where I also included the changes that the auto-roller was unable to land.
https://chromium-review.googlesource.com/c/v8/v8/+/2023553

Bug: chromium:1043646
Change-Id: Ife6547ca9cbb7f303beb48c330d1b4457495dd83
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2023556Reviewed-by: Liviu Rau <liviurau@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Liviu Rau <liviurau@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66013}

Remove include for state-values-utils.h and add node.h and
utils/ostream.h.

Bug: v8:10155
Change-Id: I3662018b546a0a9b82bc2cc72f3a8ced27156fe0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2023557
Commit-Queue: Dan Elphick <delphick@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Auto-Submit: Dan Elphick <delphick@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66012}

Change-Id: I0c85de569b75e47dddb54c2dc4101da252547751
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2023370Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#66011}

R=clemensb@chromium.org

Bug: v8:10108
Change-Id: I0a561a007ffd5327f47f68cc605b9eae57829d8e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2016596
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66010}

Declare that ByteCodeArray's source_position_table entry can also
contain Exception. (Also adds the Exception type to base.tq).

This is just a clean up for now but could be required if torque starts
generating checks for Union types (including differentiating between
different Oddballs).

Change-Id: Ie34ade100040df2f3a2e8120613b6b29d604984a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2019483
Auto-Submit: Dan Elphick <delphick@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66009}

This CL fixes a parser crash in REPL mode. Some SyntaxErrors can cause
the AST to contain NULL nodes, resulting in a crash when we want to
rewrite the AST after parsing.

Instead of re-writing a broken AST we bail early.

R=leszeks@chromium.org

Bug: chromium:1040034, chromium:1045758
Change-Id: I9c559f6de5969c8db17833ccbdb1608627b46311
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2023547Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66008}

The current implementation takes forwarding reference arguments, which
is fine when you call it with rvalues, like
make_iterator_range(V.begin(), V.end()). If you call it with lvalues
though, it doesn't do what you'd expect. ForwardIterator becomes a
reference:

Foo I = V.begin();
make_iterator_range(I, I); //ForwardIterator is deduced as Foo&

Since iterator are supposed to be small, no harm in passing them by
value.

Change-Id: I151c87304949d810c72c42f60e9d1a7151f61f83
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2020780
Commit-Queue: Philip Pfaffe <pfaffe@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66007}

This adds accounting for
- StringTable that is marked black directly without going through
  ProcessMarkingWorklist.
- DescriptorArray that is marked black directly inside VisitMap.
- FeedbackMetadata that erroneously was assigned kVisitDataObject
  visitor id, which works only for a fixed size data object.

Bug: chromium:973627
Change-Id: If7c8bca06316f60e975bf86beea09481df8aca8b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2023545Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66006}

No-Try: true
Bug: chromium:1045795
Change-Id: I8313194bd1b0706291bd6a041d370a0b43215e10
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2020956Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66005}

RequestSweep started an array buffer sweeping task even when there was
no work.

Bug: chromium:1045937
Change-Id: Ieb0835284f898dbc9b899d2b4118d9f7f6108a6f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2020961
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66004}

The flag naming was confusing, and inconsistent with other flags. To
disable bounds checks, you now have to say --no-wasm-bounds-checks
instead of the original --wasm-no-bounds-checks. Similarly, it is now
--no-wasm-stack-checks instead of --wasm-no-stack-checks.

R=clemensb@chromium.org

Bug: v8:10021
Change-Id: Ib57963866af794d4e47d68e520a42b4054ed2a8f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2017475
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66003}