SetCodeModificationPermissions better reflects its current usage.

Change-Id: Ia9b42328a2d467613736878e2b560e0d5282ad3f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3173674Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77015}

Bug: v8:11965
Change-Id: Ifa8946b28aad681bf3a13861db8f02d8e1a51730
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3178960
Auto-Submit: Dan Elphick <delphick@chromium.org>
Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77014}

.. by reusing the regexp stack from potentially multiple nested
irregexp activations.

To do this, we now maintain a stack pointer in RegExpStack. This stack
pointer is synchronized at all boundaries between generated irregexp
code and the outside world, i.e. when entering or returning from
irregexp code, and when calling into C functions such as GrowStack.

Fixed: v8:11382
Change-Id: I5ed27630c1a64ebf3afb9ddf80fb60ea067c0c40
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3162604Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Patrick Thier <pthier@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77013}

The CL provides a way for the embedder to hook in a special malloc-like
allocator that will be used for zone allocations.

An alternative approach would be to use weak functions with branches,
checking whether the functions were available at link-time. Those
branches could be optimized away with LTOs, so they would essentially
be free. However, the weak function approach is not portable (e.g.
there is no easy way to emulate it with msvc). The approach can be
revisited if indirect call turns out to be expensive (e.g. on hardware
with weak branch target predictors).

The CL is a prerequisite for running PCScan in the renderer process.

Bug: chromium:1249550
Change-Id: I221dcb2486c13e8e6e6761839ba391978319bde4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3172760Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77012}

Port aa259e30

Original Commit Message:

    When kDontAdaptArgumentsSentinel is 0 (the receiver is included in the
    argument count), we don't need a dedicated check against the sentinel
    before comparing the formal parameter count to the actual argument count
    when calling a JS function.

R=pthier@chromium.org, joransiu@ca.ibm.com, junyan@redhat.com, midawson@redhat.com
BUG=
LOG=N

Change-Id: I055ce6d72da8140aa81acd41f917e1e9a7751f72
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3175663Reviewed-by: Junliang Yan <junyan@redhat.com>
Reviewed-by: Patrick Thier <pthier@chromium.org>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#77011}

Generate arbitrary struct and array types based on
the fuzzer random input stream.
They replace the hard-coded types.
Generated types include nested reference types and recursive types.

Bug: v8:11954
Change-Id: I2e40697f2ace3eb818360213e8a4dd40037e580e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3173683
Commit-Queue: Maria Tîmbur <mtimbur@google.com>
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77010}

R=clemensb@chromium.org

Bug: chromium:1251465
Change-Id: I09507f1f945252be54c916dcd7ac9e8b7c09643b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3177220Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77009}

i32 comparisons often compare against constants, in order to implement
conditional branches. This CL optimizes such code by not loading the
constant into a register first, but directly emitting the comparison.
The code is shared for implementing {if} and {br_if} (and thereby makes
those two methods more readable).

R=thibaudm@chromium.org

Change-Id: I3f2f071a1c9e4b02c7368a2757bf4aae2920bd69
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3172765Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77008}

Change-Id: I36d230fa3e51eb27109a8dd2adc0e7802fc77a7d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3177221Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77007}

This bailout applies only when young generation is disabled.
Otherwise, getting the caged heap is required and the global load
bailout becomes redundant.

Bug: chromium:1056170, chromium:1239030
Change-Id: I826b355f4356a5c20812d9c8bf6ebc7ea0997b8a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3173685
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77006}

Bug: chromium:1244626
Change-Id: I539a476bc683e3b40d85ee4c7579957bdf4fb5d9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3133145
Auto-Submit: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77005}

This fast path check protects the IsRegExp() path (which checks
RegExp.prototype[Symbol.match]) and thus we must use the appropriate
ForMatch check instead of the default check.

Fixed: chromium:1238033
Change-Id: I0b7ce280f1fa9bfacf20381d80c84f9513f45163
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3177222
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Patrick Thier <pthier@chromium.org>
Commit-Queue: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77004}

Bug: v8:11111
Change-Id: Id1e37770f0f196db0887fceb14f895e576b78b73
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3173673Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77003}

Deprecation happend in v9.4

Bug: v8:11165
Change-Id: I7a28a9c50c25dbaad91cf254b9153154065108b9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3173678
Auto-Submit: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77002}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/66bad00..d7f25a4

Rolling v8/third_party/abseil-cpp: https://chromium.googlesource.com/chromium/src/third_party/abseil-cpp/+log/48418f3..ba539c1

Rolling v8/third_party/aemu-linux-x64: UnrNXrNKJtnUOqrH_BbjXgZ_Ns1v0PZ9WNtFgoHrQZwC..93-xiCMBx8NRjVvu1v-vuwCsej5zB1Pj3FEUsphwCeUC

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/25814bb..e155ea5

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/eff810e..04d9c83

TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I8de9a089cbc144a8c2bb12e1f32cf97daf089aa0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3176786Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#77001}

Bug: v8:12228
Change-Id: If771a7526f2567d68e676f069223ac16b7303884
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3167036Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Jing Bao <jing.bao@intel.com>
Cr-Commit-Position: refs/heads/main@{#77000}

Bug: chromium:1203071
Change-Id: Iab81add0c71c4a37b7aa8d9d6f1272781a6bae3d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3152217
Auto-Submit: Peter Kasting <pkasting@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76999}

Some tests got fixed upstream.

Bug: v8:12227
Change-Id: I78108852ce4d10523edb3fd0dbb563852598394d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3173679
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76998}

Sparkplug code does not contain deoptimization data.

Bug: v8:12258
Change-Id: Ieb9f7f1469e00677d9533c6f05b17c80ef06b9d6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3175820
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76997}

Long term, ideally, these would be fixed and this flag can be removed.
For now, this is an expedient way to allow enabling -Wshadow in
Chromium.

Bug: chromium:794619
Change-Id: I038e5fc758fbb8284bb28cb4f7f8a4c44da0db66
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3173891
Commit-Queue: Peter Kasting <pkasting@chromium.org>
Auto-Submit: Peter Kasting <pkasting@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76996}

See https://github.com/WebAssembly/js-types/blob/main/document/js-api/index.bs#L866

R=manoskouk@chromium.org

Bug: v8:12227
Change-Id: I384483a7568d37c40d077487165ff9b1761da342
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3172768Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76995}

Change-Id: I91ed4bf22231c6080b2c5e445ea407d076baeadc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3175374Reviewed-by: Milad Fa <mfarazma@redhat.com>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/main@{#76994}

When kDontAdaptArgumentsSentinel is 0 (the receiver is included in the
argument count), we don't need a dedicated check against the sentinel
before comparing the formal parameter count to the actual argument count
when calling a JS function.

Bug: v8:11112
Change-Id: I8c9f64a538984cb3de9e35f16bc6adbd3c92d24f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3173671Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Auto-Submit: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76993}

Change-Id: I01c4a68377a70cfed425b3cd1ed56b120c9b5056
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3174627Reviewed-by: Milad Fa <mfarazma@redhat.com>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/main@{#76992}

Change-Id: I83611a53426efff35960b2d90de909f2a6b07264
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3175369Reviewed-by: Milad Fa <mfarazma@redhat.com>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/main@{#76991}

Change-Id: I74873db343b3103f12d47ca1a9617369d516424d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3174411Reviewed-by: Milad Fa <mfarazma@redhat.com>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/main@{#76990}

We should cancel tasks before we destroy objects like the string table
from the isolate. So far our concurrent tasks didn't interact with
the isolate much, but we now have tasks that can e.g. access the heap
concurrently. While this is not strictly necessary at the moment, I want
to see whether there might be problems with that approach. In the future
this order will be required e.g. for baseline batch compilation tasks.

Bug: v8:11708
Change-Id: I80d8a9447bb51e9ae84ed9b6c0da6183290dc70b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3164338
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76989}

Bug: v8:11165
Change-Id: Ic2c8c6e6b97f279941e8634bc6178511103edbca
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3173676Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76988}

Liftoff is fully supported on all officially supported platforms, thus
remove a TODO to implement it on more platforms.

R=thibaudm@chromium.org

Bug: v8:11879
Change-Id: I00a559286d67e7e377a36b68803ee30e8fa2f34e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3168341
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76987}

Add support for heap sandbox on arm64 when building with v8_enable_heap_sandbox=true

Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng
Bug: v8:10391
Change-Id: I3080f5970d2a604ca67827c732cd77761f7611a3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3165057
Commit-Queue: Martyn Capewell <martyn.capewell@arm.com>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76986}

As the comment notes, we want to ensure that code space is *not*
writable by the current thread.

R=jkummerow@chromium.org
CC=mpdenton@chromium.org

Bug: v8:11974
Change-Id: I5c3cad32b8edc56013f298405c8e20d8bc9da05f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3173675Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76985}

On Mac we handle SIGBUS, not SIGSEGV, so the test should access a valid
but inaccessible pointer to trigger the right signal.

R=jkummerow@chromium.org

Bug: v8:11955, v8:12249
Change-Id: I25b93ce40bccc24ef5e84694a7c03c465eb4c51e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3168344
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76984}

Port 06af754c

Bug: v8:12203,v8:8661
Change-Id: Ib0379acc1db7dcebf7252e44d252e45bfa787e1c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3174377
Auto-Submit: Liu yu <liuyu@loongson.cn>
Reviewed-by: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/main@{#76983}

Port 3162142:[isolate-data] Split builtin tables into tiers

Change-Id: I0f506d75eb75bed9afc7e1971e61f2bdf9bf5740
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3174613
Commit-Queue: Ji Qiu <qiuji@iscas.ac.cn>
Reviewed-by: Ji Qiu <qiuji@iscas.ac.cn>
Cr-Commit-Position: refs/heads/main@{#76982}

Bug: v8:11111
Change-Id: Iddf021d292f44ab2a7d719792f14cdc57e40223b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3172759
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76981}

Bug: v8:11111
Change-Id: I6a86dd1313a7bfb72024e9857a0c18dd6c83fe3c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3160518
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76980}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/1037128..66bad00

Rolling v8/third_party/aemu-linux-x64: bOp0PE8R9VUQxsHclvuA10P4iOaWjRRpsK8ZQKtAZCAC..UnrNXrNKJtnUOqrH_BbjXgZ_Ns1v0PZ9WNtFgoHrQZwC

Rolling v8/third_party/android_sdk/public: yODElY4RdHopNEfpOnqjRcrpa6JMzbhYYqGD53-DjJwC..AuYa11pULKT8AI14_owabJrkZoRGuovL-nvwmiONlYEC

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/8ec776f..25814bb

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/c1fd44b..eff810e

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/7ea32d7..948efd2

TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I9bc3a48c310c9364a3cd2e24e1fdc6fcd5e6d934
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3172719Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#76979}

Bug: v8:12018, v8:12163
Change-Id: I87f779b4a355fa0638885db88fd0ebff0f930443
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3141034
Commit-Queue: Hao A Xu <hao.a.xu@intel.com>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76978}

DISALLOW_COPY_AND_ASSIGN is no longer in our codebase, and the compilers
mentioned in the comments are (probably) no longer supported.

Bug: v8:12244
Change-Id: I432bd56ca3ddd870be140032f11d94ddb60ce1a9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3171974Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76977}

This reverts commit f2e25f8a.

Reason for revert: Breaks GCC 8.4.0 compilation, see bug.

Original change's description:
> [base] Replace base::Optional with Abseil
>
> Change base::Optional to an alias of absl::optional. Eventually we
> should remove it entirely.
>
> Bug: v8:11006
> Change-Id: I687d44cc7e7cd0a49a84bcc207231eb6808eef2d
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2476318
> Commit-Queue: Leszek Swirski <leszeks@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#76913}

Bug: v8:11006, v8:12252
Change-Id: I8048dee676a36551d15f25a31d1e171dae00d975
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3173672
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Auto-Submit: Michael Lippautz <mlippautz@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#76976}