Rolling v8/buildtools/third_party/libunwind/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind/+log/955e2ff..2a908ee

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/b1e3787..84a7988

Rolling v8/third_party/fuchsia-sdk/sdk: version:9.20220726.1.1..version:9.20220727.1.1

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I1e7a959bb2a4c0c9c2c52c692a626cabeddc8d9e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3789872
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#82015}

After https://crrev.com/c/3787682

Bug: v8:11325
Change-Id: I3dbcd3f8f0be19d9ca9ea2ab239ec1d9e902bd9c
No-Try: true
No-Presubmit: true
No-Tree-Checks: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3789518Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82014}

Bug: v8:11325
Change-Id: Iffe8d049cbb97384e81fa3eeae5066e58b303066
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3787682Reviewed-by: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Yahan Lu <yahan@iscas.ac.cn>
Commit-Queue: Yahan Lu <yahan@iscas.ac.cn>
Cr-Commit-Position: refs/heads/main@{#82013}

Change-Id: Ibe2be0079386dd56135a0ee3f2732797b62f258a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3789512Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#82012}

This CL includes the following changes:
- Avoid using `UniqueRegister` as much as possible
- Try to group opcodes under Binary or Unary when possible

Some codegen ops had to also be modified to avoid using `Temp`
registers.

Change-Id: Ib21ab7a47f600068c8453d48c3549e481a19c328
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3780496Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#82011}

Bug: v8:10470
Change-Id: Icbd4c052b8d39300e45ab6fbee422839d852132b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3788207Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82010}

This is a reland of commit 8cb02753

Original change's description:
> [wasm] Materialize suspender in JS-to-wasm wrapper
>
> Instead of creating the Suspender object in JS and passing it to the
> stack-switching js-to-wasm wrapper, the wrapper now automatically
> creates the Suspender object and forwards it as an extra parameter to
> the wasm function. See:
> https://github.com/WebAssembly/js-promise-integration/pull/1/files
>
> R=ahaas@chromium.org
>
> Bug: v8:12191
> Change-Id: I2badee823f4223a293632f93e7e59f24c49d0820
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3779688
> Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#81890}

Bug: v8:12191
Change-Id: Iea233e30aa269279d2fe17f5230c87285c33e232
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3780817
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82009}

New nenu buttons:
- Uncollapse all blocks
- Compress layout
- Collapse selected blocks
- Uncollapse selected blocks
New hotkeys:
- Layout graph
- Select all nodes
- Select all selected block's nodes
- Collapse selected blocks
- Uncollapse selected blocks
- Select node's input nodes
- Select node's output nodes
- Collapse unused blocks (blocks that don't have direct inputs and outputs of a hovered node)
- Copy hovered node's info

Bug: v8:7327
Change-Id: I942fe595ffea878f10cfbd962c3eff1786f1b954
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3773778Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Danylo Boiko <danielboyko02@gmail.com>
Cr-Commit-Position: refs/heads/main@{#82008}

This reverts commit fb19bc36.

Reason for revert: Test is flaky (see https://logs.chromium.org/logs/v8/buildbucket/cr-buildbucket/8807487788813571761/+/u/Check_-_isolates__flakes_/regress-crbug-1347721)

Original change's description:
> [rab/gsab] Fix accessing raw byte length
>
> Bug: v8:11111,chromium:1347721
> Change-Id: Idff4256f6720841ca4dee8f691babe7245277046
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3782812
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
> Auto-Submit: Marja Hölttä <marja@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#81995}

Bug: v8:11111,chromium:1347721
Change-Id: Ib29bd8fad1227acb21c79378c71ed081ba8b4914
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3789505
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#82007}

All objects allocated during Isolate initialization are long living and
should be allocated in old space.

Bug: v8:12612
Change-Id: I394cbaa2ba45750b98bfa219afa0c538552de9c7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3785148Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82006}

Bug: v8:9407
Change-Id: I978f6d81c01bdf86131beca5a756181f23b0ed52
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3789500Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Qifan Pan <panq@google.com>
Cr-Commit-Position: refs/heads/main@{#82005}

This CL implements MemoryAllocator::LookupChunkContainingAddress, which
will be used for conservative stack scanning. The method determines
whether an address that may be an inner pointer is contained in some
allocated (normal or large) page. To achieve this, the CL introduces a
page database in the memory allocator.

Bug: v8:12851
Change-Id: I8b719a5f1b6e6b374ccf0666c91c2341c5f9856a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3784986Reviewed-by: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82004}

This change fixes two issues with VTune JIT Profiling API.

1. Update way of setting flag "--no-compact-code-space" to avoid changing flags after initialization v8.
2. Fix a crash from visiting uninitialized ptr.

Change-Id: I4878ffd554ce53630db961fe09b49e081b0091bf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3787321Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Fanchen Kong <fanchen.kong@intel.com>
Cr-Commit-Position: refs/heads/main@{#82003}

This reverts commit 4c8f742e.

Reason for revert: Looks like it causes another gpu bot failure, see
the reland commit.

Original change's description:
> Reland "cppgc: Enable pointer compression by default on Desktop"
>
> Now that the marking verifier doesn't verify stack, reenable PC.
>
> Bug: chromium:1325007
> Change-Id: I85c4ed0a76cf84992781966d3694211e8ea36a1d
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3785147
> Commit-Queue: Anton Bikineev <bikineev@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#82001}

Bug: chromium:1325007
Change-Id: Ic19810cc2e3e67bd7691465ca5be7bf724501213
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3789501
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Auto-Submit: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82002}

Now that the marking verifier doesn't verify stack, reenable PC.

Bug: chromium:1325007
Change-Id: I85c4ed0a76cf84992781966d3694211e8ea36a1d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3785147
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82001}

The RTT type can not be used directly in WebAssembly any more and is treated
as a compiler-internal type for the GC MVP.

Bug: v8:7748
Change-Id: I97cb241e6c46446149cc6ae2b1d535b93402fa76
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3787877
Auto-Submit: Matthias Liedtke <mliedtke@chromium.org>
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82000}

Bug: v8:10391
Change-Id: I18745b415962e08fada5c0b9466a0d7e66a84a12
Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3757339Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Samuel Groß <saelo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81999}

Maglev double registers spill can use simple size kDoubleSize even
when wasm is enabled.

Bug: v8:7700
Change-Id: I485f69eeda781dddcbac4d34018b4442b6eb529d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3789382Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81998}

V8 compaction, which currently runs before verification, can update
stack slots, which could lead to more false positives when we scan
compressed pointers on stack. The CL disables the stack verification if
pointer compression. The intent is to investigate if verification can be
moved before compaction.

Bug: chromium:1325007
Change-Id: Idc01df9c58bfbf338b5e95caf5f03a88593c6478
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3789381
Auto-Submit: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81997}

- num_pushed_registers was never set
- parameters_limit need to be update before visiting parameters
- pushed_register_base was off by 1
- added an ASCII diagram

Bug: v8:7700
Change-Id: Ibf02a3007e730ea9de3a86f11e10722a4a1cacaa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3789380
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81996}

Bug: v8:11111,chromium:1347721
Change-Id: Idff4256f6720841ca4dee8f691babe7245277046
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3782812Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Auto-Submit: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81995}

This is a reland of commit 4e935c7f

fix a bug on mac for not return correct memory protection key support.

Please see details in comments.


Original change's description:
> [pku][wasm] Refactor PKU usage in Wasm
>
> RwxMemoryWriteScope becomes the bottleneck for both MAP_JIT and PKU
> machinery.
> Wasm and V8 code space will use the same memory protection key.
>
> This is a next step towards adding PKU support for V8 code space.
>
> Bug: v8:13023
> Change-Id: I647f8c09bc41e5ef8a1d74b58a48a43e08454e0d
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3702213
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Commit-Queue: Wenqin Yang <wenqin.yang@intel.com>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#81947}

Bug: v8:13023
Change-Id: I5b5cc81e7c1502229ce0d2a5574ca34dc23d19d9
Cq-Include-Trybots: luci.v8.try:v8_mac_arm64_rel_ng,v8_mac_arm64_dbg_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3787320Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Wenqin Yang <wenqin.yang@intel.com>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81994}

From the assembly code(Windows10), we found in the function "JSObject::GetHeaderSize" the __security_check_cookie will be called everytime before return. It is introduced by the stringstream which is used to print the enum string. We can remove the unnecessary __security_check_cookie by removing the stingstream.

Change-Id: I2786e0cf8f216d6a8cb07f502c29018987b3cc43
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3769433Reviewed-by: Samuel Groß <saelo@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Jianxiao Lu <jianxiao.lu@intel.com>
Cr-Commit-Position: refs/heads/main@{#81993}

Drive-by-fix:
- Rename baseline to sparkplug for consistency
- Add request timeouts for the local symbol server
- Add script to start a local symbol server
- Fix -h/--help support for linux-perf-chrome-renderer-cmd.sh

Change-Id: I4c2fc3595d672871f20fc5c4065ba45e801a1111
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3769699
Auto-Submit: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81992}

Refactor the code to use RecursiveMutextGuard to make it more readable
and less error prone.

This is a tentative fix for a rare deadlock that appears in
test-cpu-profiler/CrossScriptInliningCallerLineNumbers.

Bug: v8:11191
Change-Id: Ia32e7f61167f95e0fce142992c83ddff11959222
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3779690
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81991}

Bug: v8:12446
Change-Id: I6b0ba51d4a7bd6cd9372ff5c1461036a57d4da51
No-try: True
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3787875Reviewed-by: Liviu Rau <liviurau@chromium.org>
Auto-Submit: Almothana Athamneh <almuthanna@chromium.org>
Commit-Queue: Liviu Rau <liviurau@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81990}

Normative update from
https://github.com/tc39/proposal-change-array-by-copy/issues/88

Bug: v8:13035
Change-Id: I939cebc13b4ab3cafbfb96a45d93b50453fd07e9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3785282
Auto-Submit: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81989}

There are two changes in this patch.

1. We previously added `VerifyRegExpSyntax` in regexp-parser.h to support checking regexp syntax for early errors in SpiderMonkey. Now that V8 is also emitting early errors for regexps (bug v8:896), SpiderMonkey can use the same code as V8.

2. Bug v8:11069 used a std::unordered_map as a cache for range arrays. This is currently the only place in irregexp that can call non-placement new, which SpiderMonkey has a static analysis to detect. Converting this to a ZoneUnorderedMap solves the problem for us, and seems consistent with the rest of irregexp.

Bug: v8:13108
Change-Id: Icedafd7d30fd040760cb0676a7bef8d55853bb93
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3785444
Commit-Queue: Jakob Linke <jgruber@chromium.org>
Reviewed-by: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81988}

After some solid bike shedding, we decided to rename one part of the
API.

R=jarin@chromium.org

Bug: chromium:1334585
Change-Id: Ie967f9f4947b2c328433e4c4a9d748ad15ae7175
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3788095Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81987}

Bug: v8:11880
Change-Id: Ic1492fb46e8c3a8c70ce95bd177ae71bf5292c77
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3776689
Commit-Queue: Jakob Linke <jgruber@chromium.org>
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81986}

TC39 2022-07-22 decided to take PR701
to skip order check on DateTimeFormat formatRange and formatRangeToParts
See
https://github.com/tc39/ecma402/pull/701
https://docs.google.com/presentation/d/1UUvbf3FFu9PGtrPAKPdMad9DZuVFLIvkAsAxyJZyvxM

for details.

Bug: v8:13094
Change-Id: I9ade938726f2a79e0ab2b5deb7fe36c001f2722f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3779042Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81985}

Remove the range check of formatRange, formatRangeToParts on
NumberFormat and selectRange on PluralRules

Bug: v8:10776
Change-Id: Ifede7d61db6414d5b338b22bd188406e5f7d98b7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3779041Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81984}

Call Intl function which call ICU TimeZone for the calculation
of timezone other than UTC

Bug: v8:11544
Change-Id: Idc355aaeccc0bed026a7117bb366ee914fa29733
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3783074
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81983}

Rolling v8/third_party/android_sdk/public: gMHhUuoQRKfxr-MBn3fNNXZtkAVXtOwMwT7kfx8jkIgC..9lGp8nTUCRRWGMnI_96HcKfzjnxEJKUcfvfwmA3wXNkC

Rolling v8/third_party/android_sdk/public: g7n_-r6yJd_SGRklujGB1wEt8iyr77FZTUJVS9w6O34C..RSI3iwryh7URLGRgJHsCvUxj092woTPnKt4pwFcJ6L8C

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/03071f1..b1e3787

Rolling v8/third_party/fuchsia-sdk/sdk: version:9.20220722.3.1..version:9.20220726.1.1

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: Ie0ff2ae7222f3d29ba8d00dbd39be56d3f7ddd7a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3788884
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#81982}

This reverts commit 33043888.

Reason for revert: Test262 fails on UBSan: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20UBSan/22371/overview

Original change's description:
> [test262] Roll test262
>
> https://chromium.googlesource.com/external/github.com/tc39/test262/+log/3ddfa0cd..e41d581c
>
> Bug: v8:7834
> Change-Id: Id1c5b07f109ab6f60498eb7185becc508d16af1e
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3786907
> Reviewed-by: Shu-yu Guo <syg@chromium.org>
> Commit-Queue: Frank Tang <ftang@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#81980}

Bug: v8:7834
Change-Id: I34d4b36209226d32b416608fbf2ab4c0f8702566
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3788426
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Owners-Override: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Auto-Submit: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81981}

https://chromium.googlesource.com/external/github.com/tc39/test262/+log/3ddfa0cd..e41d581c

Bug: v8:7834
Change-Id: Id1c5b07f109ab6f60498eb7185becc508d16af1e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3786907Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81980}

Using the external pointer table when compressing pointers lets us ease
the alignment requirement for the state field from 8-byte-aligned to
4-byte-aligned, as 8-byte alignment is not supported during compaction.

Bug: v8:12547
Change-Id: Ibbcb0d71f09f9bac66acc81459ab71e354ea405f
Cq-Include-Trybots: luci.v8.try:v8_linux64_pointer_compression_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3783077Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81979}

This is a reland of commit efac35f3

The LSan issues have been fixed in https://crrev.com/c/3779915

Original change's description:
> [sandbox] Sandboxify JSExternalObject external pointer
>
> Bug: v8:10391
> Change-Id: I6075a8fe3c201f9221149e0c54edf4fb191088da
> Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3757342
> Commit-Queue: Samuel Groß <saelo@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#81924}

Bug: v8:10391
Change-Id: I954520ee324c9aa4c4ccc4941ae30d19676be2ba
Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3780501Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Samuel Groß <saelo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81978}

This CL moves the external pointer table out of V8_ENABLE_SANDBOX and
into V8_COMPRESS_POINTERS. The external pointer table is also useful
even when not sandboxing external pointers to ease alignment
requirements under pointer compression.

It is onerous for the allocator to support non-tagged-size alignment.
Under pointer compression, tagged is 4 bytes while system pointers are
8 bytes. Because external pointer table indices are 4-bytes, fields that
require natural alignment (e.g. the state field in JSAtomicsMutex) when
the system pointer size is 8-bytes can use an indirection via the
pointer table to ease the alignment restriction back to 4-bytes under
pointer compression.

Bug: v8:10391
Change-Id: Iac1200e40c987128cd6a227cd279ba4dac0e5c56
Cq-Include-Trybots: luci.v8.try:v8_linux64_pointer_compression_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3783076Reviewed-by: Samuel Groß <saelo@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81977}

Similar to the FullGC marking hierarchy (MarkingVisitorBase, with
derived classes MainMarkingVisitor and ConcurrentMarkingVisitor),
this CL introduces YoungGenerationMarkingVisitorBase +
YoungGenerationConcurrentMarkingVisitor, and refactors
YoungGenerationMarkingVisitor to inherit from
YoungGenerationMarkingVisitorBase.

YoungGenerationConcurrentMarkingVisitor dispatches to functions
refactored to ConcurrentMarkingVisitorUtility by the previous CL.

Bug: v8:13012
Change-Id: I0e827eb95732ed9ddf027fe68e25a0839cdda773
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3780524Reviewed-by: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Leon Bettscheider <bettscheider@google.com>
Cr-Commit-Position: refs/heads/main@{#81976}