We had some tests, but weren't checking for OOB. Add some tests.

Change-Id: I63d4d199fe8b7be51a8e0a5a2d9b3a328e5d7ab5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2546127Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71302}

Change-Id: I6d7dc411c701797ba678d11e135cc214c913690b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2551714Reviewed-by: Milad Fa <mfarazma@redhat.com>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/master@{#71301}

LocaleBuilder validates better, it also fixes most cases in
transformed-ext-invalid except one.

Bug: v8:10447
Change-Id: I6fed6692ca3264198e42ccc3d9ca4bfb54fb0517
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2549688
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71300}

Change-Id: I233972d124c3582ed8eba7f1c1a31fa9d61fda8c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2544902Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Milad Fa <mfarazma@redhat.com>
Commit-Queue: Vasili Skurydzin <vasili.skurydzin@ibm.com>
Cr-Commit-Position: refs/heads/master@{#71299}

This reverts commit e26863df.

Reason for revert: Fails on noi18n bot, see https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux%20-%20noi18n%20-%20debug/34852/overview

Original change's description:
> [foozzie] Suppress access to CurrentTimeValue
>
> This stubs out CurrentTimeValue for differential fuzzing as otherwise
> the non-deterministic value leaks from Intl.DateTimeFormat format and
> formatToParts.
>
> This also affects other date creations, like Date.now(), which is
> already stubbed out on the JS side. We keep that code for
> backwards-compatibility to keep bisection stable.
>
> Bug: chromium:1149050
> Change-Id: Ifd82844c9fb8ce7262b55da6cf9f88f544268942
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2546685
> Reviewed-by: Camillo Bruni <cbruni@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#71294}

TBR=machenbach@chromium.org,cbruni@chromium.org,clemensb@chromium.org

Change-Id: I958ca723de826ab427d27f5121f96618cf50c832
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:1149050
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2551314Reviewed-by: Ben Smith <binji@chromium.org>
Commit-Queue: Ben Smith <binji@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71298}

The basic block instrumentation currently uses 32-bit integers, which
could overflow during a long profiling session. I considered upgrading
them to 64-bit integers, but generating the correct instrumentation code
for various architectures would be rather non-trivial. Instead, this
change uses 64-bit floating-point values, which are simple and also have
the nice behavior that they saturate rather than overflowing.

Bug: v8:10470
Change-Id: I60f7456cb750091809803c03a85dd348dc614b58
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2545573Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#71297}

Bug: v8:11177
Change-Id: Ib4bbdca5fe9811731c15edae5f58243113dd119f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2548080
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71296}

Change-Id: I0ca51abf2468f773986645fec3cb98559bca5bbe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2545143Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Milad Fa <mfarazma@redhat.com>
Commit-Queue: Vasili Skurydzin <vasili.skurydzin@ibm.com>
Cr-Commit-Position: refs/heads/master@{#71295}

This stubs out CurrentTimeValue for differential fuzzing as otherwise
the non-deterministic value leaks from Intl.DateTimeFormat format and
formatToParts.

This also affects other date creations, like Date.now(), which is
already stubbed out on the JS side. We keep that code for
backwards-compatibility to keep bisection stable.

Bug: chromium:1149050
Change-Id: Ifd82844c9fb8ce7262b55da6cf9f88f544268942
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2546685Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71294}

This removes dead methods from wasm-compiler.h and wasm-compiler.cc.
Even though e.g. {BranchExpectTrue} could become useful again in the
future, we still have {BranchExpectFalse} as a template to easily add it
back, and for now it's just untested code which adds to the compile time
and maintenance cost.

R=manoskouk@chromium.org

Bug: v8:10949
Change-Id: Ia3918c4cdfedd2c56bfbfbe7173d11386b9f2499
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2544522Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71293}

The following error is currently thrown on gcc 8:

error: suggest explicit braces to avoid ambiguous 'else'

Change-Id: I1498ef3f6f58874488a4e6897f488c122f4a7f76
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2550841Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#71292}

Before adding more tests, refactor the (single) existing test to be
parameterized by the memory type. This makes it easier to write a single
test with different expectations on memory32 and memory64.

R=manoskouk@chromium.org

Bug: v8:10949
Change-Id: Iaa9bd3af82092d46797e2222cb1c68746200f374
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2544545Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71291}

Deserialization is currently split into three main steps:
1) Read code and allocate code buffer
2) Copy and relocate code
3) Publish

This moves step 2) to a background task so that it can concurrently
process work units added to the work queue by step 1).

Next, step 3) will also be moved to a background task to create a full
pipeline, such that we can start publishing the first units almost
immediately.

R=ahaas@chromium.org
CC=​​clemensb@chromium.org

Bug: v8:11164
Change-Id: I99919765400e03737a46bacf0dcd82cb7fe2aefc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2543932
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71290}

This reverts commit 548fe208.

Reason for revert: Issues on Mac64: https://ci.chromium.org/p/v8/builders/ci/V8%20Mac64%20-%20debug/31710

Original change's description:
> cppgc: Use tracing scopes
>
> The scopes themselves mostly have the same coverage as current scopes in
> blink. A few exception due to encapsulation exist and are highlighted as
> comments on the CL.
>
> Bug: chromium:1056170
> Change-Id: I48af2cfdfd53a8caa1ab5d805d377f6f13a825bc
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2540552
> Commit-Queue: Omer Katz <omerkatz@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#71285}

TBR=ulan@chromium.org,mlippautz@chromium.org,omerkatz@chromium.org

Change-Id: I20dce9309dcaeff6ea61bdc51df3a2f62c2a103f
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:1056170
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2550782Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71289}

Reorder deserialization steps: instead of processing functions one by
one, run each step individually on all functions (read & allocate, copy
& relocate, publish). This prepares for moving some steps to background
tasks.

R=ahaas@chromium.org
CC=clemensb@chromium.org

Bug: v8:11164
Change-Id: Ic6e1e387b6a60ab16efc91f8e0d45cb2acded2a8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2543929
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71288}

This uses the old trick from TypedArrays: a Smi-like all zero
pattern plus an offset that actually contains a raw address to access
off-heap data.

Bug: v8:7793
Change-Id: Ia44448d4ff7e2dcaa02a2c5653f622fb93c3dd09
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2534817Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71287}

roll node-ci in https://chromium-review.googlesource.com/c/v8/node-ci/+/2547360

Bug: chromium:1138555
Change-Id: I894f47023ea45493d94a107ca22038a54543fc6c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2543263
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71286}

The scopes themselves mostly have the same coverage as current scopes in
blink. A few exception due to encapsulation exist and are highlighted as
comments on the CL.

Bug: chromium:1056170
Change-Id: I48af2cfdfd53a8caa1ab5d805d377f6f13a825bc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2540552
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71285}

This CL adds tracing scopes for the various cppgc classes.
Scopes use TRACE_EVENT_BEGIN and TRACE_EVENT_END macros to report trace
events. To do so they need to include trace-event.h. For unified heap
builds, trace-event.h forwards to v8's src/tracing/trace-event.h. For
other builds, trace-event.h provides a subset of
src/tracing/trace-event.h that covers just the parts used by cppgc.

This CL covers what we need for traces and blink gc metrics (up to
renaming events from BlinkGC.* to CppGC.*). UMA and UKM are not yet
handled.

Bug: chromium:1056170
Change-Id: Id92e84b27259ff0aadae7692f3d79d30896fb8e7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2540548
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71284}

Bug: v8:7748
Change-Id: I5d0cc06fafbe7fc05549a4b8fd7f602eaf838bba
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2526382
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71283}

This is required for enabling scopes such that NotifySweepingCompleted
is not called from within a scope.

Bug: chromium:1056170
Change-Id: Ia66aa4de8c22bfa7dfe1e02ee1e0d3ad088f7bf6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2549761Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71282}

When accessing a super property which is a getter, the receiver
is not restricted the same way as when doing normal property access.

In particular, the receiver can be null / undefined.

Bug: v8:9237, chromium:1148758, v8:11161
Change-Id: Ic6bc2053e5d046d4b19e868312aa9b50025256a1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2549941
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71281}

Unpark the thread for logging in TraceAbortedJob. With FLAG_trace_opt
enabled, this method is going to access the heap and therefore the
local isolate cannot be parked.

Bug: chromium:1149131, v8:10315
Change-Id: Ic08de3aebf000df6a4122602940d9f11112b430b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2549946Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71280}

Bug: v8:10961
Change-Id: I79f8410cac1c949100231d4c57dbea0379e88475
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2441128
Commit-Queue: Gus Caplan <snek@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71279}

This CL moves the disabling to the test source code.

Bug: v8:11178
Change-Id: I9771c1eb2ea474143bb401ba40f4452f6e6572ec
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2549963
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71278}

Add ASSERT_NO_SCRIPT_NO_EXCEPTION for places where we don't
want any runtime overhead.

Change-Id: Iac4e87a8802f2c93b0ba3e981fe3b3ac67a4cdba
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2546692
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71277}

For people not too familiar with cloud storage, the direct URL makes it
easier to download the zip archive.

R=machenbach@chromium.org

Bug: chromium:1142437, v8:10891
Change-Id: I6b29ebaac37489a73c4f75473d07e04e7200f2c3
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2543395
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71276}

This CL adds partial support for objects whose slow mode dictionaries
are OrderedNameDictionaries. This is the case for all slow mode objects
if V8_DICT_MODE_PROTOTYPES is enabled.

In particular, this part contains the remaining fixes to runtime code,
except for the class templating logic, which follows in a later CL.

Bug: v8:7569
Change-Id: Ib4d08d7d352125709ca916dfc75018dabf71b0cd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2540549Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Frank Emrich <emrich@google.com>
Cr-Commit-Position: refs/heads/master@{#71275}

This is a reland of e95e1b62

After landing https://crrev.com/c/2546682, this CL can be relanded
without changes.

Original change's description:
> [heap] Introduce LocalIsolate for main thread
>
> Add a LocalIsolate for the main thread to Isolate. This LocalIsolate is
> kept alive during the whole lifetime of the Isolate. The main thread
> LocalIsolate starts in the Running state in contrast to the background
> thread LocalIsolates (those start in Parked).
>
> Code paths in Turbofan that used to create a LocalIsolate on the main
> thread can now simply use the main thread LocalIsolate.
>
> LocalIsolate for the main thread will help in reducing differences
> between the main and background threads. The goal is that the main
> thread behaves more like a background thread.
>
> The main thread LocalIsolate should also make it simpler to share code
> between main thread and background threads by using LocalIsolate for
> both.
>
> Bug: v8:10315
> Change-Id: I7fd61d305a6fd7079e2319d75c291c1021e70018
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2509593
> Reviewed-by: Simon Zünd <szuend@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#71226}

Bug: v8:10315
Change-Id: I418b1217aeac4f3c44a0aa514dea9864f8a58656
TBR: szuend@chromium.org, yangguo@chromium.org, ulan@chromium.org, leszeks@chromium.org, neis@chromium.org
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2543399Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71274}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/a3c2a5d..26db078

Rolling v8/third_party/aemu-linux-x64: ZJSAA8Pwi2mDf7nU7eRK7e3lmUHyrNUgCmzdRwsMbnMC..C3a5C0JPR3a0eNVs8zflK6G9ym7N3f47xoQOm1lQe-gC

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/80f68fb..6e44bd8

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/868f530..5589652

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/1b039cb..2d30d87

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: Ib51eed2e7067c3697c04bf63abb8114873943c34
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2548127Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#71273}

Move the simd post mvp flag check into caller, instead of only checking
in the default case. This allows us to check *all* opcodes to see if
they are post-mvp or not. Before this change, we missed the check for
load and store lanes.

Bug: v8:10975,chromium:1149078
Change-Id: Id3cff8169ef5137f54a49d28291698139116e8a0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2543170Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71272}

Change-Id: I2f6e76d93309f44f90a24c2ce93f324b44a8fc6b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2544921Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#71271}

This is a temporary workaround until the root cause is fixed.

Bug: v8:11178

TBR=jgruber@chromium.org

Change-Id: I04ffaa83b88bca3d0db8079c1e798986e6bfcb62
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2547294Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71270}

- introduce view specific helper.mjs module
- clean up some imports

Bug: v8:10644
Change-Id: I0497c1a962c90f61f2beca667aca4a3f53a11e59
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2545705Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71269}

Mac-arm64 devices always have support for it.
Found by thakis@chromium.org

Change-Id: Id2dd9d53b66715efe8b4f7f0019d1ba06289c359
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2547281Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71268}

Bug: v8:9613, v8:10447
Change-Id: Iff43b298c6edaa9b258038ae15406d5df209e8b5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2543266
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71267}

AddToDictionaryTemplate in literal-objects.cc was missing several
cases when handling the overwriting between properties with statically
known and dynamically computed names. This led to wrong enumeration
orders in class prototypes created from class templates.

Bug: v8:11158
Change-Id: I7381b4680ec533bd307a6c32d75c8a66394869df
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2536464
Commit-Queue: Frank Emrich <emrich@google.com>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71266}

https://chromium.googlesource.com/external/github.com/tc39/test262/+log/0e7319c0..36d2d2d34

Bug: v8:7834
Change-Id: If35f50920cddaad0dd8e12029d153c1e2f478aeb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2545572Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71265}

Megamorphic load builtins are a performance optimization when current
feedback is megamorphic. We can't make this assumption for shared NCI
code though, since feedback in other native contexts may *not* be
megamorphic, and we'd thus miss out on necessary feedback collection.

Bug: v8:8888
Change-Id: I2adc5ef9a6b021b35cf26f975c79228d556bf94f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2546694
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71264}

... to --turbo-dynamic-map-checks. With the upcoming use in NCI code,
this feature is no longer used exclusively by Turboprop.

Bug: v8:8888
Change-Id: I61e01db086fd2e8566d2e2a09574be74b6e5a7bd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2546693
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71263}