The JSArrayBuffer::extension-field might not be aligned with pointer
compression enabled. However on AArch64 pointers need to be aligned if
you perform atomic operations on them. Therefore split extension into
two 32-bit words that each get updated atomically. There is no ABA
problem here since the extension field only transitions from
NULL --> value --> NULL. After Detach(), Attach() isn't invoked anymore.

Bug: v8:10064
Change-Id: I20c1a37ac35d1749a94bfd277a4f91d531015bc5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2078586Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66515}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/8c2d4f7..b03644a

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: I5f62d5448e47c9b05c9f6cb9e8dd8973d5ea77f5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2082005Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#66514}

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/55ab41d..9ca9c52

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: I133a199f46974bd3a283140d46b3475310eb17ee
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2081992Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#66513}

We can make better inlining decisions in TurboFan if the CallIC will
provide the feedback that it's seen multiple closures that share the
same SharedFunctionInfo. This is not difficult to do, and it fixes
some frustrating performance cliffs.

Thanks to Bmeurer@chromium.org for the prototype CL, rebased from his
project a year ago.

Bug: v8:2206, v8:10100
Change-Id: I4248145ea67216f9a23efa175bbe90e7a9ee0ec4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2054100
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66512}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/0a67df9..8c2d4f7

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/src/buildtools/+log/ef2f1b3..fa6ae42

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/21c99c4..03a5e99

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/780e6bf..55ab41d

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: Ida3c1cada6c21ef0cd0fb12d7018947de675fb29
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2081454Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#66511}

This reverts commit 93253978.

Reason for revert: Causing blink layout failures. See 

https://ci.chromium.org/p/v8/builders/ci/V8%20Blink%20Linux%20Future/2684

Original change's description:
> Use context of then function for PromiseResolveThenableJob
> 
> When a microtask is executed, we need to use an appropriate,
> non-detached Context for its execution. Currently with
> PromiseResolveThenableJobs [1], the Context used is always drawn from
> the realm of the Promise constructor being used. This may cause
> non-intuitive behavior, such as in the following case:
> 
>   const DeadPromise = iframe.contentWindow.Promise;
>   const p = DeadPromise.resolve({
>     then() {
>       return { success: true };
>     }
>   });
>   p.then(result => { console.log(result); });
> 
>   // Some time later, but synchronously...
>   iframe.src = "http://example.com"; // navigate away.
>   // DeadPromise's Context is detached state now.
>   // p never gets resolved, and its reaction handler never gets called.
> 
> To fix this behavior, when PromiseResolveThenableJob is being queued up,
> the `then` method of the thenable should be used to determine the
> context of the resultant microtask. Doing so aligns with Firefox, and
> also with the latest HTML spec [2][3].
> 
> This change is analogous to CL 1465902, which uses the realm of the
> reaction handlers to determine the Context PromiseReactionJobs run in.
> 
> [1]: https://tc39.es/ecma262/#sec-promiseresolvethenablejob
> [2]: https://html.spec.whatwg.org/C/#enqueuejob(queuename,-job,-arguments)
> [3]: https://github.com/whatwg/html/pull/5212
> 
> Bug: v8:10200
> Change-Id: I2312788eeea0f9e870c13cf3cb5730a87d15609e
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2071624
> Commit-Queue: Timothy Gu <timothygu@chromium.org>
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Reviewed-by: Shu-yu Guo <syg@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#66507}

TBR=verwaest@chromium.org,timothygu@chromium.org,syg@chromium.org

Change-Id: I81737750f8b369567ba586c5a2cfb489836b7e74
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10200
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2081091Reviewed-by: Francis McCabe <fgm@chromium.org>
Commit-Queue: Francis McCabe <fgm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66510}

"Tweaks for emitting JSON"
https://chromium-review.googlesource.com/c/deps/inspector_protocol/+/2071518

Change-Id: Ie05ff1390a5340e15c21788c58e8171cb442da10
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2073205Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Johannes Henkel <johannes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66509}

Change-Id: Iaf8e02b201c547fb8b74a7e7f2defd4bfbc098d0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2079049Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66508}

When a microtask is executed, we need to use an appropriate,
non-detached Context for its execution. Currently with
PromiseResolveThenableJobs [1], the Context used is always drawn from
the realm of the Promise constructor being used. This may cause
non-intuitive behavior, such as in the following case:

  const DeadPromise = iframe.contentWindow.Promise;
  const p = DeadPromise.resolve({
    then() {
      return { success: true };
    }
  });
  p.then(result => { console.log(result); });

  // Some time later, but synchronously...
  iframe.src = "http://example.com"; // navigate away.
  // DeadPromise's Context is detached state now.
  // p never gets resolved, and its reaction handler never gets called.

To fix this behavior, when PromiseResolveThenableJob is being queued up,
the `then` method of the thenable should be used to determine the
context of the resultant microtask. Doing so aligns with Firefox, and
also with the latest HTML spec [2][3].

This change is analogous to CL 1465902, which uses the realm of the
reaction handlers to determine the Context PromiseReactionJobs run in.

[1]: https://tc39.es/ecma262/#sec-promiseresolvethenablejob
[2]: https://html.spec.whatwg.org/C/#enqueuejob(queuename,-job,-arguments)
[3]: https://github.com/whatwg/html/pull/5212

Bug: v8:10200
Change-Id: I2312788eeea0f9e870c13cf3cb5730a87d15609e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2071624
Commit-Queue: Timothy Gu <timothygu@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66507}

We need to track misc features launched in 2019 to understand the impact.
Also we need to measure the v8BreakIterator usage of 'word' and 'line'
to lobby the need for 'line' in the replacement standard Intl.Segmenter
which an Apple engineer opposed to include.

Bug: v8:10251
Change-Id: I5d4cbe6ccf458c9ec4adfebad235f9c6dcd2ac37
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2067512Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66506}

This reverts commit 25d16574.

Reason for revert: breaks tree with new flakes. See, for example:

https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/31169
https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20arm64%20-%20sim/21895
https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20TSAN%20-%20isolates/8490


Original change's description:
> [runtime] Improve handling of enumeration index on global dictionary
> 
> Bug: chromium:1056054
> Change-Id: Ie1f2da98bc54a2ad5189cbe2ee1686fe1ef7019a
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2079035
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
> Cr-Commit-Position: refs/heads/master@{#66504}

TBR=jkummerow@chromium.org,verwaest@chromium.org,seth.brenith@microsoft.com,victorgomes@chromium.org

Change-Id: I2baa48f6ed2b0b3e23b0d705b6a805d76ee4bb8f
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:1056054
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2080653Reviewed-by: Francis McCabe <fgm@chromium.org>
Commit-Queue: Francis McCabe <fgm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66505}

Bug: chromium:1056054
Change-Id: Ie1f2da98bc54a2ad5189cbe2ee1686fe1ef7019a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2079035Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#66504}

Previously, our Torque definition of JSArrayBuffer included only the
first two fields. This allowed access to those two fields, but was
somewhat confusing and obviously didn't let Torque code access the
other fields. This change:

- Completes the JSArrayBuffer layout definition;
- Moves the associated bitfield struct definition to Torque;
- Moves a couple of JSArrayBuffer macros to Torque;
- Adds a reducer case so that the code generated using these new macros
  is not worse than what was generated previously.

Change-Id: Ib19c3ba789a33801fa9d0d064cd21d62a1e03e30
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2053769
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66503}

More instructions are being emitted with 242d58e3
hence the offset needs to be updated.

Change-Id: I892920837ca7d785eb423503921ee39134be1c0d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2079156Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#66502}

The ArchLookupSwitch implementation has been completely replaced by
ArchBinarySearchSwitch, leaving dead code behind.

Change-Id: I7fd6306cb0f5562c10e32293f5ea13bbd3bf7067
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2077684
Commit-Queue: Rodolph Perfetta <rodolph.perfetta@arm.com>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66501}

This fixes a crash related to access after free on platforms that
store the MacroAssembler as a pointer. The intended behavior is
restored by explicitly setting the flag in the macro assembler
instead of using NoRootArrayScope.

Landing as TBR as it's blocking fuzzers and fix seems simple enough.

TBR=jgruber@chromium.org
R=jyan@ca.ibm.com
R=miladfar@ca.ibm.com

Bug: chromium:1057018
Change-Id: Ib6de82b47bb1abb74da58b3d476b359669372bb5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2080242
Commit-Queue: Emanuel Ziegler <ecmziegler@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66500}

The interface for ArgumentInfo was allowing out-of-bounds
read from the returned array. Improved that by passing the
index explicitly as a parameter and checking against the
expected bounds.

Bug: v8:10267
Change-Id: Ic1022def3e338598cd9bd9e6582d67a62836d0db
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2078578Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66499}

This reverts commit 77d4e230.

Reason for revert: verify csa build bot broken
https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20verify%20csa/16218?

Original change's description:
> [wasm] Refactor AtomicWait implementation
> 
> The existing implementation included aspects that are not
> straight-forward to implement in Liftoff and seemed inefficient:
> * Convert the timeout in WebAssembly code from I64 to F64, just to
>   convert it back in the runtime.
>   * On 32-bit platforms this conversion needs an additional C-call.
> * Split the I64 expected value from I64 into two I32 values in the
>   wasm-compiler.
>   * Ideally the int64-lowering takes care of 32-bit specific handling.
> 
> With this CL the timeout and the expected value are passed as I64 to
> the runtime (a builtin moves the I64 into a bigint for that). The
> int64-lowering takes care of 32-bit platforms. There are special
> builtins for 32-bit platforms, but they are written such that ideally
> also the int64-lowering could create them.
> 
> R=​jkummerow@chromium.org, binji@chromium.org
> 
> Bug: v8:10108
> Change-Id: I2dbba5839779961b1c5bde4c23fc3f38f1895a52
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2071867
> Commit-Queue: Andreas Haas <ahaas@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Reviewed-by: Ben Smith <binji@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#66497}

TBR=binji@chromium.org,jkummerow@chromium.org,ahaas@chromium.org,clemensb@chromium.org

Change-Id: If284aa07eedddd2fbea4df8c53c7d371cac1d42e
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10108
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2080250Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66498}

The existing implementation included aspects that are not
straight-forward to implement in Liftoff and seemed inefficient:
* Convert the timeout in WebAssembly code from I64 to F64, just to
  convert it back in the runtime.
  * On 32-bit platforms this conversion needs an additional C-call.
* Split the I64 expected value from I64 into two I32 values in the
  wasm-compiler.
  * Ideally the int64-lowering takes care of 32-bit specific handling.

With this CL the timeout and the expected value are passed as I64 to
the runtime (a builtin moves the I64 into a bigint for that). The
int64-lowering takes care of 32-bit platforms. There are special
builtins for 32-bit platforms, but they are written such that ideally
also the int64-lowering could create them.

R=jkummerow@chromium.org, binji@chromium.org

Bug: v8:10108
Change-Id: I2dbba5839779961b1c5bde4c23fc3f38f1895a52
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2071867
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Ben Smith <binji@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66497}

There were a few places that still checked against the limit for
initial memory size rather than the limit for memory size after
growth (which was recently separated from the former).

Bug: v8:7881
Change-Id: Id17d86e2f7a5dfa4f1dd35153b0cefc01f72ed33
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2078574
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66496}

Change-Id: I15a4bea5e7079b69fb256ab90c2a408bcc686307
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1981153
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66495}

This reverts commit c8e10a16.

Reason for revert: This CL causes problems with webpages in the wild: https://crbug.com/1056295

Original change's description:
> [wasm][liftoff] Implement Atomic(Compare)Exchange on x64
> 
> R=​clemensb@chromium.org
> 
> Bug: v8:10108
> Change-Id: Ic9ef9ba35218450d3f9e7838890c82b785c34da4
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2037433
> Commit-Queue: Andreas Haas <ahaas@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#66429}

TBR=ahaas@chromium.org,clemensb@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:10108
Change-Id: I69251b9e3de13d8314e413a4196c8185a73bfb5c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2078544Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66494}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/ff66038..0a67df9

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/624dae6..21c99c4

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/005269a..780e6bf

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/f5a3941..d548cda

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: Id6e09dd56f42387440da7264f3ec3d18afa8f6cc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2079589Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#66493}

Implements i8x16.abs, i16x8.abs, and i32x4.abs.

Bug: v8:10233
Change-Id: I573c9969ed0ccc9dfe7ff6bde4fcddb5ffdaa789
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2067844Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66492}

Change-Id: I85d995e46577712ba7e6a3a4d55f397c09867a4b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2079344Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66491}

Port 6cd28b52

Original Commit Message:

    Added implementations for ia32, arm, arm64.

    mips/mips64 will be committed in separate CL once the build is green
    again in order not to stall this CL with the supported architectures.

    compilation by using alternative temp register for x64.

    macro assemblers.

R=ecmziegler@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: Ib08e31dfa11f0254c7888ce17dd27e7d0154c752
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2078898Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#66490}

Bug: chromium:1055317, chromium:1055312, chromium:977230
Change-Id: I877bc1547e21c95f4b82b3741949e88e22fc006b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2077222
Commit-Queue: Vitaly Buka <vitalybuka@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66489}

The set of isolates known to a native module and the set of native
modules known to an isolate were not updated on cache hit. This caused
the wasm engine to collect code when it was still live in some isolate.

R=clemensb@chromium.org

Bug: chromium:1055131
Change-Id: I56682509b284c9c0dce7c95ee20ec3929e2e8c9f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2078583
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66488}

This reverts commit 4c7c6f73.

Reason for revert: Reverted because of TSAN failures.

Original change's description:
> [heap] Enable usage of ArrayBufferExtensions
> 
> Switch the flag to true to enable ArrayBufferExtensions by default. The
> last CL (https://crrev.com/c/2065088) that tried to enable this was
> reverted because of alignment issues on ARM64
> (fixed in https://crrev.com/c/2071256).
> 
> Bug: v8:10064
> Change-Id: I47f478c978094fb5038113eb452865748956b42e
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2074157
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#66460}

TBR=ulan@chromium.org,dinfuehr@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:10064
Change-Id: Ie15bf9858eb1f01667ea905363824cbb2bf7f884
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2078585Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66487}

Change-Id: Ib13c5cd2230d29321b9502e85f9ac035e2618250
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2078313Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#66486}

This reverts commit 1f35c165.

Reason for revert: speculative revert for TSAN failure:
https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20TSAN%20-%20concurrent%20marking/12179



Original change's description:
> [objects] Update JSArrayBuffer::extension-field in two steps
> 
> The JSArrayBuffer::extension-field might not be aligned with pointer
> compression enabled. However on AArch64 pointers need to be aligned if
> you perform atomic operations on them. Therefore split extension into
> two 32-bit words that each get updated atomically. There is no ABA
> problem here since the extension field only transitions from
> NULL --> value --> NULL. After Detach(), Attach() isn't invoked anymore.
> 
> Bug: v8:10064
> Change-Id: If987ed51f0528ca7313980f3d36ffca300b75fdc
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2071256
> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#66457}

TBR=ulan@chromium.org,dinfuehr@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:10064
Change-Id: I2107a4d49d2b127dc65ce11b3b61ccc592fb0736
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2078579Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Reviewed-by: Tamer Tas <tmrts@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66485}

Change-Id: Ie7b9323d7491d1105a8a5b14b341ab023b0a59eb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2078572
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66484}

Recently the callstats runner started crashing due to scipy imports.

This CL moves the import to mitigate the crashes.

TBR=machenbach@chromium.org

Bug: v8:10269
Change-Id: I67c2093f12ae287354a59e9cd32b79c6288b8edd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2078571Reviewed-by: Tamer Tas <tmrts@chromium.org>
Commit-Queue: Tamer Tas <tmrts@chromium.org>
Auto-Submit: Tamer Tas <tmrts@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66483}

Added implementations for ia32, arm, arm64.

mips/mips64 will be committed in separate CL once the build is green
again in order not to stall this CL with the supported architectures.

Drive-by: Fixed issues with kScratchRegister being overwritten in case of RegExp
compilation by using alternative temp register for x64.

Drive-by: Added missing NoRootArrayScope to ia32, arm and arm64 RegExp
macro assemblers.

R=clemensb@chromium.org
R=petermarshall@chromium.org
R=jgruber@chromium.org

Bug: chromium:1045860
Change-Id: I716d852b9bf780ae7b8d61376c6505dd3af96a50
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2071866
Commit-Queue: Emanuel Ziegler <ecmziegler@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66482}

This reverts commit aa984947.

Reason for revert: Unexpectedly regresses SixSpeed benchmarks. Will reland a fix without refactoring.

Original change's description:
> [ptr-compr] Fix 32-bit smis on non-ptr-compr builds
> 
> Bug: v8:10047, v8:10257
> Change-Id: Ifcc65235726420fe753e26707d84061400d5d2b1
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2050384
> Commit-Queue: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#66415}

TBR=ishell@chromium.org,verwaest@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:10047, v8:10257
Change-Id: Ic3253652adcce457cf0810baa0eb09cc9a383ceb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2077913Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66481}

The bots don't have enough memory for this test.

No-try: true
Bug: v8:10280
Change-Id: I2f6dfa80d0337d2e96445577e39b4c894ae84acc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2077680
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66480}

Bug: v8:9561
Change-Id: Ic57b38cefbdc21045d71601c67995d3568634c27
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2069400
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66479}

Most function signatures are created once and never changed. Hence pass
them as const pointer. This makes it clear in function signatures that
these parameters will not be modified.

This also avoids a few ugly const_casts where we were passing pointers
to constexpr FunctionSigs via non-const pointers.

R=jkummerow@chromium.org

Bug: v8:10155
Change-Id: Ieb658ab5582bff276f76babdaf7ddb8f72bd4790
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2072739Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66478}

Bug: v8:9561
Change-Id: I6f0b027d02b4d6a128a81584d40a30b1c5c518f6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2069399
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66477}

This is a reland of 7d1f95d6

The reland fixes a performance issue in that we incorrectly marked
every pattern containing a backslash as needing to be escaped,
resulting in a new string allocation instead of reusing the existing
string.

Original change's description:
> [regexp] Correctly escape a backslash-newline sequence
>
> When printing the source string, a backslash-newline sequence ('\\\n',
> '\\\r', '\\\u2028', '\\\u2029') should be formatted as '\n', '\r',
> '\u2028', '\u2029', respectively. Prior to this CL it was formatted as
> a backslash followed by the literal newline character.
>
> Bug: v8:8615
> Change-Id: Iac90195c56ea1707ea8469066b0cc967ea87fc73
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2016583
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Auto-Submit: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#65986}

Bug: v8:8615,chromium:1046678
Change-Id: I5d75904f1ea543ec679649668e54749821116442
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2074159
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66476}