The flag is true by default and passing
--noincremental-marking-on-allocation disables starting of incremental
marking on allocation and incremental marking steps on allocation.

Change-Id: I4537e0eeaaf93fb713fcacd3860e29b98df441fc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154194Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67228}

These GC events will not be visualized in DevTools UI. The intention
is to have these events in JSON trace file for manual inspection during
offline/postmortem investigation of GC performance issues.

Bug: chromium:1072352
Change-Id: I3b05a0b2e5299f9d00d4c940eaf598a48f746aa2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154796Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67227}

The fast store handlers create elements and if we have a typed array
on the prototype chain it is not easy to check when it is OK to create
new elements. The TypedArrays swallow all OOB stores, and there is no
easy way to check if the current store is OOB for JSObjects. So use
slow stub when there are typed arrays on the prorotype chain of
JSObjects.

Bug: chromium:1068492
Change-Id: I9eea9cf00e3eb84931c5545d18ba53c4ec39f353
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2134138
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67226}

Previously, one single retained maps list was used across all contexts. When one context was disposed, this entire list of retained maps was disposed as well. This caused maps that were still alive to be disposed leading to deopts when such maps were embedded in code objects.

This patch makes the list of retained maps be per context so we can dispose only the dead maps.

Bug: v8:9684, v8:10431
Change-Id: I0a50f4f49c9f6d72367c62e950828a039220fdfc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2122016Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67225}

Spec: https://github.com/tc39/proposal-promise-any

Bug: v8:9808
Change-Id: I568b2444df9f00f615f2cda1268e4ecc5b36667e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2139571
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67224}

Deserializer can trigger OOB read in the marking bitmap inside the
RegisterDeserializedObjectsForBlackAllocation function. This happens
for example if an internalized string is deserialized as the last object
on a page and is the turned into a thin-string leaving a one-word filler
at the end of the page. In such a case IsBlack(filler) will try to fetch
a cell outside the marking bitmap.

The fix is to increase the size of the marking bitmap by one cell, so
that it is always safe to query markbits of any object on a page.

Bug: chromium:978156
Change-Id: If3c74e4f97d2caeb3c3f37a4147f38dea5f0e5a8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2152838
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67223}

... against potential typer bugs. Instead of simply eliminating the
operation, insert an aborting bounds check instead.

Also move this transformation out of SimplifiedLowering, which is
already complex enough without doing these kinds of optimizations.
Unfortunately this will result in some missed optimization opportunities
because we may have more precise types during SimplifiedLowering. Let's
see if this makes a visible performance difference.

Change-Id: I9c16ad33104c29fdba39bf729d69ee03fc9797d6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2129633
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67222}

Port 1d8f1376
https://crrev.com/c/2154048

Change-Id: I7237e784d86cd78e936741a47887c2efe731cbbb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2156165Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/master@{#67221}

Bug: chromium:1063568
Change-Id: I69ae644cc02549eb6c8c3b6169e9b1db2ee4e27e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2144067
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67220}

Both features shipped in M80.

Bug: v8:9547, v8:9553
Change-Id: I7a34db05796f22bcc112c36a42826e7c926a7364
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154768
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Auto-Submit: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67219}

Bug: v8:9909
Change-Id: I95262d0ab550d41b7c5e2ce4eb9ec8164c53e892
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154048Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Fanchen Kong <fanchen.kong@intel.com>
Cr-Commit-Position: refs/heads/master@{#67218}

This patch replaces V8's tracing implementation (i.e., the TRACE_EVENT
macros) with the track event base implementation from Perfetto. The
advantages of doing this are:

1) This allows us to remove most tracing-related backend code from V8.

2) V8 can start writing strongly typed trace event arguments, which
   are more compact, easier to process and more extensible than legacy
   JSON-based trace arguments.

For the time being, we still support the old trace macros when V8 is
embedded into Chrome and other embedders.

Design doc: https://docs.google.com/document/d/1f7tt4cb-JcA5bQFR1oXk60ncJPpkL02_Hi_Bc6MfTQk/edit#heading=h.398p6b4eaen2

Bug: chromium:1006766
Change-Id: Ie71474fbe065821772b13d851487ebbca680c4ae
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1947688
Commit-Queue: Sami Kyöstilä <skyostil@chromium.org>
Auto-Submit: Sami Kyöstilä <skyostil@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67217}

Bug: chromium:1071711
Bug: v8:10258
Change-Id: Id19add0c7e77ee3b834ff47274b9986cc2aa1f69
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154767Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67216}

And a new flag --experimental-wasm-gc, which doesn't do anything yet.

Bug: v8:7748
Change-Id: I927d1d90559249db3ee9f8d240775d45098e52a6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154197
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67215}

Port 3c809e0d

Original Commit Message:

    .type directive is required on arm to enable ARM/Thumb interworking.

R=mlippautz@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I5aa258033fc89dbb1165b926c3351abc45ed9d85
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154836Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#67214}

{StaticCharVector}, according to its name, should return a
{Vector<const char>}. For getting a {Vector<const uint8_t>}, the method
should be called {StaticOneByteVector}, analog to the
{OneByteVector} methods that already exist.

Also, {StaticCharVector} is constexpr, but {StaticOneByteVector} cannot
be, since it contains a {reinterpret_cast}. The same holds for
{Vector::cast} in general.

This CL
- changes the return type of {StaticCharVector} to be
  {Vector<const char>},
- introduces a new {StaticOneByteVector} which returns
  {Vector<const uint8_t>},
- fixes constexpr annotations at various methods returning {Vector}s,
- refactors users of {StaticCharVector} to either use
  {StaticOneByteVector} instead, or work on {char} if that makes more
  sense.

R=leszeks@chromium.org

Bug: v8:10426
Change-Id: I71e336097e41ad30f982aa6344ca3d67b3a01fe3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154196
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67213}

Currently it's possible to hit an internal compiler error by declaring a
non-extern class that doesn't extend anything. It's not very meanigful
for a class to not extend from anything, so the parser should enforce
this requirement.

Change-Id: I38064f87345d28ce84521261bbfd33d9b1c71334
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2153847
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67212}

Change-Id: I436c779613e7ddf4b5c830807414dbc8787b89f5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2151103Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#67211}

Test some constexpr factories. StaticCharVector is not actually
constexpr, this will be fixed in a follow-up CL.

R=leszeks@chromium.org

Bug: v8:10426
Change-Id: I16fdf79cd7d4b3f54d7cf73e15bdff2306810f06
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154192
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67210}

Port fc29c453
Port 8ef2f799

R=zhiguo.zhou@intel.com, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: If84d63be9864ab2ff10b522018ecbac0c56b2bea
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154765Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#67209}

These opcodes are not officially specified yet, they are defined
in the "prototype implementation spec" at https://bit.ly/3cWcm6Q.

Drive-by: drop a unit test whose entire coverage can be provided
by a compile-time check.

Bug: v8:7748
Change-Id: Icefa6dd321802c8a01c4561178b9d21eca1fbaa3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2152841Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67208}

Even though {Factory::InternalizeString} was declared as a template,
only two instantiations exists: uint8_t and uint16_t. Using any other
type leads to link-time errors, which is inconvenient.

This CL implements the two instantiations explicitly, and provides a
third implementation taking a {Vector<const char>}. This will be used
after the next CL, which changes {StaticCharVector} to actually return a
{Vector<const char>}.

This also avoid the cumbersome template exports.

R=leszeks@chromium.org

Bug: v8:10426
Change-Id: I3f669fae2c711ade6f5a087e59210ad457423a66
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2152837
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67207}

Use proper gtest macros for testing expected values.

R=leszeks@chromium.org

Bug: v8:10426
Change-Id: Ibdbbf4d05b0a8914f52a270d21a9087c019396b0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2152836Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67206}

This adds another enum value in the {ForDebugging} enum for stepping
code.
By not adding the code to the code table and jump table, we will never
execute this code via a wasm function call. The code will only be used
for the one frame where we want to step through.
This speeds up stepping over recursive calls enormously, since the
recursive calls don't run into the flooded breakpoints any more.
It also fixes issues with non-local control flow, i.e. catching a trap
and reentering the same wasm function.

R=thibaudm@chromium.org

Bug: v8:10235
Change-Id: Idb304dd465418f842016a20c21d68989bb78cf1d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2153205
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67205}

Fixed: chromium:986051
Change-Id: I01ef94fe43ac5c8734890706a6dccd01e008bfec
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2153215Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67204}

Supported HW architectures:
ia32, x64, arm, arm64, ppc64, s390, mips, mips64

Compiler support:
- clang/gcc: all
- msvc tools: ia32, x64, arm64

Thanks all for porting!

Bug: chromium:1056170
Change-Id: I26ea7d727dc6d90929941668b8f115bdbaf226ab
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2153210
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67203}

Stepping only happens in one frame at a time, so we don't need to
rewrite the whole stack. This allows us to remove the
{flooded_function_index_}, since no function is globally flooded any
more.
A follow-up CL will ensure that the code will also not be installed in
the code table and jump table any more, to fix issues with non-local
control flow (i.e. catching a trap and reentering wasm), where we
could currently accidentally execute flooded code. It will also speed
up stepping over recursive calls enormously, since the recursive calls
don't run into the flooded breakpoints any more.

R=thibaudm@chromium.org

Bug: v8:10235
Change-Id: Ifae5e35c3242c95e1fe1a89a169ce874b818a288
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2152646Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67202}

NEONFormatDecoder::Substitute function utilizes snprintf()
to substitute arrangement specifier into a format string.
Some instruction format strings (e.i. ld4r) are specified
with '%n$' positional parameter fields, but on Windows
snprintf function doesn't support these parameters.
NEONFormatDecoder logic is extended to handle four parameters
in order to avoid using positional parameters.

Bug: v8:10365
Change-Id: I79d4014c6b45d698ca47090a74c30e4eae856334
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2148776Reviewed-by: Martyn Capewell <martyn.capewell@arm.com>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67201}

This changelist adds to the GDB stub (in class wasm::gdb_server::Target) the
logic to decode and execute GDB-remote commands and to format response packets
to be sent back to the debugger.
Here most of the commands still act as a NOOP; the actual implementation
requires interactions with the Wasm engine and will be implemented in the next
CL of this series.

Build with: v8_enable_wasm_gdb_remote_debugging = true
Run with: --wasm-gdb-remote

Bug: chromium:1010467
Change-Id: Icfa63be9e1eaa657c05876d0d4e86927e0885b90
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1938466
Commit-Queue: Paolo Severini <paolosev@microsoft.com>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67200}

Port 8ef2f799
https://crrev.com/c/2150157

Change-Id: I70ffb8e0c669398339eb6e794bef2b7920b58cd3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2153194Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/master@{#67199}

GAS have a auto-align function which will align all the directive
data into it's nature boundary. And we're using .octa to present
data in embedded.S, which will be auto-aligned into 128-bit boundary.
It can break relatve offset in generated binary.
So we workaround it by forcing generate .long DataDirective on MIPS.

Also I rewoked WriteByteChunk so it can accept any kind of directive
now. Further more, implementation of HexLiteral is indentical on
generic, aix and mac so I merged them into base.

Bug: v8:10420
Change-Id: I0ff791412360769510735659f909524c5f96d3e0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2153187Reviewed-by: Dan Elphick <delphick@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67198}

No-Tree-Checks: true
No-Try: true
Bug: v8:10302
Change-Id: Ic6cf0fdf2151e0ea3cb6d42789f5499b5b70bd4a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2150591Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67197}

This changelist adds the logic to format, decode, sends and receive packets in
the format specified by the GDB-remote protocol
(https://sourceware.org/gdb/onlinedocs/gdb/Overview.html#Overview).

Build with: v8_enable_wasm_gdb_remote_debugging = true
Run with: --wasm-gdb-remote

Bug: chromium:1010467
Change-Id: Ibc9c6713c561d06847b472fab591c208c193199f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1929409
Commit-Queue: Paolo Severini <paolosev@microsoft.com>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67196}

Check that the argument passed to %OptimizeOsr is smi before accessing
it. If it isn't an Smi we crash unless we are fuzzing. When fuzzing,
this returns early (turns into a Nop) if the argument isn't an Smi.

Bug: chromium:1071045
Change-Id: Iff1ee3e368dfffdbbbab4107dc355d5460b996e9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2150602
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67195}

This reverts commit 128368c3.

Reason for revert: Just to trigger builders

Original change's description:
> Whitespace to trigger builders
> 
> TBR: machecnbach@chromium.org
> No-Presubmit: true
> No-Tree-Checks: true
> No-Try: true
> Change-Id: I208d974b1da1983a8fa5996e6819779bd35d8710
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2153216
> Commit-Queue: Liviu Rau <liviurau@chromium.org>
> Reviewed-by: Liviu Rau <liviurau@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#67193}

TBR=machenbach@chromium.org,liviurau@chromium.org

Change-Id: I87aa28cd4c50d2c63f17e7ccc50425bf05faa39f
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2153218Reviewed-by: Liviu Rau <liviurau@chromium.org>
Commit-Queue: Liviu Rau <liviurau@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67194}

TBR: machecnbach@chromium.org
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Change-Id: I208d974b1da1983a8fa5996e6819779bd35d8710
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2153216
Commit-Queue: Liviu Rau <liviurau@chromium.org>
Reviewed-by: Liviu Rau <liviurau@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67193}

Port fc29c453
https://crrev.com/c/2148640

Change-Id: I75092072ac6961c26559bd69d6a8413d2e9d2689
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2153189Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/master@{#67192}

Bug: v8:9909
Change-Id: Ic71a2a012cbd538d65afb047fe73e98be6454aed
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2150157
Commit-Queue: Fanchen Kong <fanchen.kong@intel.com>
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67191}

Instead of putting the 16 immediate bytes on the stack,
we move them into a temporary register.

The instruction-selector then has to change, to ensure that
the operands are distinct from the temporary.

Tested on the two workloads given in
https://github.com/zeux/wasm-simd/issues/2#issuecomment-614399004

For slow, the row "filter:" oct12 goes from ~50ms to ~27ms,
the rest of the figures look about the same or slightly faster.
For optimal, the same figure goes from ~25ms to ~24ms,
the rest of the figures look slightly faster.

Raw outputs are uploaded to bug.

Bug: v8:10117
Change-Id: I7f77a3066b5e24584f1c01574aa9311f56bd7fb4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2152853
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67190}

Bug: v8:9909
Change-Id: I1ec888ce0b3389afcb0edd1033bef179327e140c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2148640Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Zhiguo Zhou <zhiguo.zhou@intel.com>
Cr-Commit-Position: refs/heads/master@{#67189}