Attempting to set a FunctionTemplate without a code handler as an
accessor for a property will fail in the runtime, which expects to be
able to call the handler. Add an API check that guards against this.

Change-Id: I270f0ca3d20de507bc9bde2c4c8d23b2614313dd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3879490Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83055}

The current abort will crash if the generator is created by the
interpreter and resumed by the maglevved code.

This current workaround is not ideal since it can introduce
a deopt-reopt loop.

Bug: v8:7700, v8:13109
Change-Id: I7db71a896711255d866ace98eddde85538aa2903
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3879228
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Jakob Linke <jgruber@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83054}

Bug: v8:7700
Change-Id: Ie9be2aaf0a75cf1fd19f50ce4697f71e92a36df6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3879223Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83053}

Bug: v8:11111
Change-Id: I4af1cc85a15833c360a5a454f8d36f43840232ad
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3878254Reviewed-by: Marja Hölttä <marja@chromium.org>
Auto-Submit: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83052}

Change-Id: If4c6792d36423daafb2a4454354db2d9e4abe297
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3879229Reviewed-by: Jakob Linke <jgruber@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83051}

At the moment the shared heap is internally implemented as its own
isolate - the shared isolate. This CL prepares to remove the shared
isolate and replace it with shared spaces in the main isolate.

This CL introduces the --shared-space flag to opt-in into this shared
heap-approach. Isolate::is_shared_space_isolate() and
Isolate::shared_space_isolate() are added as well to identify the
main isolate (or shared space isolate).

Bug: v8:13267
Change-Id: I1a79c839de3b3b9cc988401e2e6e70ce3b02fa22
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3874928Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83050}

.. to increase bus factor in EU time zones.

Change-Id: I7f1bca0fd765f8f1720ff5534823b4daaa290ea3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3879488
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83049}

Bug: None
Change-Id: I8cf2e4b651c0ccb784a5d668656cbfcd573b271d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3878450Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Feng Yu <f3n67u@gmail.com>
Cr-Commit-Position: refs/heads/main@{#83048}

Set COMPACTION_WAS_ABORTED page flag also when aborting evacuation
due to OOM.

Bug: chromium:1359294, v8:12578
Change-Id: Ia9833dbf9213375698cb7b1595ade7df5e24189d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3877145Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83047}

The days is passing incorrectly between calls.
Spec text:
https://tc39.es/proposal-temporal/#sec-temporal-differencetemporalplaindatetime

Bug: v8:11544
Change-Id: If818d0f42bdd3260e68eef2c6aba1c3781632c93
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3857869
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83046}

Access the correct years, months and weeks which modified previously
instead of the value from the input.

Spec text:
https://tc39.es/proposal-temporal/#sec-temporal-roundduration

Bug: v8:11544
Change-Id: I2ffaca5545e2359bc1cc03320068424bba4c7907
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3860649Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83045}

This CL fixes redesigns the current API, which does not correctly
manage lifetimes of the shared object conveyors.

See design doc at
https://docs.google.com/document/d/1TV6agY9dafVJFvdPrUAGbEvos8wL2WDnsmf84n3OJVU/edit?usp=sharing

This CL also removes the incorrect behavior of serializing all shared
strings by sharing instead of copying. Shared strings may be sent to
another process, which should still work.

Bug: v8:12547
Change-Id: I7413abd2d871fd3d52c9b433445cfa1d03e4a732
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3868713
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83044}

Change-Id: I46763c17f7078a3a5730c5a160ec899663ed990b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3879483
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Auto-Submit: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83043}

Bug: v8:7700
Change-Id: I3da7bbd928e0a587b4eb2c90c86f71405da67323
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3876378
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83042}

This reverts commit 0a1a579a.

Reason for revert:
https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Clusterfuzz%20Linux64%20ASAN%20arm64%20-%20debug%20builder/30617/overview

Original change's description:
> Port JS-Wasm Promise Integration for arm64
>
>
> Port Generic JS-Wasm Wrapper for arm64
>
> Change-Id: I256e6511d47af9ab04c577beb6b829dfee34a6ed
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3841074
> Commit-Queue: Ilya Rezvov <irezvov@chromium.org>
> Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#83038}

Change-Id: I83b6c3596561b56d3df34ac2177aa334780dbf87
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3879482
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#83041}

Test for non-string objects in the CheckedInternalizedString slow path.

Bug: v8:7700
Change-Id: Iac82a39ad0a0a93b328f8c574ed0bb7e2f39703b
Fixed: chromium:1360432
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3879227
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83040}

The src/wasm/stacks.h file became progressively bigger, create a
cc file for it and move some function definitions there.

R=clemensb@chromium.org

Bug: v8:12191
Change-Id: I6880a4e11884856bd2f4d777cb745a3c06c71841
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3874936Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83039}

Port Generic JS-Wasm Wrapper for arm64

Change-Id: I256e6511d47af9ab04c577beb6b829dfee34a6ed
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3841074
Commit-Queue: Ilya Rezvov <irezvov@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83038}

Replace Heap::IsGCWithoutStack() with Heap::IsGCWithStack() to avoid
double-negation.

Bug: chromium:1359294, v8:12578
Change-Id: I8f2e9feb48e574fae6a7721f86a70728b089ec67
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3878170
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83037}

When stress testing compaction, also abort evacuation for 5% of the
pages somewhere in the middle of the page.

Bug: chromium:1359294, v8:12578
Change-Id: Ie2e9873660ea2c330f175607b443f536f5d3abd2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3876369
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83036}

Bug: v8:13113
Change-Id: Ib80f4517075f806950d57f97da4e5181248f2276
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3879225Reviewed-by: Alexander Schulze <alexschulze@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83035}

Change-Id: I0c11c0ba51af8e1e1c66ca6cf7e351b54464fd2c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3879226Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83034}

.. which sets the --interrupt-budget-for-maglev to a very low value
s.t.  that tiering to Maglev happens very early. Note this affects
both normal tierup and OSR.

Also add flag handling to fuzzer.py, both as added globally with
probability 0.1, and added to InterruptBudgetFuzzer (which I also
updated with other tiering-related flags).

Bug: v8:7700
Change-Id: I844cf53a6a2da459565d0ad0ccae02b04853cd26
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3878165Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Jakob Linke <jgruber@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83033}

Port commit 8e069d62

Change-Id: Ifc21ac1bb2d2b93af07ed7b548204b634f1708b9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3875382Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Auto-Submit: Liu Yu <liuyu@loongson.cn>
Cr-Commit-Position: refs/heads/main@{#83032}

- Remove the {ValueRepr} parameter from Wasm table and global object
  internals. It is now the responsibility of the user to transform
  to/from a JS object. This removes duplicate work in some cases (type
  checking in the caller, transforming in the callee).
- For the reverse direction in the JS API, introduce
  {WasmObjectToJSReturnValue}.

Bug: v8:7748
Change-Id: Ie7625cc0f08d38fe74dbe57e69004de2d93b8a11
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3876184Reviewed-by: Simon Zünd <szuend@chromium.org>
Reviewed-by: Matthias Liedtke <mliedtke@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83031}

This reverts commit 703b0b31.

Reason for revert: a simpler approach will be used instead.

Original change's description:
> [ptr-compr-8gb] Align runtime allocations to 8 bytes
>
> In order to support a larger heap cage (8GB, 16GB), the cage offset
> will take up more than 32 bits. As a consequence, for 8GB cages, the
> least significant bit of the cage offset will overlap with the most
> significant bit of the tagged offset. To avoid this, allocations need
> to be aligned to 8 bytes to free up one bit from the offset.
> All changes are deactivated behind the build flag
> `v8_enable_pointer_compression_8gb`.
>
> Bug: v8:13070
> Change-Id: Ibb0bd0177f3e88dcd24fc0ee7526335df0faa987
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3791052
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Auto-Submit: Teo Dutu <teodutu@google.com>
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Commit-Queue: Igor Sheludko <ishell@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#82299}

Bug: v8:13070
Change-Id: I5cb60f8e4500c908bdef5d417393edbe89652c9c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3877146Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Auto-Submit: Teo Dutu <teodutu@google.com>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83030}

This reverts commit 24e60017.

Reason for revert: Change breaks maglev GC stress tests.

Original change's description:
> [maglev] Deopt on overflow in >>>
>
> Re-enable the int32 fast path for ShiftRightLogical, but account for
> Maglev's missing signed/unsigned representation tracking by a)
> removing rhs==0 as the identity value (a shift by 0 is still a
> signed-unsigned conversion) and b) deoptimizing if the result cannot
> be converted to a non-negative smi.
>
> Note this is not a deopt loop, since a non-smi result will change the
> feedback to kSignedSmallInputs (from kSignedSmall).
>
> To fix this properly, we should track signed/unsigned representations
> and convert the result to a heap number if it doesn't fit within smi
> range.
>
> Bug: v8:7700
> Change-Id: Ifd538d227a6f1290eb7f008d9bfad586ff91ea0f
> Fixed: v8:13251
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3876366
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Commit-Queue: Jakob Linke <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#83025}

Bug: v8:7700
Change-Id: Ibd4c29cc57b999e1cfcd040cee3228ea27a74029
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3876374
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Owners-Override: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83029}

... which works for stale pointers. The default == operator contains
a DCHECK guarding against Code vs. non-Code object comparisons and
thus it can't be used for stale pointer.

Bug: chromium:1360793, v8:11880
Change-Id: Ic5faf9b05e1586a15388cc1cbf3e8dcddbea452f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3879222
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83028}

Bug: v8:7700
Change-Id: I8880a12e67474c630fe3e09dfeb695474e7d2e8e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3876368
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Jakob Linke <jgruber@chromium.org>
Auto-Submit: Jakob Linke <jgruber@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83027}

This is a reland of commit e7bf8110

Shared string GC issues have been fixed in https://crrev.com/c/3875028

Original change's description:
> [sandbox] Sandboxify ExternalString external pointers
>
> Bug: v8:10391
> Change-Id: I0f737e5adf6e4fd24f93436fa5680ff20c1536da
> Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3757901
> Commit-Queue: Samuel Groß <saelo@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#82958}

Bug: v8:10391
Change-Id: I555498973dc9d5dcc4163b3b1258e41d7148e2d5
Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3872273Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Samuel Groß <saelo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83026}

Re-enable the int32 fast path for ShiftRightLogical, but account for
Maglev's missing signed/unsigned representation tracking by a)
removing rhs==0 as the identity value (a shift by 0 is still a
signed-unsigned conversion) and b) deoptimizing if the result cannot
be converted to a non-negative smi.

Note this is not a deopt loop, since a non-smi result will change the
feedback to kSignedSmallInputs (from kSignedSmall).

To fix this properly, we should track signed/unsigned representations
and convert the result to a heap number if it doesn't fit within smi
range.

Bug: v8:7700
Change-Id: Ifd538d227a6f1290eb7f008d9bfad586ff91ea0f
Fixed: v8:13251
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3876366Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83025}

Some assertEquals:s should've been assertSame.

Drive-by: Coding style fixes
Drive-by: Fix the parameter order of assertEquals, it should be
(expected, found).

Bug: v8:11525
Change-Id: I4e6db32329cbbe455853d19c20abe9d251263505
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3877148
Auto-Submit: Marja Hölttä <marja@chromium.org>
Reviewed-by: Matthias Liedtke <mliedtke@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83024}

Abort evacuation for ~10% of evacuation candidates during stress
testing. This should make aborting of evacuation more frequently and
uncover bugs sooner.

Bug: chromium:1359294, v8:12578
Change-Id: I2fb2124b10456ea71da12df71ef92cf2c3d89c03
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3878173
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83023}

The laneidx of LoadLaneParameters will be taken as char type when
PrintParameter. Fix operator<< to print laneidx with integer type.

Change-Id: Ibe9992326014d912f9aa09e785c8c3632ed02c06
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3878768
Auto-Submit: Yolanda Chen <yolanda.chen@intel.com>
Commit-Queue: Yolanda Chen <yolanda.chen@intel.com>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83022}

Bug: v8:7700
Change-Id: Idf4cd2544e7ee3912809cbf95cee4823be36d1dd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3875905Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Jakob Linke <jgruber@chromium.org>
Auto-Submit: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83021}

We've previously used JSFunction::GetActiveTier, which looks at
JSFunction::code to determine the active tier. However, that may
diverge from the actually active tier (i.e. the calling frame type),
e.g. when Turbofan code is available but we haven't yet tiered up
because we're stuck in a longrunning loop.

With this CL, we determine the caller code_kind by splitting the
BytecodeBudgetInterrupt runtime function up into _Ignition,
_Sparkplug, and _Maglev variants s.t. the tier is passed implicitly
without extra overhead at runtime.

Bug: v8:7700
Change-Id: I46d19c4676e3debb6d608d9fbc53495feef5cadf
Fixed: chromium:1358577
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3871196
Commit-Queue: Jakob Linke <jgruber@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83020}

Re-implement the --log-function-events functionality after
refactoring the tiering state bits on the FeedbackVector.

The new version also tries to log first-execution of non-interpreter
code and will handle OSR events.

Not-yet supported:
- First-execution logging when OSR-ing in Sparkplug or Maglev

Bug: v8:13146
Change-Id: I2059c6d8105091f20586eaf157ef19d5e65295aa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3832375Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83019}

This is a reland of commit d00c0405

Changes since revert: Use AsAtomicTagged instead of
base::AsAtomicPointer to store a hash value in the forwarding table.

Original change's description:
> [strings] Support shared external strings>
>
> With this CL shared strings can be externalized and external strings can
> be shared.
> The StringForwardingTable is used to delay the real transition to the
> next full GC. On the API side strings marked for externalization will
> look like externalized strings.
>
> Bug: v8:12957
> Change-Id: I53b6509129bc5679c06bdf99421bdb41ea5d9082
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3849643
> Reviewed-by: Shu-yu Guo <syg@chromium.org>
> Reviewed-by: Camillo Bruni <cbruni@chromium.org>
> Commit-Queue: Patrick Thier <pthier@chromium.org>
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Reviewed-by: Victor Gomes <victorgomes@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#82966}

Bug: v8:12957
Change-Id: I17715e927e4339240a6aa12a3c4a3c2ea50eb567
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3871211
Commit-Queue: Patrick Thier <pthier@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83018}

Add an enum in the jump buffer to represent the state of the
stack: active, suspended, or retired. Update the state on stack switch
and check that they are consistent.

The previous method relied on comparing the current stack pointer with
the bounds of the stack, which was not reliable because the upper bound
of the native stack is not known precisely.

R=clemensb@chromium.org

Bug: v8:13236
Change-Id: If1880aa3efd5a9dc03c3c52ac5315d369d886a50
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3870925
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83017}

External pointers used in external strings are always stored in the
shared external pointer table.
Prior to this CL we didn't mark external pointer entries for external
strings residing in client heaps.

Bug: v8:13260
Change-Id: Ifc5dc86f4ebe2791bfb8c4c8fe2673886d24e8a8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3875028Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83016}