Design doc: bit.ly/3jEVgzz

We separate the internal representation of function references in Wasm
from their JSFunction-based (external) representation. This improves
performance of call_ref by requiring less indirections to load the
context and call target from a function reference. In the boundary
between wasm and JS/the C API, we add transformations between the two
representations.

Detailed changes:
- Introduce WasmInternalFunction, containing fields required by
  call_ref, as well as a reference to the corresponding
  WasmExternalFunction. Add a reference to the WasmInternalFunction in
  WasmFunctionData. The {WasmInternalFunction::FromExternal} helper
  extracts the internal out of an external function.
- Change {WasmInstanceObject::external_functions()} to internal
  functions.
- Change wasm function tables to contain internal functions.
- Change the following code to use internal functions:
  - call_ref in liftoff and Turbofan
  - function type checks in liftoff and Turbofan
  - CallRefIC and GenericJSToWasmWrapper builtins
  - {InitExprInterface::RefFunc}
  - module-compiler.cc in {ProcessTypeFeedback}
  - In module-instantiate.cc, in function-rtt creation.
- Add transformations between internal and external functions in:
  - WasmWrapperGraphBuilder::{ToJS, BuildUnpackObjectWrapper, FromJS,
    BuildJSToJSWrapper}.
  - debug-wasm-objects.cc in {FunctionProxy::Get},
    {WasmValueObject::New} and {AddWasmTableObjectInternalProperties}.
  - runtime-wasm.cc in ReplaceWrapper
  - the C and JS APIs
  - module-instantiate.cc, in import and export processing, as well as
    {InitializeIndirectFunctionTables}
  - WasmTableObject::{IsValidElement, SetFunctionTableEntry}
  - {WasmGlobalObject::SetFuncRef}
- Simplify body descriptors of WasmExternalFunction variants.
- Adjust tests.

Bug: v8:11510

Change-Id: I8377f46f55c3771391ae1c5c8201a83854ee7878
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3277878Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78068}

Bug: v8:12185
Change-Id: I7d5fbf624fff262b7777e443b12cb7a72d6165e5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3293404
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78067}

The CL converts uses of v8::internal::Worklist to heap::base::Worklist
which does not require to know the number of tasks working with the
work list upfront. heap::base::Worklist is the common implementation
for V8's heap and cppgc and should be used/optimized going forward.

Bug: v8:12426
Change-Id: I35713938ff80f43a763470f8bdf7e242439080f5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3297903
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78066}

In the final version, we might parse the parameters when deserializing
instead, but this approach is more suitable for prototyping.

Bug: v8:11525
Change-Id: I000869877b03fd1909acf602ab5190951b1939e5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3295456Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78065}

R=jkummerow@chromium.org

Bug: v8:12281
Change-Id: I94191b592350cfc8d06cf6fbadca6eaa8d37569f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3297897Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78064}

This is a reland of d7c3f1cd. It fixes
a build failure on native arm64.

Original change's description:
> Reland "[fastcall] Enable float support on arm64 simulator"
>
> This is a reland of b9ddcbc8
>
> The original CL was reverted due to an MSAN issue, that is fixed by
> moving the signature mapping onto the Isolate (instead of having
> per-thread storage, which got invalid on multithreaded compilation).
>
> This CL also contains fixes for the Bazel config and for a data race
> when obtaining the PerIsolateSimulatorData.
>
> Original change's description:
> > [fastcall] Enable float support on arm64 simulator
> >
> > This CL adds support for handling calls to C functions with arbitrary
> > signatures on the arm64 simulator. It adds infrastructure for
> > encoding the signature data from CallDescriptor and FunctionInfo
> > classes into a compact representation, stored in the simulator and
> > called EncodedCSignature.
> >
> > Design doc:
> > https://docs.google.com/document/d/1ZxOF3GSyNmtU0C0YJvrsydPJj35W_tTJZymeXwfDxoI/edit
> >
> > This CL is a follow up on the native support added in
> > https://chromium-review.googlesource.com/c/v8/v8/+/3182232
> > and is partially based on the previous attempt:
> > https://chromium-review.googlesource.com/c/v8/v8/+/2343072
> >
> > Bug: chromium:1052746
> > Change-Id: I0991b47bd644b2fc2244c5eb923b085261f04765
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3060486
> > Commit-Queue: Maya Lekova <mslekova@chromium.org>
> > Reviewed-by: Camillo Bruni <cbruni@chromium.org>
> > Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> > Cr-Commit-Position: refs/heads/main@{#77744}
>
> Bug: chromium:1052746, chromium:1267854
> Change-Id: I89bbd01e33fb1080543d98bcfd4c2d17b5c76861
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3270541
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Camillo Bruni <cbruni@chromium.org>
> Commit-Queue: Maya Lekova <mslekova@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#78018}

Bug: chromium:1052746, chromium:1267854
Change-Id: Ib495573569a6c930b8f9e5f1fe7ff46eb57a0aa7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3295461
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78063}

Make it an enum class too, and fix all the enums to follow style guide.

Fixes a -Wshadow warning, NONE shadows PropertyAttributes::None.

Bug: v8:12244,v8:12245
Change-Id: I9a8181a35d5690a32a6ce58587f0d8704aa1ab40
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3291696
Auto-Submit: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78062}

Bug: v8:11525
Change-Id: I28548c4eddcc7764be950950e16ac30b12ac8cdd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3297890Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78061}

Conditional compilation with @if/@ifnot is now allowed for
- statements
- typeswitch cases
- enum constants
- bitfield struct fields
- struct fields and methods

Bug: v8:7793
Change-Id: I701e8b1f4fb5c5494eaf0af6d0b540bc9166b5ca
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3296283Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78060}

When a LocalHeap is destroyed, we update (publish) the changes
in the TypedSlots, this need to be protected by a mutex, since
we may read the RecordRelocSlot in a different thread.

Bug: v8:12054, v8:12411, chromium:1272364
Change-Id: Id1684dad3ed9e02c597099c440d1fbfdbd8c47ce
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3297892
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78059}

The fix in https://crrev.com/c/3283620 doesn't work, it was meant to be
a general way to fix shadow whenever ASM_CODE_COMMENT is used, by
appending the current line, via __LINE__ macro to the variable name.
However, __LINE__ is not expended correctly when it is directly part of
a variable name.

To fix the shadowing, we use UNIQUE_IDENTIFIER to give unique names.

Bug: v8:12244,v8:12245
Change-Id: I7b9b9da74d62023ac631ff0876f41e80971e2f09
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3291804
Auto-Submit: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78058}

Bug: v8:11525
Change-Id: Ied08cccce533342474d520c9668d52846156a352
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3295452Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78057}

This CL improves --track-retaining-path with incremental marking:

* Retainers need to be cleared *after* the GC and for full GCs only.
  Otherwise a scavenger that runs during incremental marking would
  clear all retainers.
* Register marked root objects in IncrementalMarking::MarkRoots with
  retaining_root_.

Change-Id: I18ab9da48fb7ac45f9ec0826334fd338dc202edc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3297893Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78056}

R=szuend@chromium.org

Change-Id: I813d8c7083b5f3e061255a540a68340239c9c078
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3300128
Commit-Queue: Yang Guo <yangguo@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Auto-Submit: Yang Guo <yangguo@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78055}

Port commit e127f584

Bug: chromium:1260623

Change-Id: I1462126391189f328bb5d8a8fbfb00f3bce642a8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3299283
Auto-Submit: Liu yu <liuyu@loongson.cn>
Reviewed-by: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/main@{#78054}

1. The default locale may be reset / is not immutable as we thought.
2. A suffix of ignorable code points after the common length affects
   the comparison result.

Bug: v8:12196
Fixed: v8:12398
Change-Id: I6f60f56352956779df801c43de6ebac8cd9c592d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3291314
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78053}

This is an unused overload, which doesn't add any value to keep around.

Bug: none
Change-Id: I6e004e28f6ec8d4c8de87a1e86d331a624694659
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3297896
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78052}

Bug: none
Change-Id: I54e95555826c21e2625f43701ceb99a06c049a9a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3297895
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78051}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/368880d..91d63ae

Rolling v8/third_party/aemu-linux-x64: RGchQ75eBrFQJRPQJMv5DT7uzlwr_ttfbGI2Kqlzw0wC..V5Pz7_TfKoS_JMMlyA_dmnc33kG1ksWSC71zCysnq7UC

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/738798d..606d87e

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/a29f589..b23a88a

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/649f6b9..994ccaf

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I485979ace8ca9ebde6c5c0aef197c951b2bdf6ad
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3297943
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#78050}

Parser based on
https://tc39.es/proposal-temporal/#sec-temporal-iso8601grammar

Bug: v8:11544
Change-Id: I18eafc86da86005d5aee7b672c145fcf38a3ef5e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3271827Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78049}

This CL optimizes ByteReverse 16/32/64 ops on PPC<10 as
well as PPC_10_PLUS.

A 32bit sign extension is also added to `ByteRev32` in codegen.

Change-Id: I6379ac4222f3574ab226971546238142039fe977
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3298308
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Reviewed-by: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/main@{#78048}

Bug: v8:12244,v8:12245
Change-Id: I816930bfc65a2e597a41562cb115af5d0bca199b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3296147Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78047}

Previous version: https://chromium-review.googlesource.com/c/v8/v8/+/3259648

Fix 1: ValueSerializer <3 JSArrayBufferView
Fix 2: set flags correctly when creating DataViews via the API

Bug: v8:11111
Change-Id: I9cbfdaff29f97c7823eaa3d931689b363e1f4cf7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3297708Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78046}

With dynamic tiering, caching is triggered multiple times as there is
no single event anymore that triggers when the module should be cached.

This CL adds a counter for the number of times caching is triggered.
This counter can indicate whether our current caching heuristics are
good or should get adjusted.

R=thibaudm@chromium.org

Bug: v8:12281
Change-Id: I8ed9ed73a556d11df643c31ec6d20760a257e0d4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3295578Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78045}

This CL adds `can_use_compiled_module` parameter to
WasmStreaming::Finish() that is used by Chromium
https://chromium-review.googlesource.com/c/chromium/src/+/3282643
to invalidate compiled module bytes after SetCompiledModuleBytes().

Bug: chromium:1260939
Change-Id: Iebf0e8615c27c8622721777c664b06a53fb9ee91
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3297548Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Hiroshige Hayashizaki <hiroshige@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78044}

test-heap/NextCodeLinkIsWeak
test-heap/NextCodeLinkIsWeak2
test-heap/NextCodeLinkInCodeDataContainerIsCleared

These tests depends on deterministic compile job behavior.

Fixed: v8:12367
Change-Id: I47e748f18abf947a769e09df3814bd2a3443b11b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3297894
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78043}

Private methods use a property with symbol name that stores a context.
This is then loaded to perform the brand check. Since this uses
JSLoadProperty in Turbofan, we should not type JSLoadProperty as
NonInternal.

Bug: chromium:1269063, v8:12359
Change-Id: I920ccf46e939ab0477ff2fdb3cda6d7d94bab0af
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3293089Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78042}

No-Try: true
Change-Id: I9a7be37f6f1a404fb5c3517b5fdb4008aaaec45a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3295460
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78041}

The macro may be defined but the value to it may not be assigned. The
compiler can complain about (reproduced when compiling chromium on
Windows).

Bug: chromium:1249550
Change-Id: I684997ccda7122f56c01391e7a1339fadf6589e6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3297888Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78040}

This reverts commit 8f3e53b8.

Reason for revert: Blink test failures

Original change's description:
> [rab/gsab] Add RAB / GSAB support to DataViews
>
> Bug: v8:11111
> Change-Id: Ice66accee734484302d499b8098056ae1c68faf3
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3259648
> Commit-Queue: Marja Hölttä <marja@chromium.org>
> Reviewed-by: Shu-yu Guo <syg@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#78028}

Bug: v8:11111
Change-Id: Icaae7276dfede8c021f3ce1a7e96ed3ec13fe4fe
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3295577
Auto-Submit: Marja Hölttä <marja@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78039}

The list of to-be-finalized objects can grow significantly. While
running Speedometer2, the metadata that stores to-be-finalized objects
can be the second largest contributor to heap consumption (overall
taking up 2.6MB, checked with heaptrack).

The CL changes the list to be stored inlined in HoH, if cage-heap is
enabled, rather than in a separate vector.

Bug: chromium:1249550
Change-Id: I04a0c84d118655fa6ff8e2440423e802cd722842
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3295448Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78038}

Change-Id: I6411c752e3de1fb6e1547ccfe41265c5615eb421
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3296148
Auto-Submit: Jianxiao Lu <jianxiao.lu@intel.com>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78037}

Change-Id: I7755e943674ec4128b0e5869e9ff5ea735efd162
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3295309
Auto-Submit: ji qiu <qiuji@iscas.ac.cn>
Commit-Queue: Kim-Anh Tran <kimanh@chromium.org>
Reviewed-by: Yahan Lu <yahan@iscas.ac.cn>
Reviewed-by: Kim-Anh Tran <kimanh@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78036}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/eabf027..368880d

Rolling v8/third_party/aemu-linux-x64: BsMGVIB-SMSFb0qDOwUoX0kok6z1XZdfmi4kKMOPrWYC..RGchQ75eBrFQJRPQJMv5DT7uzlwr_ttfbGI2Kqlzw0wC

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/8a112e2..738798d

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/b6c1ed4..a29f589

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/b0d8d05..649f6b9

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I62d21963fa941ad4c6bee2bc4c2d48bc9e858c19
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3296368
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#78035}

Change-Id: Icc245d9939649386d44ca95b9e57933b436b5cb5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3293414Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Jie Pan <jie.pan@intel.com>
Cr-Commit-Position: refs/heads/main@{#78034}

Bug: v8:12228
Change-Id: I21b2ee1e640ba75227a03d765bb1552eff68e3fa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3293415Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Jie Pan <jie.pan@intel.com>
Cr-Commit-Position: refs/heads/main@{#78033}

Bug: chromium:1271456
Change-Id: I54b81fc8e450ba65c9895ec5e22366446098dd64
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3296146Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Paolo Severini <paolosev@microsoft.com>
Cr-Commit-Position: refs/heads/main@{#78032}

It is possible to inline a JSToWasm wrapper that directly calls a
WasmToJS wrapper. In this case we need to make sure that the instance
we pass is a WasmApiFunctionRef, not a WasmInstanceObject.

Bug: chromium:1271456
Change-Id: I684a769922895860a43c73ba43c2598c9bda4b64
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3293423
Commit-Queue: Paolo Severini <paolosev@microsoft.com>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78031}

Bug: v8:12407
Change-Id: Iedf6154796423267fdb32125a408e580bb3c205b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3295349Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78030}

For large working set, the sweeper metadata can significantly increase.
Currently, the backing of swept_unfinalized_pages never gets freed,
which causes about 300KB of memory be occupied (checked on
Speedometer2). The CL makes sure to shrink (actually free) the backing
after each GC cycle.

Bug: chromium:1249550
Change-Id: I7c7e5248983960a498afc252a344fa71cb1444c3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3295347
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Auto-Submit: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78029}