https://chromium.googlesource.com/external/github.com/tc39/test262/+log/9215420..465cf4a

Bug: v8:7834, v8:13302
Change-Id: Ieb9d6215984b0f7eab201514e5b855f7efcdda65
Fixed: v8:13302
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3906921Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Auto-Submit: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83343}

Port 3f998527

R=sroettger@google.com, joransiu@ca.ibm.com, junyan@redhat.com, midawson@redhat.com
BUG=
LOG=N

Change-Id: I4a92ab1ba942f9303c4f083d9f0b846e924c25f8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3907868
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Reviewed-by: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/main@{#83342}

This reverts commit 67106ff4.

Reason for revert: Test failure bisected locally to this (failure link: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux%20-%20gc%20stress/40535/overview). Not clear why but reverting to keep the tree green.

Original change's description:
> [wasm-gc] JS interop: Do not wrap structs/arrays by default
>
> Bug: v8:7748
> Change-Id: I441fd294bc0f31c0396217bc55c27159abacdbd1
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3905725
> Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
> Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
> Auto-Submit: Matthias Liedtke <mliedtke@chromium.org>
> Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#83338}

Bug: v8:7748
Change-Id: Ifb5e980dedf8e9824d05171c431ad383af180e50
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3904416
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83341}

Bug: v8:13281
Change-Id: Ie61eb42ad6be565c8be76c9b4aa63282c7856f25
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3905190Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Stephen Röttger <sroettger@google.com>
Cr-Commit-Position: refs/heads/main@{#83340}

As part of moving export wrappers to the isolate, it was tried to
compile them lazily on the main thread. This resulted in large
slowdowns in some cases, therefore we restore the eager parallel
compilation.

Bug: chromium:1365726
Change-Id: I9cc8d5728f3a5c71099f0e0fdcc605b37d4d6618
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3905193Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83339}

Bug: v8:7748
Change-Id: I441fd294bc0f31c0396217bc55c27159abacdbd1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3905725Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Auto-Submit: Matthias Liedtke <mliedtke@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83338}

On x64.release for linux this didn't affect binary size at all but
should improve readability of usages.

Bug: v8:7748
Change-Id: I46ecc9c2b4814244f6b5114f9ea199cd4d0220cd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3904602Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83337}

Bug: v8:7748
Change-Id: Icde19a554042ce57420a1faa72492c53a07dbc66
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3905723
Auto-Submit: Matthias Liedtke <mliedtke@chromium.org>
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83336}

This reverts commit 0cb75429.

Reason for revert: Suspect for waterfall closure - https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Maa%20-%20arm64%20-%20no%20pointer%20compression%20debug%20builder/1072/overview

Original change's description:
> Remove some unused includes
>
> Bug: v8:13006
> Change-Id: Iee530e965786583330ff5e00ccfe58358a813f76
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3879500
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#83332}

Bug: v8:13006
Change-Id: I9d9d88a84786cb683042ab2ed665d61656d6de3b
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3904415
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Owners-Override: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83335}

Bug: v8:7748
Change-Id: Ie68be87805fe85c954209cd3257a0915deec84be
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3905191Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83334}

Change-Id: I154b7d70eb9cbcb2f71db7c88a18b81b3814415d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3904424Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#83333}

Bug: v8:13006
Change-Id: Iee530e965786583330ff5e00ccfe58358a813f76
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3879500Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83332}

Change-Id: Ia8d92151114c674b581ec2fa2b4e3297e9c7cf6f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3905927
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Auto-Submit: Andrey Kosyakov <caseq@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83331}

DCHECK that input registers that are clobbered (e.g. because they are
also an output register) are not used as register inputs into eager
deopts.

This is already the case because we're only allowed to mutate input
registers that alias the result register, and eager deopt input
allocation happens after result register allocation, but this DCHECK
makes this assumption explicit and will break if we ever change the
regalloc.

Bug: v8:7700
Change-Id: I4e00a8be88e0984044d8fc5b661eaf7bea801b17
Fixed: v8:13278
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3905189
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Jakob Linke <jgruber@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83330}

This change allows to put Wasm structs / arrays into prototype
chains. While this isn't particularly useful (as any access lookup
on the wasm object will throw a TypeError), there isn't any reason
not to allow it.

Bug: v8:7748
Change-Id: I81cf709d2e8403b545bbba9ad9c538c1e9748c74
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3901979Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83329}

Change-Id: Ic1950646f880e5b752d2018fa2ad2715e3ad3292
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3904233
Commit-Queue: Stephen Röttger <sroettger@google.com>
Reviewed-by: Jakob Linke <jgruber@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83328}

Maglev support is not implemented yet.

Also make Maglev conflict with --no-maglev.

Bug: v8:13091,v8:13253
Change-Id: Iac5f06a5697405348f681b29ec43044abf50d90a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3907725
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Marja Hölttä <marja@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83327}

Bug: chromium:1342305, chromium:1354926, chromium:1359709
Change-Id: I5ddedea227669908710b83f808cfb7c4718f0699
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3904608Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83326}

Use the node aspect mechanism to find and cache tagged equivalents of
non-tagged nodes during merging.

Bug: v8:7700
Change-Id: If1e6210b34e23a3559bf6251dafa985e827f0d08
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3904234
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Jakob Linke <jgruber@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83325}

If a shift right is performed with a negative value <= -32,
it may not be reduced to a 32 bit shift.
The reduction optimization was introduced by commit
2298b35f.

Fixed: v8:13290
Change-Id: Ifb16ed85560ab54d211ebb407690abe2c156e3a2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3905143
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Auto-Submit: Matthias Liedtke <mliedtke@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83324}

Array.prototype.group and Array.prototype.groupToMap have an optional
thisArg, which is currently not passed.

Bug: v8:13301, v8:12499
Change-Id: Ib927638401d39ed0cbcc0595ab41fde328ef43cc
Fixed: v8:13301
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3905934
Auto-Submit: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83323}

This is a reland of commit d7fcbba8

The LSan support logic of the ExternalPointerTable has been optimized to
avoid timeouts on sanitizer bots

Original change's description:
> [sandbox] Increase ExternalPointerTable maximum capacity to 512MB
>
> Bug: v8:10391
> Change-Id: I383e11bdccf6fcaf13f29d25e1404545067d313e
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3891249
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Commit-Queue: Samuel Groß <saelo@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#83203}

Bug: v8:10391
Change-Id: If50156d6fecff7ca8ece5c350e7b08936f50daa6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3905141
Commit-Queue: Samuel Groß <saelo@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83322}

Bug: v8:7748
Change-Id: I1d4d951b67546e0403854b96b04b681ce101deaf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3902053
Auto-Submit: Matthias Liedtke <mliedtke@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83321}

This CL fixes isolate deserialization such that the first test for
concurrent allocation in the shared spaces already succeeds.

* Allows dereferences for the shared heap and not just for the shared
  isolate.
* Updates shared_heap_object_cache() for --shared-space.
* Sets IN_SHARED_HEAP flag on all shared space pages.

Bug: v8:13267
Change-Id: I912630da34f93e15d2ddef77a45a5e875bdceff0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3902523
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Jakob Linke <jgruber@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83320}

This CL adds a test that checks the block list for outer functions is
also correctly calculated when pausing in inner functions.

R=kimanh@chromium.org

Bug: chromium:1363561
Change-Id: I2d7c1671475759b977e4e41c7e09856b3b2e7daf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3904308Reviewed-by: Kim-Anh Tran <kimanh@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83319}

This CL introduces a new root that is conceptually a

WeakMap<ScopeInfo, Tuple2<ScopeInfo, StringSet>>

Instead of storing the "locals block list" for debug-evaluate on the
`ScopeInfo` object directly, we will store it instead in a global
WeakMap. This enables us to re-use the "locals block lists" across
multiple debug-evaluate invocations without having to modify the
`ScopeInfo` of `SharedFunctionInfo`s.

R=bmeurer@chromium.org

Doc: https://bit.ly/chrome-devtools-debug-evaluate-design
Bug: chromium:1363561
Change-Id: Ib52f9abd97cf1c8fa3053ff3c61a6062c4b814be
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3902041Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83318}

Since we have the NodeInfo map in known_node_aspects now anyway, use it
for representation changes instead of the current interpreter frame
value swapping mechanism.

We originally didn't want a map for representations, but if we have one
anyway for node types, it makes sense to merge the two mechanisms.

This also allows us to get rid of the "register same as accumulator"
hack for binops, which was trying to avoid redundant representation
changes, since the redundancy is removed by the node aspects mechanism
automatically. It's kept for CheckedInternalizedString, since that isn't
a representation change within our framework (maybe it should be?).

Bug: v8:7700
Change-Id: I92491307f83d3b63fc7a210f6b8754e45d3531a7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3905182Reviewed-by: Jakob Linke <jgruber@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83317}

This is a reland of commit defa678e

Original change's description:
> cppgc: Be more conservative in Seeper::FinishIfOutOfWork
>
> Finalizing sweeping can be beneficial to truly end a GC cylce. We
> should only finalize in `FinishIfOutOfWork()` though if that would not
> introduce any jank. Limit the amount of executing finalizers in that
> scenario.
>
> Bug: v8:13294
> Change-Id: I0237f6b6017d444c457923d83e85147c58586445
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3902222
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Omer Katz <omerkatz@chromium.org>
> Reviewed-by: Anton Bikineev <bikineev@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#83279}

Bug: v8:13294
Change-Id: I426a54785d1a0f569c2200156dcf41a5d5c7876f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3902583
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83316}

We currently use 1 test case per file for tests that check that
debug-evaluate correctly blocks the lookup of stack-allocated
variables.

This CL adapts a similar approach to `debug-scopes.js`, making it
easier to add new test cases in the future.

R=kimanh@chromium.org

Bug: chromium:1363561
Change-Id: I8ff8cfe7d59f0b9808dc02c5579e058f490553eb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3904544
Commit-Queue: Simon Zünd <szuend@chromium.org>
Reviewed-by: Kim-Anh Tran <kimanh@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83315}

Slots in free memory need to be removed. After a GC the JS application can create additional free memory by either left- or right-trimming
of heap objects. The sweeper might discover memory that was freed
because of such operations.

In case the sweeper discovers free memory, there can't be any
recorded slots in it. Otherwise subsequent allocations might store
untagged values in those slots and the next deref would most
likely crash.

Remove OLD_TO_SHARED slots in freed memory when left-trimming, right-
trimming and for DeleteObjectPropertyFast.

Also full GC was right-trimming objects which now needs to remove
slots in OLD_TO_SHARED.

Bug: v8:11708
Change-Id: I5761336e103704929fbd455d74bdbb499ae23f61
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3905144Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83314}

Allow non-registered symbols as keys in weakmap and weakset.
Allow non-registered symbols as target and unregisterToken in
WeakRef and FinalizationRegistry.

Bug: v8:12947
Change-Id: Ieb63bda66e3cc378879ac651e23300b71caed627
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3865056Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83313}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/cf385c0..29d7990

Rolling v8/third_party/fuchsia-sdk/sdk: version:9.20220918.2.1..version:9.20220919.1.1

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/b118dfd..70967a5

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: Ib5641e39edc8bfe8f1edc6ffeebe18c2af8a9f2d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3904435
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#83312}

The hoursInDay could be fractional number on the date of changng
daylight saving time for time zone in half hours or some historical time
zone.
Ex: Australia/Lord_Howe on Sunday, April 3, 2022, 2:00:00 am clocks were
turned backward 0:30 hours to Sunday, April 3, 2022, 1:30:00 am local
standard time instead. so that day will have 24.5 hours.
On Sunday, October 2, 2022, 2:00:00 am clocks are turned forward 0:30
hours to Sunday, October 2, 2022, 2:30:00 am local daylight time
instead. So the hoursInDay for that day is only 23.5 hours.

Historically, Singapore from 1933 to 1941 moved clocks forward 20 minutes for daylight savings, resulting the day in 24.33333 and
23.66667 hours.

Test covered in https://github.com/tc39/test262/blob/main/test/staging/Temporal/ZonedDateTime/old/dst-properties.js

Change the return type from MaybeHandle<Smi> to MaybeHandle<Object> so
we can return non integer value. Also change the method of division by
first convert the value to second in BigInt, then divid 3600 (number of
seconds in a hour) in double.

Bug: v8:11544
Change-Id: Ia69d2606cd832e51f415a00440fb9cbc236883e4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3901619Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83311}

Refactor the interface between intl and Temporal and pass
the nanosecond in BigInt to intl. Approximate the nanoseconds
to the correct close by millisecond depending on the usage
before calling ICU API and convert the result millisecond into
BigInt in nanosecond before return from intl.

Remove Maybe for function always complete.

Bug: v8:11544
Change-Id: Icc471b80312c513c9415b690804aa624df4a387d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3897165Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83310}

Test was using concurrent sweeper which could lead to the concurrent
sweeper holding onto memory until the allocation succeeded in rare
cases.

Bug: v8:13308
Change-Id: I0f9f93cc503cdc17d6962b3c31bc4ea698b4cb42
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3905183
Auto-Submit: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83309}

This method will be used in the marking visitors to stop marking into
the shared heap from e.g. worker or client heaps.

Bug: v8:13267
Change-Id: I7a099a3f816fa5d867d6a99558838389914e3048
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3904606
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83308}

Make sure both the fast and slow version return the same value in case
of wrong follow-bit values in the input.

Bug: chromium:1359230, chromium:1360735
Change-Id: Ic65f81109e5bbc288fa41a5540ec7e6cece10ffc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3890998
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Samuel Groß <saelo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83307}

Change-Id: I20ea43a62e051599ab7860acd34ba55f6d355ae7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3904426Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/main@{#83306}

This reverts commit d7fcbba8.

Reason for revert: Speculatively reverting because of blocked roll

Original change's description:
> [sandbox] Increase ExternalPointerTable maximum capacity to 512MB
>
> Bug: v8:10391
> Change-Id: I383e11bdccf6fcaf13f29d25e1404545067d313e
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3891249
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Commit-Queue: Samuel Groß <saelo@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#83203}

Bug: v8:10391
Change-Id: Id3a374a1f87a6ec3889d2e81d169ad004744ca99
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3904605
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83305}

Missing deps were causing correctness issues due to missed deopts. In
this CL, we reuse PropertyAccessInfo creation to create appropriate
dependencies.

Bug: v8:7700
Change-Id: Ic6c20df01fa8a36f677aed80791fcea1ccc4b512
Fixed: v8:13289
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3904603Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83304}