…des has a projection-0

Port e56a7ed https://crrev.com/c/2002547
Port e15f5ba https://crrev.com/c/2011829
Port bc436ed https://crrev.com/c/2030731

Original Commit Message:

  The instruction selector assumed for Word32AtomicPair{Load, Binops,
  CompareExchange} nodes that if there exists a Projection(1) user, then
  there also exists a Projection(0) user. This, however, is not the case,
  because TurboFan eliminates unreachable nodes. The missing projection
  node lead to a failed DCHECK in the register allocator.

Bug: v8:10275
Change-Id: I2a0327f4a26375176e633bd75a02a83f3ddd2bfd
No-Try: true
No-Presubmit: true
No-Tree-Checks: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2073207
Reviewed-by: Deepti Gandluri <[email protected]>
Commit-Queue: Deepti Gandluri <[email protected]>
Cr-Commit-Position: refs/branch-heads/8.1@{v8#35}
Cr-Branched-From: a4dcd39-refs/heads/8.1.307@{#1}
Cr-Branched-From: f22c213-refs/heads/master@{#66031}

Bug: chromium:1107661

(cherry picked from commit 3962a0f)
[email protected]

Reviewed-by: Jakob Kummerow <[email protected]>
No-Try: true
No-Presubmit: true
No-Tree-Checks: true
Change-Id: I6c55fb74bc009d2af2ae00e34fee9e1ee709a805
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2330224
Commit-Queue: Frank Tang <[email protected]>
Reviewed-by: Frank Tang <[email protected]>
Cr-Commit-Position: refs/branch-heads/8.5@{v8#35}
Cr-Branched-From: a7f8bc4-refs/heads/8.5.210@{#1}
Cr-Branched-From: dd58472-refs/heads/master@{#68510}

Revision: bc33cc6

NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
[email protected]

Change-Id: I4b0977a82f37e9c76365680dd9526129a037a728
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1870234
Reviewed-by: Michael Achenbach <[email protected]>
Commit-Queue: Michael Achenbach <[email protected]>
Cr-Commit-Position: refs/branch-heads/7.8@{v8#35}
Cr-Branched-From: 73694fd-refs/heads/7.8.279@{#1}
Cr-Branched-From: 2314928-refs/heads/master@{#63555}

Merged: MIPS64: Correct implementation of LLD/SCD instructions in simulator.
Revision: ee8bb5f

Merged: [tests] Skip wasm/atomics64-stress test on pre-r6 MIPS32
Revision: 5bd5863

[email protected]

NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true

Bug: v8:8623
Change-Id: I344303b372134992e8431b9641fd7b032d79395b
Reviewed-on: https://chromium-review.googlesource.com/c/1390126
Reviewed-by: Michael Achenbach <[email protected]>
Cr-Commit-Position: refs/branch-heads/7.2@{v8#35}
Cr-Branched-From: 6acd03c-refs/heads/7.2.502@{#1}
Cr-Branched-From: b03041d-refs/heads/master@{#57910}

…s_prototype_slot

Revision: d62cd2f

BUG=chromium:939316
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
[email protected]

Change-Id: If310872ec2bea421654c75880ecd13083d6abc86
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1547856
Reviewed-by: Georg Neis <[email protected]>
Cr-Commit-Position: refs/branch-heads/7.4@{v8#35}
Cr-Branched-From: 3e8a733-refs/heads/7.4.288@{#1}
Cr-Branched-From: d077f9b-refs/heads/master@{#60039}

Revision: 65079f1

BUG=v8:9894
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
[email protected]

Change-Id: I43d2d3517f14548b3f34789209ad1a13f7047bb9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1898654
Reviewed-by: Georg Neis <[email protected]>
Commit-Queue: Georg Neis <[email protected]>
Cr-Commit-Position: refs/branch-heads/7.9@{v8#35}
Cr-Branched-From: be181e2-refs/heads/7.9.317@{#1}
Cr-Branched-From: 0d7889d-refs/heads/master@{#64307}

This fixes a bug in lazy deopts caused by calls to the callback function
in Array.prototype.reduce and reduceRight.

The deopt continuation expects the *next* iteration's index value but
we actually passed the current iteration's value.

The user-visible effect of this bug was that sometimes, an unexpected
additional call to the callback function would occur.

It was introduced by https://crrev.com/c/1934329.

Tbr: [email protected]
No-Try: true
No-Presubmit: true
No-Treechecks: true
Bug: v8:9972,chromium:1049982
Change-Id: Icfd2ef076209e20602f54d4662220e1d4c5d07ee
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2049851
Reviewed-by: Jakob Gruber <[email protected]>
Commit-Queue: Jakob Gruber <[email protected]>
Cr-Commit-Position: refs/branch-heads/8.0@{v8#35}
Cr-Branched-From: 69827db-refs/heads/8.0.426@{v8#2}
Cr-Branched-From: 2fe1552-refs/heads/master@{#65318}

TBR=v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com

Change-Id: Ie4b14cde3d352471737acd7a7d735ed42171ba29
Reviewed-on: https://chromium-review.googlesource.com/c/1494777
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/7.3@{v8#35}
Cr-Branched-From: 9df9418-refs/heads/7.3.492@{v8#2}
Cr-Branched-From: be213cf-refs/heads/master@{#59024}

TBR=v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I68b6e97813fe5f4df34b33e7f1a99752ecb0e957
Reviewed-on: https://chromium-review.googlesource.com/c/1318095
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/7.1@{v8#35}
Cr-Branched-From: f70aaa8-refs/heads/7.1.302@{#1}
Cr-Branched-From: 1dbcc78-refs/heads/master@{#56462}

TBR=v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com

Change-Id: I152f82cb11849c885f969ce2040898aef009f009
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1683621
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/7.6@{v8#35}
Cr-Branched-From: 2cb2573-refs/heads/7.6.303@{#1}
Cr-Branched-From: 201c509-refs/heads/master@{#61902}

TBR=v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com

Change-Id: I26d319b9cec7c586dc52c06fbfa1993430f1a935
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1617005
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/7.5@{v8#35}
Cr-Branched-From: 35b9bf5-refs/heads/7.5.288@{#1}
Cr-Branched-From: 912b391-refs/heads/master@{#60911}

TBR=v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com

Change-Id: I8307859722e2202b99fb0b5a45b06b21cd7e9c9e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2279024
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/8.4@{v8#35}
Cr-Branched-From: 88ed2e3-refs/heads/8.4.371@{#1}
Cr-Branched-From: 35f88bf-refs/heads/master@{#67773}

TBR=v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com

Change-Id: I30e2fdbf34ec58212701927ad479ae705aa3657c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2853765
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/9.1@{v8#35}
Cr-Branched-From: 0e4ac64-refs/heads/9.1.269@{#1}
Cr-Branched-From: f565e72-refs/heads/master@{#73847}

Change-Id: Ic35138140c0447ed914d9460f081425c8ba8c3c3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3307350
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/9.6@{v8#35}
Cr-Branched-From: 0b7bda0-refs/heads/9.6.180@{#1}
Cr-Branched-From: 41a5a24-refs/heads/main@{#77244}

TBR=v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com

Change-Id: Icacc432e46f8f38ae7dca18175540bad5d4fbd58
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2689678
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/8.8@{v8#35}
Cr-Branched-From: 2dbcdc1-refs/heads/8.8.278@{#1}
Cr-Branched-From: 366d30c-refs/heads/master@{#71094}

On v9.2 we did not have a chached memory start yet, so the patch needed
major adjustments.

This is the original CL description:
We did not handle conflicts between regular register moves and the
cached instance / cached memory start correctly. This could lead to us
overwriting a regular register when restoring the cached instance, which
results in either crashes or miscalculations afterwards.

[email protected]

(cherry picked from commit cb6218c)

Bug: chromium:1217064
No-Try: true
No-Tree-Checks: true
No-Presubmit: true
Change-Id: Iea849950ed1209efdb965ec49e921a0a26513fef
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3024151
Commit-Queue: Clemens Backes <[email protected]>
Reviewed-by: Andreas Haas <[email protected]>
Cr-Commit-Position: refs/branch-heads/9.2@{v8#35}
Cr-Branched-From: 5123834-refs/heads/9.2.230@{#1}
Cr-Branched-From: 587a04f-refs/heads/master@{#74656}

Merged: [test] Update Mac testing from 10.13 to 10.15
Revision: ca18989

Merged: [test] Prepare removing gpu defaults for tester bots
Revision: 5e80ce5

BUG=chromium:1174040
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
[email protected]

Change-Id: If7a969a24685b48a0852538f28aa131dc02628f5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2679691
Reviewed-by: Liviu Rau <[email protected]>
Reviewed-by: Maya Lekova <[email protected]>
Commit-Queue: Michael Achenbach <[email protected]>
Cr-Commit-Position: refs/branch-heads/8.9@{v8#35}
Cr-Branched-From: 16b9bbb-refs/heads/8.9.255@{#1}
Cr-Branched-From: d16a2a6-refs/heads/master@{#72039}

GetWriteBarrierType used to consider the slot so that a barrier is not
triggered for on-stack slots. For strongifying weak collections we want
the write barrier to trigger even if the backing store is only reachable
from stack.

Blink counterpart: crrev.com/c/3162170

(cherry picked from commit ed04597)

Bug: chromium:1248435, chromium:1244057
Change-Id: I75b1ca62ad5de7bae3d2f4c1a9acce839f3ccdc1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3162127
Commit-Queue: Omer Katz <[email protected]>
Reviewed-by: Michael Lippautz <[email protected]>
Cr-Original-Commit-Position: refs/heads/main@{#76872}
No-Try: true
No-Presubmit: true
No-Tree-Checks: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3181531
Cr-Commit-Position: refs/branch-heads/9.4@{v8#35}
Cr-Branched-From: 3b51863-refs/heads/9.4.146@{#1}
Cr-Branched-From: 2890419-refs/heads/master@{#76233}

(cherry picked from commit 17da9e7)

Bug: chromium:1340335, chromium:1315901
Change-Id: I62a90686802f814b3e1f15987f3e42b89a30525b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3755142
Reviewed-by: Thibaud Michaud <[email protected]>
Commit-Queue: Samuel Groß <[email protected]>
Cr-Commit-Position: refs/branch-heads/10.3@{v8#35}
Cr-Branched-From: 1a8f4ca-refs/heads/10.3.174@{#1}
Cr-Branched-From: 8fbefa4-refs/heads/main@{#80471}

TBR=v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com

Change-Id: Ica1b15098000b693fa984b3d3d04b8445e894fb4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3208067
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/9.5@{v8#35}
Cr-Branched-From: 4a03d61-refs/heads/9.5.172@{#1}
Cr-Branched-From: 9a60704-refs/heads/main@{#76741}

Change-Id: I3a1232772e32d8d7e021381fef6caf1f13ec3b7a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3982427
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/10.7@{v8#35}
Cr-Branched-From: 4d2145c-refs/heads/10.7.193@{#1}
Cr-Branched-From: 9521696-refs/heads/main@{#83201}

... on non-JSReceiver objects.

Bug: chromium:1447430
(cherry picked from commit 515f187)

Change-Id: Ib9382d90ce19d6b55ee0b236dd299ded03ade04d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4575069
Reviewed-by: Toon Verwaest <[email protected]>
Commit-Queue: Igor Sheludko <[email protected]>
Cr-Commit-Position: refs/branch-heads/11.4@{v8#35}
Cr-Branched-From: 8a8a1e7-refs/heads/11.4.183@{#1}
Cr-Branched-From: 5483d8e-refs/heads/main@{#87241}

This commit cherry-picks small parts of:
crrev.com/c/4669597
crrev.com/c/4675296
crrev.com/c/4677170
that are suitable for backmerging.

Bug: chromium:1462951
Change-Id: Ic8994753c3bdbf9676701ce3ab8c98ae9700156b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4677663
Auto-Submit: Jakob Kummerow <[email protected]>
Reviewed-by: Manos Koukoutos <[email protected]>
Commit-Queue: Manos Koukoutos <[email protected]>
Cr-Commit-Position: refs/branch-heads/11.5@{v8#35}
Cr-Branched-From: 0c4044b-refs/heads/11.5.150@{#1}
Cr-Branched-From: b71d303-refs/heads/main@{#87781}

Change-Id: I1831a15eb14699cb07553b8591ff2fcbd4a2c789
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4833275
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/11.6@{v8#35}
Cr-Branched-From: e29c028-refs/heads/11.6.189@{v8#3}
Cr-Branched-From: 95cbef2-refs/heads/main@{#88340}

Change-Id: I0ec3712ac02cc5f6f18ee464b3cdb7781efe9840
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4885551
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/11.7@{v8#35}
Cr-Branched-From: fe60869-refs/heads/11.7.439@{#1}
Cr-Branched-From: aeb4552-refs/heads/main@{#89415}

Change-Id: I06a7a343e0e5d0fafb5a2161fd49a22560c6caba
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5049253
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/11.8@{v8#35}
Cr-Branched-From: 935bdbf-refs/heads/11.8.172@{#1}
Cr-Branched-From: b82a911-refs/heads/main@{#89779}

Two things were wrong:

 * CopyingPhase::InlineBlock did not skip Phis whose use-count was
   0. This lead to visiting Phis whose input had been removed from the
   graph.

 * [debug only] Operations with use-count of 0 were not always skipped
   when --turboshaft-opt-bisect was used, which could also lead to
   visiting operations with Invalid inputs.

Bug: v8:12781, chromium:1512481
(cherry picked from commit 9e99707)

Change-Id: Ia21859dee71dc2f08aa203155a47250fa384489e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5148988
Reviewed-by: Leszek Swirski <[email protected]>
Commit-Queue: Darius Mercadier <[email protected]>
Cr-Commit-Position: refs/branch-heads/12.1@{v8#35}
Cr-Branched-From: b74ef6f-refs/heads/12.1.285@{#1}
Cr-Branched-From: 32857fb-refs/heads/main@{#91313}

Change-Id: I84c82b4e49e277c6ada4240be32e914df5092b37
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5207113
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/12.0@{v8#35}
Cr-Branched-From: ed7b4ca-refs/heads/12.0.267@{#1}
Cr-Branched-From: 210e75b-refs/heads/main@{#90651}

Change-Id: Iac46071aefa2c88352d5888fac19f2da46c6897f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5306720
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/12.2@{#35}
Cr-Branched-From: 6eb5a96-refs/heads/12.2.281@{#1}
Cr-Branched-From: 44cf56d-refs/heads/main@{#91934}

Change-Id: I633ea21d679ff4f2436b47277bd1605288eb9291
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5490195
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/12.3@{#35}
Cr-Branched-From: a86e197-refs/heads/12.3.219@{#1}
Cr-Branched-From: 21869f7-refs/heads/main@{#92385}

Change-Id: Ib962f9690a8e759c0a8a9ac5792a4e603a26cf5e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5545222
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/12.4@{#35}
Cr-Branched-From: 309640d-refs/heads/12.4.254@{#1}
Cr-Branched-From: 5dc2470-refs/heads/main@{#92862}

Change-Id: I5bcb119b0304d3424375ff001cc70c70067bcf67
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5636733
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/12.6@{#35}
Cr-Branched-From: 3c9fa12-refs/heads/12.6.228@{#2}
Cr-Branched-From: 981bb15-refs/heads/main@{#93835}

Change-Id: I857fa8ceea625edd8d1bdbf02c4eeb5ac944f1af
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5759395
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/12.7@{#35}
Cr-Branched-From: 35cc908-refs/heads/12.7.224@{#1}
Cr-Branched-From: 6d60e67-refs/heads/main@{#94324}

Change-Id: I1006cd8983d8f709e63d1170232b3bc6c69aacb2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5800592
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/12.8@{#35}
Cr-Branched-From: 70cbb39-refs/heads/12.8.374@{#1}
Cr-Branched-From: 451b63e-refs/heads/main@{#95151}

With JSPI, the stack frame iterator stops at the end of the current
stack segment. Follow the chain of stacks to find all frames marked for
deoptimization.

[email protected]

Fixed: 365376497
(cherry picked from commit 906e41b)

Change-Id: I4e60cfcf83d66a3810caf3ace3ff32ce30728bf2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5860576
Reviewed-by: Matthias Liedtke <[email protected]>
Commit-Queue: Thibaud Michaud <[email protected]>
Cr-Commit-Position: refs/branch-heads/12.9@{#35}
Cr-Branched-From: 64a21d7-refs/heads/12.9.202@{#1}
Cr-Branched-From: da4200b-refs/heads/main@{#95679}

- The default nullexternref should be null instead of undefined
- The default exnref/nullexnref should be null instead of wasm_null

(cherry picked from commit e7ccf0a)

Change-Id: I5b32e80f2eb59b29113232f9e2f59a8803915cb3
Fixed: 372285204,372269618
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5937812
Reviewed-by: Thibaud Michaud <[email protected]>
Auto-Submit: Matthias Liedtke <[email protected]>
Commit-Queue: Thibaud Michaud <[email protected]>
Cr-Commit-Position: refs/branch-heads/13.0@{#35}
Cr-Branched-From: 4be854b-refs/heads/13.0.245@{#1}
Cr-Branched-From: 1f5183f-refs/heads/main@{#96103}

Version incremented at https://cr-buildbucket.appspot.com/build/8728914862685230017

Change-Id: I8f8478a7613f6a43075a0d229799997f5dc4ad53
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6085122
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/13.2@{#35}
Cr-Branched-From: 24068c5-refs/heads/13.2.152@{#1}
Cr-Branched-From: 6054ba9-refs/heads/main@{#97085}

Version incremented at https://cr-buildbucket.appspot.com/build/8728857488865225057

Change-Id: If754bb9f5067a0950647467bf968b4d17c823648
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6087975
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/13.1@{#35}
Cr-Branched-From: 7998da6-refs/heads/13.1.201@{#1}
Cr-Branched-From: 5e9af2a-refs/heads/main@{#96554}

Version incremented at https://cr-buildbucket.appspot.com/build/8724323487869794305

Change-Id: I2ecd0c2afd7f56d048202d7d24d078ce33f92e2d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6217962
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/13.3@{#35}
Cr-Branched-From: 41dacff-refs/heads/13.3.415@{#1}
Cr-Branched-From: 3348638-refs/heads/main@{#97937}

Take into account that TransitionElementsKindOrCheckMap might change the
map of an aliasing object.

h/t dmercadier@ for figuring out the fix.

Bug: 400052777
(cherry picked from commit 8b490a9)

Change-Id: I9b715ffb4e7a8000bbeea0c3b27c3ce59295e2ef
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6333353
Reviewed-by: Darius Mercadier <[email protected]>
Commit-Queue: Marja Hölttä <[email protected]>
Cr-Commit-Position: refs/branch-heads/13.4@{#35}
Cr-Branched-From: 0f87a54-refs/heads/13.4.114@{#1}
Cr-Branched-From: 27af2e9-refs/heads/main@{#98459}

Port commit 6ec2694

(cherry picked from commit 05803c1)

Bug: 424050952
Change-Id: I687e238e54c281ecc441d06913416bcdf3cb11eb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6636821
Reviewed-by: Darius Mercadier <[email protected]>
Commit-Queue: Zhao Jiazhong <[email protected]>
Cr-Commit-Position: refs/branch-heads/13.8@{#35}
Cr-Branched-From: 61ddd47-refs/heads/13.8.258@{#1}
Cr-Branched-From: fdb5de2-refs/heads/main@{#100480}

Version incremented at https://cr-buildbucket.appspot.com/build/8711775995515337505

Change-Id: Ie790c8599ae5b2b88c84e62e6ed0b55e08199c8d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6652451
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/13.7@{#35}
Cr-Branched-From: dd5370d-refs/heads/13.7.152@{#1}
Cr-Branched-From: fa9b753-refs/heads/main@{#99927}

Version incremented at https://cr-buildbucket.appspot.com/build/8707748394870851857

Change-Id: Id0dfa50c1d52b2471f2cb947392f40bb1e7aba7e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6811086
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/13.9@{#35}
Cr-Branched-From: 76ea409-refs/heads/13.9.205@{#1}
Cr-Branched-From: 2824212-refs/heads/main@{#100941}

The regalloc should clear the node allocations when it is done.
Failing to do so can cause the codegen to use stale register state.
In this concrete example the exception handler trampolines would not
load from the spill slot due to the left over allocation.

Bug: 457351015
(cherry picked from commit 7ef5ae5)

Change-Id: Ibf50e9c77f68654abf1b610bc1f37ccd17904c84
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7137280
Reviewed-by: Victor Gomes <[email protected]>
Commit-Queue: Victor Gomes <[email protected]>
Auto-Submit: Olivier Flückiger <[email protected]>
Cr-Commit-Position: refs/branch-heads/14.2@{#35}
Cr-Branched-From: 37f82db-refs/heads/14.2.231@{#1}
Cr-Branched-From: d1a6089-refs/heads/main@{#102804}

Version incremented at https://cr-buildbucket.appspot.com/build/8693128876354767073

Change-Id: I305fb5648d99b742625b35897d6a4a0cc291dc2b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7423918
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/14.4@{#35}
Cr-Branched-From: 80acc26-refs/heads/14.4.258@{#1}
Cr-Branched-From: ce7e597-refs/heads/main@{#104020}

Version incremented at https://cr-buildbucket.appspot.com/build/8692835568880512097

Change-Id: I812f4ecdc41c81fbca71f673f7e9cf7cbd4f6a71
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7454508
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/14.3@{#35}
Cr-Branched-From: 13c7e31-refs/heads/14.3.127@{#1}
Cr-Branched-From: 01af089-refs/heads/main@{#103352}