…ttps://codereview.chromium.org/1136553008/)"

This reverts commit 67b1691.

…set v8#4 id:50001 of https://codereview.chromium.org/1185633002/)

Reason for revert:
Fails the following test

handle-count-ast
handle-count-runtime-...

on V8 Linux - nosnap - debug - 1

http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap%20-%20debug%20-%201/builds/851/steps/Check/logs/stdio

Original issue's description:
> Additional HandleScopes to limit Handle consumption.
>
> [email protected] suggested digging into v8 handle usage. Found potential scopes in ast.cc and runtime-literals.cc and added tests.
>
> The runtime-literals.cc change reduces peak handles in imaging-darkroom.js from 1,282,610 to 428,218. The ast.cc change reduces the peak handles in string-tagcloud.js from 80,738 to 8,176.
>
> No significant handle count issues found with major websites, but substantial savings on some benchmarks and demos:
>
> Kraken's imaging-darkroom.js down from 1,282,610 to 428,218 due to runtime-literals.cc scope.
> SunSpider's string-tagcloud.js down from 80,738 to 8.176 due to ast.cc
>
> http://www.flohofwoe.net/demos/dragons_asmjs.html (738,906 -> 478,296)
> http://www.flohofwoe.net/demos/instancing_asmjs.html (737,884 -> 477,274)
> https://dl.dropboxusercontent.com/u/16662598/Ports/DOSBox-web/doom.html?engine=dosbox-growth.js (1,724,114 -> 1,087,408)
> https://kripken.github.io/ammo.js/examples/new/ammo.html (175,784 -> 142,058)
>
> BUG=
>
> Committed: https://crrev.com/3a4c7538839186aa38910c66c986abb563f4ccd2
> Cr-Commit-Position: refs/heads/master@{#29155}

[email protected],[email protected],[email protected]
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1194873004

Cr-Commit-Position: refs/heads/master@{#29160}

…1 of https://codereview.chromium.org/1207693004/)

Reason for revert:
Breaks arm64 bots.

Original issue's description:
> [android] Migrate more configs to gyp.
>
> BUG=chromium:502176
> LOG=n
>
> Committed: https://crrev.com/174869573e42c999da1489c264b9c4602b98ba31
> Cr-Commit-Position: refs/heads/master@{#29314}

[email protected],[email protected],[email protected],[email protected]
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:502176

Review URL: https://codereview.chromium.org/1211383002

Cr-Commit-Position: refs/heads/master@{#29316}

…tps://codereview.chromium.org/1200833013/)

Reason for revert:
[Sheriff] Breaks mac on the main waterfall (though not on the tryserver):
http://build.chromium.org/p/client.v8/builders/V8%20Mac64/builds/3925

Original issue's description:
> Use third_party clang on Mac.
>
> BUG=
>
> Committed: https://crrev.com/57b20413294940476ab2b2e71ed0802aaf8c223f
> Cr-Commit-Position: refs/heads/master@{#29343}

[email protected],[email protected],[email protected],[email protected],[email protected]
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1217823003

Cr-Commit-Position: refs/heads/master@{#29345}

…ss checks (patchset v8#4 id:80001 of https://codereview.chromium.org/1193633003/)

Reason for revert:
[Sheriff] Breaks gc stress:
http://build.chromium.org/p/client.v8/builders/V8%20GC%20Stress%20-%202/builds/3968

Original issue's description:
> [strong] Add tests for loading from proxy, super, with access checks
>
> Followup for https://codereview.chromium.org/1168093002/
>
> These seem to already function correctly without the need for further runtime
> changes.
>
> There will be a final follow-up for interceptors.
>
> BUG=v8:3956
> LOG=N
>
> Committed: https://crrev.com/ea4e568363f48955e7de6b538e559132e9899c86
> Cr-Commit-Position: refs/heads/master@{#29389}

[email protected],[email protected]
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3956

Review URL: https://codereview.chromium.org/1218123003

Cr-Commit-Position: refs/heads/master@{#29390}

(patchset v8#4 id:60001 of https://codereview.chromium.org/1134333005/)"

This reverts commit 81c080e.
Patchset #1 is the original CL.
Patchset #2 fixes a handlification bug that caused the crash.

[email protected]
BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1143813002

Cr-Commit-Position: refs/heads/master@{#28497}

https://codereview.chromium.org/1222013002/)

Reason for revert:
[Sheriff] Increased flaky crashes. See:
https://code.google.com/p/v8/issues/detail?id=4275

Original issue's description:
> Concurrent sweeping of code space.
>
> BUG=
>
> Committed: https://crrev.com/3050b52f57d652dc45c8baf416e174f22dc2c159
> Cr-Commit-Position: refs/heads/master@{#29456}

[email protected],[email protected]
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1223763003

Cr-Commit-Position: refs/heads/master@{#29475}

…allocation (patchset v8#4 id:60001 of https://codereview.chromium.org/1077153004/)

Reason for revert:
[Sheriff] Speculative revert, see:
https://code.google.com/p/chromium/issues/detail?id=506875

Original issue's description:
> Reland: Fix logic for incremental marking steps on tenured allocation
>
> BUG=
>
> Committed: https://crrev.com/5000650bde2ec0bc90d959b529c97aea20385043
> Cr-Commit-Position: refs/heads/master@{#29442}

[email protected],[email protected]
BUG=chromium:506875
LOG=n
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1212063005

Cr-Commit-Position: refs/heads/master@{#29494}

Merged 0790a8c

Revert of Reland: Fix logic for incremental marking steps on tenured allocation (patchset #4 id:60001 of https://codereview.chromium.org/1077153004/)

BUG=chromium:506875
LOG=N
[email protected]
[email protected]

Review URL: https://codereview.chromium.org/1225783002.

Cr-Commit-Position: refs/heads/4.5.98@{#2}
Cr-Branched-From: 9bb8264-refs/heads/master@{#29475}

…ld (patchset v8#4 id:80001 of https://codereview.chromium.org/1214053004/)

Reason for revert:
[Sheriff] Fails here:
http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20shared/builds/4737

Original issue's description:
> [d8] bounds-check before getting Shell::Worker internal field
>
> Prevents fatal error in debug builds
>
> BUG=v8:4271
> [email protected]
> LOG=N
>
> Committed: https://crrev.com/43ce9c6f101c4224addd9a54e0c39963188dc7fa
> Cr-Commit-Position: refs/heads/master@{#29524}

[email protected],[email protected],[email protected],[email protected]
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4271

Review URL: https://codereview.chromium.org/1215333012

Cr-Commit-Position: refs/heads/master@{#29525}

…b (patchset v8#4 id:60001 of https://codereview.chromium.org/1225943002/)

Reason for revert:
Failure on compiling runtime.js on windows

Original issue's description:
> Add unoptimized/optimized variants of MathFloor TF code stub
>
> - Add a TurboFanIC class, derived from TurboFanCodeStub, that
>   automatically distinguishes between versions of the IC called from
>   optimized and unoptimized code.
> - Add appropriate InterfaceDescriptors for both the versions of the
>   stub called from unoptimized and optimized code
> - Change the MathFloor TF stub generator to output either the
>   for-optimized or for-unoptimized version based on the minor_key
>   parameter.
>
> Committed: https://crrev.com/8f13b655b8a10dae2116dd18b32f09337bb2d410
> Cr-Commit-Position: refs/heads/master@{#29534}

[email protected],[email protected]
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1220783006

Cr-Commit-Position: refs/heads/master@{#29535}

Merged a5616e5

Disable the pending task if the memory reducer is torn down.

BUG=chromium:508584
LOG=N
[email protected]

Review URL: https://codereview.chromium.org/1235543005 .

Cr-Commit-Position: refs/branch-heads/4.5@{#4}
Cr-Branched-From: 7f21153-refs/heads/4.5.103@{#1}
Cr-Branched-From: 4b38c15-refs/heads/master@{#29527}

…ps://codereview.chromium.org/1303263002/ )

Reason for revert:
Several tests on V8 Linux64 TSAN bot are broken, due to data races between allocation & GC.

A bisect points to this CL, and the CL description sounds pertinent to the observed breakage.

Original issue's description:
> Concurrently unmap free pages.
>
> BUG=
>
> Committed: https://crrev.com/d1aeb45d96123d47023066b244c0f450fbe57d2d
> Cr-Commit-Position: refs/heads/master@{#30306}

[email protected],[email protected]
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1306213002

Cr-Commit-Position: refs/heads/master@{#30310}

Merged c75af23

Unship arrow functions

BUG=v8:4211
LOG=N
[email protected]

Review URL: https://codereview.chromium.org/1303423003 .

Cr-Commit-Position: refs/branch-heads/4.6@{#4}
Cr-Branched-From: 24d34a8-refs/heads/4.6.85@{#1}
Cr-Branched-From: 8f44118-refs/heads/master@{#30256}

Merged 39491c5

Restore NothingOrDone action in idle time handler.

BUG=chromium:460090,chromium:489323
LOG=N
[email protected]

Review URL: https://codereview.chromium.org/1153043002

Cr-Commit-Position: refs/branch-heads/4.4@{#4}
Cr-Branched-From: 2e4c550-refs/heads/4.4.63@{#1}
Cr-Branched-From: 0208b8e-refs/heads/master@{#28333}

BUG=none
LOG=n
[email protected], [email protected]

Review URL: https://codereview.chromium.org/1070653003

Cr-Commit-Position: refs/branch-heads/4.3@{#4}
Cr-Branched-From: f5c0a23-refs/heads/4.3.61@{#1}
Cr-Branched-From: 0a7d4f4-refs/heads/master@{#27508}

Merged cd87f25
Merged 47913ba

X87: Stop using HeapType in IC and Crankshaft.

Add the dummy implementation for turbofan unsupported port.

[email protected],[email protected]
BUG=

Review URL: https://codereview.chromium.org/979763002

Cr-Commit-Position: refs/branch-heads/4.2@{#4}
Cr-Branched-From: 3dfd929-refs/heads/4.2.77@{#2}
Cr-Branched-From: e011092-refs/heads/master@{#26757}

…hset v8#4 id:60001 of https://codereview.chromium.org/1340923004/ )

Reason for revert:
crashing: http://build.chromium.org/p/client.v8/builders/V8%20Win32%20-%20debug%20-%203/builds/4716

Original issue's description:
> [heap] Concurrency support for heap book-keeping info.
>
> Adds concurrency support for:
> - MemoryChunk: Fragmentation counters
> - MemoryChunk: High-water mark
> - MemoryAllocator: Lowest and highest ever allocated addresses, size, and
>   capacity
>
> [email protected]
> BUG=chromium:524425
> LOG=N
>
> Committed: https://crrev.com/63190721cda4966e01d71e92a730ce48ea789fbc
> Cr-Commit-Position: refs/heads/master@{#30749}

[email protected]
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:524425

Review URL: https://codereview.chromium.org/1340323002

Cr-Commit-Position: refs/heads/master@{#30752}

…set v8#4 id:60001 of https://codereview.chromium.org/1347353003/ )

Reason for revert:
[Sheriff] Breaks mips cross-compile:
http://build.chromium.org/p/client.v8/builders/V8%20Mips%20-%20builder/builds/4315

Original issue's description:
> [turbofan] Checking of input counts on node creation
>
> This required fixing bunch of tests with wrong input counts.
>
> Committed: https://crrev.com/260ec46efd74c45cdc4b156d95086b7de06621ad
> Cr-Commit-Position: refs/heads/master@{#30877}

[email protected],[email protected],[email protected]
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1362783004

Cr-Commit-Position: refs/heads/master@{#30878}

 id:100001 of https://codereview.chromium.org/1365743003/ )

Reason for revert:
failing again: https://chromegw.corp.google.com/i/client.v8/builders/V8%20Mac/builds/4505/steps/Mozilla%20%28flakes%29/logs/regress-416628

Original issue's description:
> Reland of "[heap] Add more tasks for parallel compaction"
>
> - We now compute the number of parallel compaction tasks, depending on the
>   evacuation candidate list, the number of cores, and some hard limit.
> - Free memory is moved over to compaction tasks (up to some limit)
> - Moving over memory is done by dividing the free list of a given space up among
>   other free lists. Since this is potentially slow we limit the maximum amount
>   of moved memory.
>
> This reverts commit bfccd51.
>
> BUG=chromium:524425
> LOG=N
>
> Committed: https://crrev.com/7e283d746a194ceaaca114e2ba17504653d6a109
> Cr-Commit-Position: refs/heads/master@{#30945}

[email protected]
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:524425

Review URL: https://codereview.chromium.org/1371653002

Cr-Commit-Position: refs/heads/master@{#30947}

LOG=N
[email protected]
NOTRY=true
NOPRESUBMIT=true

Review URL: https://codereview.chromium.org/1378573003 .

Cr-Commit-Position: refs/branch-heads/4.7@{#4}
Cr-Branched-From: f3c8926-refs/heads/master@{#31014}

... on non-JSReceiver objects.

Bug: chromium:1447430
(cherry picked from commit 515f187)

Change-Id: Ib260f028eece91135860d09871ee769b834cd53e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4575070
Reviewed-by: Toon Verwaest <[email protected]>
Commit-Queue: Igor Sheludko <[email protected]>
Cr-Commit-Position: refs/branch-heads/11.5@{v8#4}
Cr-Branched-From: 0c4044b-refs/heads/11.5.150@{#1}
Cr-Branched-From: b71d303-refs/heads/main@{#87781}

Revision: 9e02af1

BUG=v8:7700
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
[email protected]

Change-Id: I28ccf32025a6cce2d940d899d3de6980f1bc2d85
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4633197
Reviewed-by: Igor Sheludko <[email protected]>
Commit-Queue: Igor Sheludko <[email protected]>
Auto-Submit: Leszek Swirski <[email protected]>
Cr-Commit-Position: refs/branch-heads/11.6@{v8#4}
Cr-Branched-From: e29c028-refs/heads/11.6.189@{v8#3}
Cr-Branched-From: 95cbef2-refs/heads/main@{#88340}

Issues:
* The top frame can be a non-jsframe now
* non-js builtin continuations are non-js frames

Also, add a verification in the translation array builder.

(cherry picked from commit d7548f2)

Bug: chromium:1471511
Change-Id: Ib271a2b46068c6b40a2c49a68c1c4449b93fb468
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4774624
Auto-Submit: Olivier Flückiger <[email protected]>
Reviewed-by: Lutz Vahl <[email protected]>
Commit-Queue: Lutz Vahl <[email protected]>
Bot-Commit: Rubber Stamper <[email protected]>
Reviewed-by: Camillo Bruni <[email protected]>
Cr-Commit-Position: refs/branch-heads/11.7@{v8#4}
Cr-Branched-From: fe60869-refs/heads/11.7.439@{#1}
Cr-Branched-From: aeb4552-refs/heads/main@{#89415}

…ation

Fixed: chromium:1478556
(cherry picked from commit 8c8de41)

Change-Id: Iff8ab405cbffabf0618dc3871b1d7d5584c7c201
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4856799
Commit-Queue: Matthias Liedtke <[email protected]>
Reviewed-by: Matthias Liedtke <[email protected]>
Auto-Submit: Jakob Kummerow <[email protected]>
Cr-Commit-Position: refs/branch-heads/11.8@{v8#4}
Cr-Branched-From: 935bdbf-refs/heads/11.8.172@{#1}
Cr-Branched-From: b82a911-refs/heads/main@{#89779}

…input

All inputs into struct.get should have been typed either during graph
building or from the wasm-typer.cc.
All untyped input should only be the jsgraph()->Dead() node.
There are a few crashes in the wild with struct.get and an input node
typed "None".

Bug: chromium:1507106
(cherry picked from commit 66b4d8d)

Change-Id: Id0ba1dd891756c765cf730ccd5f39f8f12f2530b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5097210
Auto-Submit: Matthias Liedtke <[email protected]>
Commit-Queue: Jakob Kummerow <[email protected]>
Reviewed-by: Jakob Kummerow <[email protected]>
Cr-Commit-Position: refs/branch-heads/12.1@{v8#4}
Cr-Branched-From: b74ef6f-refs/heads/12.1.285@{#1}
Cr-Branched-From: 32857fb-refs/heads/main@{#91313}

Protected instructions do not emit a safepoint, except in debug code.
Hence we should not use a previously defined safepoint which might have
tagged spill slots which are not valid any more at the protected
instruction.

[email protected]

(cherry picked from commit 955d197)

Bug: 325866363
Change-Id: Ic261203cec4139400e3b8540db6e746961109f3e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5317577
Commit-Queue: Clemens Backes <[email protected]>
Reviewed-by: Andreas Haas <[email protected]>
Cr-Commit-Position: refs/branch-heads/12.3@{#4}
Cr-Branched-From: a86e197-refs/heads/12.3.219@{#1}
Cr-Branched-From: 21869f7-refs/heads/main@{#92385}

This reverts commit ebf059d.

Reason for revert: 328812070

Original change's description:
> [maglev] Enable escape analysis
>
> Bug: 326091155
> Change-Id: I876e0ff6f0f264f58a9bd849c9e25f8a464aad27
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5366029
> Commit-Queue: Patrick Thier <[email protected]>
> Auto-Submit: Victor Gomes <[email protected]>
> Commit-Queue: Victor Gomes <[email protected]>
> Reviewed-by: Patrick Thier <[email protected]>
> Cr-Commit-Position: refs/heads/main@{#92809}

Bug: 326091155
(cherry picked from commit 6e89395)

Change-Id: I4e0af32590c8b348167c8079fd14db0faa23e592
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5374340
Commit-Queue: Leszek Swirski <[email protected]>
Auto-Submit: Victor Gomes <[email protected]>
Reviewed-by: Leszek Swirski <[email protected]>
Cr-Commit-Position: refs/branch-heads/12.4@{#4}
Cr-Branched-From: 309640d-refs/heads/12.4.254@{#1}
Cr-Branched-From: 5dc2470-refs/heads/main@{#92862}

In the configuration with shared/trusted space we may have slots in the
remembered set pointing to the pages in those spaces. The CL postpones
freeing of these pages after evacuation.

(cherry picked from commit 234cebd)

Bug: chromium:1520445
Change-Id: I1523521d2a116c5ce5e71a448e4aa3d5954768fe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5227861
Reviewed-by: Michael Lippautz <[email protected]>
Commit-Queue: Anton Bikineev <[email protected]>
Cr-Original-Commit-Position: refs/heads/main@{#91954}
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5233524
Cr-Commit-Position: refs/branch-heads/12.2@{v8#4}
Cr-Branched-From: 6eb5a96-refs/heads/12.2.281@{#1}
Cr-Branched-From: 44cf56d-refs/heads/main@{#91934}

There is currently an issue where detaching an ArrayBuffer's extension
can interfere with table compaction and the zapping mechanism of managed
external resources. This CL temporarily disables the managed external
resource mechanism for ArrayBufferExtensions until the best approach for
fixing the issue has been determined.

(cherry picked from commit e9dbc07)

Bug: chromium:333493383
Change-Id: I876887429cb35a1e2a577493f4e0bc234b08d0e7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5471668
Commit-Queue: Samuel Groß <[email protected]>
Reviewed-by: Michael Lippautz <[email protected]>
Cr-Commit-Position: refs/branch-heads/12.5@{#4}
Cr-Branched-From: 15b9756-refs/heads/12.5.227@{#1}
Cr-Branched-From: 497d857-refs/heads/main@{#93350}

DependOnInitialMapInstanceSizePrediction uses the default initial
map for the array_function to calculate the slack size.

Later we update the initial map depending on the elements kind.
We assume that the slack calculated by this updated initial map
is the same.

So in the CL we add a check in CapturedObject::set to be sure
we don't overflow the CapturedObject.

Drive-by: We refactor ReduceArrayConstructor to make the
initial map logic more explicit.

Fixed: 339517309
(cherry picked from commit 6615a7a)

and Merged: [maglev] Fix regression when refactoring ReduceArrayConstructor
(cherry picked from commit 21fd4aa)

Change-Id: I3d21279d974b80eb2557dbcc129e79cbb1526ec9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5538404
Auto-Submit: Victor Gomes <[email protected]>
Reviewed-by: Olivier Flückiger <[email protected]>
Commit-Queue: Olivier Flückiger <[email protected]>
Cr-Commit-Position: refs/branch-heads/12.6@{#4}
Cr-Branched-From: 3c9fa12-refs/heads/12.6.228@{#2}
Cr-Branched-From: 981bb15-refs/heads/main@{#93835}

This is a reland of commit 86bc438

Fix: we don't have a map for the rest parameter, so we only
allow to forward the arguments object if the map is a JSArray
and elements array is ArgumentsElements.

Original change's description:
> [maglev] Fix VirtualObject refactoring
>
> - VirtualObject::slot_count does not include the Map. We need to add +1
> when the map count should be included.
>
> - We forgot to patch the nested allocations back to the object
> graph.
>
> Fixed: 346042378

(cherry picked from commit fe1e217)

Change-Id: Ic5178efd9a1f37f633d8f9bc1cd7faaa173f0589
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5626016
Commit-Queue: Leszek Swirski <[email protected]>
Auto-Submit: Victor Gomes <[email protected]>
Reviewed-by: Leszek Swirski <[email protected]>
Cr-Commit-Position: refs/branch-heads/12.7@{#4}
Cr-Branched-From: 35cc908-refs/heads/12.7.224@{#1}
Cr-Branched-From: 6d60e67-refs/heads/main@{#94324}

https://crrev.com/c/5715959 has introduced  F16 memory instructions
on liftoff, as a result we need to add support for I16 load/stores
on liftoff to avoid any endianness problems.

Bug: 337998764
(cherry picked from commit f21e26e)

Change-Id: Icb816142cefe1db040cbed18fd80673431ae6d92
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5734360
Auto-Submit: Milad Farazmand <[email protected]>
Reviewed-by: Jakob Kummerow <[email protected]>
Commit-Queue: Jakob Kummerow <[email protected]>
Cr-Commit-Position: refs/branch-heads/12.8@{#4}
Cr-Branched-From: 70cbb39-refs/heads/12.8.374@{#1}
Cr-Branched-From: 451b63e-refs/heads/main@{#95151}

on speculative inlining.
A similar issue exists for return_call_indirect which is going to be
addressed as part of https://crbug.com/360052650.

(cherry picked from commit 782d7f5)

Change-Id: Ib7fa4b4105c4053dc7869ba91fafcd39c8493ddf
Fixed: 360044696
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5803642
Commit-Queue: Matthias Liedtke <[email protected]>
Reviewed-by: Daniel Lehmann <[email protected]>
Commit-Queue: Daniel Lehmann <[email protected]>
Auto-Submit: Matthias Liedtke <[email protected]>
Cr-Commit-Position: refs/branch-heads/12.9@{#4}
Cr-Branched-From: 64a21d7-refs/heads/12.9.202@{#1}
Cr-Branched-From: da4200b-refs/heads/main@{#95679}

This reverts commit 0654522.

Reason for revert: crbug.com/366381662

Original change's description:
> [maglev] Enable object tracking
>
> Bug: v8:7700
> Change-Id: I3ae73b0ae19e3fc5b3d1205c6cdfac24505e517b
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5803785
> Commit-Queue: Leszek Swirski <[email protected]>
> Auto-Submit: Victor Gomes <[email protected]>
> Reviewed-by: Leszek Swirski <[email protected]>
> Cr-Commit-Position: refs/heads/main@{#95758}

(cherry picked from commit e5a048d)

Bug: v8:7700, 366381662
Change-Id: I910f1746b858a258e80bd99dd44b18e3b9a62c49
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5872499
Auto-Submit: Leszek Swirski <[email protected]>
Reviewed-by: Patrick Thier <[email protected]>
Commit-Queue: Patrick Thier <[email protected]>
Cr-Commit-Position: refs/branch-heads/13.0@{#4}
Cr-Branched-From: 4be854b-refs/heads/13.0.245@{#1}
Cr-Branched-From: 1f5183f-refs/heads/main@{#96103}

This bug was introduced by https://crrev.com/c/5886727, which adds a
cache for global ATOM match calls. We only insert sliced string
subjects into the cache, but they may turn into other shapes during
gc or internalization.

In this case, clear the cache and return early.

(cherry picked from commit 994b762)

Fixed: 372819446
No-Try: true
No-Presubmit: true
No-Treechecks: true
Change-Id: Ifadd38e017c05952d899130c1ceae979e704c300
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5934880
Auto-Submit: Jakob Linke <[email protected]>
Reviewed-by: Patrick Thier <[email protected]>
Commit-Queue: Patrick Thier <[email protected]>
Cr-Original-Commit-Position: refs/heads/main@{#96622}
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5952843
Cr-Commit-Position: refs/branch-heads/13.1@{#4}
Cr-Branched-From: 7998da6-refs/heads/13.1.201@{#1}
Cr-Branched-From: 5e9af2a-refs/heads/main@{#96554}

... for constants `let` in script context slots.

Otherwise, we would need to support comparing the loaded string with
a non-internalized one.

Fixed: 377736134

(cherry picked from commit 1a785aa)

Change-Id: Idc401525e26bb6bef3a10614c1c23c44c1e33942
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6020656
Auto-Submit: Victor Gomes <[email protected]>
Commit-Queue: Toon Verwaest <[email protected]>
Reviewed-by: Toon Verwaest <[email protected]>
Cr-Commit-Position: refs/branch-heads/13.2@{#4}
Cr-Branched-From: 24068c5-refs/heads/13.2.152@{#1}
Cr-Branched-From: 6054ba9-refs/heads/main@{#97085}

Add the WasmTrapHandlerThrowTrap builtin to the list of wasm builtins to
ensure that it switches to the central stack before calling the
corresponding runtime function.

[email protected]

Bug: 385167053
(cherry picked from commit 91acb7e)

Change-Id: I33c663beaab7a7fcb505ac5173d8759eacff2e90
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6158067
Reviewed-by: Daniel Lehmann <[email protected]>
Commit-Queue: Thibaud Michaud <[email protected]>
Cr-Commit-Position: refs/branch-heads/13.3@{#4}
Cr-Branched-From: 41dacff-refs/heads/13.3.415@{#1}
Cr-Branched-From: 3348638-refs/heads/main@{#97937}

Fixed: 393408781

(cherry picked from commit e290e08)

Change-Id: Ib10a792df89ac7836697f47fd06ff8de0fbb25f7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6225242
Auto-Submit: Victor Gomes <[email protected]>
Commit-Queue: Victor Gomes <[email protected]>
Reviewed-by: Jakob Kummerow <[email protected]>
Cr-Commit-Position: refs/branch-heads/13.4@{#4}
Cr-Branched-From: 0f87a54-refs/heads/13.4.114@{#1}
Cr-Branched-From: 27af2e9-refs/heads/main@{#98459}

Somewhat unintuitively, string equality comparisons can allocate:
non-flat strings are flattened on demand to simplify and speed up
the following comparison(s). That causes trouble when the involved
builtins call each other in such a way that the CEntryStub's frame
ends up sitting directly on top of a Wasm frame: in case of GC,
neither of them will scan the parameters located between them.
The best long-term fix for this will be Conservative Stack Scanning.
As a short-term mitigation, this patch creates explicit handles in
Runtime_StringEqual.

(cherry picked from commit 7ac8987)

Fixed: 400486361
Fixed: 400920812
Change-Id: I1ebb29342824eedcbe649a9ffd99e87f3258596f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6333171
Commit-Queue: Jakob Kummerow <[email protected]>
Commit-Queue: Nikolaos Papaspyrou <[email protected]>
Auto-Submit: Jakob Kummerow <[email protected]>
Reviewed-by: Nikolaos Papaspyrou <[email protected]>
Cr-Commit-Position: refs/branch-heads/13.5@{#4}
Cr-Branched-From: c206c46-refs/heads/13.5.212@{#1}
Cr-Branched-From: af3cadc-refs/heads/main@{#99020}

... in case of scope reuse failure.

Bug: 401059828
(cherry picked from commit 2ff8d15)

Change-Id: I8190a1c3bd1d4f62b3ce89313afbbaf0534a76b5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6433730
Reviewed-by: Toon Verwaest <[email protected]>
Commit-Queue: Igor Sheludko <[email protected]>
Cr-Commit-Position: refs/branch-heads/13.6@{#4}
Cr-Branched-From: 04fa9cb-refs/heads/13.6.233@{#1}
Cr-Branched-From: f6be482-refs/heads/main@{#99571}

…ible

This CL adds v8::ObjectTemplate::SealAndPrepareForPromotionToReadOnly()
which is supposed to be called by embedder when the object template
is ready and is not going to be modified.

Additionally, support 3-way promo decisions for promotion to read only
space. The third mode "match host" is supposed to indicate that
decision depends on the outer object. This is useful for types such as
ArrayList or JSExternalObject (AKA v8::External), when it's impossible
to make a promo decision by looking just at object without knowing how
it's used.

Bug: 399393891
Bug: 413385733
Fixed: 414748115

(cherry picked from commit fc8f96d)

Change-Id: I5c31272a81e25841e602869776e793897f887c46
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6507403
Reviewed-by: Leszek Swirski <[email protected]>
Commit-Queue: Igor Sheludko <[email protected]>
Cr-Commit-Position: refs/branch-heads/13.7@{#4}
Cr-Branched-From: dd5370d-refs/heads/13.7.152@{#1}
Cr-Branched-From: fa9b753-refs/heads/main@{#99927}

Bug: 420636529
(cherry picked from commit 7bc0a67)

Change-Id: If7bf1a55a0ee814c85ae943acd264fe41fd1d5c9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6594911
Reviewed-by: Deepti Gandluri <[email protected]>
Auto-Submit: Shu-yu Guo <[email protected]>
Commit-Queue: Shu-yu Guo <[email protected]>
Cr-Commit-Position: refs/branch-heads/13.8@{#4}
Cr-Branched-From: 61ddd47-refs/heads/13.8.258@{#1}
Cr-Branched-From: fdb5de2-refs/heads/main@{#100480}

…nation"

This reverts commit 8efa07e.

Reason for revert: Temporarily to get more bake time.

Original change's description:
> Merged: [turbofan] Weaken alias analysis in store-store elimination
>
> Bug: 420636529
> (cherry picked from commit 7bc0a67)
>
> Change-Id: If7bf1a55a0ee814c85ae943acd264fe41fd1d5c9
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6594911
> Reviewed-by: Deepti Gandluri <[email protected]>
> Auto-Submit: Shu-yu Guo <[email protected]>
> Commit-Queue: Shu-yu Guo <[email protected]>
> Cr-Commit-Position: refs/branch-heads/13.8@{#4}
> Cr-Branched-From: 61ddd47-refs/heads/13.8.258@{#1}
> Cr-Branched-From: fdb5de2-refs/heads/main@{#100480}

Bug: 420636529
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Change-Id: I00c5583e61e30ead3a993e8fa9ee7d1226f6a849
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6594913
Bot-Commit: Rubber Stamper <[email protected]>
Commit-Queue: Shu-yu Guo <[email protected]>
Cr-Commit-Position: refs/branch-heads/13.8@{#6}
Cr-Branched-From: 61ddd47-refs/heads/13.8.258@{#1}
Cr-Branched-From: fdb5de2-refs/heads/main@{#100480}

Bug: 427663123
(cherry picked from commit 22e9d96)

Change-Id: Id78d84f018ae1ddcae6237ce895744e4830cf0f2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6678712
Reviewed-by: Deepti Gandluri <[email protected]>
Commit-Queue: Stephen Röttger <[email protected]>
Cr-Commit-Position: refs/branch-heads/13.9@{#4}
Cr-Branched-From: 76ea409-refs/heads/13.9.205@{#1}
Cr-Branched-From: 2824212-refs/heads/main@{#100941}

Bug: 436623746
(cherry picked from commit 19c0bf4)

Change-Id: Ia95442dca758a6bfecdbecbb14bbcad926cdc5f8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6850493
Commit-Queue: Igor Sheludko <[email protected]>
Reviewed-by: Matthias Liedtke <[email protected]>
Auto-Submit: Igor Sheludko <[email protected]>
Commit-Queue: Matthias Liedtke <[email protected]>
Cr-Commit-Position: refs/branch-heads/14.0@{#4}
Cr-Branched-From: 4ec2f43-refs/heads/14.0.365@{#1}
Cr-Branched-From: a88b570-refs/heads/main@{#101731}

Fixed: 441668149

(cherry picked from commit 24ae366)

Change-Id: Id4fe1d636c2fd68d69dca70623a39b92977a1e8a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6945497
Auto-Submit: Victor Gomes <[email protected]>
Commit-Queue: Leszek Swirski <[email protected]>
Reviewed-by: Leszek Swirski <[email protected]>
Cr-Commit-Position: refs/branch-heads/14.1@{#4}
Cr-Branched-From: 1f4839b-refs/heads/14.1.146@{#1}
Cr-Branched-From: cd6944c-refs/heads/main@{#102149}

Bug: 447658917
(cherry picked from commit 10f09c4)

Change-Id: I8f2d19049505fd5d2718d3930332feb771caf8d3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7002871
Auto-Submit: Darius Mercadier <[email protected]>
Commit-Queue: Leszek Swirski <[email protected]>
Reviewed-by: Leszek Swirski <[email protected]>
Cr-Commit-Position: refs/branch-heads/14.2@{#4}
Cr-Branched-From: 37f82db-refs/heads/14.2.231@{#1}
Cr-Branched-From: d1a6089-refs/heads/main@{#102804}

This fixes an issues introduced in
https://chromium-review.googlesource.com/c/v8/v8/+/7079806.

The intent was to call GetSmiValue for nodes with NodeType::kSmi.
However, due to the use of NodeTypeIs, the logic was also applied for
NodeType::kNone.  Use `type == NodeType::kSmi` instead.

(cherry picked from commit 27d43a6)

Bug: 454945068
Change-Id: I2a7f3cffa034868d92bb3992b97bd19c11c4ca1c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7086087
Auto-Submit: Jakob Linke <[email protected]>
Reviewed-by: Victor Gomes <[email protected]>
Commit-Queue: Jakob Linke <[email protected]>
Cr-Original-Commit-Position: refs/heads/main@{#103355}
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7100239
Commit-Queue: Rubber Stamper <[email protected]>
Bot-Commit: Rubber Stamper <[email protected]>
Cr-Commit-Position: refs/branch-heads/14.3@{#4}
Cr-Branched-From: 13c7e31-refs/heads/14.3.127@{#1}
Cr-Branched-From: 01af089-refs/heads/main@{#103352}

Original change's description:
> [maglev] Don't check if loop phi inputs are the hole
> 
> ... since 2 phis can be the input of each other and
> the method would loop forever.
> 
> Fixed: 464597454
> Change-Id: Ic92d078e7434f64976ecb794332c9314cbfe755e
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7206029
> Reviewed-by: Marja Hölttä <[email protected]>
> Commit-Queue: Marja Hölttä <[email protected]>
> Auto-Submit: Victor Gomes <[email protected]>
> Commit-Queue: Victor Gomes <[email protected]>
> Cr-Commit-Position: refs/heads/main@{#104024}

(cherry picked from commit 53c7997)

Bug: 465390735,464597454
Change-Id: Ic92d078e7434f64976ecb794332c9314cbfe755e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7216569
Commit-Queue: Rubber Stamper <[email protected]>
Bot-Commit: Rubber Stamper <[email protected]>
Auto-Submit: Chrome Cherry Picker <chrome-cherry-picker@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/14.4@{#4}
Cr-Branched-From: 80acc26-refs/heads/14.4.258@{#1}
Cr-Branched-From: ce7e597-refs/heads/main@{#104020}

Fixed: 474458890

(cherry picked from commit 4000d62)

Change-Id: Ie524e40e2aaa42bab7c477dbda3daf7cc6b77ff4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7482749
Auto-Submit: Victor Gomes <[email protected]>
Commit-Queue: Toon Verwaest <[email protected]>
Reviewed-by: Toon Verwaest <[email protected]>
Cr-Commit-Position: refs/branch-heads/14.5@{#4}
Cr-Branched-From: f09d67c-refs/heads/14.5.201@{#2}
Cr-Branched-From: 3f00643-refs/heads/main@{#104623}