… id:1 of https://codereview.chromium.org/1483003002/ )

Reason for revert:
Suspect for crashing found, relanding for canary coverage.

Original issue's description:
> Revert of Introduce instance type for transition arrays. (patchset v8#6 id:100001 of https://codereview.chromium.org/1480873003/ )
>
> Reason for revert:
> Broken canary. Trying to find out root cause.
>
> Original issue's description:
> > Introduce instance type for transition arrays.
> >
> > The motivation is to allow specialized marking visitor for transition arrays and collect all transition array in a list for post-processing in ClearNonLiveReferences.
> >
> > BUG=chromium:554488
> > LOG=NO
> >
> > Committed: https://crrev.com/026095a3c7932573e1810b8064ec3008ed696601
> > Cr-Commit-Position: refs/heads/master@{#32396}
>
> [email protected],[email protected],[email protected]
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=chromium:554488
>
> Committed: https://crrev.com/38bf70b9cd2a07b99ac0c0b7eda111849e79c146
> Cr-Commit-Position: refs/heads/master@{#32404}

[email protected],[email protected],[email protected]
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:554488

Review URL: https://codereview.chromium.org/1500623002

Cr-Commit-Position: refs/heads/master@{#32561}

v8#6 id:140001 of https://codereview.chromium.org/1511933002/ )

Reason for revert:
Failing on Win 32bit nosnap:
  https://chromegw.corp.google.com/i/client.v8/builders/V8%20Win32%20-%20nosnap%20-%20shared/builds/10602

Original issue's description:
> [cctest] Add tests for aborting compaction of pages
>
> Tests for
> * aborting a full page.
> * partially aborting a page.
> * partially aborting a page with pointers between aborted pages.
> * partially aborting a page with store buffer entries.
>
> Also introduces force_oom() which prohibits a old space to
> expand
>
> BUG=chromium:524425
> LOG=N

[email protected],[email protected]
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:524425

Review URL: https://codereview.chromium.org/1514603008

Cr-Commit-Position: refs/heads/master@{#32785}

…100001 of https://codereview.chromium.org/1530293004/ )

Reason for revert:
needs --allow-natives-syntax

Original issue's description:
> [proxies] Better print for proxies in d8
>
> Function proxies would not be printed so far since they ended up in Function.prototype.toString which only works with Function as a receiver but no Proxy. Additionally added support for more gracefully dealing with recursive __proto__ structures introduced by proxies.
>
> BUG=v8:1543
> LOG=n
>
> Committed: https://crrev.com/8bfb7189a3472bc9d0820a1bd4534eaaf78ff847
> Cr-Commit-Position: refs/heads/master@{#32985}

[email protected],[email protected]
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:1543

Review URL: https://codereview.chromium.org/1543803002

Cr-Commit-Position: refs/heads/master@{#33001}

…v8#6 id:120001 of https://codereview.chromium.org/1645573002/ )

Reason for revert:
[Sheriff] Breaks layout tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/4222

Original issue's description:
> [regexp] restrict pattern syntax for unicode mode.
>
> ES2015 Annex B.1.4 specifies a restricted pattern language for unicode
> mode. This change reflects that, based on some test262 test cases.
>
> [email protected]
> BUG=v8:2952
> LOG=N
>
> Committed: https://crrev.com/e918c4ec464456a374098049ca22eac2107f6223
> Cr-Commit-Position: refs/heads/master@{#33584}

[email protected],[email protected]
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:2952

Review URL: https://codereview.chromium.org/1648673002

Cr-Commit-Position: refs/heads/master@{#33588}

…patchset v8#6 id:100001 of https://codereview.chromium.org/1637753004/ )

Reason for revert:
[Sheriff] Breaks gc stress:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20gc%20stress/builds/1642

Original issue's description:
> [es7] refactor and fix Object.values() / Object.entries()
>
> Previously, Object.values() and Object.entries() were piggy-backing on
> Object.keys(). This meant that they would pre-filter non-enumerable properties,
> violating the runtime behaviour of the methods. Unfortunately, this does not
> match the current proposal text.
>
> Also incorporates several tests verifying this behaviour based on tests included
> in the ChakraCore implementation.
>
> BUG=v8:4663
> LOG=N
> [email protected], [email protected], [email protected]
>
> Committed: https://crrev.com/5c5ccd9d7f8693990d1a9eb26ba3a94f376dcf0b
> Cr-Commit-Position: refs/heads/master@{#33782}

[email protected],[email protected],[email protected],[email protected],[email protected]
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4663

Review URL: https://codereview.chromium.org/1675663002

Cr-Commit-Position: refs/heads/master@{#33787}

Still to do:

- Refactor RewriteNonPattern, it does not need the expression.
- Thing again about v8#4 of the design-doc, probably enforce that
  rewritable things are indeed RewriteExpressions.
- Think about RewriteNonPatternObjectLiteralProperty.
- v8#6 from design-doc.

…id:100001 of https://codereview.chromium.org/1746063003/ )

Reason for revert:
[Sheriff] Seems to break chromium win compile:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Win/builds/3800/steps/compile/logs/stdio

Original issue's description:
> [wasm] Add support for 64-bit LEB encodings.
>
> [email protected],[email protected]
> BUG=
>
> Committed: https://crrev.com/616f05496e9867cfa934098a76826cfde7feeaa2
> Cr-Commit-Position: refs/heads/master@{#34406}

[email protected],[email protected],[email protected]
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1749343002

Cr-Commit-Position: refs/heads/master@{#34407}

…ttps://codereview.chromium.org/1741893003/ )

Reason for revert:
[Sheriff] Speculative. Seems to break a bunch of webkit tests and causes timeouts:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/5103

Please rebase upstream if intended.

Original issue's description:
> Introduce v8::MicrotasksScope.
>
> This scope is used to control microtasks execution when MicrotasksPolicy::kScoped is engaged.
>
> BUG=chromium:585949
> LOG=Y
> TEST=ScopedMicrotasks
>
> Committed: https://crrev.com/db77cec242dbdf8ee26da8232fa930270429f253
> Cr-Commit-Position: refs/heads/master@{#34472}

[email protected],[email protected],[email protected]
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:585949

Review URL: https://codereview.chromium.org/1762943002

Cr-Commit-Position: refs/heads/master@{#34480}

…erJoin to JS (patchset v8#6 id:100001 of https://codereview.chromium.org/1775403008/ )

Reason for revert:
[Sheriff] This lets a gc stress test time out:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20gc%20stress/builds/2337/steps/Mjsunit%20%28flakes%29/logs/regress-542823

The test ran in <2sec before this. Please fix the test as well on a reland.

Original issue's description:
> Replace PushIfAbsent by a Stack object and move StringBuilderJoin to JS
>
> This significantly speeds up String(array).
> BUG=
>
> Committed: https://crrev.com/c91faa0b39b62025460eb9f8b578e20d88f3549e
> Cr-Commit-Position: refs/heads/master@{#34696}

[email protected],[email protected],[email protected],[email protected]
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1785003004

Cr-Commit-Position: refs/heads/master@{#34706}

Merged b3de78c

PPC: [fullcodegen] Implement operand stack depth tracking.

BUG=v8:4488,v8:4755
LOG=N
[email protected]

Review URL: https://codereview.chromium.org/1742743003 .

Cr-Commit-Position: refs/branch-heads/5.0@{v8#6}
Cr-Branched-From: ad16e6c-refs/heads/5.0.71@{#1}
Cr-Branched-From: bd9df50-refs/heads/master@{#34215}

…id:140001 of https://codereview.chromium.org/1801203002/ )

Reason for revert:
Violates ES6 spec (crbug.com/4850), and implementation was over-eager. Will revert for now.

Original issue's description:
> Parser: Make skipping HTML comments optional.
>
> API change: This adds a new flag skip_html_comments to v8::ScriptOriginOptions. This flag controls whether V8 will attempt to honour HTML-style comments in JS sources.
>
> (That is: Gracefully ignore <!-- ... ---> in JS sources, which was a popular technique in the early days of JavaScript, to prevent non-JS-enabled browsers from displaying script sources to uses.)
>
> The flag defaults to 'true' when using v8::ScriptOrigin constructor, which preserves the existing behaviour. Embedders which are happy with the existing behaviour will thus not need any changes.
>
> BUG=chromium:573887
> LOG=Y
>
> Committed: https://crrev.com/91d344288aa51ed03eaaa1cb3e368ac1e82f0173
> Cr-Commit-Position: refs/heads/master@{#34904}

[email protected],[email protected]
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=chromium:573887, v8:4850
LOG=Y

Review URL: https://codereview.chromium.org/1817163003

Cr-Commit-Position: refs/heads/master@{#34958}

 id:100001 of https://codereview.chromium.org/1891033002/ )

Reason for revert:
[Sheriff] Breaks
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20ASAN%20mipsel%20-%20debug%20builder/builds/6121

Original issue's description:
> [Atomics] Remove Atomics code stubs; use TF ops
>
> This is a much cleaner solution, which won't require nearly as much
> architecture-specific code. Thanks bmeurer@!
>
> BUG=v8:4614
> LOG=y
> [email protected],[email protected]
>
> Committed: https://crrev.com/6ff5881b1def45b35384572f61327e42563a89c3
> Cr-Commit-Position: refs/heads/master@{#35547}

[email protected],[email protected],[email protected],[email protected]
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4614

Review URL: https://codereview.chromium.org/1895643002

Cr-Commit-Position: refs/heads/master@{#35548}

Merged 2f8de2e

Fix Gyp rule that broke node.js build after snapshot log removal.

[email protected]
NOTRY=true
NOPRESUBMIT=true

Review URL: https://codereview.chromium.org/1870103002

Cr-Commit-Position: refs/branch-heads/5.1@{v8#6}
Cr-Branched-From: 167dc63-refs/heads/5.1.281@{#1}
Cr-Branched-From: 03953f5-refs/heads/master@{#35282}

…0001 of https://codereview.chromium.org/1961973002/ )

Reason for revert:
The ThreadSanitizer finds data races.

Original issue's description:
> [wasm] Implement parallel compilation.
>
> With this CL it is possible to compile a wasm module with multiple
> threads in parallel. Parallel compilation works as follows:
>
> 1)   The main thread allocates a compilation unit for each wasm function.
> 2)   The main thread spawns WasmCompilationTasks which run on the
>      background threads.
> 3.a) The background threads and the main thread pick one compilation unit
>      at a time and execute the parallel phase of the compilation unit.
>      After finishing the execution of the parallel phase, the compilation
>      unit is stored in a result queue.
> 3.b) If the result queue contains a compilation unit, the main thread
>      dequeues it and finishes its compilation.
> 4)   After the execution of the parallel phase of all compilation units has
>      started, the main thread waits for all WasmCompilationTasks to finish.
> 5)   The main thread finalizes the compilation of the module.
>
> I'm going to add some additional tests before committing this CL.
>
> [email protected], [email protected], [email protected], [email protected]
>
> Committed: https://crrev.com/17215438659d8ff2d7d55f95226bf8a1477ccd79
> Cr-Commit-Position: refs/heads/master@{#36178}

[email protected],[email protected],[email protected],[email protected]
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/1965243003
Cr-Commit-Position: refs/heads/master@{#36182}

… mode (patchset v8#6 id:100001 of https://codereview.chromium.org/1948403002/ )

Reason for revert:
[Sheriff] Breaks
https://build.chromium.org/p/client.v8.ports/builders/V8%20Arm%20-%20debug%20builder/builds/602

Original issue's description:
> In parallel to the strict octal check that would reject `012` in strict mode, this patch collects UseCounters for `089` in strict mode. The spec says this should be an error, but this patch does not report it as such.
>
> BUG=v8:4973
> LOG=y
>
> Committed: https://crrev.com/d0b6686c14339bd5d0aeaf610705c7ed85393e1f
> Cr-Commit-Position: refs/heads/master@{#36221}

[email protected],[email protected],[email protected]
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4973

Review-Url: https://codereview.chromium.org/1970333004
Cr-Commit-Position: refs/heads/master@{#36224}

…with returning to the entry trampoline. (patchset v8#6 id:170001 of https://codereview.chromium.org/1969423002/ )

Reason for revert:
Breaks
https://build.chromium.org/p/client.v8.ports/builders/V8%20Linux%20-%20arm%20-%20sim/builds/619

Might only affect pure release builds?

Original issue's description:
> [Interpreter] Remove InterpreterExitTrampoline and replace with returning to the entry trampoline.
>
> In order to support compiling to baseline on return we need to be able to
> return to the actual return address. With this change this is what the
> Return bytecode now does, removing the need for the
> InterpreterExitTrampoline.
>
> This change also removes the InterpreterNotifyDeoptXXX builtins and
> unifies FCG and Igntion to both use NotifyDeoptXXX. As part of this
> change, FullCodegenerator::State is moved to Deoptimize::BailoutState.
>
> BUG=v8:4280
> LOG=N
>
> Committed: https://crrev.com/34c9626e2ee56fe805de549697ca5323aed7cb66
> Cr-Commit-Position: refs/heads/master@{#36288}

[email protected],[email protected],[email protected]
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4280

Review-Url: https://codereview.chromium.org/1986353002
Cr-Commit-Position: refs/heads/master@{#36294}

…01 of https://codereview.chromium.org/1986173002/ )

Reason for revert:
Breaks layout tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/6896

Original issue's description:
> Refactor script position calculation
>
> Script position calculation logic (i.e. line & column numbers for a
> given code position) is now based on a single method
> Script::GetPositionInfo(). Refactored related code in isolate.cc and
> js/messages.js to use the new method and removed the line_ends JS
> accessor.
>
> [email protected]
> BUG=
>
> Committed: https://crrev.com/c04d547298ce4fd425ef1eaa9b02ad1e177918dc
> Cr-Commit-Position: refs/heads/master@{#36359}

[email protected],[email protected]
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review-Url: https://codereview.chromium.org/1994973002
Cr-Commit-Position: refs/heads/master@{#36368}

…id:220001 of https://codereview.chromium.org/2005723005/ )

Reason for revert:
Breaking TSAN
  https://uberchromegw.corp.google.com/i/client.v8/builders/V8%20Linux64%20TSAN/builds/9741/steps/Ignition%20-%20turbofan%20%28flakes%29/logs/FixedUint32Array

Original issue's description:
> Reland of "[heap] Fine-grained JSArrayBuffer tracking"
>
> Track based on JSArrayBuffer addresses on pages instead of the attached
> backing store.
>
> Details of tracking:
> - Scavenge: New space pages are processes in bulk on the main thread
> - MC: Unswept pages are processed in bulk in parallel. All other pages
>   are processed by the sweeper concurrently.
>
> This reverts commit d2dff03.
>
> [email protected]
> BUG=chromium:611688
> LOG=N
> CQ_EXTRA_TRYBOTS=tryserver.v8:v8_linux_arm64_gc_stress_dbg,v8_linux_gc_stress_dbg,v8_mac_gc_stress_dbg,v8_linux64_tsan_rel,v8_mac64_asan_rel
>
> Committed: https://crrev.com/b5704bc1e6ba74c9ca975f5d58f5b2dc60261457
> Cr-Commit-Position: refs/heads/master@{#36495}

[email protected]
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:611688

Review-Url: https://codereview.chromium.org/2011863002
Cr-Commit-Position: refs/heads/master@{#36504}

…review.chromium.org/2011853002/ )

Reason for revert:
http://crbug.com/615890

Original issue's description:
> [gn] Add unittests
>
> BUG=chromium:474921
> NOTRY=true
>
> Committed: https://crrev.com/67e549ec5b34ad02506abb2720c6a0851ae31f5e
> Cr-Commit-Position: refs/heads/master@{#36510}
>
> Committed: https://crrev.com/143b3d167d7014525d049d3ab53c73cf2592243c
> Cr-Commit-Position: refs/heads/master@{#36582}

[email protected],[email protected],[email protected]
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:474921

Review-Url: https://codereview.chromium.org/2022893002
Cr-Commit-Position: refs/heads/master@{#36605}

…ap. (patchset v8#6 id:100001 of https://codereview.chromium.org/2046953002/ )

Reason for revert:
Revert because uncommit of lo is broken.

Original issue's description:
> [heap] Unregister shrinked large object memory from chunk map.
>
> BUG=chromium:617883
> LOG=n
>
> Committed: https://crrev.com/2b38d3121b5fd0e409cdda0071fa2e0ec2846ab2
> Cr-Commit-Position: refs/heads/master@{#36793}

[email protected]
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:617883

Review-Url: https://codereview.chromium.org/2046563008
Cr-Commit-Position: refs/heads/master@{#36806}

… id:100001 of https://codereview.chromium.org/2052523002/ )

Reason for revert:
Seems to break TSAN, see http://build.chromium.org/p/client.v8/builders/V8%20Linux64%20TSAN/builds/10057

Original issue's description:
> The trace-events will have a high overhead when turned on, but they are in a disabled-by-default category.
>
> As long as the off overhead is negligible, this CL allows us to understand the behavior of V8 rather than its performance at the moment.
>
> BUG=v8:5089
>
> Committed: https://crrev.com/44ec143f26769bd103662643bfeafc7d0834cc90
> Cr-Commit-Position: refs/heads/master@{#36909}

[email protected],[email protected]
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5089

Review-Url: https://codereview.chromium.org/2064553002
Cr-Commit-Position: refs/heads/master@{#36910}

…eters. (patchset v8#6 id:100001 of https://codereview.chromium.org/2109733003/ )

Reason for revert:
Fuzzer claims `try {  \"\" ; } catch(x) { let x1 = [1,,], x = x; }` causes a crash.

Original issue's description:
> Add errors for declarations which conflict with catch parameters.
>
> Catch parameters are largely treated as lexical declarations in the
> block which contains their body for the purposes of early syntax errors,
> with some exceptions outlined in B.3.5. This patch introduces most of
> those errors, except those from `eval('for (var e of ...);')` inside of
> a catch with a simple parameter named 'e'.
>
> Note that annex B.3.5 allows var declarations to conflict with simple
> catch parameters, except when the variable declaration is the init of a
> for-of statement.
>
> BUG=v8:5112,v8:4231
>
> Committed: https://crrev.com/2907c726b2bb5cf20b2bec639ca9e6a521585406
> Cr-Commit-Position: refs/heads/master@{#37462}

[email protected]
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5112,v8:4231

Review-Url: https://codereview.chromium.org/2112223002
Cr-Commit-Position: refs/heads/master@{#37464}

…eters. (patchset #1 id:1 of https://codereview.chromium.org/2112223002/ )

Reason for revert:
Correcting issue.

Original issue's description:
> Revert of Add errors for declarations which conflict with catch parameters. (patchset v8#6 id:100001 of https://codereview.chromium.org/2109733003/ )
>
> Reason for revert:
> Fuzzer claims `try {  \"\" ; } catch(x) { let x1 = [1,,], x = x; }` causes a crash.
>
> Original issue's description:
> > Add errors for declarations which conflict with catch parameters.
> >
> > Catch parameters are largely treated as lexical declarations in the
> > block which contains their body for the purposes of early syntax errors,
> > with some exceptions outlined in B.3.5. This patch introduces most of
> > those errors, except those from `eval('for (var e of ...);')` inside of
> > a catch with a simple parameter named 'e'.
> >
> > Note that annex B.3.5 allows var declarations to conflict with simple
> > catch parameters, except when the variable declaration is the init of a
> > for-of statement.
> >
> > BUG=v8:5112,v8:4231
> >
> > Committed: https://crrev.com/2907c726b2bb5cf20b2bec639ca9e6a521585406
> > Cr-Commit-Position: refs/heads/master@{#37462}
>
> [email protected]
> # Skipping CQ checks because original CL landed less than 1 days ago.
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=v8:5112,v8:4231
>
> Committed: https://crrev.com/8834d5ecb559001c87c42322969471da60574a8c
> Cr-Commit-Position: refs/heads/master@{#37464}

[email protected]
BUG=v8:5112,v8:4231

Review-Url: https://codereview.chromium.org/2119933002
Cr-Commit-Position: refs/heads/master@{#37728}

…de handler (patchset v8#6 id:100001 of https://codereview.chromium.org/2153433002/ )

Reason for revert:
This cl causes a large regression in octane (https://chromeperf.appspot.com/group_report?bug_id=629503). I have to investigate the reason before I can reland this.

Original issue's description:
> [Interpreter] Collect type feedback for 'new' in the bytecode handler
>
> Collect type feedback in the bytecode handler for 'new' bytecode. The
> current implementation does not collect allocation site feedback.
>
> BUG=v8:4280, v8:4780
> LOG=N
>
> Committed: https://crrev.com/1eadc76419b323fb2e55ae9953142f801704aa59
> Cr-Commit-Position: refs/heads/master@{#37862}

[email protected],[email protected]
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4280, v8:4780

Review-Url: https://codereview.chromium.org/2165633003
Cr-Commit-Position: refs/heads/master@{#37872}

…chset v8#6 id:100001 of https://codereview.chromium.org/2160613002/ )

Reason for revert:
Suspected to cause crbug.com/630969

Original issue's description:
> [heap] Remove black pages and use black areas instead.
>
> BUG=630386
> LOG=n
>
> Committed: https://crrev.com/b008a0d5a3db80a854cb93d9c94d67bf2d780f2c
> Cr-Commit-Position: refs/heads/master@{#37967}

[email protected],[email protected]
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=630386

Review-Url: https://codereview.chromium.org/2176133002
Cr-Commit-Position: refs/heads/master@{#38006}

…8#6 id:100001 of https://codereview.chromium.org/2172233002/ )

Reason for revert:
Bunch of breakages. Maybe bad interaction with https://chromium.googlesource.com/v8/v8/+/e520e5da5550f0d1a975e87d6e66a2edecbb0c8e ?

E.g.:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64/builds/11607

Original issue's description:
> [interpreter] Add explicit OSR polling bytecode.
>
> This adds an explicit {OsrPoll} bytecode into every loop header which
> triggers on-stack replacement when armed. Note that each such bytecode
> stores the static loop depths as an operand, and hence can be armed for
> specific loop depths.
>
> This also adds builtin code that triggers OSR compilation and switches
> execution over to optimized code in case compilation succeeds. In case
> compilation fails, the bytecode dispatch just continues unhindered.
>
> [email protected]
> TEST=mjsunit/ignition/osr-from-bytecode
> BUG=v8:4764
>
> Committed: https://crrev.com/a55beb68e0ededb3773affa294a71edc50621458
> Cr-Commit-Position: refs/heads/master@{#38043}

[email protected],[email protected]
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4764

Review-Url: https://codereview.chromium.org/2184553003
Cr-Commit-Position: refs/heads/master@{#38044}

…#1 id:1 of https://codereview.chromium.org/2184553003/ )

Reason for revert:
Fix has been landed.

Original issue's description:
> Revert of [interpreter] Add explicit OSR polling bytecode. (patchset v8#6 id:100001 of https://codereview.chromium.org/2172233002/ )
>
> Reason for revert:
> Bunch of breakages. Maybe bad interaction with https://chromium.googlesource.com/v8/v8/+/e520e5da5550f0d1a975e87d6e66a2edecbb0c8e ?
>
> E.g.:
> https://build.chromium.org/p/client.v8/builders/V8%20Linux64/builds/11607
>
> Original issue's description:
> > [interpreter] Add explicit OSR polling bytecode.
> >
> > This adds an explicit {OsrPoll} bytecode into every loop header which
> > triggers on-stack replacement when armed. Note that each such bytecode
> > stores the static loop depths as an operand, and hence can be armed for
> > specific loop depths.
> >
> > This also adds builtin code that triggers OSR compilation and switches
> > execution over to optimized code in case compilation succeeds. In case
> > compilation fails, the bytecode dispatch just continues unhindered.
> >
> > [email protected]
> > TEST=mjsunit/ignition/osr-from-bytecode
> > BUG=v8:4764
> >
> > Committed: https://crrev.com/a55beb68e0ededb3773affa294a71edc50621458
> > Cr-Commit-Position: refs/heads/master@{#38043}
>
> [email protected],[email protected]
> # Skipping CQ checks because original CL landed less than 1 days ago.
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=v8:4764
>
> Committed: https://crrev.com/439aa2c6d708bfd95db725bd6f97c4c49bbc51fc
> Cr-Commit-Position: refs/heads/master@{#38044}

[email protected],[email protected]
BUG=v8:4764

Review-Url: https://codereview.chromium.org/2184713002
Cr-Commit-Position: refs/heads/master@{#38056}

Drive-by: fix printing of handlers in --trace-feedback-updates mode.

Bug: chromium:1450481
(cherry picked from commit e144f3b)

Change-Id: Ic8d20764a8eeac3d1f77c37cfb270d387482e7bb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4584888
Reviewed-by: Toon Verwaest <[email protected]>
Commit-Queue: Igor Sheludko <[email protected]>
Cr-Commit-Position: refs/branch-heads/11.5@{v8#6}
Cr-Branched-From: 0c4044b-refs/heads/11.5.150@{#1}
Cr-Branched-From: b71d303-refs/heads/main@{#87781}

…ack checks

Bug: chromium:1452137
(cherry picked from commit f58b1da)

Change-Id: I271b23a863beca2b69a8d9cdd0f0a34fb49338a6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4637131
Commit-Queue: Toon Verwaest <[email protected]>
Auto-Submit: Tobias Tebbi <[email protected]>
Commit-Queue: Tobias Tebbi <[email protected]>
Reviewed-by: Toon Verwaest <[email protected]>
Cr-Commit-Position: refs/branch-heads/11.6@{v8#6}
Cr-Branched-From: e29c028-refs/heads/11.6.189@{v8#3}
Cr-Branched-From: 95cbef2-refs/heads/main@{#88340}

The clone ic miss handler did not correctly anticipate that the target
map chosen by the runtime clone implementation can pick a target map
with fewer inobject properties. In this case inobject properties need to
be moved to normal properties, which the fast case cannot.

Bug: chromium:1472121
(cherry picked from commit 10b0e62)

Change-Id: If621ad6b4640115214f825f435c15df65e774590
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4775580
Commit-Queue: Lutz Vahl <[email protected]>
Auto-Submit: Olivier Flückiger <[email protected]>
Bot-Commit: Rubber Stamper <[email protected]>
Reviewed-by: Lutz Vahl <[email protected]>
Cr-Commit-Position: refs/branch-heads/11.7@{v8#6}
Cr-Branched-From: fe60869-refs/heads/11.7.439@{#1}
Cr-Branched-From: aeb4552-refs/heads/main@{#89415}

(cherry picked from commit f188422)

Bug: chromium:1479104
Change-Id: I3072d2a08553a9e399072b6e009c098864c74258
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4862978
Auto-Submit: Shu-yu Guo <[email protected]>
Commit-Queue: Adam Klein <[email protected]>
Reviewed-by: Adam Klein <[email protected]>
Cr-Commit-Position: refs/branch-heads/11.8@{v8#6}
Cr-Branched-From: 935bdbf-refs/heads/11.8.172@{#1}
Cr-Branched-From: b82a911-refs/heads/main@{#89779}

Merged: [loong64][wasm] Single landing pad for trap handlers
Revision: 4341fa2

Merged: [loong64][simulator] Add support for single landing pad of trap handler
Revision: 04f51bc

BUG=v8:14437
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
[email protected]

Change-Id: I3d2247716da3f438b1f04fa87a578355d477f759
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5003811
Reviewed-by: Lutz Vahl <[email protected]>
Reviewed-by: Andreas Haas <[email protected]>
Reviewed-by: Clemens Backes <[email protected]>
Commit-Queue: Lutz Vahl <[email protected]>
Cr-Commit-Position: refs/branch-heads/12.0@{v8#6}
Cr-Branched-From: ed7b4ca-refs/heads/12.0.267@{#1}
Cr-Branched-From: 210e75b-refs/heads/main@{#90651}

Revision: a424868

BUG=v8:14505
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
[email protected]

Change-Id: Icc047a49d2360ceb08cd4bebdd1df81b6d432ef4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5099423
Reviewed-by: Clemens Backes <[email protected]>
Commit-Queue: Milad Farazmand <[email protected]>
Cr-Commit-Position: refs/branch-heads/12.1@{v8#6}
Cr-Branched-From: b74ef6f-refs/heads/12.1.285@{#1}
Cr-Branched-From: 32857fb-refs/heads/main@{#91313}

Wrapper tier up iterates all dispatch tables to find the relevant entry.
Not all tables also allocate dispatch tables though. We need to skip
non-existing ones.

[email protected]

(cherry picked from commit ca1b752)

Bug: 325878101
Change-Id: Ic3bf02dcf32ae2d1e73693f5e57d1dbc565c2b5b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5319672
Commit-Queue: Clemens Backes <[email protected]>
Reviewed-by: Andreas Haas <[email protected]>
Cr-Commit-Position: refs/branch-heads/12.3@{#6}
Cr-Branched-From: a86e197-refs/heads/12.3.219@{#1}
Cr-Branched-From: 21869f7-refs/heads/main@{#92385}

The code field in the WasmInternalFunction is a code pointer since
https://crrev.com/c/5110559, so it has to be scanned explicitly.

Bug: 329130358

(cherry picked from commit b93975a)

Change-Id: If179456d54b3790593c33ed5a6ac4dc2c24b631a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5378293
Reviewed-by: Clemens Backes <[email protected]>
Commit-Queue: Andreas Haas <[email protected]>
Cr-Commit-Position: refs/branch-heads/12.4@{#6}
Cr-Branched-From: 309640d-refs/heads/12.4.254@{#1}
Cr-Branched-From: 5dc2470-refs/heads/main@{#92862}

The out parameter isn't used by all callers and is even defaulted
to nullptr. Check it before setting the out parameter.

[email protected]

(cherry picked from commit be722ff)

Fixed: chromium:1520672
Change-Id: I6aea2d97df1825a67cf9a748ec8eff4399f2472a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5233714
Commit-Queue: Simon Zünd <[email protected]>
Bot-Commit: Rubber Stamper <[email protected]>
Cr-Commit-Position: refs/branch-heads/12.2@{v8#6}
Cr-Branched-From: 6eb5a96-refs/heads/12.2.281@{#1}
Cr-Branched-From: 44cf56d-refs/heads/main@{#91934}

[email protected]

Together-with: [email protected]
Bug: 333926321

(cherry picked from commit b321e27)

Change-Id: Icd3b6fdbff77d0956125e462b01ca9936fb4b6ff
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5481733
Commit-Queue: Andreas Haas <[email protected]>
Reviewed-by: Jakob Kummerow <[email protected]>
Cr-Commit-Position: refs/branch-heads/12.5@{#6}
Cr-Branched-From: 15b9756-refs/heads/12.5.227@{#1}
Cr-Branched-From: 497d857-refs/heads/main@{#93350}

So far, LateLoadElimination was assuming that maps would never change
after a AssumeMap. However, it can happen that a map is updated
in-place with a regular Store (typically, because of a transitioning
store).

Bug: 42202729, 340663085
(cherry picked from commit 66c754d)

Change-Id: I2d6832309947e5e8486e8f4cd293a3664accff3c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5537986
Commit-Queue: Nico Hartmann <[email protected]>
Auto-Submit: Darius Mercadier <[email protected]>
Reviewed-by: Nico Hartmann <[email protected]>
Cr-Commit-Position: refs/branch-heads/12.6@{#6}
Cr-Branched-From: 3c9fa12-refs/heads/12.6.228@{#2}
Cr-Branched-From: 981bb15-refs/heads/main@{#93835}

Somehow Clang is able to compile the call to GetFunctionTemplateData()
even though it was defined in "api_internal" namespace (the change
was made here: https://crrev.com/c/5587862).
This CL adds a missing namespace prefix.

Bug: 326505377
(cherry picked from commit 46d7ec6)

Change-Id: Ifdf87d542f1d6e5d234383824321abc74f48f510
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5621358
Auto-Submit: Igor Sheludko <[email protected]>
Reviewed-by: Leszek Swirski <[email protected]>
Commit-Queue: Leszek Swirski <[email protected]>
Cr-Commit-Position: refs/branch-heads/12.7@{#6}
Cr-Branched-From: 35cc908-refs/heads/12.7.224@{#1}
Cr-Branched-From: 6d60e67-refs/heads/main@{#94324}

Fixed: 355256380

(cherry picked from commit 313905c)

Change-Id: Ifb7589c000b4b01cc6a00a91083a4aa54ed55f89
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5746763
Commit-Queue: Leszek Swirski <[email protected]>
Auto-Submit: Victor Gomes <[email protected]>
Commit-Queue: Victor Gomes <[email protected]>
Reviewed-by: Leszek Swirski <[email protected]>
Cr-Commit-Position: refs/branch-heads/12.8@{#6}
Cr-Branched-From: 70cbb39-refs/heads/12.8.374@{#1}
Cr-Branched-From: 451b63e-refs/heads/main@{#95151}

Bug: chromium:351865302
(cherry picked from commit f784b0b)

Change-Id: I8d3319b0bd131d9321033a2f413c84ec1bfb42ab
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5803048
Commit-Queue: Matthias Liedtke <[email protected]>
Commit-Queue: Nico Hartmann <[email protected]>
Auto-Submit: Nico Hartmann <[email protected]>
Reviewed-by: Matthias Liedtke <[email protected]>
Cr-Commit-Position: refs/branch-heads/12.9@{#6}
Cr-Branched-From: 64a21d7-refs/heads/12.9.202@{#1}
Cr-Branched-From: da4200b-refs/heads/main@{#95679}

Oddballs are converted to an empty object by the spread literal. However
the clone IC is also responsible to setup the null prototype if given
in the object literal. Thus `{...null, __proto__: null}` cannot use the
fast case since that one cannot set a custom proto.

Bug: chromium:1491106

(cherry picked from commit b41f8b5)

Change-Id: I86117cd8d07b890a81795371e428c4ebe16d3ad4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4942231
Auto-Submit: Olivier Flückiger <[email protected]>
Commit-Queue: Olivier Flückiger <[email protected]>
Commit-Queue: Igor Sheludko <[email protected]>
Reviewed-by: Igor Sheludko <[email protected]>
Cr-Commit-Position: refs/branch-heads/11.9@{v8#6}
Cr-Branched-From: 3eb7d73-refs/heads/11.9.169@{#1}
Cr-Branched-From: 1a13bf9-refs/heads/main@{#90218}

Drive-by: fix printing of side step transitions.

Bug: 364422411
(cherry picked from commit 7d4760c)

Change-Id: Id0b50f4447e7428a86359bdeb1b0961a908fa6a8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5876460
Commit-Queue: Igor Sheludko <[email protected]>
Reviewed-by: Toon Verwaest <[email protected]>
Cr-Commit-Position: refs/branch-heads/13.0@{#6}
Cr-Branched-From: 4be854b-refs/heads/13.0.245@{#1}
Cr-Branched-From: 1f5183f-refs/heads/main@{#96103}

Remove "experimental" from --wasm-deopt making it eligible for VRP.
Also stage it behind --future.

(cherry picked from commit 55c0e0f)

Bug: 373703280, 42204618
Change-Id: I98af9adaf9ab7ba9a9d46e6fbffa9195446b967f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5952963
Auto-Submit: Matthias Liedtke <[email protected]>
Commit-Queue: Matthias Liedtke <[email protected]>
Commit-Queue: Jakob Kummerow <[email protected]>
Reviewed-by: Jakob Kummerow <[email protected]>
Cr-Commit-Position: refs/branch-heads/13.1@{#6}
Cr-Branched-From: 7998da6-refs/heads/13.1.201@{#1}
Cr-Branched-From: 5e9af2a-refs/heads/main@{#96554}

See comments in codegen and test case for details.
Fixes return_call_indirect as well, call_ref was already correct.

Also don't inline (into) shared functions, as this could cause similar
issues to the linked bug, just wrt. shared code + thread local data +
inlining (and shared everything is still evolving).

(cherry picked from commit 7d2a6e8)

Bug: 335082212, 378584789
Fixed: 377744184
Change-Id: Ia7d1dd699fe6993c16ec16294ead1d80b39c40fe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6023578
Commit-Queue: Matthias Liedtke <[email protected]>
Reviewed-by: Daniel Lehmann <[email protected]>
Cr-Commit-Position: refs/branch-heads/13.2@{#6}
Cr-Branched-From: 24068c5-refs/heads/13.2.152@{#1}
Cr-Branched-From: 6054ba9-refs/heads/main@{#97085}

This reverts the following commits:

"Reland [typed arrays] Remove the `length` field, use only byte length"

"[postmortem] remove JSTypedArray.kRawLengthOffset extra accessor"

Bug: 40070746, 385167059
(cherry picked from commit 10716de)

Change-Id: I4686eb4b441f403b01fbf73d37463202c457c548
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6162734
Reviewed-by: Leszek Swirski <[email protected]>
Commit-Queue: Marja Hölttä <[email protected]>
Cr-Commit-Position: refs/branch-heads/13.3@{#6}
Cr-Branched-From: 41dacff-refs/heads/13.3.415@{#1}
Cr-Branched-From: 3348638-refs/heads/main@{#97937}

(cherry picked from commit f609228)

Change-Id: I942b33e1bd8026b8e040107214057993b06f35d4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6240137
Reviewed-by: Lutz Vahl <[email protected]>
Commit-Queue: Andreas Haas <[email protected]>
Cr-Commit-Position: refs/branch-heads/13.4@{#6}
Cr-Branched-From: 0f87a54-refs/heads/13.4.114@{#1}
Cr-Branched-From: 27af2e9-refs/heads/main@{#98459}

Take into account that TransitionElementsKindOrCheckMap might change the
map of an aliasing object.

h/t dmercadier@ for figuring out the fix.

Bug: 400052777
(cherry picked from commit 8b490a9)

Change-Id: I018749ad4e56dddc4bb7255fa59e2b84ffc9008e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6333352
Reviewed-by: Darius Mercadier <[email protected]>
Commit-Queue: Marja Hölttä <[email protected]>
Cr-Commit-Position: refs/branch-heads/13.5@{#6}
Cr-Branched-From: c206c46-refs/heads/13.5.212@{#1}
Cr-Branched-From: af3cadc-refs/heads/main@{#99020}

... in case of scope reuse failure.

Bug: 401059828
(cherry picked from commit 8cc0282)

Change-Id: I81489157985313a3addeb15f8b015c3e4ad75eac
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6434493
Reviewed-by: Toon Verwaest <[email protected]>
Commit-Queue: Toon Verwaest <[email protected]>
Auto-Submit: Igor Sheludko <[email protected]>
Cr-Commit-Position: refs/branch-heads/13.6@{#6}
Cr-Branched-From: 04fa9cb-refs/heads/13.6.233@{#1}
Cr-Branched-From: f6be482-refs/heads/main@{#99571}

…le type in CheckMaps

This avoids problems in generating dead code (esp write barriers).

Fixed: 413419840
(cherry picked from commit b04613a)

Change-Id: Iaa6cb394ce80e33c807b85d941e4ff19418376bf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6500902
Commit-Queue: Leszek Swirski <[email protected]>
Reviewed-by: Leszek Swirski <[email protected]>
Auto-Submit: Marja Hölttä <[email protected]>
Cr-Commit-Position: refs/branch-heads/13.7@{#6}
Cr-Branched-From: dd5370d-refs/heads/13.7.152@{#1}
Cr-Branched-From: fa9b753-refs/heads/main@{#99927}

…nation"

This reverts commit 8efa07e.

Reason for revert: Temporarily to get more bake time.

Original change's description:
> Merged: [turbofan] Weaken alias analysis in store-store elimination
>
> Bug: 420636529
> (cherry picked from commit 7bc0a67)
>
> Change-Id: If7bf1a55a0ee814c85ae943acd264fe41fd1d5c9
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6594911
> Reviewed-by: Deepti Gandluri <[email protected]>
> Auto-Submit: Shu-yu Guo <[email protected]>
> Commit-Queue: Shu-yu Guo <[email protected]>
> Cr-Commit-Position: refs/branch-heads/13.8@{#4}
> Cr-Branched-From: 61ddd47-refs/heads/13.8.258@{#1}
> Cr-Branched-From: fdb5de2-refs/heads/main@{#100480}

Bug: 420636529
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Change-Id: I00c5583e61e30ead3a993e8fa9ee7d1226f6a849
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6594913
Bot-Commit: Rubber Stamper <[email protected]>
Commit-Queue: Shu-yu Guo <[email protected]>
Cr-Commit-Position: refs/branch-heads/13.8@{#6}
Cr-Branched-From: 61ddd47-refs/heads/13.8.258@{#1}
Cr-Branched-From: fdb5de2-refs/heads/main@{#100480}

…handler

This is a reland of commit ddc8269

The issue in the original CL was fixed in https://crrev.com/c/6662778.

Original change's description:
> [fastcall][deopt] Skip frame of fast caller when searching for handler
>
> When an exception is thrown, `UnwindAndFindHandler` iterates over the
> stack and tries to find an exception handler for the thrown exception.
> This is done by loading the return addresses from the stack and
> comparing them with the entries in the handler tables of the code
> objects that correspond to the stack frames.
>
> When lazy deopt is triggered, the return address on the stack gets
> overwritten with the address of a deopt exit, so that after the function
> return of the callee the execution does not continue after the call
> instruction but at the deopt exit. To make exception handling work with
> the modified return address on the stack, `UnwindAndFindHandler` calls a
> translation function which checks if the return address is a deopt exit,
> and if so, translates the return address back to the original value.
>
> When a function does a fast API call, and in this call an exception is
> thrown and the function gets marked for deoptimization, then
> `UnwindAndFindHandler` is not called within the fast API call, but
> within the builtin that gets called by the deopt exit. This means the
> return address on the stack for the function neither points after the
> fast API call nor at the deopt exit of the fast API call, but at the
> instruction after the call in the deopt exit, which is the deopt exit
> for the next deopt point.
>
> Therefore, as the return address on the stack is neither the instruction
> after the fast API call nor its deopt exit, `UnwindAndFindHandler` does
> not look up the correct entry in the handler table and therefore may
> behave incorrectly.
>
> This CL fixes the issue by adjusting the stack iteration in
> `UnwindAndFindHandler`. The frame of the function that did the fast API
> call gets handled already anyways by the frame of the deoptimization
> builtin. Therefore, when the frame of the builtin gets processed, it
> sets a flag that the next frame, i.e. the frame of the caller function,
> should be ignore in the stack iteration.
>
> Bug: 424627229
> Change-Id: I5997f4b85d82f41bbba0a750f6514a4b7d1db50c
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6652839
> Reviewed-by: Leszek Swirski <[email protected]>
> Commit-Queue: Andreas Haas <[email protected]>
> Cr-Commit-Position: refs/heads/main@{#100942}

Bug: 424627229

(cherry picked from commit 2680687)

Change-Id: I65cb69c7a96282fa073386437531c54ec71c8267
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6689115
Commit-Queue: Andreas Haas <[email protected]>
Commit-Queue: Leszek Swirski <[email protected]>
Auto-Submit: Andreas Haas <[email protected]>
Reviewed-by: Leszek Swirski <[email protected]>
Cr-Commit-Position: refs/branch-heads/13.9@{#6}
Cr-Branched-From: 76ea409-refs/heads/13.9.205@{#1}
Cr-Branched-From: 2824212-refs/heads/main@{#100941}

Original change's description:
> [segmented-table] Fix aligment of segments
> 
> The alignment of segments should be equal to the segment size,
> regardless of the pool's size.
> 
> This caused us to waste 3/4 of the virtual memory on affected
> architectures (i.e., all except windows and ppc64).
> 
> Bug: 432056905
> Change-Id: I74d9cea90c8647e6d8559b6f8434be62163e600c
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6851156
> Auto-Submit: Olivier Flückiger <[email protected]>
> Commit-Queue: Olivier Flückiger <[email protected]>
> Reviewed-by: Michael Lippautz <[email protected]>
> Commit-Queue: Michael Lippautz <[email protected]>
> Cr-Commit-Position: refs/heads/main@{#101919}

Bug: 439562553,432056905
Change-Id: I74d9cea90c8647e6d8559b6f8434be62163e600c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6867749
Commit-Queue: Rubber Stamper <[email protected]>
Bot-Commit: Rubber Stamper <[email protected]>
Auto-Submit: Chrome Cherry Picker <chrome-cherry-picker@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/14.0@{#6}
Cr-Branched-From: 4ec2f43-refs/heads/14.0.365@{#1}
Cr-Branched-From: a88b570-refs/heads/main@{#101731}

Fixed: 444048019

(cherry picked from commit 618d1a0)

Change-Id: I525fb868c43b3a43f6db227f449344f11cc2c3b5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6954063
Commit-Queue: Victor Gomes <[email protected]>
Auto-Submit: Victor Gomes <[email protected]>
Commit-Queue: Leszek Swirski <[email protected]>
Reviewed-by: Leszek Swirski <[email protected]>
Cr-Commit-Position: refs/branch-heads/14.1@{#6}
Cr-Branched-From: 1f4839b-refs/heads/14.1.146@{#1}
Cr-Branched-From: cd6944c-refs/heads/main@{#102149}

Slot indices are commonly derived from possibly-corrupted heap objects.
Add runtime checks that they are in bounds.

(cherry picked from commit 15a7214)

Bug: 447693720
Change-Id: I67b735a3f866ff7091fccd740f33e22808f6f2b1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6993031
Reviewed-by: Darius Mercadier <[email protected]>
Auto-Submit: Jakob Linke <[email protected]>
Commit-Queue: Jakob Linke <[email protected]>
Cr-Original-Commit-Position: refs/heads/main@{#102812}
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6999407
Cr-Commit-Position: refs/branch-heads/14.2@{#6}
Cr-Branched-From: 37f82db-refs/heads/14.2.231@{#1}
Cr-Branched-From: d1a6089-refs/heads/main@{#102804}

Original change's description:
> [compiler][arm64] Fix Dup and Shuffle recognition
> 
> The 'dup and shuffle' optimization worked on the assumption that, for
> swizzles, we could drop the second argument and replace it with the
> result of the dup. This would result in the dup producing the eight
> most significant bytes and the canonical shuffle would produce the
> other eight.
> 
> However, because we are dealing with swizzles, it may be that the
> instruction used to implement the canonical shuffle doesn't read from
> two registers. In this case the dup is never read and so the top bytes
> are not what we expect.
> 
> Bug: 455592080
> Change-Id: Ic205b01dec1a82631b1de1fce2d98e82d9af3804
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7095236
> Reviewed-by: Darius Mercadier <[email protected]>
> Commit-Queue: Darius Mercadier <[email protected]>
> Reviewed-by: Marja Hölttä <[email protected]>
> Cr-Commit-Position: refs/heads/main@{#103394}

(cherry picked from commit b8ff29c)

Bug: 456117279,455592080
Change-Id: Ic205b01dec1a82631b1de1fce2d98e82d9af3804
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7101278
Commit-Queue: Rubber Stamper <[email protected]>
Auto-Submit: Chrome Cherry Picker <chrome-cherry-picker@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: Rubber Stamper <[email protected]>
Cr-Commit-Position: refs/branch-heads/14.3@{#6}
Cr-Branched-From: 13c7e31-refs/heads/14.3.127@{#1}
Cr-Branched-From: 01af089-refs/heads/main@{#103352}

Fixed: 464965404
(cherry picked from commit 0caaa4e)

Change-Id: Ie114b44fc1386e17b93a67db71154025c1398cfb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7222290
Commit-Queue: Marja Hölttä <[email protected]>
Commit-Queue: Victor Gomes <[email protected]>
Reviewed-by: Marja Hölttä <[email protected]>
Auto-Submit: Victor Gomes <[email protected]>
Cr-Commit-Position: refs/branch-heads/14.4@{#6}
Cr-Branched-From: 80acc26-refs/heads/14.4.258@{#1}
Cr-Branched-From: ce7e597-refs/heads/main@{#104020}