TBR=v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com

Change-Id: I13a2a669b7fc5750404137a8f69bbe7b97a31404
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2939078
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/9.1@{v8#62}
Cr-Branched-From: 0e4ac64-refs/heads/9.1.269@{#1}
Cr-Branched-From: f565e72-refs/heads/master@{#73847}

TBR=v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com

Change-Id: I4677403f9d696663a7493b6fee3c92f81de775d2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3115195
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/9.2@{v8#62}
Cr-Branched-From: 5123834-refs/heads/9.2.230@{#1}
Cr-Branched-From: 587a04f-refs/heads/master@{#74656}

(cherry picked from commit 8081a5f)

Bug: chromium:1315901
No-Try: true
No-Presubmit: true
No-Tree-Checks: true
Change-Id: Ic44bfcae32aba202ba25c5f59fe579214a444584
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3584117
Commit-Queue: Tobias Tebbi <[email protected]>
Cr-Original-Commit-Position: refs/heads/main@{#79968}
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3584531
Reviewed-by: Tobias Tebbi <[email protected]>
Reviewed-by: Nico Hartmann <[email protected]>
Commit-Queue: Roger Felipe Zanoni da Silva <[email protected]>
Cr-Commit-Position: refs/branch-heads/9.6@{v8#62}
Cr-Branched-From: 0b7bda0-refs/heads/9.6.180@{#1}
Cr-Branched-From: 41a5a24-refs/heads/main@{#77244}

…cy for FastDataConstant"

This is a reland of 638d1b2 after a
one-character change. A local variable still has a non-optional type
in this version of V8.

Original change's description:
> Merged: [compiler] Always record constness dependency for FastDataConstant
>
> Revision: 1bfa513
>
> BUG=chromium:1209558
> NOTRY=true
> NOPRESUBMIT=true
> NOTREECHECKS=true
>
> Change-Id: If4f7243647bcc12ed482796c1353f0717630f6b9
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2919823
> Commit-Queue: Georg Neis <[email protected]>
> Reviewed-by: Igor Sheludko <[email protected]>
> Cr-Commit-Position: refs/branch-heads/9.1@{v8#59}
> Cr-Branched-From: 0e4ac64-refs/heads/9.1.269@{#1}
> Cr-Branched-From: f565e72-refs/heads/master@{#73847}

NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true

(cherry picked from commit 73666e3)

Bug: chromium:1209558
Change-Id: I0c81353882b0f17942fd92ad4181732f941bcb1d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2939991
Commit-Queue: Georg Neis <[email protected]>
Reviewed-by: Igor Sheludko <[email protected]>
Cr-Original-Commit-Position: refs/branch-heads/9.1@{v8#63}
Cr-Original-Branched-From: 0e4ac64-refs/heads/9.1.269@{#1}
Cr-Original-Branched-From: f565e72-refs/heads/master@{#73847}
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2948651
Reviewed-by: Artem Sumaneev <[email protected]>
Commit-Queue: Victor-Gabriel Savu <[email protected]>
Cr-Commit-Position: refs/branch-heads/9.0@{v8#62}
Cr-Branched-From: bd0108b-refs/heads/9.0.257@{#1}
Cr-Branched-From: 349bcc6-refs/heads/master@{#73001}

... by using JavaScript spec compliant JSReceiver::DefineOwnProperty.

Drive-by:
- cleanup comments in include/v8-object.h, insert links to
respective pages of https://tc39.es/ecma262/ when referencing spec,
- rename JSObject::DefineAccessor() to
  JSObject::DefineOwnAccessorIgnoreAttributes().

(cherry picked from commit b8020e1)

Bug: chromium:1433211
Change-Id: Ia9edaadd68f1986f18581156ad8f79c438b77744
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4458947
Commit-Queue: Igor Sheludko <[email protected]>
Cr-Original-Commit-Position: refs/heads/main@{#87302}
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4573392
Commit-Queue: Roger Felipe Zanoni da Silva <[email protected]>
Reviewed-by: Michael Lippautz <[email protected]>
Reviewed-by: Igor Sheludko <[email protected]>
Cr-Commit-Position: refs/branch-heads/10.8@{v8#62}
Cr-Branched-From: f1bc03f-refs/heads/10.8.168@{#1}
Cr-Branched-From: 237de89-refs/heads/main@{#83672}

Change-Id: I16e4449eb9ade2b1b54fa48deea7f5372d7a0479
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4879832
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/11.4@{v8#62}
Cr-Branched-From: 8a8a1e7-refs/heads/11.4.183@{#1}
Cr-Branched-From: 5483d8e-refs/heads/main@{#87241}

M120 merge issues:
  src/wasm/wasm-js.cc:
    - EncodeExceptionValues(): conflicting indentation

  src/wasm/wasm-objects.h/cc:
    - New(): conflicting types for "tag"

  src/wasm/module-instantiate.cc:
    - instance is a parameter of ProcessExports() in 120, removed
    the added code to instantiate it from the original fix, but kept
    instance as a parameter of WasmTagObject::New()

When we encode a JS value in a wasm exception, canonicalize the type
stored in the tag's signature first. Canonicalize it using the tag's
original module by storing the instance on the tag object.

[email protected]

(cherry picked from commit 89dc6ea)

Bug: b/346197738
Change-Id: I7575fd79c792d98e4a11c00b466700f0ab82d164
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5613375
Commit-Queue: Thibaud Michaud <[email protected]>
Cr-Original-Commit-Position: refs/heads/main@{#94335}
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5638978
Reviewed-by: Jakob Kummerow <[email protected]>
Auto-Submit: Roger Felipe Zanoni da Silva <[email protected]>
Reviewed-by: Thibaud Michaud <[email protected]>
Commit-Queue: Jakob Kummerow <[email protected]>
Cr-Commit-Position: refs/branch-heads/12.0@{#62}
Cr-Branched-From: ed7b4ca-refs/heads/12.0.267@{#1}
Cr-Branched-From: 210e75b-refs/heads/main@{#90651}

M126 merge issues:
  The HandleStackSwitch function doesn't exist in the LTS branch.

... And forward the exception to the parent stack instead.

[email protected]

(cherry picked from commit 9495e79)

Fixed: 361717714
Change-Id: I7c6a75b53bc7732546ec6a7a1425ac50b9b1756b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5817264
Commit-Queue: Thibaud Michaud <[email protected]>
Cr-Original-Commit-Position: refs/heads/main@{#95847}
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5831578
Reviewed-by: Thibaud Michaud <[email protected]>
Reviewed-by: Igor Sheludko <[email protected]>
Commit-Queue: Roger Felipe Zanoni da Silva (xWF) <[email protected]>
Cr-Commit-Position: refs/branch-heads/12.6@{#62}
Cr-Branched-From: 3c9fa12-refs/heads/12.6.228@{#2}
Cr-Branched-From: 981bb15-refs/heads/main@{#93835}

Change-Id: I5e0650ac721e10b1785eeab5b8128532bc838cab
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5840253
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/12.8@{#62}
Cr-Branched-From: 70cbb39-refs/heads/12.8.374@{#1}
Cr-Branched-From: 451b63e-refs/heads/main@{#95151}

Bug: 385155406
(cherry picked from commit d357708)

Change-Id: I98c7166588f4099c5665ff94dc65da5c25be7535
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6175036
Reviewed-by: Leszek Swirski <[email protected]>
Commit-Queue: Leszek Swirski <[email protected]>
Auto-Submit: Toon Verwaest <[email protected]>
Cr-Commit-Position: refs/branch-heads/13.2@{#62}
Cr-Branched-From: 24068c5-refs/heads/13.2.152@{#1}
Cr-Branched-From: 6054ba9-refs/heads/main@{#97085}

The embedder could pass a byte vector which points inside the sandbox,
hence we should make sure to only read it once to protect against
concurrent modification.

This CL feeds the decoder the bytes from the copy we did anyways instead
of using the incoming bytes.

[email protected]

Bug: 433533359
(cherry picked from commit 1eda930)

Change-Id: I67d2265252633d7429a345372f1770f811f396e7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6827422
Reviewed-by: Matthias Liedtke <[email protected]>
Commit-Queue: Matthias Liedtke <[email protected]>
Auto-Submit: Jakob Kummerow <[email protected]>
Cr-Commit-Position: refs/branch-heads/13.8@{#62}
Cr-Branched-From: 61ddd47-refs/heads/13.8.258@{#1}
Cr-Branched-From: fdb5de2-refs/heads/main@{#100480}