…tchset v8#12 id:220001 of https://codereview.chromium.org/2663803002/ )

Reason for revert:
Breaks win64 debug:
https://build.chromium.org/p/client.v8/builders/V8%20Win64%20-%20debug/builds/14967

Original issue's description:
> [string] Migrate String.prototype.{split,replace} to TF
>
> BUG=
>
> Review-Url: https://codereview.chromium.org/2663803002
> Cr-Commit-Position: refs/heads/master@{#42881}
> Committed: https://chromium.googlesource.com/v8/v8/+/65ad1e35d9a97c1126a55cc9d3014598fd224259

TBR=bmeurer@chromium.org,ishell@chromium.org,yangguo@chromium.org,jgruber@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review-Url: https://codereview.chromium.org/2671673003
Cr-Commit-Position: refs/heads/master@{#42882}

Cr-Commit-Position: refs/branch-heads/5.8@{#12}
Cr-Branched-From: eda659c-refs/heads/5.8.283@{#1}
Cr-Branched-From: 4310cd0-refs/heads/master@{#43429}

Cr-Commit-Position: refs/branch-heads/5.9@{#12}
Cr-Branched-From: fe9bb7e-refs/heads/5.9.211@{#1}
Cr-Branched-From: 70ad237-refs/heads/master@{#44591}

Revision: cbb7145

NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
TBR=hablich@chromium.org

Review-Url: https://codereview.chromium.org/2646073003 .
Cr-Commit-Position: refs/branch-heads/5.7@{#12}
Cr-Branched-From: 975e9a3-refs/heads/5.7.492@{#1}
Cr-Branched-From: 8d76f0e-refs/heads/master@{#42426}

Revision: a4f37da

BUG=chromium:654723
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
TBR=jarin@chromium.org

Review URL: https://codereview.chromium.org/2415343002 .

Cr-Commit-Position: refs/branch-heads/5.5@{#12}
Cr-Branched-From: 3cbd583-refs/heads/5.5.372@{#1}
Cr-Branched-From: b3c8b0c-refs/heads/master@{#40015}

Merged d944015
Merged 43d0b7e
Merged 90fa326
Merged 7a02c72
Merged 9a9ffd1
Merged 21550e0
Merged bf4ef54

X87: [builtins] Introduce proper Float64Tan operator.

X87: [cleanup] Remove dead code from DeclareLookupSlot and rename it.

X87: [builtins] NonNumberToNumber and StringToNumber now use CallRuntime instead of TailCallRuntime.

X87: Reland: [Crankshaft] Always check for stubs marked to not require an eager frame.

X87: disable some sin/cos/expm1/tan test cases for x87.

X87: [RegisterConfiguration] Streamline access to arch defaults, simplify Registers.

X87: disable test-gap-resolver/FuzzResolver test case for x87.

R=hablich@chromium.org
BUG=
LOG=N
NOTRY=true
NOPRESUBMIT=true

Review-Url: https://codereview.chromium.org/2127683002
Cr-Commit-Position: refs/branch-heads/5.3@{#12}
Cr-Branched-From: 820a23a-refs/heads/5.3.332@{#2}
Cr-Branched-From: 37538cb-refs/heads/master@{#37308}

Merged 298ee9c

Revert of [d8] Fix the shared-library build (patchset #12 id:20002 of https://codereview.chromium.org/2342563002/ )

BUG=chromium:646337
LOG=N
R=hablich@chromium.org
TBR=hablich@chromium.org

Review URL: https://codereview.chromium.org/2356713002 .

Cr-Commit-Position: refs/heads/5.5.228@{#2}
Cr-Branched-From: 2c10ca8-refs/heads/master@{#39503}

Revision: f3bf8f9

R=hablich@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com,
michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=
NOTRY=true
NOPRESUBMIT=true

Review-Url: https://codereview.chromium.org/2290603004
Cr-Commit-Position: refs/branch-heads/5.4@{#12}
Cr-Branched-From: 5ce2827-refs/heads/5.4.500@{#2}
Cr-Branched-From: ad07b49-refs/heads/master@{#38841}

Cr-Commit-Position: refs/branch-heads/5.6@{#12}
Cr-Branched-From: bdd3886-refs/heads/5.6.326@{#1}
Cr-Branched-From: 879f659-refs/heads/master@{#41014}

Merged d0151bf

[heap] Don't use black pages for map, code and, lo space. Instead color objects black.

BUG=chromium:599174
LOG=N
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1899193005 .

Cr-Commit-Position: refs/branch-heads/5.1@{#12}
Cr-Branched-From: 167dc63-refs/heads/5.1.281@{#1}
Cr-Branched-From: 03953f5-refs/heads/master@{#35282}

Cr-Commit-Position: refs/branch-heads/5.2@{#12}
Cr-Branched-From: 2cd36d6-refs/heads/5.2.361@{#1}
Cr-Branched-From: 3fef34e-refs/heads/master@{#36332}

Merged c268aea

[turbofan] Unship try-catch.

R=jkummerow@chromium.org, bmeurer@chromium.org
BUG=v8:3566
LOG=Y

Review URL: https://codereview.chromium.org/1768293002 .

Cr-Commit-Position: refs/branch-heads/5.0@{#12}
Cr-Branched-From: ad16e6c-refs/heads/5.0.71@{#1}
Cr-Branched-From: bd9df50-refs/heads/master@{#34215}

Cr-Commit-Position: refs/branch-heads/6.0@{#12}
Cr-Branched-From: 97dbf62-refs/heads/6.0.286@{#1}
Cr-Branched-From: 12e6f1c-refs/heads/master@{#45439}

…jects"

This reverts commit b45c1c5.

Reason for revert: <INSERT REASONING HERE>

Original change's description:
> Merged: [regexp] Teach deoptimizer to materialize JSRegExp objects
> 
> Revision: d8e1477
> 
> BUG=chromium:747825,v8:6556,v8:6605
> LOG=N
> NOTRY=true
> NOPRESUBMIT=true
> NOTREECHECKS=true
> TBR=jarin@chromium.org
> 
> Change-Id: Ie3e68e53f13f28d3ea321a4ff9143eaec10fd787
> Reviewed-on: https://chromium-review.googlesource.com/584841
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/branch-heads/6.1@{#10}
> Cr-Branched-From: 1bf2e10-refs/heads/6.1.534@{#1}
> Cr-Branched-From: e825c43-refs/heads/master@{#46746}

TBR=jarin@chromium.org,jgruber@chromium.org

Change-Id: I32aca2f02b8e1dd1aed282ac4a4b3ec40eace3d7
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:747825, v8:6556, v8:6605
Reviewed-on: https://chromium-review.googlesource.com/585530
Reviewed-by: Michael Hablich <hablich@chromium.org>
Commit-Queue: Michael Hablich <hablich@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.1@{#12}
Cr-Branched-From: 1bf2e10-refs/heads/6.1.534@{#1}
Cr-Branched-From: e825c43-refs/heads/master@{#46746}

TBR=machenbach@chromium.org

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I8888f44df064901b243589dfc3367bec57894386
Reviewed-on: https://chromium-review.googlesource.com/660157
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.2@{#12}
Cr-Branched-From: efa2ac4-refs/heads/6.2.414@{#1}
Cr-Branched-From: a861ebb-refs/heads/master@{#47693}

… bits).

Revision: a803fad

BUG=v8:6916
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=bmeurer@chromium.org

Change-Id: I4236e37ee9693bed3f4bb65e43b33d8da94cf634
Reviewed-on: https://chromium-review.googlesource.com/722640
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.3@{#12}
Cr-Branched-From: 094a7c9-refs/heads/6.3.292@{#1}
Cr-Branched-From: 18b8fbb-refs/heads/master@{#48432}

…stores of small integers.

Revision: f883485

BUG=chromium:791245
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=bmeurer@chromium.org

Change-Id: I442c5c745df2e1c62f344945ba79f09033fcd6d5
Reviewed-on: https://chromium-review.googlesource.com/817440
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.4@{#12}
Cr-Branched-From: 0407506-refs/heads/6.4.388@{#1}
Cr-Branched-From: a5fc4e0-refs/heads/master@{#49724}

TBR=machenbach@chromium.org

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Ia11a67ab6370ac6eed031372c69d54a1a1d1ebc6
Reviewed-on: https://chromium-review.googlesource.com/891904
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.5@{#12}
Cr-Branched-From: 73c55f5-refs/heads/6.5.254@{#1}
Cr-Branched-From: 594a1a0-refs/heads/master@{#50664}

TBR=machenbach@chromium.org

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I3597d880c2e4987079ce9621b901e4effe0fd073
Reviewed-on: https://chromium-review.googlesource.com/951941
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.6@{#12}
Cr-Branched-From: d500271-refs/heads/6.6.346@{#1}
Cr-Branched-From: 265ef0b-refs/heads/master@{#51624}

It is not safe to assume the first match is a string just
because the RegExp result is fast.

NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true

Bug: chromium:831943
Change-Id: Idd40f8b75312f0be54f45f626dc017339033abc6
Reviewed-on: https://chromium-review.googlesource.com/1009325
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Peter Wong <peter.wm.wong@gmail.com>
Cr-Original-Commit-Position: refs/heads/master@{#52578}(cherry picked from commit 7bdbe77)
Reviewed-on: https://chromium-review.googlesource.com/1013578
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.7@{#12}
Cr-Branched-From: 8457e81-refs/heads/6.7.288@{#2}
Cr-Branched-From: e921be5-refs/heads/master@{#52547}

TBR=machenbach@chromium.org

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: Ia18671db3899c8428270d84dbff140643644d5c1
Reviewed-on: https://chromium-review.googlesource.com/1083982
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.8@{#12}
Cr-Branched-From: 44d7d7d-refs/heads/6.8.275@{#1}
Cr-Branched-From: 5754f66-refs/heads/master@{#53286}

This reverts commit 52a10e5.

Reason for revert: https://test-results.appspot.com/data/layout_results/V8-Blink_Linux_64__dbg_/12434/layout-test-results/results.html

Crash e.g. in http/tests/devtools/oopif/oopif-performance-cpu-profiles.js

crash log for devtools (pid <unknown>):
STDOUT: <empty>
STDERR: 
STDERR: 
STDERR: #
STDERR: # Fatal error in ../../v8/src/compilation-dependencies.cc, line 281
STDERR: # Debug check failed: descriptor == owner->LastAdded() (10 vs. 22).
STDERR: #
STDERR: #
STDERR: #
STDERR: #FailureMessage Object: 0x7fff86878630#0 0x0000031c642c base::debug::StackTrace::StackTrace()
STDERR: #1 0x0000046a56bb gin::(anonymous namespace)::PrintStackTrace()
STDERR: v8#2 0x00000469c528 V8_Fatal()
STDERR: v8#3 0x00000469c285 v8::base::(anonymous namespace)::DefaultDcheckHandler()
STDERR: v8#4 0x000001cc5253 v8::internal::CompilationDependencies::DependOnFieldType()
STDERR: v8#5 0x000001cdcc46 v8::internal::compiler::AccessInfoFactory::ComputePropertyAccessInfo()
STDERR: v8#6 0x000001cde661 v8::internal::compiler::AccessInfoFactory::ComputePropertyAccessInfos()
STDERR: v8#7 0x000001dd982b v8::internal::compiler::JSNativeContextSpecialization::ReduceNamedAccess()
STDERR: v8#8 0x000001ddb715 v8::internal::compiler::JSNativeContextSpecialization::ReduceNamedAccessFromNexus()
STDERR: v8#9 0x000001dd656d v8::internal::compiler::JSNativeContextSpecialization::ReduceJSLoadNamed()
STDERR: v8#10 0x000001d53872 v8::internal::compiler::GraphReducer::Reduce()
STDERR: v8#11 0x000001d534a5 v8::internal::compiler::GraphReducer::ReduceTop()
STDERR: v8#12 0x000001d52e58 v8::internal::compiler::GraphReducer::ReduceNode()
STDERR: v8#13 0x000001e4c201 v8::internal::compiler::InliningPhase::Run()
STDERR: v8#14 0x000001e44f79 v8::internal::compiler::PipelineImpl::Run<>()
STDERR: v8#15 0x000001e41058 v8::internal::compiler::PipelineImpl::CreateGraph()
STDERR: v8#16 0x000001e40c75 v8::internal::compiler::PipelineCompilationJob::PrepareJobImpl()
STDERR: v8#17 0x000001ccd437 v8::internal::OptimizedCompilationJob::PrepareJob()
STDERR: v8#18 0x000001cd071e v8::internal::(anonymous namespace)::GetOptimizedCode()
STDERR: v8#19 0x000001cd0c6f v8::internal::Compiler::CompileOptimized()
STDERR: v8#20 0x00000231fb62 v8::internal::__RT_impl_Runtime_CompileOptimized_Concurrent()
STDERR: v8#21 0x00000288e535 <unknown>

Original change's description:
> [turbofan] Rewrite CompilationDependencies
> 
> Instead of installing code dependencies during graph reduction,
> install them after code generation.
> 
> Bug: v8:7902, v8:7790
> Change-Id: I8a3798254abb5b9ec7c295a1592aeb6b51f24c7a
> Reviewed-on: https://chromium-review.googlesource.com/1119913
> Commit-Queue: Georg Neis <neis@chromium.org>
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#54170}

TBR=mstarzinger@chromium.org,jarin@chromium.org,neis@chromium.org

Change-Id: Ic58c2bfadbd34bb6ba7dc0d2b74871cc90b0a74f
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7902, v8:7790
Reviewed-on: https://chromium-review.googlesource.com/1125680
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54192}

TBR=machenbach@chromium.org

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I3b85edfc96d3b612f8a0c35aa6b82359104a1971
Reviewed-on: https://chromium-review.googlesource.com/1150408
Reviewed-by: V8 Autoroller <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/6.9@{#12}
Cr-Branched-From: d7b61ab-refs/heads/6.9.427@{#1}
Cr-Branched-From: b7e108d-refs/heads/master@{#54504}

This reverts commit caed2cc.

Reason for revert: Breaks layout tests, e.g.

https://test-results.appspot.com/data/layout_results/V8-Blink_Linux_64__dbg_/14924/webkit_layout_tests%20%28with%20patch%29/layout-test-results/results.html

crash log for renderer (pid <unknown>):
STDOUT: <empty>
STDERR: 
STDERR: 
STDERR: #
STDERR: # Fatal error in ../../v8/src/base/platform/elapsed-timer.h, line 24
STDERR: # Debug check failed: !IsStarted().
STDERR: #
STDERR: #
STDERR: #
STDERR: #FailureMessage Object: 0x7ffc46707640#0 0x565409263b6f base::debug::StackTrace::StackTrace()
STDERR: #1 0x56540a8a32fb gin::(anonymous namespace)::PrintStackTrace()
STDERR: #2 0x56540a8980d8 V8_Fatal()
STDERR: #3 0x56540a897e35 v8::base::(anonymous namespace)::DefaultDcheckHandler()
STDERR: v8#4 0x565407971f02 v8::base::ElapsedTimer::Start()
STDERR: v8#5 0x565407d08edf v8::internal::TimedHistogram::Start()
STDERR: v8#6 0x565407e500d5 v8::internal::IncrementalMarking::AdvanceIncrementalMarkingOnAllocation()
STDERR: v8#7 0x565407e4f977 v8::internal::IncrementalMarking::Observer::Step()
STDERR: v8#8 0x565407e48092 v8::internal::AllocationObserver::AllocationStep()
STDERR: v8#9 0x565407eb0751 v8::internal::SpaceWithLinearArea::InlineAllocationStep()
STDERR: v8#10 0x565407eb3e44 v8::internal::NewSpace::EnsureAllocation()
STDERR: v8#11 0x565407e258ff v8::internal::NewSpace::AllocateRaw()
STDERR: v8#12 0x565407e06b2d v8::internal::Heap::AllocateRaw()
STDERR: v8#13 0x565407e432ef v8::internal::Heap::AllocateRawWithLightRetry()
STDERR: v8#14 0x565407e433cf v8::internal::Heap::AllocateRawWithRetryOrFail()
STDERR: v8#15 0x565407e04d48 v8::internal::Factory::NewFixedArrayWithFiller()
STDERR: v8#16 0x565407fd6339 v8::internal::HashTable<>::New()
STDERR: v8#17 0x565407fd7be8 v8::internal::HashTable<>::EnsureCapacity()
STDERR: v8#18 0x565407fc7e95 v8::internal::Dictionary<>::Add()
STDERR: v8#19 0x565407fcf453 v8::internal::BaseNameDictionary<>::Add()
STDERR: v8#20 0x565407f89ee4 v8::internal::LookupIterator::ApplyTransitionToDataProperty()
STDERR: v8#21 0x5654080036e2 v8::internal::Object::AddDataProperty()
STDERR: v8#22 0x56540793061f v8::internal::(anonymous namespace)::DefineDataProperty()
STDERR: v8#23 0x56540792da59 v8::internal::(anonymous namespace)::InstantiateObject()
STDERR: v8#24 0x56540792b75a v8::internal::(anonymous namespace)::InstantiateFunction()
STDERR: v8#25 0x56540792b4db v8::internal::ApiNatives::InstantiateFunction()
STDERR: v8#26 0x5654079594bf v8::FunctionTemplate::GetFunction()
STDERR: v8#27 0x56540a7af74e blink::V8ObjectConstructor::CreateInterfaceObject()
STDERR: v8#28 0x56540a7afe01 blink::V8PerContextData::ConstructorForTypeSlowCase()
STDERR: v8#29 0x56540a7afdd6 blink::V8PerContextData::ConstructorForTypeSlowCase()
STDERR: v8#30 0x56540a7afdd6 blink::V8PerContextData::ConstructorForTypeSlowCase()
STDERR: v8#31 0x56540a7afcb4 blink::V8PerContextData::CreateWrapperFromCacheSlowCase()
STDERR: v8#32 0x56540a7aef73 blink::V8DOMWrapper::CreateWrapper()
STDERR: v8#33 0x56540a7abf6b blink::ScriptWrappable::Wrap()
STDERR: v8#34 0x56540a677199 blink::V8Document::documentElementAttributeGetterCallback()
STDERR: v8#35 0x565407a0aec3 v8::internal::FunctionCallbackArguments::Call()
STDERR: v8#36 0x565407a097be v8::internal::(anonymous namespace)::HandleApiCallHelper<>()
STDERR: v8#37 0x565407a0877b v8::internal::Builtins::InvokeApiFunction()
STDERR: v8#38 0x565407fe785a v8::internal::Object::GetPropertyWithAccessor()
STDERR: v8#39 0x565407fe697e v8::internal::Object::GetProperty()
STDERR: v8#40 0x565407ec8c71 v8::internal::LoadIC::Load()
STDERR: v8#41 0x565407ed6401 v8::internal::__RT_impl_Runtime_LoadIC_Miss()
STDERR: v8#42 0x5654087593f2 <unknown>
STDERR: [16162:16185:1122/143518.356897:WARNING:crash_handler_host_linux.cc(341)] Could not translate tid, attempt = 1 retry ...


Original change's description:
> [heap] Improve embedder tracing during incremental marking
> 
> Add a path into embedder tracing on allocation. This is safe as as Blink
> is not allowed to call into V8 during object construction.
> 
> Bug: chromium:843903
> Change-Id: I5af053c3169f5a33778ebce5d7c5c43e4efb1aa4
> Reviewed-on: https://chromium-review.googlesource.com/c/1348749
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#57757}

TBR=ulan@chromium.org,mlippautz@chromium.org

Change-Id: Ide2c0b284b52bee17573adcc89f14be4e40dab91
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:843903
Reviewed-on: https://chromium-review.googlesource.com/c/1349189
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57759}

TBR=v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com

Change-Id: Ica10eb7c1b3ce27adfb9236497dd1eca2da30777
Reviewed-on: https://chromium-review.googlesource.com/c/1367884
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/7.2@{v8#12}
Cr-Branched-From: 6acd03c-refs/heads/7.2.502@{#1}
Cr-Branched-From: b03041d-refs/heads/master@{#57910}

…ials

Bug: v8:13917, chromium:1459545
(cherry picked from commit 030e148)

Change-Id: I34c85bd72eef468e18a3595956ef6d6764e27e90
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4669544
Reviewed-by: Lutz Vahl <vahl@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/branch-heads/11.6@{v8#12}
Cr-Branched-From: e29c028-refs/heads/11.6.189@{v8#3}
Cr-Branched-From: 95cbef2-refs/heads/main@{#88340}

No-Try: true
Bug: chromium:1472354
Change-Id: I80498f94b77425730e4936b4e49ecd6795f9b2a6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4813089
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/branch-heads/11.7@{v8#12}
Cr-Branched-From: fe60869-refs/heads/11.7.439@{#1}
Cr-Branched-From: aeb4552-refs/heads/main@{#89415}

…in AssembleMove

Bug: v8:14334

(cherry picked from commit f233e69)

Change-Id: I57778821773627ce93d488603cef74045a057688
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4885890
Commit-Queue: Lutz Vahl <vahl@chromium.org>
Auto-Submit: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Reviewed-by: Lutz Vahl <vahl@chromium.org>
Cr-Commit-Position: refs/branch-heads/11.8@{v8#12}
Cr-Branched-From: 935bdbf-refs/heads/11.8.172@{#1}
Cr-Branched-From: b82a911-refs/heads/main@{#89779}

Merged: [maglev] Fix phi untagging skipping smi check
Revision: 9e0df0b

Merged: [maglev] Phi untagging fix
Revision: 1a57a37

Merged: [maglev] Fix another phi untagging skipping smi check
Revision: 5e88842

BUG=chromium:1499133,v8:7700
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=dmercadier@chromium.org

Change-Id: I8231c3d9f5d94d3a2ac828e2674bf1579d8269fb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5047532
Reviewed-by: Darius Mercadier <dmercadier@chromium.org>
Cr-Commit-Position: refs/branch-heads/12.0@{v8#12}
Cr-Branched-From: ed7b4ca-refs/heads/12.0.267@{#1}
Cr-Branched-From: 210e75b-refs/heads/main@{#90651}

Merged: [maglev] Fix phi untagging skipping smi check
Revision: 9e0df0b

Merged: [maglev] Phi untagging fix
Revision: 1a57a37

Merged: [maglev] Fix another phi untagging skipping smi check
Revision: 5e88842

BUG=chromium:1499133,v8:7700
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=dmercadier@chromium.org

Change-Id: I585d3b3409d56b64ec6c83602829fd0510e6a2a6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5049231
Reviewed-by: Darius Mercadier <dmercadier@chromium.org>
Cr-Commit-Position: refs/branch-heads/11.9@{v8#12}
Cr-Branched-From: 3eb7d73-refs/heads/11.9.169@{#1}
Cr-Branched-From: 1a13bf9-refs/heads/main@{#90218}

…ffect

Bug: v8:12783, chromium:1508367
(cherry picked from commit 9ccc063)

Change-Id: If5d244e0caa493fc8ebb90fa3d43009607bb7295
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5103869
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Darius Mercadier <dmercadier@chromium.org>
Commit-Queue: Darius Mercadier <dmercadier@chromium.org>
Cr-Commit-Position: refs/branch-heads/12.1@{v8#12}
Cr-Branched-From: b74ef6f-refs/heads/12.1.285@{#1}
Cr-Branched-From: 32857fb-refs/heads/main@{#91313}

…ffect free

R=bmeurer@chromium.org

(cherry picked from commit d01ae0d)

Bug: 326117121
Change-Id: I6390bf672e5f3f5b881a0e8eedcb1080d6766824
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5343614
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/branch-heads/12.3@{#12}
Cr-Branched-From: a86e197-refs/heads/12.3.219@{#1}
Cr-Branched-From: 21869f7-refs/heads/main@{#92385}

Crash occurred because JSPI initialization was not completed if OT only.

Moved all of init code to bootstrap phase; guarded both by OT & non-heap serialization (during snapshot) tests.

Bug: chromium:330543313
(cherry picked from commit 1e59b8f)

Change-Id: I4b7b7b727d67e939d2493e5ee84a8d3aad1585c4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5393700
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Francis McCabe <fgm@chromium.org>
Cr-Commit-Position: refs/branch-heads/12.4@{#12}
Cr-Branched-From: 309640d-refs/heads/12.4.254@{#1}
Cr-Branched-From: 5dc2470-refs/heads/main@{#92862}

Int64Lowering currently cannot deal with "elem_size_log2" scaling
parameters, because AtomicWord32Pair doesn't support them. So the
MachineOptimizationReducer shouldn't produce these parameters on
this particular configuration.

Fixed: chromium:1520311
(cherry picked from commit e0a43f2)

Change-Id: I41c774068f62e07bca242e30dae5f6dd5998dd65
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5239031
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/branch-heads/12.2@{v8#12}
Cr-Branched-From: 6eb5a96-refs/heads/12.2.281@{#1}
Cr-Branched-From: 44cf56d-refs/heads/main@{#91934}

…perties

Bug: 339458194
(cherry picked from commit f320600)

Change-Id: Ic1cb6953060fcd63081dab88ff87eece3175aca8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5526311
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Auto-Submit: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/branch-heads/12.5@{#12}
Cr-Branched-From: 15b9756-refs/heads/12.5.227@{#1}
Cr-Branched-From: 497d857-refs/heads/main@{#93350}

A few of these should account for the possibility of the object
not being a JSObject.
Some of them were simply redundant.

(cherry picked from commit fe67713)

Bug: 339753685
Change-Id: I97dab098fb7024408a3d79934824b8e0316068ef
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5557062
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Auto-Submit: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/branch-heads/12.6@{#12}
Cr-Branched-From: 3c9fa12-refs/heads/12.6.228@{#2}
Cr-Branched-From: 981bb15-refs/heads/main@{#93835}

It has bugs.

Bug: 347961785
(cherry picked from commit cff1b40)

Change-Id: Ia006d3d976da436f8b3e9b50b4703a0b18b13da5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5645251
Reviewed-by: Matthias Liedtke <mliedtke@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/branch-heads/12.7@{#12}
Cr-Branched-From: 35cc908-refs/heads/12.7.224@{#1}
Cr-Branched-From: 6d60e67-refs/heads/main@{#94324}

Bug: 352690885
(cherry picked from commit af7f8f0)

Change-Id: Ic95ed304891aa5158d072038a0198d6bbb718441
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5762853
Reviewed-by: Rezvan Mahdavi Hezaveh <rezvan@chromium.org>
Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@chromium.org>
Cr-Commit-Position: refs/branch-heads/12.8@{#12}
Cr-Branched-From: 70cbb39-refs/heads/12.8.374@{#1}
Cr-Branched-From: 451b63e-refs/heads/main@{#95151}

Merged: [parser] Fix HomeObjectScope to start at the receiver scope
Bug: 352690885
(cherry picked from commit af7f8f0)

Change-Id: Ic95ed304891aa5158d072038a0198d6bbb718441
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5762853
Reviewed-by: Rezvan Mahdavi Hezaveh <rezvan@chromium.org>
Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@chromium.org>
Cr-Commit-Position: refs/branch-heads/12.8@{v8#12}
Cr-Branched-From: 70cbb39-refs/heads/12.8.374@{#1}
Cr-Branched-From: 451b63e-refs/heads/main@{#95151}

# Conflicts:
#	src/ast/scopes.cc

Updates a CHECK to support EVALUATING-ASYNC modules.

Updates GatherAvailableAncestors to check kErrored before
calling AsyncEvaluationOrdinalCompare to prevent hitting DCHECK.

Bug: 361615555
Bug: 361603701
Bug: 361611791

(cherry picked from commit 5af53ec)

Change-Id: Ia79093acd6d48d219620578254160ca44caa09ed
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5825786
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/branch-heads/12.9@{#12}
Cr-Branched-From: 64a21d7-refs/heads/12.9.202@{#1}
Cr-Branched-From: da4200b-refs/heads/main@{#95679}

This is a follow up to crrev.com/c/5826664: rather than dropping
the TypeGuard entirely, we must insert it in the right position.

Fixed: 368241691
(cherry picked from commit bc82a56)

Change-Id: I5659277d665e016ae6e5f264a6d6b238c74d7b32
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5872659
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Reviewed-by: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/branch-heads/13.0@{#12}
Cr-Branched-From: 4be854b-refs/heads/13.0.245@{#1}
Cr-Branched-From: 1f5183f-refs/heads/main@{#96103}

This reverts commit f15986d.

Reason for revert: 374811614

Original change's description:
> Reland "[maglev] Enable object tracking"
>
> This is a reland of commit 0654522
>
> Original change's description:
> > [maglev] Enable object tracking
> >
> > Bug: v8:7700
> > Change-Id: I3ae73b0ae19e3fc5b3d1205c6cdfac24505e517b
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5803785
> > Commit-Queue: Leszek Swirski <leszeks@chromium.org>
> > Auto-Submit: Victor Gomes <victorgomes@chromium.org>
> > Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> > Cr-Commit-Position: refs/heads/main@{#95758}
>
> Bug: v8:7700
> Change-Id: I47f8346a09872146f044040fe1648bf2ef5acbbe
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5890514
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Commit-Queue: Victor Gomes <victorgomes@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#96301}

Bug: v8:7700, 374811614

(cherry picked from commit 1dc8d04)

Change-Id: I0d418c21c8b362f8b9ce6d154a15fe87784a5a23
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5979711
Commit-Queue: Marja Hölttä <marja@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/branch-heads/13.1@{#12}
Cr-Branched-From: 7998da6-refs/heads/13.1.201@{#1}
Cr-Branched-From: 5e9af2a-refs/heads/main@{#96554}

The previous jump table update clashes with `-fsanitize=alignment` since
the write is not aligned. But since the entries are 8 byte now anyway,
we can simply write the whole entry with a single store.

Bug: 378840211

(cherry picked from commit ce4c06f)

Change-Id: Ie648941401e38713a99c1c0ef5f77d0e38fb26e7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6034895
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/branch-heads/13.2@{#12}
Cr-Branched-From: 24068c5-refs/heads/13.2.152@{#1}
Cr-Branched-From: 6054ba9-refs/heads/main@{#97085}

Resumable loops which are not loops can be either:

1. An unreachable loop with only a back-edge
2. A fall-through to a resumable loop with a dead back-edge

Only (1) starts with an empty register state.

Fixed: 386143468
(cherry picked from commit b44bd24)

Change-Id: Iec24477dc1f15f9d438f56749696d533e72204a4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6172032
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Auto-Submit: Olivier Flückiger <olivf@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/branch-heads/13.3@{#12}
Cr-Branched-From: 41dacff-refs/heads/13.3.415@{#1}
Cr-Branched-From: 3348638-refs/heads/main@{#97937}

Bug: 382005099
(cherry picked from commit ee9fe68)

Change-Id: I35ddf7dd2c657f4c71bf634c2a8a56c91825adc9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6253039
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/branch-heads/13.4@{#12}
Cr-Branched-From: 0f87a54-refs/heads/13.4.114@{#1}
Cr-Branched-From: 27af2e9-refs/heads/main@{#98459}

Only WB in stores to an open allocation folding block can be elided.

Bug: 400944465, 402032540
(cherry picked from commit 9315baa)

Change-Id: I3417ad121af7a90f2f19799f241effd9f1e9c153
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6348462
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Olivier Flückiger <olivf@chromium.org>
Cr-Commit-Position: refs/branch-heads/13.5@{#12}
Cr-Branched-From: c206c46-refs/heads/13.5.212@{#1}
Cr-Branched-From: af3cadc-refs/heads/main@{#99020}

…ckwards"

This reverts commit 9afafeb.

Reason for revert: https://crbug.com/410878541

Original change's description:
> [regexp] Fix common prefix extraction when reading backwards
>
> We extract common prefixes out of disjunctions (e.g. ab|ac|ad becomes
> a(?:b|c|d). To do so alternatives are stable-sorted, comparing the first
> character only. In general the order of alternatives matter, as they
> have to be evaluated left to right. As we only compare on the first
> char, this is usually fine as alternatives with the same first char stay
> in the same order and for alternatives with different first chars only
> one of them can match.
> However this optimization (specifically stable-sorting on the first
> char) is not correct if we read backwards (e.g. for look-behind
> assertions). To fix this issue, we extract common prefixes when we read
> forward, and common suffixes when reading backward.
>
> Fixed: 388290816
> Change-Id: I86fb87462f6f0affd14a08904f924be77e683fce
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6372663
> Commit-Queue: Patrick Thier <pthier@chromium.org>
> Reviewed-by: Jakob Linke <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#99339}

Fixed: 411357703
Bug: 410878541
(cherry picked from commit 2152603)

Change-Id: Ieaf6c5ab6fe563524f0699a80338a6daac0bf0c5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6469755
Auto-Submit: Patrick Thier <pthier@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/branch-heads/13.6@{#12}
Cr-Branched-From: 04fa9cb-refs/heads/13.6.233@{#1}
Cr-Branched-From: f6be482-refs/heads/main@{#99571}

Wasm deoptimizations are enabled by default now but aren't implemented
properly on all platforms. Disable the feature on these platforms and
list these platforms explicitly in the test exclusion file instead of
listing the supported platforms there.

(cherry picked from commit 495e5d6)

Fixed: 415228635
Bug: 381281321, 42204618
Change-Id: Iccf1387890844d008a562dfb890770f0d716106e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6531484
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Reviewed-by: Lutz Vahl <vahl@chromium.org>
Cr-Commit-Position: refs/branch-heads/13.7@{#12}
Cr-Branched-From: dd5370d-refs/heads/13.7.152@{#1}
Cr-Branched-From: fa9b753-refs/heads/main@{#99927}

…roach

This is fixing
https://chromium-review.googlesource.com/c/v8/v8/+/6574425 ; a getter is
not always a JSFunction.

Fixed: 419744895
Bug: 388844115
(cherry picked from commit 3633476)

Change-Id: If4b9b131473d7f1f96fad52d434dada5ba3ea0fd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6606817
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/branch-heads/13.8@{#12}
Cr-Branched-From: 61ddd47-refs/heads/13.8.258@{#1}
Cr-Branched-From: fdb5de2-refs/heads/main@{#100480}

The {FromStringLarge} implementation uses the allocated result as
temporary storage at first. This algorithm crucially relies on that
result having the right size. We do allocate it with the right size,
but a concurrent mutator could immediately muck with it; so guard
against that with a CHECK.

Fixed: 427600180
(cherry picked from commit eba1812)

Change-Id: Ieff335c9b636d159a689d09547b826f1380c58c3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6700246
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/branch-heads/13.9@{#12}
Cr-Branched-From: 76ea409-refs/heads/13.9.205@{#1}
Cr-Branched-From: 2824212-refs/heads/main@{#100941}

Fixed: 444048019

(cherry picked from commit 618d1a0)

Change-Id: I1b89bb88ec84a9936d52ac2f6501530ce4cca949
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6951336
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/branch-heads/14.0@{#12}
Cr-Branched-From: 4ec2f43-refs/heads/14.0.365@{#1}
Cr-Branched-From: a88b570-refs/heads/main@{#101731}

Version incremented at https://cr-buildbucket.appspot.com/build/8703378034801776353

Change-Id: I225a16835542be7c2a6bfba850aff1b02d52fd13
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6965883
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/14.1@{#12}
Cr-Branched-From: 1f4839b-refs/heads/14.1.146@{#1}
Cr-Branched-From: cd6944c-refs/heads/main@{#102149}

Version incremented at https://cr-buildbucket.appspot.com/build/8700865290952722753

Change-Id: I1c94116b22f456a505282b7c23326bd8ce52673e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7049077
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/14.2@{#12}
Cr-Branched-From: 37f82db-refs/heads/14.2.231@{#1}
Cr-Branched-From: d1a6089-refs/heads/main@{#102804}

The regalloc should clear the node allocations when it is done.
Failing to do so can cause the codegen to use stale register state.
In this concrete example the exception handler trampolines would not
load from the spill slot due to the left over allocation.

Bug: 457351015
(cherry picked from commit 7ef5ae5)

Change-Id: I4d98362923bda183a7adb446a72a33dee1c29dd8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7137279
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Olivier Flückiger <olivf@chromium.org>
Cr-Commit-Position: refs/branch-heads/14.3@{#12}
Cr-Branched-From: 13c7e31-refs/heads/14.3.127@{#1}
Cr-Branched-From: 01af089-refs/heads/main@{#103352}

In particular:
 - remove Isolate parameter from JSGlobalProxy::IsDetachedFrom()
   and IsDetached() methods,
 - add more efficient implementations of global_proxy() and
   global_object() accessors to NativeContext compared to generic
   ones in Context,
 - make Isolate::DetachGlobal() do nothing if the context is already
   detached.

Bug: 466990858
(cherry picked from commit bdded6d)

Change-Id: I659378a43a472bc49ca60e3b6bf5accebfc08b46
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7241452
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/branch-heads/14.4@{#12}
Cr-Branched-From: 80acc26-refs/heads/14.4.258@{#1}
Cr-Branched-From: ce7e597-refs/heads/main@{#104020}