…tchset v8#12 id:220001 of https://codereview.chromium.org/2663803002/ )

Reason for revert:
Breaks win64 debug:
https://build.chromium.org/p/client.v8/builders/V8%20Win64%20-%20debug/builds/14967

Original issue's description:
> [string] Migrate String.prototype.{split,replace} to TF
>
> BUG=
>
> Review-Url: https://codereview.chromium.org/2663803002
> Cr-Commit-Position: refs/heads/master@{#42881}
> Committed: https://chromium.googlesource.com/v8/v8/+/65ad1e35d9a97c1126a55cc9d3014598fd224259

TBR=bmeurer@chromium.org,ishell@chromium.org,yangguo@chromium.org,jgruber@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review-Url: https://codereview.chromium.org/2671673003
Cr-Commit-Position: refs/heads/master@{#42882}

Cr-Commit-Position: refs/branch-heads/5.8@{#12}
Cr-Branched-From: eda659c-refs/heads/5.8.283@{#1}
Cr-Branched-From: 4310cd0-refs/heads/master@{#43429}

Cr-Commit-Position: refs/branch-heads/5.9@{#12}
Cr-Branched-From: fe9bb7e-refs/heads/5.9.211@{#1}
Cr-Branched-From: 70ad237-refs/heads/master@{#44591}

Revision: cbb7145

NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
TBR=hablich@chromium.org

Review-Url: https://codereview.chromium.org/2646073003 .
Cr-Commit-Position: refs/branch-heads/5.7@{#12}
Cr-Branched-From: 975e9a3-refs/heads/5.7.492@{#1}
Cr-Branched-From: 8d76f0e-refs/heads/master@{#42426}

Revision: a4f37da

BUG=chromium:654723
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
TBR=jarin@chromium.org

Review URL: https://codereview.chromium.org/2415343002 .

Cr-Commit-Position: refs/branch-heads/5.5@{#12}
Cr-Branched-From: 3cbd583-refs/heads/5.5.372@{#1}
Cr-Branched-From: b3c8b0c-refs/heads/master@{#40015}

Merged d944015
Merged 43d0b7e
Merged 90fa326
Merged 7a02c72
Merged 9a9ffd1
Merged 21550e0
Merged bf4ef54

X87: [builtins] Introduce proper Float64Tan operator.

X87: [cleanup] Remove dead code from DeclareLookupSlot and rename it.

X87: [builtins] NonNumberToNumber and StringToNumber now use CallRuntime instead of TailCallRuntime.

X87: Reland: [Crankshaft] Always check for stubs marked to not require an eager frame.

X87: disable some sin/cos/expm1/tan test cases for x87.

X87: [RegisterConfiguration] Streamline access to arch defaults, simplify Registers.

X87: disable test-gap-resolver/FuzzResolver test case for x87.

R=hablich@chromium.org
BUG=
LOG=N
NOTRY=true
NOPRESUBMIT=true

Review-Url: https://codereview.chromium.org/2127683002
Cr-Commit-Position: refs/branch-heads/5.3@{#12}
Cr-Branched-From: 820a23a-refs/heads/5.3.332@{#2}
Cr-Branched-From: 37538cb-refs/heads/master@{#37308}

Merged 298ee9c

Revert of [d8] Fix the shared-library build (patchset #12 id:20002 of https://codereview.chromium.org/2342563002/ )

BUG=chromium:646337
LOG=N
R=hablich@chromium.org
TBR=hablich@chromium.org

Review URL: https://codereview.chromium.org/2356713002 .

Cr-Commit-Position: refs/heads/5.5.228@{#2}
Cr-Branched-From: 2c10ca8-refs/heads/master@{#39503}

Revision: f3bf8f9

R=hablich@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com,
michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=
NOTRY=true
NOPRESUBMIT=true

Review-Url: https://codereview.chromium.org/2290603004
Cr-Commit-Position: refs/branch-heads/5.4@{#12}
Cr-Branched-From: 5ce2827-refs/heads/5.4.500@{#2}
Cr-Branched-From: ad07b49-refs/heads/master@{#38841}

Cr-Commit-Position: refs/branch-heads/5.6@{#12}
Cr-Branched-From: bdd3886-refs/heads/5.6.326@{#1}
Cr-Branched-From: 879f659-refs/heads/master@{#41014}

Merged d0151bf

[heap] Don't use black pages for map, code and, lo space. Instead color objects black.

BUG=chromium:599174
LOG=N
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1899193005 .

Cr-Commit-Position: refs/branch-heads/5.1@{#12}
Cr-Branched-From: 167dc63-refs/heads/5.1.281@{#1}
Cr-Branched-From: 03953f5-refs/heads/master@{#35282}

Cr-Commit-Position: refs/branch-heads/5.2@{#12}
Cr-Branched-From: 2cd36d6-refs/heads/5.2.361@{#1}
Cr-Branched-From: 3fef34e-refs/heads/master@{#36332}

Merged c268aea

[turbofan] Unship try-catch.

R=jkummerow@chromium.org, bmeurer@chromium.org
BUG=v8:3566
LOG=Y

Review URL: https://codereview.chromium.org/1768293002 .

Cr-Commit-Position: refs/branch-heads/5.0@{#12}
Cr-Branched-From: ad16e6c-refs/heads/5.0.71@{#1}
Cr-Branched-From: bd9df50-refs/heads/master@{#34215}

Cr-Commit-Position: refs/branch-heads/6.0@{#12}
Cr-Branched-From: 97dbf62-refs/heads/6.0.286@{#1}
Cr-Branched-From: 12e6f1c-refs/heads/master@{#45439}

…jects"

This reverts commit b45c1c5.

Reason for revert: <INSERT REASONING HERE>

Original change's description:
> Merged: [regexp] Teach deoptimizer to materialize JSRegExp objects
> 
> Revision: d8e1477
> 
> BUG=chromium:747825,v8:6556,v8:6605
> LOG=N
> NOTRY=true
> NOPRESUBMIT=true
> NOTREECHECKS=true
> TBR=jarin@chromium.org
> 
> Change-Id: Ie3e68e53f13f28d3ea321a4ff9143eaec10fd787
> Reviewed-on: https://chromium-review.googlesource.com/584841
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/branch-heads/6.1@{#10}
> Cr-Branched-From: 1bf2e10-refs/heads/6.1.534@{#1}
> Cr-Branched-From: e825c43-refs/heads/master@{#46746}

TBR=jarin@chromium.org,jgruber@chromium.org

Change-Id: I32aca2f02b8e1dd1aed282ac4a4b3ec40eace3d7
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:747825, v8:6556, v8:6605
Reviewed-on: https://chromium-review.googlesource.com/585530
Reviewed-by: Michael Hablich <hablich@chromium.org>
Commit-Queue: Michael Hablich <hablich@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.1@{#12}
Cr-Branched-From: 1bf2e10-refs/heads/6.1.534@{#1}
Cr-Branched-From: e825c43-refs/heads/master@{#46746}

TBR=machenbach@chromium.org

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I8888f44df064901b243589dfc3367bec57894386
Reviewed-on: https://chromium-review.googlesource.com/660157
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.2@{#12}
Cr-Branched-From: efa2ac4-refs/heads/6.2.414@{#1}
Cr-Branched-From: a861ebb-refs/heads/master@{#47693}

… bits).

Revision: a803fad

BUG=v8:6916
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=bmeurer@chromium.org

Change-Id: I4236e37ee9693bed3f4bb65e43b33d8da94cf634
Reviewed-on: https://chromium-review.googlesource.com/722640
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.3@{#12}
Cr-Branched-From: 094a7c9-refs/heads/6.3.292@{#1}
Cr-Branched-From: 18b8fbb-refs/heads/master@{#48432}

…stores of small integers.

Revision: f883485

BUG=chromium:791245
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=bmeurer@chromium.org

Change-Id: I442c5c745df2e1c62f344945ba79f09033fcd6d5
Reviewed-on: https://chromium-review.googlesource.com/817440
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.4@{#12}
Cr-Branched-From: 0407506-refs/heads/6.4.388@{#1}
Cr-Branched-From: a5fc4e0-refs/heads/master@{#49724}

TBR=machenbach@chromium.org

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Ia11a67ab6370ac6eed031372c69d54a1a1d1ebc6
Reviewed-on: https://chromium-review.googlesource.com/891904
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.5@{#12}
Cr-Branched-From: 73c55f5-refs/heads/6.5.254@{#1}
Cr-Branched-From: 594a1a0-refs/heads/master@{#50664}

TBR=machenbach@chromium.org

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I3597d880c2e4987079ce9621b901e4effe0fd073
Reviewed-on: https://chromium-review.googlesource.com/951941
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.6@{#12}
Cr-Branched-From: d500271-refs/heads/6.6.346@{#1}
Cr-Branched-From: 265ef0b-refs/heads/master@{#51624}

It is not safe to assume the first match is a string just
because the RegExp result is fast.

NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true

Bug: chromium:831943
Change-Id: Idd40f8b75312f0be54f45f626dc017339033abc6
Reviewed-on: https://chromium-review.googlesource.com/1009325
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Peter Wong <peter.wm.wong@gmail.com>
Cr-Original-Commit-Position: refs/heads/master@{#52578}(cherry picked from commit 7bdbe77)
Reviewed-on: https://chromium-review.googlesource.com/1013578
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.7@{#12}
Cr-Branched-From: 8457e81-refs/heads/6.7.288@{#2}
Cr-Branched-From: e921be5-refs/heads/master@{#52547}

TBR=machenbach@chromium.org

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: Ia18671db3899c8428270d84dbff140643644d5c1
Reviewed-on: https://chromium-review.googlesource.com/1083982
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.8@{#12}
Cr-Branched-From: 44d7d7d-refs/heads/6.8.275@{#1}
Cr-Branched-From: 5754f66-refs/heads/master@{#53286}

This reverts commit 52a10e5.

Reason for revert: https://test-results.appspot.com/data/layout_results/V8-Blink_Linux_64__dbg_/12434/layout-test-results/results.html

Crash e.g. in http/tests/devtools/oopif/oopif-performance-cpu-profiles.js

crash log for devtools (pid <unknown>):
STDOUT: <empty>
STDERR: 
STDERR: 
STDERR: #
STDERR: # Fatal error in ../../v8/src/compilation-dependencies.cc, line 281
STDERR: # Debug check failed: descriptor == owner->LastAdded() (10 vs. 22).
STDERR: #
STDERR: #
STDERR: #
STDERR: #FailureMessage Object: 0x7fff86878630#0 0x0000031c642c base::debug::StackTrace::StackTrace()
STDERR: #1 0x0000046a56bb gin::(anonymous namespace)::PrintStackTrace()
STDERR: v8#2 0x00000469c528 V8_Fatal()
STDERR: v8#3 0x00000469c285 v8::base::(anonymous namespace)::DefaultDcheckHandler()
STDERR: v8#4 0x000001cc5253 v8::internal::CompilationDependencies::DependOnFieldType()
STDERR: v8#5 0x000001cdcc46 v8::internal::compiler::AccessInfoFactory::ComputePropertyAccessInfo()
STDERR: v8#6 0x000001cde661 v8::internal::compiler::AccessInfoFactory::ComputePropertyAccessInfos()
STDERR: v8#7 0x000001dd982b v8::internal::compiler::JSNativeContextSpecialization::ReduceNamedAccess()
STDERR: v8#8 0x000001ddb715 v8::internal::compiler::JSNativeContextSpecialization::ReduceNamedAccessFromNexus()
STDERR: v8#9 0x000001dd656d v8::internal::compiler::JSNativeContextSpecialization::ReduceJSLoadNamed()
STDERR: v8#10 0x000001d53872 v8::internal::compiler::GraphReducer::Reduce()
STDERR: v8#11 0x000001d534a5 v8::internal::compiler::GraphReducer::ReduceTop()
STDERR: v8#12 0x000001d52e58 v8::internal::compiler::GraphReducer::ReduceNode()
STDERR: v8#13 0x000001e4c201 v8::internal::compiler::InliningPhase::Run()
STDERR: v8#14 0x000001e44f79 v8::internal::compiler::PipelineImpl::Run<>()
STDERR: v8#15 0x000001e41058 v8::internal::compiler::PipelineImpl::CreateGraph()
STDERR: v8#16 0x000001e40c75 v8::internal::compiler::PipelineCompilationJob::PrepareJobImpl()
STDERR: v8#17 0x000001ccd437 v8::internal::OptimizedCompilationJob::PrepareJob()
STDERR: v8#18 0x000001cd071e v8::internal::(anonymous namespace)::GetOptimizedCode()
STDERR: v8#19 0x000001cd0c6f v8::internal::Compiler::CompileOptimized()
STDERR: v8#20 0x00000231fb62 v8::internal::__RT_impl_Runtime_CompileOptimized_Concurrent()
STDERR: v8#21 0x00000288e535 <unknown>

Original change's description:
> [turbofan] Rewrite CompilationDependencies
> 
> Instead of installing code dependencies during graph reduction,
> install them after code generation.
> 
> Bug: v8:7902, v8:7790
> Change-Id: I8a3798254abb5b9ec7c295a1592aeb6b51f24c7a
> Reviewed-on: https://chromium-review.googlesource.com/1119913
> Commit-Queue: Georg Neis <neis@chromium.org>
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#54170}

TBR=mstarzinger@chromium.org,jarin@chromium.org,neis@chromium.org

Change-Id: Ic58c2bfadbd34bb6ba7dc0d2b74871cc90b0a74f
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7902, v8:7790
Reviewed-on: https://chromium-review.googlesource.com/1125680
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54192}

TBR=machenbach@chromium.org

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I3b85edfc96d3b612f8a0c35aa6b82359104a1971
Reviewed-on: https://chromium-review.googlesource.com/1150408
Reviewed-by: V8 Autoroller <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/6.9@{#12}
Cr-Branched-From: d7b61ab-refs/heads/6.9.427@{#1}
Cr-Branched-From: b7e108d-refs/heads/master@{#54504}

This reverts commit caed2cc.

Reason for revert: Breaks layout tests, e.g.

https://test-results.appspot.com/data/layout_results/V8-Blink_Linux_64__dbg_/14924/webkit_layout_tests%20%28with%20patch%29/layout-test-results/results.html

crash log for renderer (pid <unknown>):
STDOUT: <empty>
STDERR: 
STDERR: 
STDERR: #
STDERR: # Fatal error in ../../v8/src/base/platform/elapsed-timer.h, line 24
STDERR: # Debug check failed: !IsStarted().
STDERR: #
STDERR: #
STDERR: #
STDERR: #FailureMessage Object: 0x7ffc46707640#0 0x565409263b6f base::debug::StackTrace::StackTrace()
STDERR: #1 0x56540a8a32fb gin::(anonymous namespace)::PrintStackTrace()
STDERR: #2 0x56540a8980d8 V8_Fatal()
STDERR: #3 0x56540a897e35 v8::base::(anonymous namespace)::DefaultDcheckHandler()
STDERR: v8#4 0x565407971f02 v8::base::ElapsedTimer::Start()
STDERR: v8#5 0x565407d08edf v8::internal::TimedHistogram::Start()
STDERR: v8#6 0x565407e500d5 v8::internal::IncrementalMarking::AdvanceIncrementalMarkingOnAllocation()
STDERR: v8#7 0x565407e4f977 v8::internal::IncrementalMarking::Observer::Step()
STDERR: v8#8 0x565407e48092 v8::internal::AllocationObserver::AllocationStep()
STDERR: v8#9 0x565407eb0751 v8::internal::SpaceWithLinearArea::InlineAllocationStep()
STDERR: v8#10 0x565407eb3e44 v8::internal::NewSpace::EnsureAllocation()
STDERR: v8#11 0x565407e258ff v8::internal::NewSpace::AllocateRaw()
STDERR: v8#12 0x565407e06b2d v8::internal::Heap::AllocateRaw()
STDERR: v8#13 0x565407e432ef v8::internal::Heap::AllocateRawWithLightRetry()
STDERR: v8#14 0x565407e433cf v8::internal::Heap::AllocateRawWithRetryOrFail()
STDERR: v8#15 0x565407e04d48 v8::internal::Factory::NewFixedArrayWithFiller()
STDERR: v8#16 0x565407fd6339 v8::internal::HashTable<>::New()
STDERR: v8#17 0x565407fd7be8 v8::internal::HashTable<>::EnsureCapacity()
STDERR: v8#18 0x565407fc7e95 v8::internal::Dictionary<>::Add()
STDERR: v8#19 0x565407fcf453 v8::internal::BaseNameDictionary<>::Add()
STDERR: v8#20 0x565407f89ee4 v8::internal::LookupIterator::ApplyTransitionToDataProperty()
STDERR: v8#21 0x5654080036e2 v8::internal::Object::AddDataProperty()
STDERR: v8#22 0x56540793061f v8::internal::(anonymous namespace)::DefineDataProperty()
STDERR: v8#23 0x56540792da59 v8::internal::(anonymous namespace)::InstantiateObject()
STDERR: v8#24 0x56540792b75a v8::internal::(anonymous namespace)::InstantiateFunction()
STDERR: v8#25 0x56540792b4db v8::internal::ApiNatives::InstantiateFunction()
STDERR: v8#26 0x5654079594bf v8::FunctionTemplate::GetFunction()
STDERR: v8#27 0x56540a7af74e blink::V8ObjectConstructor::CreateInterfaceObject()
STDERR: v8#28 0x56540a7afe01 blink::V8PerContextData::ConstructorForTypeSlowCase()
STDERR: v8#29 0x56540a7afdd6 blink::V8PerContextData::ConstructorForTypeSlowCase()
STDERR: v8#30 0x56540a7afdd6 blink::V8PerContextData::ConstructorForTypeSlowCase()
STDERR: v8#31 0x56540a7afcb4 blink::V8PerContextData::CreateWrapperFromCacheSlowCase()
STDERR: v8#32 0x56540a7aef73 blink::V8DOMWrapper::CreateWrapper()
STDERR: v8#33 0x56540a7abf6b blink::ScriptWrappable::Wrap()
STDERR: v8#34 0x56540a677199 blink::V8Document::documentElementAttributeGetterCallback()
STDERR: v8#35 0x565407a0aec3 v8::internal::FunctionCallbackArguments::Call()
STDERR: v8#36 0x565407a097be v8::internal::(anonymous namespace)::HandleApiCallHelper<>()
STDERR: v8#37 0x565407a0877b v8::internal::Builtins::InvokeApiFunction()
STDERR: v8#38 0x565407fe785a v8::internal::Object::GetPropertyWithAccessor()
STDERR: v8#39 0x565407fe697e v8::internal::Object::GetProperty()
STDERR: v8#40 0x565407ec8c71 v8::internal::LoadIC::Load()
STDERR: v8#41 0x565407ed6401 v8::internal::__RT_impl_Runtime_LoadIC_Miss()
STDERR: v8#42 0x5654087593f2 <unknown>
STDERR: [16162:16185:1122/143518.356897:WARNING:crash_handler_host_linux.cc(341)] Could not translate tid, attempt = 1 retry ...


Original change's description:
> [heap] Improve embedder tracing during incremental marking
> 
> Add a path into embedder tracing on allocation. This is safe as as Blink
> is not allowed to call into V8 during object construction.
> 
> Bug: chromium:843903
> Change-Id: I5af053c3169f5a33778ebce5d7c5c43e4efb1aa4
> Reviewed-on: https://chromium-review.googlesource.com/c/1348749
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#57757}

TBR=ulan@chromium.org,mlippautz@chromium.org

Change-Id: Ide2c0b284b52bee17573adcc89f14be4e40dab91
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:843903
Reviewed-on: https://chromium-review.googlesource.com/c/1349189
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57759}

TBR=v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com

Change-Id: Ica10eb7c1b3ce27adfb9236497dd1eca2da30777
Reviewed-on: https://chromium-review.googlesource.com/c/1367884
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/7.2@{v8#12}
Cr-Branched-From: 6acd03c-refs/heads/7.2.502@{#1}
Cr-Branched-From: b03041d-refs/heads/master@{#57910}

TBR=v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com

Change-Id: If4f014884e10733d8a4b133a1097d0bdcf5cd651
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1871951
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/7.9@{v8#12}
Cr-Branched-From: be181e2-refs/heads/7.9.317@{#1}
Cr-Branched-From: 0d7889d-refs/heads/master@{#64307}

Revision: 008478e

BUG=v8:8402
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=machenbach@chromium.org

Change-Id: I4b7f6a174f719f1293537a593b0882869550fec7
Reviewed-on: https://chromium-review.googlesource.com/c/1434217
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/branch-heads/7.3@{v8#12}
Cr-Branched-From: 9df9418-refs/heads/7.3.492@{v8#2}
Cr-Branched-From: be213cf-refs/heads/master@{#59024}

Merging https://chromium-review.googlesource.com/c/v8/v8/+/1296471 added
a status line for a test that doesn't exist on the branch yet.

This CL removes that line.

TBR=yangguo@chromium.org
NOTRY=true
NOPRESUBMIT=true

Change-Id: Ie03b7bae890d6b5e36d5048458f1b92d12bdff80
Reviewed-on: https://chromium-review.googlesource.com/c/1298030
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/branch-heads/7.1@{v8#12}
Cr-Branched-From: f70aaa8-refs/heads/7.1.302@{#1}
Cr-Branched-From: 1dbcc78-refs/heads/master@{#56462}

This section potentially contains allocations and thus gc, all object
references should be handlified.

(cherry picked from commit b107214)

No-Try: true
No-Presubmit: true
No-Treechecks: true
Bug: v8:9333
Tbr: hablich@chromium.org
Change-Id: I5814e66e8b9b75a8bd952afecae7a3a27b42a642
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1647695
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#62012}
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1660620
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/branch-heads/7.6@{v8#12}
Cr-Branched-From: 2cb2573-refs/heads/7.6.303@{#1}
Cr-Branched-From: 201c509-refs/heads/master@{#61902}

Merged: [wasm] Try to avoid LTO bug on arm
Revision: 241294f

Merged: cpu-arm: Add noinline to cache flushing logic
Revision: e0e36ba

BUG=chromium:952759
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=jkummerow@chromium.org

Change-Id: I15357d13a9609c1b82fa1108330b36c4bd7a95fe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1588463
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/branch-heads/7.5@{v8#12}
Cr-Branched-From: 35b9bf5-refs/heads/7.5.288@{#1}
Cr-Branched-From: 912b391-refs/heads/master@{#60911}

This reverts commit f5bee00.

Reason for revert: Crashes android webview, see https://crbug.com/1071708.

Original change's description:
> Revisiting auxvec data gathering for PPC/ARM.
>
> /proc/sys/auxv might not be accessible, instead
> getting these from the user's stack.
>
> Change-Id: I2dcf696734e2b4dc1da27a991930b9e0d4228d51
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1730990
> Commit-Queue: Clemens Backes [né Hammacher] <clemensb@chromium.org>
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Reviewed-by: Clemens Backes [né Hammacher] <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#64037}

(cherry picked from commit 4dbb446)

TBR=clemensb@chromium.org,bmeurer@chromium.org,devnexen@gmail.com

Bug: chromium:1071708
No-Try: true
No-Tree-Checks: true
No-Presubmit: true
Change-Id: I9e11bdce1f12a6f69b93c33dd81ad1677c713120
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2162855
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/branch-heads/8.3@{v8#12}
Cr-Branched-From: 1668abd-refs/heads/8.3.110@{#1}
Cr-Branched-From: 04a7a68-refs/heads/master@{#66926}

Frames that have not been compiled by Liftoff for debugging are
uninspectable. Instead of reporting an empty local scope and stack scope
in this case, just don't report these two scopes at all.

This also fixes a case missed in https://crrev.com/c/2196349, where we
would still try to generate the stack scope for non-debugging code.

Drive-by: Use {WasmFrame} instead of {StandardFrame} in the
{DebugWasmScopeIterator}, and use the {FrameInspectionScope}
consistently.

TBR=​thibaudm@chromium.org, bmeurer@chromium.org
CC=​kimanh@chromium.org

(cherry picked from commit 10e8664)

Bug: v8:10359, chromium:1071757, chromium:1079328, chromium:1072839
Change-Id: I98de447ac200706e4e1acce8782a61748bb23300
No-Try: true
No-Presubmit: true
No-Tree-Checks: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2210241
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/branch-heads/8.4@{v8#12}
Cr-Branched-From: 88ed2e3-refs/heads/8.4.371@{#1}
Cr-Branched-From: 35f88bf-refs/heads/master@{#67773}

Revision: 219b28b

BUG=chromium:1127319
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=tebbi@chromium.org

Change-Id: I98e77bac81e2cf822a4a4987115e0cf01b1dbc52
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2416383
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/branch-heads/8.6@{v8#12}
Cr-Branched-From: a64aed2-refs/heads/8.6.395@{#1}
Cr-Branched-From: a626bc0-refs/heads/master@{#69472}

This changes a '<' to a '<=' and adds a comment to explain why it is
safe to use a jump table where the maximum distance is exactly
{kMaxCodeSpaceSize}.

R=​jkummerow@chromium.org

(cherry picked from commit b61e85a)

Bug: chromium:1151364
Change-Id: Id4971a2e9095fa99df48367ab09af4adbfadffaf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2552906
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#71337}
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2565133
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/branch-heads/8.8@{v8#12}
Cr-Branched-From: 2dbcdc1-refs/heads/8.8.278@{#1}
Cr-Branched-From: 366d30c-refs/heads/master@{#71094}

Operand 1 is not always a register (when AVX is supported).

(cherry picked from commit 476582b)

Bug: chromium:1182571,v8:11215
Tbr: gdeepti@chromium.org
No-Try: true
No-Presubmit: true
No-Tree-Checks: true
Change-Id: I1c6f53e07a6a40304ce719b4fb26b73ddf464adc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2729245
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/branch-heads/9.0@{v8#12}
Cr-Branched-From: bd0108b-refs/heads/9.0.257@{#1}
Cr-Branched-From: 349bcc6-refs/heads/master@{#73001}

Port: 064ca18

Bug: v8:11420

No-Try: true
No-Presubmit: true
No-Tree-Checks: true
(cherry picked from commit ee1b74a)

Change-Id: I38ef39a9959cd833b21517ca5706fcd258715de7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2821248
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Reviewed-by: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/branch-heads/9.1@{v8#12}
Cr-Branched-From: 0e4ac64-refs/heads/9.1.269@{#1}
Cr-Branched-From: f565e72-refs/heads/master@{#73847}

TBR=v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com

Change-Id: Id731644f179d8c937a072a508fc97af1304dacf6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3099645
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/9.4@{v8#12}
Cr-Branched-From: 3b51863-refs/heads/9.4.146@{#1}
Cr-Branched-From: 2890419-refs/heads/master@{#76233}

R=​jkummerow@chromium.org

Bug: chromium:1307946
(cherry picked from commit 1e94817)

No-Try: true
No-Presubmit: true
No-Tree-Checks: true
Change-Id: I783dcb4bbd0474f96a8a6bca91bb874da75fa088
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3564562
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/branch-heads/10.1@{v8#12}
Cr-Branched-From: b003970-refs/heads/10.1.124@{#1}
Cr-Branched-From: e62f556-refs/heads/main@{#79503}

…machines

Revision: 1caa896

NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=junyan@redhat.com

Bug: v8:11846
Change-Id: I18e269e00a45566e9f710cd40387b2d88f77a6ad
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2937259
Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/branch-heads/9.2@{v8#12}
Cr-Branched-From: 5123834-refs/heads/9.2.230@{#1}
Cr-Branched-From: 587a04f-refs/heads/master@{#74656}

v8::TracedReference is supposed to be used from objects allocated on
CppHeap. Such objects can be in construction during garbage
collection, meaning that they are unable to invoke
Trace(v8::TraceReference) as they have not been properly set up.

It is thus necessary to use conservative tracing to find
v8::TracedReference (backed by TracedNode in GlobalHandle) in
in-construction objects.

(cherry picked from commit 2c37749)

Bug: v8:13141, chromium:1322114
Change-Id: I2781ca5660c071c13ac34a90cce12625d5b2b3bb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3835687
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/branch-heads/10.5@{v8#12}
Cr-Branched-From: 51c4d6c-refs/heads/10.5.218@{#1}
Cr-Branched-From: c641530-refs/heads/main@{#81851}

Revision: be5738a

NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=junyan@redhat.com

Change-Id: Ic6f07cc059b81a06d5358651e202482211b46c3d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2633625
Reviewed-by: Junliang Yan <junyan@redhat.com>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/branch-heads/8.9@{v8#12}
Cr-Branched-From: 16b9bbb-refs/heads/8.9.255@{#1}
Cr-Branched-From: d16a2a6-refs/heads/master@{#72039}

LLd and Scd should be used for StoreType::kI64Store* types.

(cherry picked from commit 207f489)

Bug: v8:12904
Change-Id: Ia7f86a91f807f7e87a4bd1d4506a691c83ce2194
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3662800
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Liu Yu <liuyu@loongson.cn>
Commit-Queue: Liu Yu <liuyu@loongson.cn>
Cr-Commit-Position: refs/branch-heads/10.3@{v8#12}
Cr-Branched-From: 1a8f4ca-refs/heads/10.3.174@{#1}
Cr-Branched-From: 8fbefa4-refs/heads/main@{#80471}

Bug: chromium:1309225
Change-Id: Ic8184508503ee0099f5e7d0104ce68244c9827e0
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3550257
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Owners-Override: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/branch-heads/10.0@{v8#12}
Cr-Branched-From: 6ea73a7-refs/heads/10.0.139@{#1}
Cr-Branched-From: ccc6890-refs/heads/main@{#79131}

1) Code in JSCallReducer read a FeedbackCell twice and expected the
   result to be the same.

2) JSInliningHeuristics, in the CheckClosure case, assumed that the
   FeedbackCell contains a FeedbackVector.

(cherry picked from commit d90e873)

Bug: chromium:1248743, v8:7790
No-Try: true
No-Presubmit: true
No-Tree-Checks: true
Change-Id: I66d6dd5f7a879c2479572e1896dd78aeedd2fa27
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3162613
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/branch-heads/9.5@{v8#12}
Cr-Branched-From: 4a03d61-refs/heads/9.5.172@{#1}
Cr-Branched-From: 9a60704-refs/heads/main@{#76741}

Change-Id: Icda95f09e9c4c903839f6d765de55c0060535458
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3846152
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/10.6@{v8#12}
Cr-Branched-From: 41bc743-refs/heads/10.6.194@{#1}
Cr-Branched-From: d5f29b9-refs/heads/main@{#82548}

Revision: 9e9d914

BUG=chromium:1292016
R=liviurau@chromium.org

Change-Id: I8b482486e4e95591f941b61204c93273a4258e79
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3447362
Reviewed-by: Liviu Rau <liviurau@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/branch-heads/9.9@{v8#12}
Cr-Branched-From: c4208cc-refs/heads/9.9.115@{#1}
Cr-Branched-From: 19c6fd7-refs/heads/main@{#78682}

…ted to module exports

Revision: e4dba97

BUG=chromium:1260577
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
TBR=ishell@chromium.org

Change-Id: Iab516d6edb15bf9965aa37f5a80956b0e9861bf2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3231340
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/branch-heads/9.6@{v8#12}
Cr-Branched-From: 0b7bda0-refs/heads/9.6.180@{#1}
Cr-Branched-From: 41a5a24-refs/heads/main@{#77244}

Merged: [wasm] Fix return value of lazy compile runtime function
Revision: 22a16bd

Merged: [loong64][mips][wasm] Fix return value of lazy compile runtime function
Revision: 7e50fa6

Merged: PPC/s390: [wasm] Fix return value of lazy compile runtime function
Revision: 68ae81b

Merged: [riscv64] Fix return value of lazy compile runtime function
Revision: bdb2062

R=jkummerow@chromium.org

Bug: chromium:1311960
Change-Id: I7556b2867051931029b0ede1aba5b5321d097c82
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3687697
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/branch-heads/10.2@{v8#12}
Cr-Branched-From: 374091f-refs/heads/10.2.154@{#1}
Cr-Branched-From: f0c353f-refs/heads/main@{#79976}

Change-Id: If08fb926df2c4d828d22025f228bc8698687af2d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3710108
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/10.4@{v8#12}
Cr-Branched-From: b1413ed-refs/heads/10.4.132@{#1}
Cr-Branched-From: 9d0a093-refs/heads/main@{#80972}

Merged: [ptr-cage] Fix Code by PC lookup
Revision: 12dc338

Merged: [ptr-cage] Fix Code by PC lookup, pt.2
Revision: 4ee0a0a

BUG=chromium:1241665,v8:11460
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=verwaest@chromium.org

Change-Id: I12b9af56e9bf0c7c49e8947b42e94c64a96d7391
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3400971
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/branch-heads/9.8@{v8#12}
Cr-Branched-From: e218afa-refs/heads/9.8.177@{#1}
Cr-Branched-From: 86ebfc9-refs/heads/main@{#78312}

This is a reland of b99fe75.
The test is now skipped on non-SIMD hardware.

Original change's description:
> [liftoff][arm64] Zero-extend offsets also for SIMD
>
> This extends https://crrev.com/c/2917612 also for SIMD, which
> (sometimes) uses the special {GetMemOpWithImmOffsetZero} method.
> As part of this CL, that method is renamed to {GetEffectiveAddress}
> which IMO is a better name. Also, it just returns a register to make the
> semantic of that function obvious in the signature.
>
> Drive-by: When sign extending to 32 bit, only write to the W portion of
>           the register. This is a bit cleaner, and I first thought that
>           this would be the bug.
>
> R=jkummerow@chromium.org
> CC=​thibaudm@chromium.org
>
> Bug: chromium:1231950, v8:12018
> Change-Id: Ifaefe1f18e3a00534a30c99e3c37ed09d9508f6e
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3049073
> Reviewed-by: Zhi An Ng <zhin@chromium.org>
> Commit-Queue: Clemens Backes <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#75898}

TBR=thibaudm@chromium.org

(cherry picked from commit 5e90a61)

Bug: chromium:1231950
Change-Id: Ie04cd1e1ae9e653d3774e381f89e4b29f14fb1f8
No-Try: true
No-Tree-Checks: true
No-Presubmit: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3059693
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/branch-heads/9.3@{v8#12}
Cr-Branched-From: 7744dce-refs/heads/9.3.345@{#1}
Cr-Branched-From: 4b6b4ca-refs/heads/master@{#75728}

No-Try: true
No-Presubmit: true
No-Tree-Checks: true
Change-Id: I9de26b1e86783768fc41ec704e1f5b24aabd3cda
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3289182
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Liviu Rau <liviurau@chromium.org>
Cr-Commit-Position: refs/branch-heads/9.7@{v8#12}
Cr-Branched-From: 49162da-refs/heads/9.7.106@{#1}
Cr-Branched-From: a7e9b8f-refs/heads/main@{#77674}

This reverts commit 82ce475.

Reason for revert: trigger builders

Original change's description:
> Whitespace to trigger builders
>
> No-Try: true
> No-Presubmit: true
> No-Tree-Checks: true
> Change-Id: I9de26b1e86783768fc41ec704e1f5b24aabd3cda
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3289182
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Commit-Queue: Liviu Rau <liviurau@chromium.org>
> Cr-Commit-Position: refs/branch-heads/9.7@{v8#12}
> Cr-Branched-From: 49162da-refs/heads/9.7.106@{#1}
> Cr-Branched-From: a7e9b8f-refs/heads/main@{#77674}

Change-Id: I31afa1623dbf70835312cd87b8897d6416a204c8
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3293087
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Liviu Rau <liviurau@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/branch-heads/9.7@{v8#13}
Cr-Branched-From: 49162da-refs/heads/9.7.106@{#1}
Cr-Branched-From: a7e9b8f-refs/heads/main@{#77674}

LoadTransform is always a SIMD operation (it always results in a v128),
so it should unconditionally set has_simd_.

Bug: chromium:1137583
(cherry picked from commit 752aba9)

Change-Id: I1af26eb472dce95ae31f53c74981c97278044243
No-Try: true
No-Presubmit: true
No-Tree-Checks: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2473577
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/branch-heads/8.7@{v8#12}
Cr-Branched-From: 0d81cd7-refs/heads/8.7.220@{#1}
Cr-Branched-From: 942c2ef-refs/heads/master@{#70196}

Otherwise it's propagated to the parent

Bug: chromium:1394973
(cherry picked from commit e1e0890)

Change-Id: Id4e3059a79924c5056823af75688494cc531df40
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4108029
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/branch-heads/10.9@{v8#12}
Cr-Branched-From: 8ade6bf-refs/heads/10.9.194@{aosp-riscv#1}
Cr-Branched-From: 9ff2515-refs/heads/main@{#84164}