…s://codereview.chromium.org/2847923003/ )

Reason for revert:
Linux-nosnap failures:

https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap%20-%20debug/builds/13282

Original issue's description:
> [csa] Add assertions to CSA
>
> This adds a bunch of assertions to CSA, mostly about documenting and checking
> parameter types.
>
> Drive-by-change: Removed unused function.
>
> BUG=v8:6325
>
> Review-Url: https://codereview.chromium.org/2847923003
> Cr-Original-Commit-Position: refs/heads/master@{#45398}
> Committed: https://chromium.googlesource.com/v8/v8/+/b14a981496ad1f841683479d2f9188dfa2d6b4bd
> Review-Url: https://codereview.chromium.org/2847923003
> Cr-Commit-Position: refs/heads/master@{#45443}
> Committed: https://chromium.googlesource.com/v8/v8/+/62b0de1ef53816d6dae3fa519a846f942b701dda

TBR=cbruni@chromium.org,ishell@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:6325

Review-Url: https://codereview.chromium.org/2893253002
Cr-Commit-Position: refs/heads/master@{#45445}

Cr-Commit-Position: refs/branch-heads/5.8@{v8#14}
Cr-Branched-From: eda659c-refs/heads/5.8.283@{#1}
Cr-Branched-From: 4310cd0-refs/heads/master@{#43429}

…ring to LAP. (patchset v8#14 id:540001 of https://codereview.chromium.org/2770003002/ )

Reason for revert:
Speculative: Seems to break webkit_unit_tests:
https://build.chromium.org/p/tryserver.v8/builders/v8_linux_blink_rel/builds/23247
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Mac/builds/11038

Original issue's description:
> Set the current context to the function's context when entering to LAP.
>
> In case of LAP(lazy accessor pair), the function's creation context
> must be equal to the accessor holder's creation context, so this CL
> changes the current context to the accessor holder's creation context.
>
> BUG=v8:6156
>
> Review-Url: https://codereview.chromium.org/2770003002
> Cr-Commit-Position: refs/heads/master@{#46406}
> Committed: https://chromium.googlesource.com/v8/v8/+/18e73287dc65452bc2f952fc005b2251fc32c15a

TBR=jochen@chromium.org,verwaest@chromium.org,mstarzinger@chromium.org,tebbi@google.com,yukishiino@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:6156

Review-Url: https://codereview.chromium.org/2973593002
Cr-Commit-Position: refs/heads/master@{#46408}

Revision: d8e1477

Partially cherry-picked 2bce488 for last_index
accessor.

BUG=chromium:747825,v8:6556,v8:6605
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
TBR=jarin@chromium.org

Change-Id: I1e8192a24700fe1468ae6c5d75510c01d19112a8
Reviewed-on: https://chromium-review.googlesource.com/584845
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.1@{#14}
Cr-Branched-From: 1bf2e10-refs/heads/6.1.534@{#1}
Cr-Branched-From: e825c43-refs/heads/master@{#46746}

TBR=machenbach@chromium.org

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Ic57b5e89499d59d608535dab7b1c44be2e3a90b0
Reviewed-on: https://chromium-review.googlesource.com/661079
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.2@{#14}
Cr-Branched-From: efa2ac4-refs/heads/6.2.414@{#1}
Cr-Branched-From: a861ebb-refs/heads/master@{#47693}

Merged: [ic] Do access checks when storing via JSGlobalProxy.
Revision: 5ea95fe

Merged: [ic] Fix storing to JSGlobalProxy having JSProxy in prototype chain.
Revision: b19a1ba

BUG=chromium:764219
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=verwaest@chromium.org

Change-Id: Icc7dde6ba3faae1aee29c4f3ac1aaa27d94f3124
Reviewed-on: https://chromium-review.googlesource.com/721443
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.3@{#14}
Cr-Branched-From: 094a7c9-refs/heads/6.3.292@{#1}
Cr-Branched-From: 18b8fbb-refs/heads/master@{#48432}

Revision: 80c9b69

BUG=680637
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
TBR=mvstanton@chromium.org

Review-Url: https://codereview.chromium.org/2641183002
Cr-Commit-Position: refs/branch-heads/5.7@{v8#14}
Cr-Branched-From: 975e9a3-refs/heads/5.7.492@{#1}
Cr-Branched-From: 8d76f0e-refs/heads/master@{#42426}

Revision: 9a6f442

BUG=chromium:787301
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=bmeurer@chromium.org

Change-Id: I58698edad5431b87f15614afec8e133f2bc1f7d4
Reviewed-on: https://chromium-review.googlesource.com/828993
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.4@{#14}
Cr-Branched-From: 0407506-refs/heads/6.4.388@{#1}
Cr-Branched-From: a5fc4e0-refs/heads/master@{#49724}

TBR=machenbach@chromium.org

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I33ab8c30247d7863986fadf6f35ff116013cb6c9
Reviewed-on: https://chromium-review.googlesource.com/893682
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.5@{#14}
Cr-Branched-From: 73c55f5-refs/heads/6.5.254@{#1}
Cr-Branched-From: 594a1a0-refs/heads/master@{#50664}

TBR=machenbach@chromium.org

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I7e8771da46fc9d3d4cc8e4eef565d751bb5cf6b4
Reviewed-on: https://chromium-review.googlesource.com/958210
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.6@{#14}
Cr-Branched-From: d500271-refs/heads/6.6.346@{#1}
Cr-Branched-From: 265ef0b-refs/heads/master@{#51624}

Revision: fcb8061

NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true

Change-Id: I8bc32f31b873d144ad99eb70474c71cb7e27b252
Reviewed-on: https://chromium-review.googlesource.com/1013560
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.7@{#14}
Cr-Branched-From: 8457e81-refs/heads/6.7.288@{#2}
Cr-Branched-From: e921be5-refs/heads/master@{#52547}

Cr-Commit-Position: refs/branch-heads/6.0@{v8#14}
Cr-Branched-From: 97dbf62-refs/heads/6.0.286@{#1}
Cr-Branched-From: 12e6f1c-refs/heads/master@{#45439}

TBR=machenbach@chromium.org

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I8e1e64323e815121dcb141a3f62d7fa181e183c7
Reviewed-on: https://chromium-review.googlesource.com/1086973
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.8@{#14}
Cr-Branched-From: 44d7d7d-refs/heads/6.8.275@{#1}
Cr-Branched-From: 5754f66-refs/heads/master@{#53286}

This reverts commit 52a10e5.

Reason for revert: https://test-results.appspot.com/data/layout_results/V8-Blink_Linux_64__dbg_/12434/layout-test-results/results.html

Crash e.g. in http/tests/devtools/oopif/oopif-performance-cpu-profiles.js

crash log for devtools (pid <unknown>):
STDOUT: <empty>
STDERR: 
STDERR: 
STDERR: #
STDERR: # Fatal error in ../../v8/src/compilation-dependencies.cc, line 281
STDERR: # Debug check failed: descriptor == owner->LastAdded() (10 vs. 22).
STDERR: #
STDERR: #
STDERR: #
STDERR: #FailureMessage Object: 0x7fff86878630#0 0x0000031c642c base::debug::StackTrace::StackTrace()
STDERR: #1 0x0000046a56bb gin::(anonymous namespace)::PrintStackTrace()
STDERR: v8#2 0x00000469c528 V8_Fatal()
STDERR: v8#3 0x00000469c285 v8::base::(anonymous namespace)::DefaultDcheckHandler()
STDERR: v8#4 0x000001cc5253 v8::internal::CompilationDependencies::DependOnFieldType()
STDERR: v8#5 0x000001cdcc46 v8::internal::compiler::AccessInfoFactory::ComputePropertyAccessInfo()
STDERR: v8#6 0x000001cde661 v8::internal::compiler::AccessInfoFactory::ComputePropertyAccessInfos()
STDERR: v8#7 0x000001dd982b v8::internal::compiler::JSNativeContextSpecialization::ReduceNamedAccess()
STDERR: v8#8 0x000001ddb715 v8::internal::compiler::JSNativeContextSpecialization::ReduceNamedAccessFromNexus()
STDERR: v8#9 0x000001dd656d v8::internal::compiler::JSNativeContextSpecialization::ReduceJSLoadNamed()
STDERR: v8#10 0x000001d53872 v8::internal::compiler::GraphReducer::Reduce()
STDERR: v8#11 0x000001d534a5 v8::internal::compiler::GraphReducer::ReduceTop()
STDERR: v8#12 0x000001d52e58 v8::internal::compiler::GraphReducer::ReduceNode()
STDERR: v8#13 0x000001e4c201 v8::internal::compiler::InliningPhase::Run()
STDERR: v8#14 0x000001e44f79 v8::internal::compiler::PipelineImpl::Run<>()
STDERR: v8#15 0x000001e41058 v8::internal::compiler::PipelineImpl::CreateGraph()
STDERR: v8#16 0x000001e40c75 v8::internal::compiler::PipelineCompilationJob::PrepareJobImpl()
STDERR: v8#17 0x000001ccd437 v8::internal::OptimizedCompilationJob::PrepareJob()
STDERR: v8#18 0x000001cd071e v8::internal::(anonymous namespace)::GetOptimizedCode()
STDERR: v8#19 0x000001cd0c6f v8::internal::Compiler::CompileOptimized()
STDERR: v8#20 0x00000231fb62 v8::internal::__RT_impl_Runtime_CompileOptimized_Concurrent()
STDERR: v8#21 0x00000288e535 <unknown>

Original change's description:
> [turbofan] Rewrite CompilationDependencies
> 
> Instead of installing code dependencies during graph reduction,
> install them after code generation.
> 
> Bug: v8:7902, v8:7790
> Change-Id: I8a3798254abb5b9ec7c295a1592aeb6b51f24c7a
> Reviewed-on: https://chromium-review.googlesource.com/1119913
> Commit-Queue: Georg Neis <neis@chromium.org>
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#54170}

TBR=mstarzinger@chromium.org,jarin@chromium.org,neis@chromium.org

Change-Id: Ic58c2bfadbd34bb6ba7dc0d2b74871cc90b0a74f
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7902, v8:7790
Reviewed-on: https://chromium-review.googlesource.com/1125680
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54192}

TBR=machenbach@chromium.org

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: Ie5783e9198c62b16e0534c460d6b9f982fc0d691
Reviewed-on: https://chromium-review.googlesource.com/1155262
Reviewed-by: V8 Autoroller <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/6.9@{#14}
Cr-Branched-From: d7b61ab-refs/heads/6.9.427@{#1}
Cr-Branched-From: b7e108d-refs/heads/master@{#54504}

This reverts commit caed2cc.

Reason for revert: Breaks layout tests, e.g.

https://test-results.appspot.com/data/layout_results/V8-Blink_Linux_64__dbg_/14924/webkit_layout_tests%20%28with%20patch%29/layout-test-results/results.html

crash log for renderer (pid <unknown>):
STDOUT: <empty>
STDERR: 
STDERR: 
STDERR: #
STDERR: # Fatal error in ../../v8/src/base/platform/elapsed-timer.h, line 24
STDERR: # Debug check failed: !IsStarted().
STDERR: #
STDERR: #
STDERR: #
STDERR: #FailureMessage Object: 0x7ffc46707640#0 0x565409263b6f base::debug::StackTrace::StackTrace()
STDERR: #1 0x56540a8a32fb gin::(anonymous namespace)::PrintStackTrace()
STDERR: #2 0x56540a8980d8 V8_Fatal()
STDERR: #3 0x56540a897e35 v8::base::(anonymous namespace)::DefaultDcheckHandler()
STDERR: v8#4 0x565407971f02 v8::base::ElapsedTimer::Start()
STDERR: v8#5 0x565407d08edf v8::internal::TimedHistogram::Start()
STDERR: v8#6 0x565407e500d5 v8::internal::IncrementalMarking::AdvanceIncrementalMarkingOnAllocation()
STDERR: v8#7 0x565407e4f977 v8::internal::IncrementalMarking::Observer::Step()
STDERR: v8#8 0x565407e48092 v8::internal::AllocationObserver::AllocationStep()
STDERR: v8#9 0x565407eb0751 v8::internal::SpaceWithLinearArea::InlineAllocationStep()
STDERR: v8#10 0x565407eb3e44 v8::internal::NewSpace::EnsureAllocation()
STDERR: v8#11 0x565407e258ff v8::internal::NewSpace::AllocateRaw()
STDERR: v8#12 0x565407e06b2d v8::internal::Heap::AllocateRaw()
STDERR: v8#13 0x565407e432ef v8::internal::Heap::AllocateRawWithLightRetry()
STDERR: v8#14 0x565407e433cf v8::internal::Heap::AllocateRawWithRetryOrFail()
STDERR: v8#15 0x565407e04d48 v8::internal::Factory::NewFixedArrayWithFiller()
STDERR: v8#16 0x565407fd6339 v8::internal::HashTable<>::New()
STDERR: v8#17 0x565407fd7be8 v8::internal::HashTable<>::EnsureCapacity()
STDERR: v8#18 0x565407fc7e95 v8::internal::Dictionary<>::Add()
STDERR: v8#19 0x565407fcf453 v8::internal::BaseNameDictionary<>::Add()
STDERR: v8#20 0x565407f89ee4 v8::internal::LookupIterator::ApplyTransitionToDataProperty()
STDERR: v8#21 0x5654080036e2 v8::internal::Object::AddDataProperty()
STDERR: v8#22 0x56540793061f v8::internal::(anonymous namespace)::DefineDataProperty()
STDERR: v8#23 0x56540792da59 v8::internal::(anonymous namespace)::InstantiateObject()
STDERR: v8#24 0x56540792b75a v8::internal::(anonymous namespace)::InstantiateFunction()
STDERR: v8#25 0x56540792b4db v8::internal::ApiNatives::InstantiateFunction()
STDERR: v8#26 0x5654079594bf v8::FunctionTemplate::GetFunction()
STDERR: v8#27 0x56540a7af74e blink::V8ObjectConstructor::CreateInterfaceObject()
STDERR: v8#28 0x56540a7afe01 blink::V8PerContextData::ConstructorForTypeSlowCase()
STDERR: v8#29 0x56540a7afdd6 blink::V8PerContextData::ConstructorForTypeSlowCase()
STDERR: v8#30 0x56540a7afdd6 blink::V8PerContextData::ConstructorForTypeSlowCase()
STDERR: v8#31 0x56540a7afcb4 blink::V8PerContextData::CreateWrapperFromCacheSlowCase()
STDERR: v8#32 0x56540a7aef73 blink::V8DOMWrapper::CreateWrapper()
STDERR: v8#33 0x56540a7abf6b blink::ScriptWrappable::Wrap()
STDERR: v8#34 0x56540a677199 blink::V8Document::documentElementAttributeGetterCallback()
STDERR: v8#35 0x565407a0aec3 v8::internal::FunctionCallbackArguments::Call()
STDERR: v8#36 0x565407a097be v8::internal::(anonymous namespace)::HandleApiCallHelper<>()
STDERR: v8#37 0x565407a0877b v8::internal::Builtins::InvokeApiFunction()
STDERR: v8#38 0x565407fe785a v8::internal::Object::GetPropertyWithAccessor()
STDERR: v8#39 0x565407fe697e v8::internal::Object::GetProperty()
STDERR: v8#40 0x565407ec8c71 v8::internal::LoadIC::Load()
STDERR: v8#41 0x565407ed6401 v8::internal::__RT_impl_Runtime_LoadIC_Miss()
STDERR: v8#42 0x5654087593f2 <unknown>
STDERR: [16162:16185:1122/143518.356897:WARNING:crash_handler_host_linux.cc(341)] Could not translate tid, attempt = 1 retry ...


Original change's description:
> [heap] Improve embedder tracing during incremental marking
> 
> Add a path into embedder tracing on allocation. This is safe as as Blink
> is not allowed to call into V8 during object construction.
> 
> Bug: chromium:843903
> Change-Id: I5af053c3169f5a33778ebce5d7c5c43e4efb1aa4
> Reviewed-on: https://chromium-review.googlesource.com/c/1348749
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#57757}

TBR=ulan@chromium.org,mlippautz@chromium.org

Change-Id: Ide2c0b284b52bee17573adcc89f14be4e40dab91
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:843903
Reviewed-on: https://chromium-review.googlesource.com/c/1349189
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57759}

TBR=v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com

Change-Id: Icc4497632fc30b0a2bc57c07dc61e6f4f0060413
Reviewed-on: https://chromium-review.googlesource.com/c/1370007
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/7.2@{v8#14}
Cr-Branched-From: 6acd03c-refs/heads/7.2.502@{#1}
Cr-Branched-From: b03041d-refs/heads/master@{#57910}

TBR=v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com

Change-Id: I2593fb4e859f5a477d33cab19f8115fdd2a48a16
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1523367
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/7.4@{v8#14}
Cr-Branched-From: 3e8a733-refs/heads/7.4.288@{#1}
Cr-Branched-From: d077f9b-refs/heads/master@{#60039}

Check aliased FP registers when constructing the {to_be_live} set from
multiple predecessors.

TBR=sigurds@chromium.org
(cherry picked from commit 8c050b7)

Bug: chromium:1029642
No-Try: true
No-Presubmit: true
No-Tree-Checks: true
Change-Id: I7beb22d5c4cc62be4e6b8453fb00f9c16a564433
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1969899
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/branch-heads/8.0@{v8#14}
Cr-Branched-From: 69827db-refs/heads/8.0.426@{v8#2}
Cr-Branched-From: 2fe1552-refs/heads/master@{#65318}

Revision: 8738ab8

BUG=v8:10198,v8:9706,chromium:1045034
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=ulan@chromium.org

Change-Id: Ic7c5a705a841a8f55407bd1caebaea4300e2b14a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2056852
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/branch-heads/8.1@{v8#14}
Cr-Branched-From: a4dcd39-refs/heads/8.1.307@{#1}
Cr-Branched-From: f22c213-refs/heads/master@{#66031}

When filling stack slots, the start offset can be too large to fit into
the immediate of a str instruction (which is used to handle remainders
after stp). For example, a function with 32 i64 params will require 256
bytes reserved for the params, so the offset starts at 256 + 16
(instance) = 272. This does not fit into a int9, so we hit an
UNREACHABLE case when emitting str.

The fix here checks that start can fit in an unscaled immediate, and if
it doesn't fallback to the general case. We could use the Str
from macro-asesmbler, but that uses another instruction, so we are not
saving anything.

A check for IsImmLSUnscaled(-start-12) is sufficient because 12 is the
largest possible value for remainder. So if -start-12 fits, everything
else will fit.

TBR=clemensb@chromium.org

(cherry picked from commit c92e74f)

Bug: v8:10645
Change-Id: Ibde69e667693e9c2c267469181db79c91e4aa765
No-Try: true
No-Presubmit: true
No-Tree-Checks: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2274084
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/branch-heads/8.5@{v8#14}
Cr-Branched-From: a7f8bc4-refs/heads/8.5.210@{#1}
Cr-Branched-From: dd58472-refs/heads/master@{#68510}

…x field

Revision: 35d8b9a

BUG=chromium:1003286
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=mvstanton@chromium.org

Change-Id: Icdf6e132f3a7b39ae8532f878923e373500d3f33
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1820937
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/branch-heads/7.8@{v8#14}
Cr-Branched-From: 73694fd-refs/heads/7.8.279@{#1}
Cr-Branched-From: 2314928-refs/heads/master@{#63555}

This reverts commit a22b7b5.

Reason for revert: Breaks presubmit bot - https://ci.chromium.org/p/v8/builders/ci/V8%20Presubmit%20-%20beta%20branch/252

Original change's description:
> Merged: [turbofan] Fix memory corruption
> 
> Revision: f16a3a7
> 
> BUG=chromium:997057
> LOG=N
> NOTRY=true
> NOPRESUBMIT=true
> NOTREECHECKS=true
> R=​hablich@chromium.org
> 
> Change-Id: I179a853f4e8765d251ac59c2a31a554bc9bb0041
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1768362
> Reviewed-by: Michael Hablich <hablich@chromium.org>
> Cr-Commit-Position: refs/branch-heads/7.7@{v8#12}
> Cr-Branched-From: 4035531-refs/heads/7.7.299@{#1}
> Cr-Branched-From: 1320c91-refs/heads/master@{#62881}

TBR=hablich@chromium.org,mslekova@chromium.org

Change-Id: I827ff48d9400c24b400defa437d17f21faf0da8e
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:997057
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1768364
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/branch-heads/7.7@{v8#14}
Cr-Branched-From: 4035531-refs/heads/7.7.299@{#1}
Cr-Branched-From: 1320c91-refs/heads/master@{#62881}

TBR=v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com

Change-Id: I7870cad33c16bd5378c81b013dbee4c8a55f6f53
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1871953
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/7.9@{v8#14}
Cr-Branched-From: be181e2-refs/heads/7.9.317@{#1}
Cr-Branched-From: 0d7889d-refs/heads/master@{#64307}

…al memory

Revision: dfa7e3f

BUG=chromium:914304
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=ulan@chromium.org

Change-Id: I9a71b14cf80594550d9cd9770fdc8a908425467f
Reviewed-on: https://chromium-review.googlesource.com/c/1456103
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/branch-heads/7.3@{v8#14}
Cr-Branched-From: 9df9418-refs/heads/7.3.492@{v8#2}
Cr-Branched-From: be213cf-refs/heads/master@{#59024}

Revision: 78e5763

BUG=chromium:881247
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=ishell@chromium.org

Change-Id: I22f54875f6ee8db7aa15f2d92d25495baa808e3c
Reviewed-on: https://chromium-review.googlesource.com/c/1297964
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/branch-heads/7.1@{v8#14}
Cr-Branched-From: f70aaa8-refs/heads/7.1.302@{#1}
Cr-Branched-From: 1dbcc78-refs/heads/master@{#56462}

Revision: 1a3c514

BUG=chromium:1239144
R=mlippautz@chromium.org

Change-Id: Ie86c2c80bdc5f51e91aac5230a72d097bede020d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3100208
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/branch-heads/9.4@{v8#14}
Cr-Branched-From: 3b51863-refs/heads/9.4.146@{#1}
Cr-Branched-From: 2890419-refs/heads/master@{#76233}

…t wasm

(cherry picked from commit 2b14bd0)

Bug: chromium:1260621
No-Try: true
No-Presubmit: true
No-Tree-Checks: true
Change-Id: I23dc6b2a20fce2f9c625b190eef91fc27dbd3644
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3242003
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/branch-heads/9.6@{v8#14}
Cr-Branched-From: 0b7bda0-refs/heads/9.6.180@{#1}
Cr-Branched-From: 41a5a24-refs/heads/main@{#77244}

R=​clemensb@chromium.org

(cherry picked from commit 13640f6)

Bug: chromium:1307603
No-Try: true
No-Presubmit: true
No-Tree-Checks: true
Change-Id: I6963a0bfe7e132f6c7e3034b9e5df8295fcd80e6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3570425
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/branch-heads/10.1@{v8#14}
Cr-Branched-From: b003970-refs/heads/10.1.124@{#1}
Cr-Branched-From: e62f556-refs/heads/main@{#79503}

Merged: Disable left-trimming when optimizing compile jobs exist
Revision: ac0605a

Merged: [heap] Don't assume that optimizing-compile-dispatcher exists
Revision: 022b312

BUG=chromium:1211215,chromium:1215514
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=dinfuehr@chromium.org

Change-Id: I6de22e11e8ace53fb247bba539feaa83874ea609
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2939989
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/branch-heads/9.2@{v8#14}
Cr-Branched-From: 5123834-refs/heads/9.2.230@{#1}
Cr-Branched-From: 587a04f-refs/heads/master@{#74656}

…ters

.. and

[compiler] Don't iterate past end of StateValuesAccess iterator

The two CLs were reviewed on

https://chromium-review.googlesource.com/c/v8/v8/+/2625879
https://chromium-review.googlesource.com/c/v8/v8/+/2637213

Tbr: neis@chromium.org
Bug: chromium:1167709,chromium:1166136
Change-Id: Ia646f7482cc19e3da59e1e6c76228b42fce805b5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2640457
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/branch-heads/8.9@{v8#14}
Cr-Branched-From: 16b9bbb-refs/heads/8.9.255@{#1}
Cr-Branched-From: d16a2a6-refs/heads/master@{#72039}

Merged: [wasm] Fix return value of lazy compile runtime function
Revision: 22a16bd

Merged: [loong64][mips][wasm] Fix return value of lazy compile runtime function
Revision: 7e50fa6

Merged: PPC/s390: [wasm] Fix return value of lazy compile runtime function
Revision: 68ae81b

Merged: [riscv64] Fix return value of lazy compile runtime function
Revision: bdb2062

R=jkummerow@chromium.org

Bug: chromium:1311960
Change-Id: I0f32b5900660046fae0f680250db710a1add1b3e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3676854
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/branch-heads/10.3@{v8#14}
Cr-Branched-From: 1a8f4ca-refs/heads/10.3.174@{#1}
Cr-Branched-From: 8fbefa4-refs/heads/main@{#80471}

They make assumptions which don't hold for API handlers.

Merge issues:
  Conflicts in the bytecode test expectations

(cherry picked from commit c6b68cb)

Bug: v8:9237,chromium:1308360
Change-Id: Iffe4adddb6d0ab469b6bc78af1d40d73f29ffa38
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3550584
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/branch-heads/10.0@{v8#14}
Cr-Branched-From: 6ea73a7-refs/heads/10.0.139@{#1}
Cr-Branched-From: ccc6890-refs/heads/main@{#79131}

The function used raw pointers but also created Refs, which can cause
GC. Thus the code isn't safe (this has already lead to crashes in an
older version of the code).

Drive-by: Remove unnecessary native_context field (get the native
context from the context instead).

(cherry picked from commit 23b4cc8)

Bug: v8:12205, v8:7790
No-Try: true
No-Presubmit: true
No-Tree-Checks: true
Change-Id: I4868323f48fc411e8462b7824fde3d8715b55abc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3162615
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/branch-heads/9.5@{v8#14}
Cr-Branched-From: 4a03d61-refs/heads/9.5.172@{#1}
Cr-Branched-From: 9a60704-refs/heads/main@{#76741}

…ocale::TextInfo

Originally, the check "if (orientation == ULOC_LAYOUT_LTR)" lead dir
to be "rtl" when orientation is "ltr". Fix it to correct check
"if (orientation == ULOC_LAYOUT_RTL)"

(cherry picked from commit 838b755)

Bug: v8:12531
Change-Id: I5fba29466c66b4fd05e31ddbe4083c16c19e9005
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3459928
Reviewed-by: Frank Tang <ftang@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Original-Commit-Position: refs/heads/main@{#79213}
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3488781
Cr-Commit-Position: refs/branch-heads/9.9@{v8#14}
Cr-Branched-From: c4208cc-refs/heads/9.9.115@{#1}
Cr-Branched-From: 19c6fd7-refs/heads/main@{#78682}

In https://crrev.com/c/3522896 we changed the last_id_ to be a member
variable. This subtly changed how profile id's were generated.

This CL changes this part back to a static variable that guarantees
process-wide unique profile ids.

Bug: chromium:1330726, chromium:1297283
(cherry picked from commit f1c4fd3)

Change-Id: Ie1314ab576668cfc550f8bf12a15803dc17b4405
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3688397
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/branch-heads/10.2@{v8#14}
Cr-Branched-From: 374091f-refs/heads/10.2.154@{#1}
Cr-Branched-From: f0c353f-refs/heads/main@{#79976}

Change-Id: Iaf128e839847e9fd8c85f034490e28031c8d459b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3714895
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/10.4@{v8#14}
Cr-Branched-From: b1413ed-refs/heads/10.4.132@{#1}
Cr-Branched-From: 9d0a093-refs/heads/main@{#80972}

Previously, StoreOwnIC incorrectly reuses the [[Set]] semantics
when initializing public literal class fields and object literals in
certain cases (e.g. when there's no feedback).
This was less of an issue for object literals, but with public class
fields it's possible to define property attributes while the
instance is still being initialized, or to encounter existing static
"name" or "length" properties that should be readonly. This patch
fixes it by

1) Emitting code that calls into the slow stub when
   handling StoreOwnIC with existing read-only properties.
2) Adding extra steps in StoreIC::Store to handle such stores
   properly with [[DefineOwnProperty]] semantics.

Bug: v8:12421, v8:9888

(cherry picked from commit 80bbbb1)

Change-Id: I6547320a1caba58c66ee1043cd3183a2de7cefef
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3405392
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Lutz Vahl <vahl@chromium.org>
Cr-Commit-Position: refs/branch-heads/9.8@{v8#14}
Cr-Branched-From: e218afa-refs/heads/9.8.177@{#1}
Cr-Branched-From: 86ebfc9-refs/heads/main@{#78312}

Merged: [debug] correctly tier down function for side effect check mode
Revision: dc49fe0

Merged: Fix test expectation for new inspector test
Revision: 04ade0b

Merged: Skip regress-crbug-1233401 for jitless mode
Revision: 06ae019

BUG=chromium:1233401
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=kimanh@chromium.org

Change-Id: I90b6d02c16655fd21213b1d73e8ac4da480d5eff
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3064605
Reviewed-by: Kim-Anh Tran <kimanh@chromium.org>
Cr-Commit-Position: refs/branch-heads/9.3@{v8#14}
Cr-Branched-From: 7744dce-refs/heads/9.3.345@{#1}
Cr-Branched-From: 4b6b4ca-refs/heads/master@{#75728}

TBR=v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com

Change-Id: I38bd3ba0e3d771a7f4eb21cb5999e1f71a12a36a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3288242
Reviewed-by: Liviu Rau <liviurau@chromium.org>
Commit-Queue: Liviu Rau <liviurau@chromium.org>
Cr-Commit-Position: refs/branch-heads/9.7@{v8#14}
Cr-Branched-From: 49162da-refs/heads/9.7.106@{#1}
Cr-Branched-From: a7e9b8f-refs/heads/main@{#77674}

Revision: 518d67a

BUG=chromium:1133527
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=verwaest@chromium.org

Change-Id: I95929cfa42f052930121505d252a6726aeb10356
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2487121
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/branch-heads/8.7@{v8#14}
Cr-Branched-From: 0d81cd7-refs/heads/8.7.220@{#1}
Cr-Branched-From: 942c2ef-refs/heads/master@{#70196}

When loading a 32-bit value from the stack, just load 32 bit and
zero-extend them into the target register, instead of loading the full
64 bits.

As there are things to fix (see https://crbug.com/1356461), we only
enable this optimization for Wasm for now.

Also include the related fix https://crrev.com/c/4096985.

R=mslekova@chromium.org

(cherry picked from commit 2ee5244)
(cherry picked from commit a382099)

Bug: chromium:1395604
Change-Id: I9c507fcb7ba3c0bf6c47f3ee361992840e02dffc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4110917
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/branch-heads/10.9@{v8#14}
Cr-Branched-From: 8ade6bf-refs/heads/10.9.194@{aosp-riscv#1}
Cr-Branched-From: 9ff2515-refs/heads/main@{#84164}

Bug: v8:10470
Change-Id: Id9d82173ed776ce4237e6cd36d39bbd7f05ca539
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4146434
Reviewed-by: Alexander Schulze <alexschulze@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/branch-heads/11.0@{v8#14}
Cr-Branched-From: 06097c6-refs/heads/11.0.226@{#1}
Cr-Branched-From: 6bf3344-refs/heads/main@{#84857}

Revision: ed45f59

BUG=v8:5498
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
TBR=hablich@chromium.org

Review URL: https://codereview.chromium.org/2424473002 .

Cr-Commit-Position: refs/branch-heads/5.5@{v8#14}
Cr-Branched-From: 3cbd583-refs/heads/5.5.372@{#1}
Cr-Branched-From: b3c8b0c-refs/heads/master@{#40015}

Merged 7614362

[turbofan] Set elements kind to holey if constructing array of possibly non-zero length.

BUG=chromium:621147
LOG=N
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/2131003003 .

Cr-Commit-Position: refs/branch-heads/5.3@{v8#14}
Cr-Branched-From: 820a23a-refs/heads/5.3.332@{v8#2}
Cr-Branched-From: 37538cb-refs/heads/master@{#37308}

Change-Id: Ib9ffae05291d088e653324a8796fcdfb52905793
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4294477
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/11.2@{v8#14}
Cr-Branched-From: 755511a-refs/heads/11.2.214@{#1}
Cr-Branched-From: e6b1cce-refs/heads/main@{#86014}

The split is rudimental and now is not needed at all:
- as part of the shared-cage effort we added HeapHandle pointer to the
  BasePageHandle class (on the API side);
- for the value-full barrier we get HeapHandle from bitmasking the
  value;
- for the value-less barrier we get it from the callback provided by the
  caller.

The CL entirely removes the split and uses the single
BoundedPageAllocator. A minor note: the conservative stack scanning can
become sligthly more expensive.

Bug: chromium:1361582, chromium:1325007, chromium:1353749

(cherry picked from commit 411cd56)

(cherry picked from commit b038343)

Change-Id: I2a8aded3dd12037998f36341c68af8e23b0dcd88
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3912055
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Cr-Original-Commit-Position: refs/branch-heads/10.7@{v8#14}
Cr-Original-Branched-From: 4d2145c-refs/heads/10.7.193@{#1}
Cr-Original-Branched-From: 9521696-refs/heads/main@{#83201}
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3918416
Cr-Commit-Position: refs/branch-heads/10.6@{v8#35}
Cr-Branched-From: 41bc743-refs/heads/10.6.194@{#1}
Cr-Branched-From: d5f29b9-refs/heads/main@{#82548}

Cr-Commit-Position: refs/branch-heads/5.4@{v8#14}
Cr-Branched-From: 5ce2827-refs/heads/5.4.500@{v8#2}
Cr-Branched-From: ad07b49-refs/heads/master@{#38841}

Cr-Commit-Position: refs/branch-heads/5.6@{v8#14}
Cr-Branched-From: bdd3886-refs/heads/5.6.326@{#1}
Cr-Branched-From: 879f659-refs/heads/master@{#41014}

Replace U+202F with U+0020 after formatting date. This lets websites
continue to work without any changes.

This matches Firefox behavior, according to
https://bugzilla.mozilla.org/show_bug.cgi?id=1806042#c17.

(cherry picked from commit 90be99f)

Bug: chromium:1414292, chromium:1401829, chromium:1392814
Change-Id: I1c41f6a8d1ec532936743586d01a45f0d8bc30a3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4240360
Commit-Queue: Adam Klein <adamk@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/11.1@{v8#14}
Cr-Branched-From: c77793a-refs/heads/11.1.277@{#1}
Cr-Branched-From: 95b79bf-refs/heads/main@{#85479}

Major improvements on Speedometer and minor on JetStream
https://pinpoint-dot-chromeperf.appspot.com/job/136fcb8c260000
https://pinpoint-dot-chromeperf.appspot.com/job/159ebe74260000

(cherry picked from commit 3ca992e)

Bug: v8:7700
Change-Id: I17fb8cd84519e6611c7270010a0acd2964adb22b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4525907
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Lutz Vahl <vahl@chromium.org>
Cr-Commit-Position: refs/branch-heads/11.4@{v8#14}
Cr-Branched-From: 8a8a1e7-refs/heads/11.4.183@{#1}
Cr-Branched-From: 5483d8e-refs/heads/main@{#87241}

Cr-Commit-Position: refs/branch-heads/5.9@{v8#14}
Cr-Branched-From: fe9bb7e-refs/heads/5.9.211@{#1}
Cr-Branched-From: 70ad237-refs/heads/master@{#44591}

Revision: 3ec02e3

BUG=chromium:1359294,v8:12578
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=mlippautz@chromium.org

Change-Id: I565f412cc63b102c0032775b48680e1f9868ef73
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3882978
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/branch-heads/10.5@{v8#14}
Cr-Branched-From: 51c4d6c-refs/heads/10.5.218@{#1}
Cr-Branched-From: c641530-refs/heads/main@{#81851}

(cherry picked from commit fa81078)

Bug: chromium:1432210
Change-Id: I8aa4c3f1d9ecbfffce503085c2879416ff916c69
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4417690
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Cr-Original-Commit-Position: refs/heads/main@{#87045}
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4419051
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Lutz Vahl <vahl@chromium.org>
Cr-Commit-Position: refs/branch-heads/11.3@{v8#14}
Cr-Branched-From: b0a3a06-refs/heads/11.3.244@{#1}
Cr-Branched-From: 0326cf6-refs/heads/main@{#86647}

This reverts commit 1f26e44.

Reason for revert: https://crbug.com/1453645#c12

Original change's description:
> [arm64][turbofan] Word[32|64]Select support
>
> Enable the use of csel.
>
> Change-Id: I6c2d3cc835149ce4beeb7334985ad2c11300d2c8
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4374179
> Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
> Commit-Queue: Martyn Capewell <martyn.capewell@arm.com>
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#87165}

(cherry picked from commit 51311a8)

Bug: chromium:1451929, chromium:1453645
Change-Id: I9b8a9c04b796a8459d3614eb5979e0ed99340ac8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4607616
Commit-Queue: Adam Klein <adamk@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/11.5@{v8#14}
Cr-Branched-From: 0c4044b-refs/heads/11.5.150@{#1}
Cr-Branched-From: b71d303-refs/heads/main@{#87781}

We usually use t9 as the jump target register in mips64 (t7 in
loong64), and change PushAllRegistersAndIterateStack to be so.

Besides, fix an error in loong64, the frame pointer is fp instead
of s8.

(cherry picked from commit ff2e308)

Bug: v8:14138
Change-Id: I4b2618adc0ed78da9a8a9580f15d68ef2940eb11
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4629799
Auto-Submit: Liu Yu <liuyu@loongson.cn>
Reviewed-by: Lutz Vahl <vahl@chromium.org>
Commit-Queue: Lutz Vahl <vahl@chromium.org>
Cr-Commit-Position: refs/branch-heads/11.6@{v8#14}
Cr-Branched-From: e29c028-refs/heads/11.6.189@{v8#3}
Cr-Branched-From: 95cbef2-refs/heads/main@{#88340}