This reverts commit d734370.

Reason for revert: broke some branch builders like https://build.chromium.org/p/client.v8.branches/builders/V8%20arm%20-%20sim%20-%20beta%20branch%20-%20debug

Original change's description:
> Merged: Revert "Enable icu-timezone-data by default"
> 
> This reverts commit d9a2584.
> This is for 6.3 branch (to go with Chromium 63 branch). 
> 
> Reason for revert:
> 
> I'm reverting this CL for a few reasons. #2 is the most significant and
> I should have thought of that before making a switch. Sorry for that.
> 
> 1) perf-regression: http://crbug.com/769706
> 2) http://crbug.com/612010 : ICU timezone update is not propagated to
> zygote process so that new tabs will hold on to an old timezone even
> after a timezone change on Linux and Chrome OS.
> 
> 3)  http://crbug.com/754053  : OS timezone detection issues on macOS
> 10.13, Ubutu 16, RHEL 7, SuSe Linux 12 or newer. ; it's being fixed. So,
> it actually ok.
> 
> 4)  http://crbug.com/771868  : timezone wrong in gmail: If it's due to
> 
> Revision: 28ef8dc
> 
> BUG=chromium:612010,chromium:769706,chromium:771868,v8:2137,v8:6031,v8:6076
> LOG=N
> NOTRY=true
> NOPRESUBMIT=true
> NOTREECHECKS=true
> R=​adamk@chromium.org, hablich@chromium.org
> 
> Change-Id: Id0093c2bc69e5bc1d3b7147b7bbcc633ed625a45
> Reviewed-on: https://chromium-review.googlesource.com/721919
> Reviewed-by: Adam Klein <adamk@chromium.org>
> Commit-Queue: Jungshik Shin <jshin@chromium.org>
> Cr-Commit-Position: refs/branch-heads/6.3@{#7}
> Cr-Branched-From: 094a7c9-refs/heads/6.3.292@{#1}
> Cr-Branched-From: 18b8fbb-refs/heads/master@{#48432}

TBR=adamk@chromium.org,hablich@chromium.org,jshin@chromium.org

Change-Id: I8b30f8f9c63b93cb000facbf910ed111ca3f9ab2
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:612010, chromium:769706, chromium:771868, v8:2137, v8:6031, v8:6076
Reviewed-on: https://chromium-review.googlesource.com/723324
Reviewed-by: Michael Hablich <hablich@chromium.org>
Commit-Queue: Michael Hablich <hablich@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.3@{#18}
Cr-Branched-From: 094a7c9-refs/heads/6.3.292@{#1}
Cr-Branched-From: 18b8fbb-refs/heads/master@{#48432}

This reverts commit 3b1cfa3.

Reason for revert: ICU was not rolled in 6.3 branch leading invalid-locale test failure (that was added to test an ICU fix). Now, ICU is rolled in 6.3 branch ( https://chromium-review.googlesource.com/c/v8/v8/+/723564 ). 

Original change's description:
> Revert "Merged: Revert "Enable icu-timezone-data by default""
> 
> This reverts commit d734370.
> 
> Reason for revert: broke some branch builders like https://build.chromium.org/p/client.v8.branches/builders/V8%20arm%20-%20sim%20-%20beta%20branch%20-%20debug
> 
> Original change's description:
> > Merged: Revert "Enable icu-timezone-data by default"
> > 
> > This reverts commit d9a2584.
> > This is for 6.3 branch (to go with Chromium 63 branch). 
> > 
> > Reason for revert:
> > 
> > I'm reverting this CL for a few reasons. #2 is the most significant and
> > I should have thought of that before making a switch. Sorry for that.
> > 
> > 1) perf-regression: http://crbug.com/769706
> > 2) http://crbug.com/612010 : ICU timezone update is not propagated to
> > zygote process so that new tabs will hold on to an old timezone even
> > after a timezone change on Linux and Chrome OS.
> > 
> > 3)  http://crbug.com/754053  : OS timezone detection issues on macOS
> > 10.13, Ubutu 16, RHEL 7, SuSe Linux 12 or newer. ; it's being fixed. So,
> > it actually ok.
> > 
> > 4)  http://crbug.com/771868  : timezone wrong in gmail: If it's due to
> > 
> > Revision: 28ef8dc
> > 
> > BUG=chromium:612010,chromium:769706,chromium:771868,v8:2137,v8:6031,v8:6076
> > LOG=N
> > NOTRY=true
> > NOPRESUBMIT=true
> > NOTREECHECKS=true
> > R=​adamk@chromium.org, hablich@chromium.org
> > 
> > Change-Id: Id0093c2bc69e5bc1d3b7147b7bbcc633ed625a45
> > Reviewed-on: https://chromium-review.googlesource.com/721919
> > Reviewed-by: Adam Klein <adamk@chromium.org>
> > Commit-Queue: Jungshik Shin <jshin@chromium.org>
> > Cr-Commit-Position: refs/branch-heads/6.3@{#7}
> > Cr-Branched-From: 094a7c9-refs/heads/6.3.292@{#1}
> > Cr-Branched-From: 18b8fbb-refs/heads/master@{#48432}
> 
> TBR=adamk@chromium.org,hablich@chromium.org,jshin@chromium.org
> 
> Change-Id: I8b30f8f9c63b93cb000facbf910ed111ca3f9ab2
> No-Presubmit: true
> No-Tree-Checks: true
> No-Try: true
> Bug: chromium:612010, chromium:769706, chromium:771868, v8:2137, v8:6031, v8:6076
> Reviewed-on: https://chromium-review.googlesource.com/723324
> Reviewed-by: Michael Hablich <hablich@chromium.org>
> Commit-Queue: Michael Hablich <hablich@chromium.org>
> Cr-Commit-Position: refs/branch-heads/6.3@{#18}
> Cr-Branched-From: 094a7c9-refs/heads/6.3.292@{#1}
> Cr-Branched-From: 18b8fbb-refs/heads/master@{#48432}

TBR=adamk@chromium.org,hablich@chromium.org,jshin@chromium.org

Change-Id: I8f712f1e6eb1f14c703ffe9f1d63d23b4b4bb08e
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:612010, chromium:769706, chromium:771868, v8:2137, v8:6031, v8:6076
Reviewed-on: https://chromium-review.googlesource.com/723962
Reviewed-by: Michael Hablich <hablich@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Jungshik Shin <jshin@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.3@{#21}
Cr-Branched-From: 094a7c9-refs/heads/6.3.292@{#1}
Cr-Branched-From: 18b8fbb-refs/heads/master@{#48432}

…iteral slots

Revision: 55feaae

BUG=v8:5456
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=jochen@chromium.org

Review-Url: https://codereview.chromium.org/2657573002 .
Cr-Commit-Position: refs/branch-heads/5.7@{v8#18}
Cr-Branched-From: 975e9a3-refs/heads/5.7.492@{#1}
Cr-Branched-From: 8d76f0e-refs/heads/master@{#42426}

…text.

Revision: 649ab06

BUG=chromium:794822
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=sigurds@chromium.org

Change-Id: I201d016de010d364581a627851d4ffe6ef774afb
Reviewed-on: https://chromium-review.googlesource.com/832479
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.4@{#18}
Cr-Branched-From: 0407506-refs/heads/6.4.388@{#1}
Cr-Branched-From: a5fc4e0-refs/heads/master@{#49724}

TBR=machenbach@chromium.org

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I78c9d35ad861b9c51d2b2614ce0038f98a9d53cf
Reviewed-on: https://chromium-review.googlesource.com/895723
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.5@{#18}
Cr-Branched-From: 73c55f5-refs/heads/6.5.254@{#1}
Cr-Branched-From: 594a1a0-refs/heads/master@{#50664}

TBR=machenbach@chromium.org

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I75ce8279e66518d3438733131b21f72c5a35c773
Reviewed-on: https://chromium-review.googlesource.com/958213
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.6@{#18}
Cr-Branched-From: d500271-refs/heads/6.6.346@{#1}
Cr-Branched-From: 265ef0b-refs/heads/master@{#51624}

Revision: e184dca

NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true

Change-Id: Idc4659ea9c727a171d12adc58584a87fab873c1c
Bug: v8:7655
Reviewed-on: https://chromium-review.googlesource.com/1013706
Reviewed-by: Sreten Kovacevic <sreten.kovacevic@mips.com>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.7@{#18}
Cr-Branched-From: 8457e81-refs/heads/6.7.288@{#2}
Cr-Branched-From: e921be5-refs/heads/master@{#52547}

Cr-Commit-Position: refs/branch-heads/6.0@{v8#18}
Cr-Branched-From: 97dbf62-refs/heads/6.0.286@{#1}
Cr-Branched-From: 12e6f1c-refs/heads/master@{#45439}

TBR=machenbach@chromium.org

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I43455cc9d226bda69f5d0c89c60f024afc870760
Reviewed-on: https://chromium-review.googlesource.com/1090405
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.8@{#18}
Cr-Branched-From: 44d7d7d-refs/heads/6.8.275@{#1}
Cr-Branched-From: 5754f66-refs/heads/master@{#53286}

This reverts commit 52a10e5.

Reason for revert: https://test-results.appspot.com/data/layout_results/V8-Blink_Linux_64__dbg_/12434/layout-test-results/results.html

Crash e.g. in http/tests/devtools/oopif/oopif-performance-cpu-profiles.js

crash log for devtools (pid <unknown>):
STDOUT: <empty>
STDERR: 
STDERR: 
STDERR: #
STDERR: # Fatal error in ../../v8/src/compilation-dependencies.cc, line 281
STDERR: # Debug check failed: descriptor == owner->LastAdded() (10 vs. 22).
STDERR: #
STDERR: #
STDERR: #
STDERR: #FailureMessage Object: 0x7fff86878630#0 0x0000031c642c base::debug::StackTrace::StackTrace()
STDERR: #1 0x0000046a56bb gin::(anonymous namespace)::PrintStackTrace()
STDERR: v8#2 0x00000469c528 V8_Fatal()
STDERR: v8#3 0x00000469c285 v8::base::(anonymous namespace)::DefaultDcheckHandler()
STDERR: v8#4 0x000001cc5253 v8::internal::CompilationDependencies::DependOnFieldType()
STDERR: v8#5 0x000001cdcc46 v8::internal::compiler::AccessInfoFactory::ComputePropertyAccessInfo()
STDERR: v8#6 0x000001cde661 v8::internal::compiler::AccessInfoFactory::ComputePropertyAccessInfos()
STDERR: v8#7 0x000001dd982b v8::internal::compiler::JSNativeContextSpecialization::ReduceNamedAccess()
STDERR: v8#8 0x000001ddb715 v8::internal::compiler::JSNativeContextSpecialization::ReduceNamedAccessFromNexus()
STDERR: v8#9 0x000001dd656d v8::internal::compiler::JSNativeContextSpecialization::ReduceJSLoadNamed()
STDERR: v8#10 0x000001d53872 v8::internal::compiler::GraphReducer::Reduce()
STDERR: v8#11 0x000001d534a5 v8::internal::compiler::GraphReducer::ReduceTop()
STDERR: v8#12 0x000001d52e58 v8::internal::compiler::GraphReducer::ReduceNode()
STDERR: v8#13 0x000001e4c201 v8::internal::compiler::InliningPhase::Run()
STDERR: v8#14 0x000001e44f79 v8::internal::compiler::PipelineImpl::Run<>()
STDERR: v8#15 0x000001e41058 v8::internal::compiler::PipelineImpl::CreateGraph()
STDERR: v8#16 0x000001e40c75 v8::internal::compiler::PipelineCompilationJob::PrepareJobImpl()
STDERR: v8#17 0x000001ccd437 v8::internal::OptimizedCompilationJob::PrepareJob()
STDERR: v8#18 0x000001cd071e v8::internal::(anonymous namespace)::GetOptimizedCode()
STDERR: v8#19 0x000001cd0c6f v8::internal::Compiler::CompileOptimized()
STDERR: v8#20 0x00000231fb62 v8::internal::__RT_impl_Runtime_CompileOptimized_Concurrent()
STDERR: v8#21 0x00000288e535 <unknown>

Original change's description:
> [turbofan] Rewrite CompilationDependencies
> 
> Instead of installing code dependencies during graph reduction,
> install them after code generation.
> 
> Bug: v8:7902, v8:7790
> Change-Id: I8a3798254abb5b9ec7c295a1592aeb6b51f24c7a
> Reviewed-on: https://chromium-review.googlesource.com/1119913
> Commit-Queue: Georg Neis <neis@chromium.org>
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#54170}

TBR=mstarzinger@chromium.org,jarin@chromium.org,neis@chromium.org

Change-Id: Ic58c2bfadbd34bb6ba7dc0d2b74871cc90b0a74f
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7902, v8:7790
Reviewed-on: https://chromium-review.googlesource.com/1125680
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54192}

TBR=machenbach@chromium.org

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: Ic8104d98b86edfc5ecd294bf578a3efe61ded0bd
Reviewed-on: https://chromium-review.googlesource.com/1156057
Reviewed-by: V8 Autoroller <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/6.9@{#18}
Cr-Branched-From: d7b61ab-refs/heads/6.9.427@{#1}
Cr-Branched-From: b7e108d-refs/heads/master@{#54504}

This reverts commit caed2cc.

Reason for revert: Breaks layout tests, e.g.

https://test-results.appspot.com/data/layout_results/V8-Blink_Linux_64__dbg_/14924/webkit_layout_tests%20%28with%20patch%29/layout-test-results/results.html

crash log for renderer (pid <unknown>):
STDOUT: <empty>
STDERR: 
STDERR: 
STDERR: #
STDERR: # Fatal error in ../../v8/src/base/platform/elapsed-timer.h, line 24
STDERR: # Debug check failed: !IsStarted().
STDERR: #
STDERR: #
STDERR: #
STDERR: #FailureMessage Object: 0x7ffc46707640#0 0x565409263b6f base::debug::StackTrace::StackTrace()
STDERR: #1 0x56540a8a32fb gin::(anonymous namespace)::PrintStackTrace()
STDERR: #2 0x56540a8980d8 V8_Fatal()
STDERR: #3 0x56540a897e35 v8::base::(anonymous namespace)::DefaultDcheckHandler()
STDERR: v8#4 0x565407971f02 v8::base::ElapsedTimer::Start()
STDERR: v8#5 0x565407d08edf v8::internal::TimedHistogram::Start()
STDERR: v8#6 0x565407e500d5 v8::internal::IncrementalMarking::AdvanceIncrementalMarkingOnAllocation()
STDERR: v8#7 0x565407e4f977 v8::internal::IncrementalMarking::Observer::Step()
STDERR: v8#8 0x565407e48092 v8::internal::AllocationObserver::AllocationStep()
STDERR: v8#9 0x565407eb0751 v8::internal::SpaceWithLinearArea::InlineAllocationStep()
STDERR: v8#10 0x565407eb3e44 v8::internal::NewSpace::EnsureAllocation()
STDERR: v8#11 0x565407e258ff v8::internal::NewSpace::AllocateRaw()
STDERR: v8#12 0x565407e06b2d v8::internal::Heap::AllocateRaw()
STDERR: v8#13 0x565407e432ef v8::internal::Heap::AllocateRawWithLightRetry()
STDERR: v8#14 0x565407e433cf v8::internal::Heap::AllocateRawWithRetryOrFail()
STDERR: v8#15 0x565407e04d48 v8::internal::Factory::NewFixedArrayWithFiller()
STDERR: v8#16 0x565407fd6339 v8::internal::HashTable<>::New()
STDERR: v8#17 0x565407fd7be8 v8::internal::HashTable<>::EnsureCapacity()
STDERR: v8#18 0x565407fc7e95 v8::internal::Dictionary<>::Add()
STDERR: v8#19 0x565407fcf453 v8::internal::BaseNameDictionary<>::Add()
STDERR: v8#20 0x565407f89ee4 v8::internal::LookupIterator::ApplyTransitionToDataProperty()
STDERR: v8#21 0x5654080036e2 v8::internal::Object::AddDataProperty()
STDERR: v8#22 0x56540793061f v8::internal::(anonymous namespace)::DefineDataProperty()
STDERR: v8#23 0x56540792da59 v8::internal::(anonymous namespace)::InstantiateObject()
STDERR: v8#24 0x56540792b75a v8::internal::(anonymous namespace)::InstantiateFunction()
STDERR: v8#25 0x56540792b4db v8::internal::ApiNatives::InstantiateFunction()
STDERR: v8#26 0x5654079594bf v8::FunctionTemplate::GetFunction()
STDERR: v8#27 0x56540a7af74e blink::V8ObjectConstructor::CreateInterfaceObject()
STDERR: v8#28 0x56540a7afe01 blink::V8PerContextData::ConstructorForTypeSlowCase()
STDERR: v8#29 0x56540a7afdd6 blink::V8PerContextData::ConstructorForTypeSlowCase()
STDERR: v8#30 0x56540a7afdd6 blink::V8PerContextData::ConstructorForTypeSlowCase()
STDERR: v8#31 0x56540a7afcb4 blink::V8PerContextData::CreateWrapperFromCacheSlowCase()
STDERR: v8#32 0x56540a7aef73 blink::V8DOMWrapper::CreateWrapper()
STDERR: v8#33 0x56540a7abf6b blink::ScriptWrappable::Wrap()
STDERR: v8#34 0x56540a677199 blink::V8Document::documentElementAttributeGetterCallback()
STDERR: v8#35 0x565407a0aec3 v8::internal::FunctionCallbackArguments::Call()
STDERR: v8#36 0x565407a097be v8::internal::(anonymous namespace)::HandleApiCallHelper<>()
STDERR: v8#37 0x565407a0877b v8::internal::Builtins::InvokeApiFunction()
STDERR: v8#38 0x565407fe785a v8::internal::Object::GetPropertyWithAccessor()
STDERR: v8#39 0x565407fe697e v8::internal::Object::GetProperty()
STDERR: v8#40 0x565407ec8c71 v8::internal::LoadIC::Load()
STDERR: v8#41 0x565407ed6401 v8::internal::__RT_impl_Runtime_LoadIC_Miss()
STDERR: v8#42 0x5654087593f2 <unknown>
STDERR: [16162:16185:1122/143518.356897:WARNING:crash_handler_host_linux.cc(341)] Could not translate tid, attempt = 1 retry ...


Original change's description:
> [heap] Improve embedder tracing during incremental marking
> 
> Add a path into embedder tracing on allocation. This is safe as as Blink
> is not allowed to call into V8 during object construction.
> 
> Bug: chromium:843903
> Change-Id: I5af053c3169f5a33778ebce5d7c5c43e4efb1aa4
> Reviewed-on: https://chromium-review.googlesource.com/c/1348749
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#57757}

TBR=ulan@chromium.org,mlippautz@chromium.org

Change-Id: Ide2c0b284b52bee17573adcc89f14be4e40dab91
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:843903
Reviewed-on: https://chromium-review.googlesource.com/c/1349189
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57759}

TBR=v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com

Change-Id: I02ce815e722efa655a992c3b3101b882d61d22c5
Reviewed-on: https://chromium-review.googlesource.com/c/1370013
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/7.2@{v8#18}
Cr-Branched-From: 6acd03c-refs/heads/7.2.502@{#1}
Cr-Branched-From: b03041d-refs/heads/master@{#57910}

TBR=v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com

Change-Id: I350ed1c412fe3938dc5e87e7b86d1c23963f7f69
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1524076
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/7.4@{v8#18}
Cr-Branched-From: 3e8a733-refs/heads/7.4.288@{#1}
Cr-Branched-From: d077f9b-refs/heads/master@{#60039}

Reported at comment v8#18 of the linked bug.

Bug: chromium:1027461
Change-Id: I64fb4c4edd4df07ddf86c508dfecec7f509efc9f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1940262
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65263}

Revision: 6239ec1

BUG=chromium:1050164
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
TBR=hablich@chromium.org

Change-Id: I9962cd139f77f79dd24debe52fb5db5f85a4e038
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2056859
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/branch-heads/8.1@{v8#18}
Cr-Branched-From: a4dcd39-refs/heads/8.1.307@{#1}
Cr-Branched-From: f22c213-refs/heads/master@{#66031}

(cherry picked from commit 0a9db74)

R=jkummerow@chromium.org

Bug: chromium:1103161
Change-Id: Id243aebd1f239146fd8af64e7dd71d9ec9209009
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2292245
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/branch-heads/8.5@{v8#18}
Cr-Branched-From: a7f8bc4-refs/heads/8.5.210@{#1}
Cr-Branched-From: dd58472-refs/heads/master@{#68510}

TBR=v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com

Change-Id: Ifee5a45d752f5d21f2e3b6bf6a75726cd03ef594
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1821059
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/7.8@{v8#18}
Cr-Branched-From: 73694fd-refs/heads/7.8.279@{#1}
Cr-Branched-From: 2314928-refs/heads/master@{#63555}

TBR=v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com

Change-Id: I2221693817984e2eff40a8a97f288e9be18429e6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1781197
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/7.7@{v8#18}
Cr-Branched-From: 4035531-refs/heads/7.7.299@{#1}
Cr-Branched-From: 1320c91-refs/heads/master@{#62881}

TBR=v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com

Change-Id: I1dbdf34b5a94ad807d569b95d8cdb8792196a542
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1871966
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/7.9@{v8#18}
Cr-Branched-From: be181e2-refs/heads/7.9.317@{#1}
Cr-Branched-From: 0d7889d-refs/heads/master@{#64307}

The receiver may be undefined when calling optionally chained
properties, so CallAnyReceiver should be used instead of CallProperty.

TBR=rmcilroy@chromium.org

(cherry picked from commit 4c2379e)

Bug: chromium:1038178
Change-Id: I4f648ac5140427b6ae5668d60a570de60e253b83
No-Try: true
No-Presubmit: true
No-Tree-Checks: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1990134
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/branch-heads/8.0@{v8#18}
Cr-Branched-From: 69827db-refs/heads/8.0.426@{v8#2}
Cr-Branched-From: 2fe1552-refs/heads/master@{#65318}

Revision: d874e78

BUG=chromium:930255
LOG=N
NOTRY=true
NOTREECHECKS=true
TBR=sergiyb@chromium.org

Change-Id: I67c166ba96a136a3968d8d5491bf4e4e307f5d51
Reviewed-on: https://chromium-review.googlesource.com/c/1472674
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/branch-heads/7.3@{v8#18}
Cr-Branched-From: 9df9418-refs/heads/7.3.492@{v8#2}
Cr-Branched-From: be213cf-refs/heads/master@{#59024}

Because of ordering issues we didn't set the wire bytes on the
{NativeModule} during {OnFinishedStream}. We then failed during
instantiation when trying to read the import names from the wire bytes.

This CL fixes this locally without much code churn. I plan to clean up
the interaction between {AsyncCompileJob} and {AsyncStreamingProcessor}
in a follow-up CL.

R=ahaas@chromium.org

Bug: chromium:898310
Change-Id: I304f99a6d50ca4f488b3ae7a0707c824815016ad
Originally-reviewed-on: https://chromium-review.googlesource.com/c/1296467
No-Try: true
No-Tree-Checks: true
No-Presubmit: true
Reviewed-on: https://chromium-review.googlesource.com/c/1301474
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/branch-heads/7.1@{v8#18}
Cr-Branched-From: f70aaa8-refs/heads/7.1.302@{#1}
Cr-Branched-From: 1dbcc78-refs/heads/master@{#56462}

Bug: chromium:954890
Change-Id: I5351c5cbbb35eb395fa79e7fcf927f24d80873fc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1672928
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/branch-heads/7.6@{v8#18}
Cr-Branched-From: 2cb2573-refs/heads/7.6.303@{#1}
Cr-Branched-From: 201c509-refs/heads/master@{#61902}

Revision: 1810066

BUG=v8:4153,v8:7881
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
TBR=jarin@chromium.org, bmeurer@chromium.org
R=szuend@chromium.org

Change-Id: I7bca25822b77b2e9eed698ba6717a023a891484b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1594437
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/branch-heads/7.5@{v8#18}
Cr-Branched-From: 35b9bf5-refs/heads/7.5.288@{#1}
Cr-Branched-From: 912b391-refs/heads/master@{#60911}

Revision: d4ddf64

BUG=chromium:1076708
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true

TBR: neis@chromium.org
Change-Id: I8acdb4715a6786d954d5be49b909b136b4067969
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2187624
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/branch-heads/8.3@{v8#18}
Cr-Branched-From: 1668abd-refs/heads/8.3.110@{#1}
Cr-Branched-From: 04a7a68-refs/heads/master@{#66926}

Revision: d4ddf64

BUG=chromium:1076708
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true

(cherry picked from commit fb9aa71)

TBR: neis@chromium.org
Change-Id: I8acdb4715a6786d954d5be49b909b136b4067969
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2187624
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Original-Commit-Position: refs/branch-heads/8.3@{v8#18}
Cr-Original-Branched-From: 1668abd-refs/heads/8.3.110@{#1}
Cr-Original-Branched-From: 04a7a68-refs/heads/master@{#66926}
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2208932
Cr-Commit-Position: refs/branch-heads/8.1@{v8#67}
Cr-Branched-From: a4dcd39-refs/heads/8.1.307@{#1}
Cr-Branched-From: f22c213-refs/heads/master@{#66031}

This reverts commit 611e412.

Reason for revert: https://crbug.com/1080367

Original change's description:
> [Intl] Use new getDefaultHourCycle to replace old hack
> 
> Use the ICU 67.1 new API DateTimePatternGenerator::getDefaultHourCycle
> to replace a hack which get the pattern of "jjmm" to find out the
> default hour cycle of a locale
> Bump the required API version from 65 to 67
> 
> Bug: v8:10225
> Change-Id: I3378edacb6dfb8400357ac0bf3d5d50b9fe008bd
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2173875
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Frank Tang <ftang@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#67549}

TBR=jkummerow@chromium.org,ftang@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:10225
(cherry picked from commit 3b1d24c)

Change-Id: I30254b775b538229fb1ee93ffa89228548962a2a
No-Try: true
No-Presubmit: true
No-Tree-Checks: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2212894
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/branch-heads/8.4@{v8#18}
Cr-Branched-From: 88ed2e3-refs/heads/8.4.371@{#1}
Cr-Branched-From: 35f88bf-refs/heads/master@{#67773}

The tier up check in br_if is only executed conditionally, so it is
not allowed to update any cache state. Later code would work with that
updated state, even though the corresponding code would not have
executed.
There was a partial implementation for this by passing in a scratch
register for {TierupCheck}, but {TierupCheckOnExit} has the same
problem, and needs up to three scratch registers.

Until we come up with a better solution, just snapshot the cache state
before doing the tier up check, and restore it later. This has some
performance cost, but it's an effective fix.

R=jkummerow@chromium.org

(cherry picked from commit 8072d31)

Bug: chromium:1314184
Change-Id: I2d2b65c3a8f47de9072bef3b5ee31c1a30229c60
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3582383
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/branch-heads/10.1@{v8#18}
Cr-Branched-From: b003970-refs/heads/10.1.124@{#1}
Cr-Branched-From: e62f556-refs/heads/main@{#79503}

TBR=v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com

Change-Id: I2f126ffa1d5a7340c5e1529cf4ff16fbb8cb9b00
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2942631
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/9.2@{v8#18}
Cr-Branched-From: 5123834-refs/heads/9.2.230@{#1}
Cr-Branched-From: 587a04f-refs/heads/master@{#74656}

This reverts commit 4662879.

Reason for revert: Compat breakage

Bug: chromium:1170196

Original change's description:
> Ship the relative indexing method `.at`
>
> I2S with LGTMs:
> https://groups.google.com/a/chromium.org/g/blink-dev/c/I8S78w7aFmE/m/qLHAcjhRCQAJ
>
> v8: 10961
> Change-Id: If0440c0595823c61352f144c1fc29c54a1175623
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2574716
> Reviewed-by: Marja Hölttä <marja@chromium.org>
> Commit-Queue: Shu-yu Guo <syg@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#71619}


Change-Id: I1bd3c32e0d6e1891bb90d4b2c99250ab76c49b23
No-Try: true
No-Presubmit: true
No-Tree-Checks: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2650229
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/branch-heads/8.9@{v8#18}
Cr-Branched-From: 16b9bbb-refs/heads/8.9.255@{#1}
Cr-Branched-From: d16a2a6-refs/heads/master@{#72039}

In https://crrev.com/c/3522896 we changed the last_id_ to be a member
variable. This subtly changed how profile id's were generated.

This CL changes this part back to a static variable that guarantees
process-wide unique profile ids.

Bug: chromium:1330726, chromium:1297283
(cherry picked from commit f1c4fd3)

Change-Id: I4f30fc73e113aefe1f5c7ebe4f351a93d91a4963
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3688396
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/branch-heads/10.3@{v8#18}
Cr-Branched-From: 1a8f4ca-refs/heads/10.3.174@{#1}
Cr-Branched-From: 8fbefa4-refs/heads/main@{#80471}

(cherry picked from commit bdc4f54)

No-Try: true
No-Presubmit: true
No-Treechecks: true
Bug: chromium:1307610
Change-Id: I60aaa0e58e13b705b5eff4b57411a0ad4a2e9b3f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3534849
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Original-Commit-Position: refs/heads/main@{#79538}
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3565716
Reviewed-by: Patrick Thier <pthier@chromium.org>
Commit-Queue: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/branch-heads/10.0@{v8#18}
Cr-Branched-From: 6ea73a7-refs/heads/10.0.139@{#1}
Cr-Branched-From: ccc6890-refs/heads/main@{#79131}

This reverts commit 5c287a6.

Reason for revert: we want to finch concurrent inlining in 9.5.

Original change's description:
> [compiler] Enable --concurrent-inlining by default
>
> As per the release plan in crbug.com/v8/12142.
>
> Bug: v8:7790,v8:12142
> Change-Id: I80e2a3c571681a968ea245d52adfa539e0e7ab7b
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3127711
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Commit-Queue: Georg Neis <neis@chromium.org>
> Auto-Submit: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#76560}

Bug: v8:7790,v8:12142
No-Try: true
No-Presubmit: true
No-Tree-Checks: true
Change-Id: I6c6b3e8750662ef9c4dbc7c8c0993663a31dfd7b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3164459
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/branch-heads/9.5@{v8#18}
Cr-Branched-From: 4a03d61-refs/heads/9.5.172@{#1}
Cr-Branched-From: 9a60704-refs/heads/main@{#76741}

Bug: chromium:1309225
Change-Id: If1eb290c19d26db2a024f1ea0f4c7c70fa1b3aad
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3550258
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Owners-Override: Shu-yu Guo <syg@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/branch-heads/9.9@{v8#18}
Cr-Branched-From: c4208cc-refs/heads/9.9.115@{#1}
Cr-Branched-From: 19c6fd7-refs/heads/main@{#78682}

Merged 85b4b5d

[compiler] only enable MidTierRegisterAllocator for Wasm

Bug: chromium:1335054
Change-Id: I61ab97d4fbfcbb81319e611a64a6454e050a1d65
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3705397
Owners-Override: Tobias Tebbi <tebbi@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/10.2@{v8#18}
Cr-Branched-From: 374091f-refs/heads/10.2.154@{#1}
Cr-Branched-From: f0c353f-refs/heads/main@{#79976}

Change-Id: Ib5f00ea19a09c6fc57e211a12c933290a41fc8da
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3717730
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/10.4@{v8#18}
Cr-Branched-From: b1413ed-refs/heads/10.4.132@{#1}
Cr-Branched-From: 9d0a093-refs/heads/main@{#80972}

Revision: efd28c1

BUG=chromium:1292016,chromium:1293709
R=liviurau@chromium.org

Change-Id: Ic6450f31b4511448503deee66c747bb2bf86cae9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3439910
Reviewed-by: Liviu Rau <liviurau@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/branch-heads/9.8@{v8#18}
Cr-Branched-From: e218afa-refs/heads/9.8.177@{#1}
Cr-Branched-From: 86ebfc9-refs/heads/main@{#78312}

ICU 69 moved content of nb resources to no and let
nb fallback to no. This break our original design of checking
locale availability. Hard wire to check on no if nb fail for now
until we come out with a better fix.

(cherry picked from commit d2db7fa)

Bug: chromium:1215606
Change-Id: I831529d29590cc643ee0109fb2ce8948dac75613
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3068010
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#76044}
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3068284
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/branch-heads/9.3@{v8#18}
Cr-Branched-From: 7744dce-refs/heads/9.3.345@{#1}
Cr-Branched-From: 4b6b4ca-refs/heads/master@{#75728}

…ontext

BUG=chromium:1257321
TEST=none

(cherry picked from commit 581355b)

Change-Id: I59f34e8b41ba08f5046754c13be8f1df6a335655
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3271389
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Scott Violet <sky@chromium.org>
Cr-Original-Commit-Position: refs/heads/main@{#77824}
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3295927
Cr-Commit-Position: refs/branch-heads/9.7@{v8#18}
Cr-Branched-From: 49162da-refs/heads/9.7.106@{#1}
Cr-Branched-From: a7e9b8f-refs/heads/main@{#77674}

The register that holds the {new_value} for the AtomicCompareExchange8U
has to be a byte register on ia32. There was code to guarantee that, but
after that code there was code that frees the {eax} register, and that
code moved the {new_value} to a different register again. With this CL
we first free {eax}, and then find a byte register for the {new_value}.

R=​clemensb@chromium.org
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true

(cherry picked from commit 70a389a)

Bug: chromium:1140549
Change-Id: I1679f3f9ab26c5416ea251c7925366ff43336d85
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2491031
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#70721}
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2501282
Cr-Commit-Position: refs/branch-heads/8.7@{v8#18}
Cr-Branched-From: 0d81cd7-refs/heads/8.7.220@{#1}
Cr-Branched-From: 942c2ef-refs/heads/master@{#70196}

V8FileLogger has a dynamic behaviour when listening to
code events, i.e., it can stop listening without removing
itself from the Logger, which invalidates the field
is_listening_to_code_events_. This field is only updated
when adding/removing an event listener.

This cache was recently introduced in a refactoring
https://crrev.com/c/3582125

Bug: chromium:1400809
Change-Id: Icf7b8c27eef0cb9444cacf0e21659334206fc7c0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4152511
Reviewed-by: Patrick Thier <pthier@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/branch-heads/11.0@{v8#18}
Cr-Branched-From: 06097c6-refs/heads/11.0.226@{#1}
Cr-Branched-From: 6bf3344-refs/heads/main@{#84857}

Approved merge to 6.1.

Revision: d9b98f3

BUG=chromium:747075
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=jarin@chromium.org

Change-Id: Ia59f078c7c8c1dfef3fe49bc0e493492f5f3d2ee
Reviewed-on: https://chromium-review.googlesource.com/586689
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.1@{v8#18}
Cr-Branched-From: 1bf2e10-refs/heads/6.1.534@{#1}
Cr-Branched-From: e825c43-refs/heads/master@{#46746}

Revision: 91c99de

NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=machenbach@chromium.org
BUG=

Review-Url: https://chromiumcodereview.appspot.com/2429213005
Cr-Commit-Position: refs/branch-heads/5.5@{v8#18}
Cr-Branched-From: 3cbd583-refs/heads/5.5.372@{#1}
Cr-Branched-From: b3c8b0c-refs/heads/master@{#40015}

Change-Id: I2443af21a92d65bf1024df3b7f4e255d0f2c8d9c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4335198
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/11.2@{v8#18}
Cr-Branched-From: 755511a-refs/heads/11.2.214@{#1}
Cr-Branched-From: e6b1cce-refs/heads/main@{#86014}

…VFP to general regs. (patch ...

Revision: 0932677

BUG=v8:4124
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=bbudge@chromium.org
TBR=bbudge@chromium.org

Review URL: https://codereview.chromium.org/2525023002 .

Cr-Commit-Position: refs/branch-heads/5.6@{v8#18}
Cr-Branched-From: bdd3886-refs/heads/5.6.326@{#1}
Cr-Branched-From: 879f659-refs/heads/master@{#41014}

…onary maps

Map::Update might return a dictionary map, and the calling code didn't
take it into account.

Bug: chromium:1412487
(cherry picked from commit b0db663)

Change-Id: I01995340856b5e21d1cda51915e8a2543428cfc4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4290144
Reviewed-by: Lutz Vahl <vahl@chromium.org>
Commit-Queue: Lutz Vahl <vahl@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/branch-heads/11.1@{v8#18}
Cr-Branched-From: c77793a-refs/heads/11.1.277@{#1}
Cr-Branched-From: 95b79bf-refs/heads/main@{#85479}

Wine does not implement flipping PAGE_WRITECOPY pages to PAGE_READWRITE
after they're written to, and fails the CHECK in
base::OS::SetDataReadOnly.
Loosen the CHECK so that PAGE_WRITECOPY is also accepted as the previous
protection value.

R=mlippautz@chromium.org

(cherry picked from commit df1eaa2)
Bug: v8:13512

Change-Id: I857f1eb2e8df745dc46aebd33bf0f58a6729237b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4152510
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/branch-heads/10.9@{v8#18}
Cr-Branched-From: 8ade6bf-refs/heads/10.9.194@{#1}
Cr-Branched-From: 9ff2515-refs/heads/main@{#84164}

TBR=machenbach@chromium.org

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: If19ea8706af8589edda22244ef787dd2b3069f9e
Reviewed-on: https://chromium-review.googlesource.com/667701
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.2@{v8#18}
Cr-Branched-From: efa2ac4-refs/heads/6.2.414@{#1}
Cr-Branched-From: a861ebb-refs/heads/master@{#47693}

.. since interrupts may trigger code deoptimization, which in turn
invalidates assumptions we've already checked at the beginning of
OnStackReplacement.

This CL disables the stack check as part of the bytecode budget
interrupt, i.e. we don't call stack_guard()->HandleInterrupts()
in Runtime_BytecodeBudgetInterrupt_{Ignition,Sparkplug}.

(cherry picked from commit c2eda65)

No-Try: true
No-Presubmit: true
No-Treechecks: true
Fixed: chromium:1432470,chromium:1442603
Change-Id: I63dc51812741161cfb2f1cdb67c46e269d37f0f6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4518604
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Jakob Linke <jgruber@chromium.org>
Cr-Original-Commit-Position: refs/heads/main@{#87590}
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4543623
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/branch-heads/11.4@{v8#18}
Cr-Branched-From: 8a8a1e7-refs/heads/11.4.183@{#1}
Cr-Branched-From: 5483d8e-refs/heads/main@{#87241}

Cr-Commit-Position: refs/branch-heads/5.9@{v8#18}
Cr-Branched-From: fe9bb7e-refs/heads/5.9.211@{#1}
Cr-Branched-From: 70ad237-refs/heads/master@{#44591}

Cr-Commit-Position: refs/branch-heads/5.8@{v8#18}
Cr-Branched-From: eda659c-refs/heads/5.8.283@{#1}
Cr-Branched-From: 4310cd0-refs/heads/master@{#43429}

Bug: chromium:1439691
(cherry picked from commit 2c8a019)

Change-Id: I2743e3dd2e60249c14650c3acb4e11ed2dde4092
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4502670
Reviewed-by: Jakob Linke <jgruber@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/branch-heads/11.3@{v8#18}
Cr-Branched-From: b0a3a06-refs/heads/11.3.244@{#1}
Cr-Branched-From: 0326cf6-refs/heads/main@{#86647}

...to avoid temporaries clobbering parameters.

Bug: v8:7700
(cherry picked from commit f7eda06b95654722f1b0720b9dfe0ff959564d71)

Change-Id: I92e1bbb91913d618bf66562ee79c8a5cc8d5c483
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4614667
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/branch-heads/11.5@{v8#18}
Cr-Branched-From: 0c4044b-refs/heads/11.5.150@{#1}
Cr-Branched-From: b71d303-refs/heads/main@{#87781}

Bug: v8:7700, chromium:1466088
(cherry picked from commit 3462172)

Change-Id: I5c6a08d25f7090280cd33164eaeba4392f14463e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4701652
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/branch-heads/11.6@{v8#18}
Cr-Branched-From: e29c028-refs/heads/11.6.189@{v8#3}
Cr-Branched-From: 95cbef2-refs/heads/main@{#88340}

When allocating a new feedback vector for polymorphic configs we must
keep the handler handlified.

Bug: chromium:1473961
(cherry picked from commit 4628443)

Change-Id: Ic02c866de0c9ddbca25b96d3a07d0ebf246abddb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4818826
Auto-Submit: Olivier Flückiger <olivf@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/branch-heads/11.7@{v8#18}
Cr-Branched-From: fe60869-refs/heads/11.7.439@{#1}
Cr-Branched-From: aeb4552-refs/heads/main@{#89415}

The input register of comparison may contain dirty data in it's
upper 32 bits, which will result in a wrong comparison result.

Bug: v8:14344

(cherry picked from commit dbcc3ef)

Change-Id: I1491e4f57547341562d8b639548d9185cc95e82e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4899385
Auto-Submit: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Reviewed-by: Lutz Vahl <vahl@chromium.org>
Commit-Queue: Lutz Vahl <vahl@chromium.org>
Cr-Commit-Position: refs/branch-heads/11.8@{v8#18}
Cr-Branched-From: 935bdbf-refs/heads/11.8.172@{#1}
Cr-Branched-From: b82a911-refs/heads/main@{#89779}

Merged: [builtin][tq] Fix Array.prototype.flat
Revision: d429a14

Merged: [builtin][tq] Fix Array.prototype.flat again
Revision: 05122fe

Merged: [builtin][tq] Fix bad DCHECK in Array.prototype.flat
Revision: cf3e066

Bug: chromium:1507416, chromium:1509252, v8:14306
Change-Id: I6d398d1996fefd1996feb5c7e1f3d075cd5ee005
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5110202
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Patrick Thier <pthier@chromium.org>
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/branch-heads/12.1@{v8#18}
Cr-Branched-From: b74ef6f-refs/heads/12.1.285@{#1}
Cr-Branched-From: 32857fb-refs/heads/main@{#91313}