TBR=machenbach@chromium.org

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I56b0cc38fd719c193b7af2c44cb6cb3206e43ba5
Reviewed-on: https://chromium-review.googlesource.com/897044
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.5@{#22}
Cr-Branched-From: 73c55f5-refs/heads/6.5.254@{#1}
Cr-Branched-From: 594a1a0-refs/heads/master@{#50664}

TBR=machenbach@chromium.org

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: Ib532493d117839789053375019e82b9b9eea4927
Reviewed-on: https://chromium-review.googlesource.com/962324
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.6@{#22}
Cr-Branched-From: d500271-refs/heads/6.6.346@{#1}
Cr-Branched-From: 265ef0b-refs/heads/master@{#51624}

R=​ahaas@chromium.org

Change-Id: I6cfd5812675ef7700a1af2bf00ed4cceca0919d5
No-Try: true
No-Presubmit: true
No-Treechecks: true
Bug: chromium:831989, chromium:824681
Originally-reviewed-on: https://chromium-review.googlesource.com/1009603
Reviewed-on: https://chromium-review.googlesource.com/1016280
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.7@{#22}
Cr-Branched-From: 8457e81-refs/heads/6.7.288@{#2}
Cr-Branched-From: e921be5-refs/heads/master@{#52547}

Cr-Commit-Position: refs/branch-heads/6.0@{v8#22}
Cr-Branched-From: 97dbf62-refs/heads/6.0.286@{#1}
Cr-Branched-From: 12e6f1c-refs/heads/master@{#45439}

TBR=machenbach@chromium.org

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I44f31fc6c9ccb9398b6c5cf15c1156c7fffef1a0
Reviewed-on: https://chromium-review.googlesource.com/1093055
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.8@{#22}
Cr-Branched-From: 44d7d7d-refs/heads/6.8.275@{#1}
Cr-Branched-From: 5754f66-refs/heads/master@{#53286}

TBR=machenbach@chromium.org

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: Ic3ed2c966f18df8d047235e94c9ea25ebe6a506e
Reviewed-on: https://chromium-review.googlesource.com/1159110
Reviewed-by: V8 Autoroller <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/6.9@{#22}
Cr-Branched-From: d7b61ab-refs/heads/6.9.427@{#1}
Cr-Branched-From: b7e108d-refs/heads/master@{#54504}

This reverts commit caed2cc.

Reason for revert: Breaks layout tests, e.g.

https://test-results.appspot.com/data/layout_results/V8-Blink_Linux_64__dbg_/14924/webkit_layout_tests%20%28with%20patch%29/layout-test-results/results.html

crash log for renderer (pid <unknown>):
STDOUT: <empty>
STDERR: 
STDERR: 
STDERR: #
STDERR: # Fatal error in ../../v8/src/base/platform/elapsed-timer.h, line 24
STDERR: # Debug check failed: !IsStarted().
STDERR: #
STDERR: #
STDERR: #
STDERR: #FailureMessage Object: 0x7ffc46707640#0 0x565409263b6f base::debug::StackTrace::StackTrace()
STDERR: #1 0x56540a8a32fb gin::(anonymous namespace)::PrintStackTrace()
STDERR: #2 0x56540a8980d8 V8_Fatal()
STDERR: #3 0x56540a897e35 v8::base::(anonymous namespace)::DefaultDcheckHandler()
STDERR: v8#4 0x565407971f02 v8::base::ElapsedTimer::Start()
STDERR: v8#5 0x565407d08edf v8::internal::TimedHistogram::Start()
STDERR: v8#6 0x565407e500d5 v8::internal::IncrementalMarking::AdvanceIncrementalMarkingOnAllocation()
STDERR: v8#7 0x565407e4f977 v8::internal::IncrementalMarking::Observer::Step()
STDERR: v8#8 0x565407e48092 v8::internal::AllocationObserver::AllocationStep()
STDERR: v8#9 0x565407eb0751 v8::internal::SpaceWithLinearArea::InlineAllocationStep()
STDERR: v8#10 0x565407eb3e44 v8::internal::NewSpace::EnsureAllocation()
STDERR: v8#11 0x565407e258ff v8::internal::NewSpace::AllocateRaw()
STDERR: v8#12 0x565407e06b2d v8::internal::Heap::AllocateRaw()
STDERR: v8#13 0x565407e432ef v8::internal::Heap::AllocateRawWithLightRetry()
STDERR: v8#14 0x565407e433cf v8::internal::Heap::AllocateRawWithRetryOrFail()
STDERR: v8#15 0x565407e04d48 v8::internal::Factory::NewFixedArrayWithFiller()
STDERR: v8#16 0x565407fd6339 v8::internal::HashTable<>::New()
STDERR: v8#17 0x565407fd7be8 v8::internal::HashTable<>::EnsureCapacity()
STDERR: v8#18 0x565407fc7e95 v8::internal::Dictionary<>::Add()
STDERR: v8#19 0x565407fcf453 v8::internal::BaseNameDictionary<>::Add()
STDERR: v8#20 0x565407f89ee4 v8::internal::LookupIterator::ApplyTransitionToDataProperty()
STDERR: v8#21 0x5654080036e2 v8::internal::Object::AddDataProperty()
STDERR: v8#22 0x56540793061f v8::internal::(anonymous namespace)::DefineDataProperty()
STDERR: v8#23 0x56540792da59 v8::internal::(anonymous namespace)::InstantiateObject()
STDERR: v8#24 0x56540792b75a v8::internal::(anonymous namespace)::InstantiateFunction()
STDERR: v8#25 0x56540792b4db v8::internal::ApiNatives::InstantiateFunction()
STDERR: v8#26 0x5654079594bf v8::FunctionTemplate::GetFunction()
STDERR: v8#27 0x56540a7af74e blink::V8ObjectConstructor::CreateInterfaceObject()
STDERR: v8#28 0x56540a7afe01 blink::V8PerContextData::ConstructorForTypeSlowCase()
STDERR: v8#29 0x56540a7afdd6 blink::V8PerContextData::ConstructorForTypeSlowCase()
STDERR: v8#30 0x56540a7afdd6 blink::V8PerContextData::ConstructorForTypeSlowCase()
STDERR: v8#31 0x56540a7afcb4 blink::V8PerContextData::CreateWrapperFromCacheSlowCase()
STDERR: v8#32 0x56540a7aef73 blink::V8DOMWrapper::CreateWrapper()
STDERR: v8#33 0x56540a7abf6b blink::ScriptWrappable::Wrap()
STDERR: v8#34 0x56540a677199 blink::V8Document::documentElementAttributeGetterCallback()
STDERR: v8#35 0x565407a0aec3 v8::internal::FunctionCallbackArguments::Call()
STDERR: v8#36 0x565407a097be v8::internal::(anonymous namespace)::HandleApiCallHelper<>()
STDERR: v8#37 0x565407a0877b v8::internal::Builtins::InvokeApiFunction()
STDERR: v8#38 0x565407fe785a v8::internal::Object::GetPropertyWithAccessor()
STDERR: v8#39 0x565407fe697e v8::internal::Object::GetProperty()
STDERR: v8#40 0x565407ec8c71 v8::internal::LoadIC::Load()
STDERR: v8#41 0x565407ed6401 v8::internal::__RT_impl_Runtime_LoadIC_Miss()
STDERR: v8#42 0x5654087593f2 <unknown>
STDERR: [16162:16185:1122/143518.356897:WARNING:crash_handler_host_linux.cc(341)] Could not translate tid, attempt = 1 retry ...


Original change's description:
> [heap] Improve embedder tracing during incremental marking
> 
> Add a path into embedder tracing on allocation. This is safe as as Blink
> is not allowed to call into V8 during object construction.
> 
> Bug: chromium:843903
> Change-Id: I5af053c3169f5a33778ebce5d7c5c43e4efb1aa4
> Reviewed-on: https://chromium-review.googlesource.com/c/1348749
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#57757}

TBR=ulan@chromium.org,mlippautz@chromium.org

Change-Id: Ide2c0b284b52bee17573adcc89f14be4e40dab91
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:843903
Reviewed-on: https://chromium-review.googlesource.com/c/1349189
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57759}

TBR=v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com

Change-Id: Iebdb2a08fce458a00e0db3682e50a177232d7e51
Reviewed-on: https://chromium-review.googlesource.com/c/1373909
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/7.2@{v8#22}
Cr-Branched-From: 6acd03c-refs/heads/7.2.502@{#1}
Cr-Branched-From: b03041d-refs/heads/master@{#57910}

TBR=v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com

Change-Id: Id78d219020dc7fe3eeef54a760c5c70ed55aa0b1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1532981
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/7.4@{v8#22}
Cr-Branched-From: 3e8a733-refs/heads/7.4.288@{#1}
Cr-Branched-From: d077f9b-refs/heads/master@{#60039}

TBR=v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com

Change-Id: If63637b31694252eafbd836ca9da88965b482a07
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2060750
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/8.1@{v8#22}
Cr-Branched-From: a4dcd39-refs/heads/8.1.307@{#1}
Cr-Branched-From: f22c213-refs/heads/master@{#66031}

Add RISC-V support for gm.py-based builds

…t closures

(cherry picked from commit 26df3fd)

Bug: chromium:1105318
Change-Id: I7b1c57b7ff7beaaa53c19a270d5a8c36b11baf17
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2301082
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#68903}
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2304717
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/branch-heads/8.5@{v8#22}
Cr-Branched-From: a7f8bc4-refs/heads/8.5.210@{#1}
Cr-Branched-From: dd58472-refs/heads/master@{#68510}

TBR=v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com

Change-Id: Ie20765ff61419da2bc05ea49b9a7fcaa6cfdf4ac
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1831188
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/7.8@{v8#22}
Cr-Branched-From: 73694fd-refs/heads/7.8.279@{#1}
Cr-Branched-From: 2314928-refs/heads/master@{#63555}

TBR=v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com

Change-Id: I0514b941fc43ae41e59db029f1de8b7092c25ec1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1789602
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/7.7@{v8#22}
Cr-Branched-From: 4035531-refs/heads/7.7.299@{#1}
Cr-Branched-From: 1320c91-refs/heads/master@{#62881}

TBR=v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com

Change-Id: I4d3b02b2135746756409df505d166a5d978d0225
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1874836
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/7.9@{v8#22}
Cr-Branched-From: be181e2-refs/heads/7.9.317@{#1}
Cr-Branched-From: 0d7889d-refs/heads/master@{#64307}

Merged: [turbofan] fix type widening bug in RedundancyElimination
Revision: 3f7e99a

Merged: [turbofan] fix type widening bug in RedundancyElimination, completely
Revision: 69b195c

BUG=chromium:1031909
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=tebbi@chromium.org

Change-Id: I938a5ad9c1b9f7bd345311f44d815f5e49dc08df
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2002388
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/branch-heads/8.0@{v8#22}
Cr-Branched-From: 69827db-refs/heads/8.0.426@{v8#2}
Cr-Branched-From: 2fe1552-refs/heads/master@{#65318}

Revision: 97d130f

NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=jgruber@chromium.org, machenbach@chromium.org, mstarzinger@chromium.org

Bug: v8:8828
Change-Id: I78aac8ea0fbd75dc4b826d5204cbef9724500234
Reviewed-on: https://chromium-review.googlesource.com/c/1470610
Reviewed-by: Michael Hablich <hablich@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/branch-heads/7.3@{v8#22}
Cr-Branched-From: 9df9418-refs/heads/7.3.492@{v8#2}
Cr-Branched-From: be213cf-refs/heads/master@{#59024}

PrepareElementsForSort must return a number less than or equal the array
length.

No-Try: true
No-Presubmit: true
No-Treechecks: true
Bug: chromium:897512, v8:7382
Change-Id: If5f9c4d052e623ab9f3300b8534603abbee859fa
Reviewed-on: https://chromium-review.googlesource.com/c/1297958
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#56982}
Reviewed-on: https://chromium-review.googlesource.com/c/1304318
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/branch-heads/7.1@{v8#22}
Cr-Branched-From: f70aaa8-refs/heads/7.1.302@{#1}
Cr-Branched-From: 1dbcc78-refs/heads/master@{#56462}

Registering shared wasm memory with the memory tracker was implemented to
track which instances need to be upated across threads on grow. As the
growing of memory when it is shared is behind a flag, the registering
should also be gated by the flag so as to not create global handles
that keep the memory alive.

(cherry picked from commit ac30897)

Bug: v8:9075
Tbr: gdeepti@chromium.org
Change-Id: I379a19413befa281cd384c9167fbc22ba52f4c2c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1646882
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#62043}
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1673135
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/branch-heads/7.6@{v8#22}
Cr-Branched-From: 2cb2573-refs/heads/7.6.303@{#1}
Cr-Branched-From: 201c509-refs/heads/master@{#61902}

Revision: 87b3416

BUG=chromium:958716
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=jarin@chromium.org

Change-Id: I98dcd3eedaf36dde8fb6a427e682af8cdd49f71d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1596741
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/branch-heads/7.5@{v8#22}
Cr-Branched-From: 35b9bf5-refs/heads/7.5.288@{#1}
Cr-Branched-From: 912b391-refs/heads/master@{#60911}

This reverts commit 2966ed0.

Reason for revert: broke presubmit check.

Original change's description:
> Merged: [torque] check FixedArray length
> 
> (cherry picked from commit 85bc1b0)
> 
> Bug: chromium:1086890
> TBR: mvstanton@chromium.org
> No-Try: true
> No-Presubmit: true
> No-Tree-Checks: true
> Change-Id: If08ae887bf47630f4db8fb2de9a2e241a43a716e
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2238571
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Cr-Commit-Position: refs/branch-heads/8.3@{v8#20}
> Cr-Branched-From: 1668abd-refs/heads/8.3.110@{#1}
> Cr-Branched-From: 04a7a68-refs/heads/master@{#66926}

TBR=mvstanton@chromium.org,tebbi@chromium.org

Change-Id: I6f0406c22e8ad877c93d672fe6ded8b1561f0e75
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:1086890
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2239575
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/branch-heads/8.3@{v8#22}
Cr-Branched-From: 1668abd-refs/heads/8.3.110@{#1}
Cr-Branched-From: 04a7a68-refs/heads/master@{#66926}

The lowering for anytrue was assuming that the input nodes are all
integers. The regression test added in https://crrev.com/c/2194471 calls
anytrue with float operands, this was causing the lowering to generate
cmpl instructions with a float register and an immediate, which is
wrong.

The fix is to use GetReplacementsWithType on the input nodes, but
only if the input were floats, since we use Word32Equal.

Drive-by clean up of comments in the aforementioned regression test.

(cherry picked from commit d16003d)

TBR=bbudge@chromium.org

Bug: v8:10535,v8:10593
No-Try: true
No-Presubmit: true
No-Tree-Checks: true
Change-Id: I0a7699fe35e5cf7edb2984034b50f94a1ed494b7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2235924
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/branch-heads/8.4@{v8#22}
Cr-Branched-From: 88ed2e3-refs/heads/8.4.371@{#1}
Cr-Branched-From: 35f88bf-refs/heads/master@{#67773}

With WebAssembly streaming compilation it is possible that FinishStream
indirectly calls AbortStream. This had the effect that while
FinishStream fulfilled the promise, AbortStream disposed the promise
by removing the compile job from the wasm engine and thereby deallocated
AsyncCompileJob and all the state that belongs to it. Without that
state, FinishStream could not finish fulfilling the promise correctly.

With this CL the streaming decoder remembers that the stream has
already been finished. When the stream has been finished, all calls to
Abort get ignored.

The regression test for this issue requires the Chrome embedding, see
https://crrev.com/c/2368359

R=​clemensb@chromium.org
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true

(cherry picked from commit 32dd547)

Bug: chromium:1117258
Change-Id: Ifc28a1ee38c228b051c4d7d85b305fe2a721fa1f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2367858
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#69549}
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2465830
Cr-Commit-Position: refs/branch-heads/8.6@{v8#22}
Cr-Branched-From: a64aed2-refs/heads/8.6.395@{#1}
Cr-Branched-From: a626bc0-refs/heads/master@{#69472}

TBR=v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com

Change-Id: I6b3ef37f32c4309e33330b55c535ba8ee064f63a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2611523
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/8.8@{v8#22}
Cr-Branched-From: 2dbcdc1-refs/heads/8.8.278@{#1}
Cr-Branched-From: 366d30c-refs/heads/master@{#71094}

Merged: [mips64][wasm-simd] Retrieve the value of SupportsWasmSimd128() in builtin
Revision: d7be571

Merged: [mips][wasm] Avoid duplicating parameter lists
Revision: 1974111

Merged: [mips64] Fix TestFastJSWasmCall_MultipleArgs failure
Revision: 33ece42

Merged: [mips] Skip all Simd tests on MIPS like PPC
Revision: dc0a1b4

BUG= v8:11535
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=zhaojiazhong-hf@loongson.cn

Change-Id: Ic7e0bece640bdfd6b78aa8a515c62a72b1d8034f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2738785
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/branch-heads/9.0@{v8#22}
Cr-Branched-From: bd0108b-refs/heads/9.0.257@{#1}
Cr-Branched-From: 349bcc6-refs/heads/master@{#73001}

Revision: d4aafa4

TBR=glazunov@chromium.org
BUG=chromium:1198696
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true

Change-Id: Ie78f892af33e0ac1a12736cd9c67934308415b9a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2833912
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/branch-heads/9.1@{v8#22}
Cr-Branched-From: 0e4ac64-refs/heads/9.1.269@{#1}
Cr-Branched-From: f565e72-refs/heads/master@{#73847}

Bug: chromium:1254189
(cherry picked from commit bdf31d5)

Change-Id: I1d4426fee8392c7a680ad67af4bf2745d04b2e52
No-Try: true
No-Presubmit: true
No-Tree-Checks: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3268905
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/branch-heads/9.6@{v8#22}
Cr-Branched-From: 0b7bda0-refs/heads/9.6.180@{#1}
Cr-Branched-From: 41a5a24-refs/heads/main@{#77244}

The very last part skipped the max_digits check, and earlier parts
forgot to account for that in their check. The reason why the last
part originally got special treatment no longer applies, so we can
fix this bug by removing the special case, simplifying the overall
logic.

(cherry picked from commit 45fc148)

Fixed: chromium:1248972
No-Try: true
No-Presubmit: true
No-Tree-Checks: true
Change-Id: I6ac3c314f56d7cd13b857e9d0b7081d0d0c91196
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3171145
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/branch-heads/9.5@{v8#22}
Cr-Branched-From: 4a03d61-refs/heads/9.5.172@{#1}
Cr-Branched-From: 9a60704-refs/heads/main@{#76741}

Change-Id: I9210890e507aede24d1dd47cf364bd4dc0d243be
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3727235
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/10.2@{v8#22}
Cr-Branched-From: 374091f-refs/heads/10.2.154@{#1}
Cr-Branched-From: f0c353f-refs/heads/main@{#79976}

Change-Id: I888a6015e38f97f1c9c7a617ef04bf6f8ceaf202
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3719039
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/10.4@{v8#22}
Cr-Branched-From: b1413ed-refs/heads/10.4.132@{#1}
Cr-Branched-From: 9d0a093-refs/heads/main@{#80972}

{AtomicSub} on x64 first negates the {value} register, then does an
atomic addition. For that reason, {value} should be a unique register.
So far, we only checked that it's not used in the value stack, but we
should also check for overlap with the destination address or the offset
register.

Drive-by: Remove unneeded handling of non-unique register index on arm,
as that cannot happen (LiftoffCompiler ensures that the result register
is unique).

R=thibaudm@chromium.org

(cherry picked from commit b5003a3)

Bug: chromium:1296876
Change-Id: Ie39f81785ac6b2b8fdd5ee23fb6d037b3f756c1a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3507511
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/branch-heads/9.8@{v8#22}
Cr-Branched-From: e218afa-refs/heads/9.8.177@{#1}
Cr-Branched-From: 86ebfc9-refs/heads/main@{#78312}

TBR=v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com

Change-Id: I575793bb08a2ca18ba10c10f8d9fe0888a5fb8cb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3080683
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/9.3@{v8#22}
Cr-Branched-From: 7744dce-refs/heads/9.3.345@{#1}
Cr-Branched-From: 4b6b4ca-refs/heads/master@{#75728}

Revision: 823c44d

NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=machenbach@chromium.org

Change-Id: If371e92e611cf65242e6aba7c916cb753dbc94d7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3306378
Reviewed-by: Tamer Tas <tmrts@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Liviu Rau <liviurau@chromium.org>
Cr-Commit-Position: refs/branch-heads/9.7@{v8#22}
Cr-Branched-From: 49162da-refs/heads/9.7.106@{#1}
Cr-Branched-From: a7e9b8f-refs/heads/main@{#77674}

TBR=v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com

Change-Id: I394a13a52c3237f563a4656bf18101942406c31d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2506813
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/8.7@{v8#22}
Cr-Branched-From: 0d81cd7-refs/heads/8.7.220@{#1}
Cr-Branched-From: 942c2ef-refs/heads/master@{#70196}

(cherry picked from commit 8fe2791)

No-Try: true
Bug: chromium:1406448
Change-Id: Ife4643913e340c382eaf8738b13bdb47b4b6f46d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4154411
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Alexander Schulze <alexschulze@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Alexander Schulze <alexschulze@chromium.org>
Cr-Original-Commit-Position: refs/heads/main@{#85198}
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4194554
Reviewed-by: Almothana Athamneh <almuthanna@chromium.org>
Cr-Commit-Position: refs/branch-heads/11.0@{v8#22}
Cr-Branched-From: 06097c6-refs/heads/11.0.226@{#1}
Cr-Branched-From: 6bf3344-refs/heads/main@{#84857}

Merged: [runtime] Don't track "class" field types for arrays with properties.
Revision: 21e7f08

Merged: [runtime] Don't create "class" field types for arrays' fields.
Revision: c558369

Merged: [runtime] Don't create class field types for arrays' fields.
Revision: 10e4fe3

BUG=chromium:738763,chromium:745844,chromium:747979,chromium:748539
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=hablich@chromium.org

Change-Id: I73e305aacfb532121f1621078a46f465cf463b05
Reviewed-on: https://chromium-review.googlesource.com/590230
Reviewed-by: Michael Hablich <hablich@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.1@{v8#22}
Cr-Branched-From: 1bf2e10-refs/heads/6.1.534@{#1}
Cr-Branched-From: e825c43-refs/heads/master@{#46746}

Change-Id: I3149dca07e2fda5e1fd6676a19ddec8d17ca89c8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4353672
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/11.2@{v8#22}
Cr-Branched-From: 755511a-refs/heads/11.2.214@{#1}
Cr-Branched-From: e6b1cce-refs/heads/main@{#86014}

Partial cherry-pick from 19a2ff2be5b60f6df6c7c7160860ede2cb85e27
This change needs to be backmerged as well due to the fixed
DCHECK in a7eae99.

Bug: chromium:1417908
Change-Id: Ic90c556e66e6291f677d0fa3751945b39e3d5559
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4290446
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/branch-heads/11.1@{v8#22}
Cr-Branched-From: c77793a-refs/heads/11.1.277@{#1}
Cr-Branched-From: 95b79bf-refs/heads/main@{#85479}

(cherry picked from commit a0927f2335aca0df713503669fc5f32a766ccb2b)

Bug: chromium:1411452
Change-Id: I5858324baf229093f89a4e86e8aff1ff629341f1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4231452
Auto-Submit: Liviu Rau <liviurau@chromium.org>
Commit-Queue: Liviu Rau <liviurau@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Reviewed-by: Liviu Rau <liviurau@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4231971
Cr-Commit-Position: refs/branch-heads/10.9@{v8#22}
Cr-Branched-From: 8ade6bf-refs/heads/10.9.194@{#1}
Cr-Branched-From: 9ff2515-refs/heads/main@{#84164}

This reverts commit 5fef8ed.

Reason for revert: trigger builders

Original change's description:
> Whitespace to trigger builders
>
>
> (cherry picked from commit a0927f2335aca0df713503669fc5f32a766ccb2b)
>
> Bug: chromium:1411452
> Change-Id: I5858324baf229093f89a4e86e8aff1ff629341f1
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4231452
> Auto-Submit: Liviu Rau <liviurau@chromium.org>
> Commit-Queue: Liviu Rau <liviurau@chromium.org>
> Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
> Reviewed-by: Liviu Rau <liviurau@chromium.org>
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4231971
> Cr-Commit-Position: refs/branch-heads/10.9@{v8#22}
> Cr-Branched-From: 8ade6bf-refs/heads/10.9.194@{#1}
> Cr-Branched-From: 9ff2515-refs/heads/main@{#84164}

Bug: chromium:1411452
Change-Id: Ib46b47fdb52989826bfc0745d47dccdaeaa44681
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4232537
Reviewed-by: Liviu Rau <liviurau@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Liviu Rau <liviurau@chromium.org>
Cr-Commit-Position: refs/branch-heads/10.9@{v8#24}
Cr-Branched-From: 8ade6bf-refs/heads/10.9.194@{#1}
Cr-Branched-From: 9ff2515-refs/heads/main@{#84164}

This is a reland of commit 5fef8ed

Original change's description:
> Whitespace to trigger builders
>
>
> (cherry picked from commit a0927f2335aca0df713503669fc5f32a766ccb2b)
>
> Bug: chromium:1411452
> Change-Id: I5858324baf229093f89a4e86e8aff1ff629341f1
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4231452
> Auto-Submit: Liviu Rau <liviurau@chromium.org>
> Commit-Queue: Liviu Rau <liviurau@chromium.org>
> Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
> Reviewed-by: Liviu Rau <liviurau@chromium.org>
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4231971
> Cr-Commit-Position: refs/branch-heads/10.9@{v8#22}
> Cr-Branched-From: 8ade6bf-refs/heads/10.9.194@{#1}
> Cr-Branched-From: 9ff2515-refs/heads/main@{#84164}

Bug: chromium:1411452
Change-Id: I6fb82d6142645e03bf45b2b109af3653883666f7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4231793
Reviewed-by: Liviu Rau <liviurau@chromium.org>
Commit-Queue: Liviu Rau <liviurau@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/10.9@{v8#26}
Cr-Branched-From: 8ade6bf-refs/heads/10.9.194@{#1}
Cr-Branched-From: 9ff2515-refs/heads/main@{#84164}

TBR=machenbach@chromium.org

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I62b1a8f898e09e9bc39ea52ce55a4965cd40e8d5
Reviewed-on: https://chromium-review.googlesource.com/669446
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.2@{v8#22}
Cr-Branched-From: efa2ac4-refs/heads/6.2.414@{#1}
Cr-Branched-From: a861ebb-refs/heads/master@{#47693}

... when defining properties in favour of CheckIfCanDefine.

Drive-by: move JSReceiver::CheckIfCanDefine to
JSObject::CheckIfCanDefineAsConfigurable and fix handling of
absent properties.

Bug: chromium:1443452
(cherry picked from commit e98baa3)

Change-Id: Ia1fd617778be608accee99dcee37f7d1ce3460b8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4545762
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/branch-heads/11.4@{v8#22}
Cr-Branched-From: 8a8a1e7-refs/heads/11.4.183@{#1}
Cr-Branched-From: 5483d8e-refs/heads/main@{#87241}

Cr-Commit-Position: refs/branch-heads/5.9@{v8#22}
Cr-Branched-From: fe9bb7e-refs/heads/5.9.211@{#1}
Cr-Branched-From: 70ad237-refs/heads/master@{#44591}

There are only two changes in the roll. This is to match
Chromium M63's ICU in v8's 6.3 branch

 https://chromium.googlesource.com/chromium/deps/icu/+log/08cb9568..21d33b1a

Bug: 770452
Test: See the bug
Change-Id: I63007a5ece0222374a02a958bb04a523f66c78c1
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/723564
Commit-Queue: Jungshik Shin <jshin@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Michael Hablich <hablich@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.3@{v8#22}
Cr-Branched-From: 094a7c9-refs/heads/6.3.292@{#1}
Cr-Branched-From: 18b8fbb-refs/heads/master@{#48432}

TBR=iannucci@chromium.org
NOTRY=true
NOPRESUBMIT=true

Bug: chromium:786503
Change-Id: I8e1643a8faaed44c0cec92cbaa06e68363c55217
Reviewed-on: https://chromium-review.googlesource.com/839060
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.4@{v8#22}
Cr-Branched-From: 0407506-refs/heads/6.4.388@{#1}
Cr-Branched-From: a5fc4e0-refs/heads/master@{#49724}

Cr-Commit-Position: refs/branch-heads/5.8@{v8#22}
Cr-Branched-From: eda659c-refs/heads/5.8.283@{#1}
Cr-Branched-From: 4310cd0-refs/heads/master@{#43429}

Revision: eadaef5

NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true

Bug: v8:14008
Change-Id: I4f70ebaaf7633d32de9ffa671b9cf34256b53a48
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4543311
Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Cr-Commit-Position: refs/branch-heads/11.3@{v8#22}
Cr-Branched-From: b0a3a06-refs/heads/11.3.244@{#1}
Cr-Branched-From: 0326cf6-refs/heads/main@{#86647}

…"used"

Revision: 970d907

BUG=681529
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=bradnelson@chromium.org

Review-Url: https://codereview.chromium.org/2653853003
Cr-Commit-Position: refs/branch-heads/5.7@{v8#22}
Cr-Branched-From: 975e9a3-refs/heads/5.7.492@{#1}
Cr-Branched-From: 8d76f0e-refs/heads/master@{#42426}

Bug: chromium:1452137
(cherry picked from commit e548943)

Change-Id: I4be8b53f5668839515efefa566476d8e9c6182dd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4637186
Auto-Submit: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/branch-heads/11.5@{v8#22}
Cr-Branched-From: 0c4044b-refs/heads/11.5.150@{#1}
Cr-Branched-From: b71d303-refs/heads/main@{#87781}

(cherry picked from commit b947905)

Bug: v8:7748, chromium:1466183
Change-Id: I6d7de33e0cec37747045269f441e65f7a482dd4f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4701553
Auto-Submit: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Original-Commit-Position: refs/heads/main@{#89060}
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4714606
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/branch-heads/11.6@{v8#22}
Cr-Branched-From: e29c028-refs/heads/11.6.189@{v8#3}
Cr-Branched-From: 95cbef2-refs/heads/main@{#88340}

The clone ic blindly copies the properties backing store, thus source
and target map better have the same sized backing store.

Bug: chromium:1476373
(cherry picked from commit d0dc4fc)

Change-Id: I134f9ff42b637541674a2fad03208cb723244e85
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4828324
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Olivier Flückiger <olivf@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/branch-heads/11.7@{v8#22}
Cr-Branched-From: fe60869-refs/heads/11.7.439@{#1}
Cr-Branched-From: aeb4552-refs/heads/main@{#89415}

The Assembler's {b} method is missing logic we need here, thus use the
MacroAssembler's {B} method instead.

Bug: chromium:1485829
(cherry picked from commit bd75ac3)

Change-Id: I69e131e45d28d64418bde227ace15b64684f6ae7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4902687
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/branch-heads/11.8@{v8#22}
Cr-Branched-From: 935bdbf-refs/heads/11.8.172@{#1}
Cr-Branched-From: b82a911-refs/heads/main@{#89779}

When called on strings, SameValue can flatten ConsString, which
allocates memory.

Bug: v8:12783, chromium:1489500
(cherry picked from commit e5e3ce3)

Change-Id: I4fc6f7fd4f421d5fc478fc6bccea7673b426791b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5110981
Reviewed-by: Matthias Liedtke <mliedtke@chromium.org>
Auto-Submit: Darius Mercadier <dmercadier@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/branch-heads/12.1@{v8#22}
Cr-Branched-From: b74ef6f-refs/heads/12.1.285@{#1}
Cr-Branched-From: 32857fb-refs/heads/main@{#91313}

…ne() type

(cherry picked from commit 949bbdf)

Bug: chromium:1507106
Change-Id: Ic4ea57fe004cb417459231f4f9dc49a08d4fa94f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5126172
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Eva Herencsárová <evih@chromium.org>
Auto-Submit: Eva Herencsárová <evih@chromium.org>
Cr-Commit-Position: refs/branch-heads/12.0@{v8#22}
Cr-Branched-From: ed7b4ca-refs/heads/12.0.267@{#1}
Cr-Branched-From: 210e75b-refs/heads/main@{#90651}

…in register

When constants should be used as Smi as FrameState input, we used to
convert Int32Constant to tagged by using a BitcastWordToTagged, but a
recent CL (https://crrev.com/c/5083021) made that more precise,
generating a BitcastWordToTaggedSigned instead.

When the Instruction Selector visits a BitcastWordToTagged, it emits a
Nop with a DefineSameAsFirst (which seems to be some kind of
GapMove). However, when it visits BitcastWordToTaggedSmi, it doesn't
emit anything and just does a renaming.

For a reason that's not clear to me, the register allocator does not
want to spill registers holding constants that come from renamings,
but is happy to spill registers holding constants coming from
GapMoves.

This lead to the register allocator running out of registers when
allocating registers for FrameState inputs, because it was using one
register per integer constant input and didn't want to spill any of
them.

This CL fixes the issue by adding a special case when generating frame
states in the Instruction Selector: BitcastWordToTaggedSigned with
Word32 constant inputs now lead to using a Constant rather than using
the BitcastWordToTaggedSigned itself.

Bug: v8:12783, chromium:1520697
(cherry picked from commit a5e2207)

Change-Id: I5da8a10bc9ffd95511f2237488178fe8066ba65a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5250114
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Auto-Submit: Darius Mercadier <dmercadier@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/branch-heads/12.2@{#22}
Cr-Branched-From: 6eb5a96-refs/heads/12.2.281@{#1}
Cr-Branched-From: 44cf56d-refs/heads/main@{#91934}

Crash occurred because JSPI initialization was not completed if OT only.

Moved all of init code to bootstrap phase; guarded both by OT & non-heap serialization (during snapshot) tests.

Bug: chromium:330543313
(cherry picked from commit 1e59b8f)

Change-Id: Ib132f54d4fbef4075e3897dc11b3b5943b0496a3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5388197
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Francis McCabe <fgm@chromium.org>
Cr-Commit-Position: refs/branch-heads/12.3@{#22}
Cr-Branched-From: a86e197-refs/heads/12.3.219@{#1}
Cr-Branched-From: 21869f7-refs/heads/main@{#92385}