With eager compilation, CompilationEventCallbacks get released when all
compilation units in the compilation state are finished. This is
possible because no future compilation event could get triggered after
that. With dynamic tiering, though, the {FinishedCompilationChunk} event
can trigger repeatedly, even after all compilation units finish at some
point in time, as dynamic tiering can create new CompilationUnits. As
a temporary fix, CompilationEventCallbacks don't get released when
dynamic tiering is enabled.

This CL fixes this issue by turning the callback from an std::function
into a class, and adding a second function to the class which indicates
whether the callback can be released when all compilation units in the
compilation state are finished. Thereby all callbacks can be deallocated
except the ones like the code caching callback which waits for the
{FinishedCompilationChunk} events.

R=jkummerow@chromium.org

Bug: v8:12289
Change-Id: I0f73f4bd2dffe644c9a26c274cb52ac6fa49ab67
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3264288
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77890}

In each wasm CallDescriptor, we store the signature of the call based on
the real parameters passed to the call. This signature is more precise
than the formal function signature. We use this signature in inlining
to enable more optimizations.

Changes:
- Add wasm_sig_ field to CallDescriptor.
- Construct the real signature in {DoCall} and {DoReturnCall} in
  graph-builder-interface, and pass it to all call-related functions in
  WasmGraphBuilder.
- Update {ReplaceTypeInCallDescriptorWith} to use ValueType over
  MachineType. Construct the updated function signature.
- In wasm-inlining, kill the Call node after inlining.
- Add two tests.

Bug: v8:11510
Change-Id: Ica711b6b4d83945ecb7201be26577eab7db3c060
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3270539Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77889}

Change-Id: I2c05683f2172cc4a37189382ad886f523d51e823
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3273814Reviewed-by: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Auto-Submit: Jianxiao Lu <jianxiao.lu@intel.com>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77888}

Rolling v8/third_party/google_benchmark/src: https://chromium.googlesource.com/external/github.com/google/benchmark/+log/a17480d..8401429

Remove bazelbuild/rules_cc dependency (#1283) (Teodor Spæren)
https://chromium.googlesource.com/external/github.com/google/benchmark/+/8401429

Support for building with LLVM clang-10/clang-11 on Windows. (#1227) (Alisenai)
https://chromium.googlesource.com/external/github.com/google/benchmark/+/926f61d

TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com,mlippautz@chromium.org

Change-Id: I8bf8ac6270221ea56ab065bb7acedd7dbe8f43f8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3281561Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#77887}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/2c7b246..d134d68

TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: Id7ae91bc1ac02eac6b9e5efe0c89b6e3a07a766b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3281560Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#77886}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/701766c..2c7b246

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/08a95d8..3fca89b

Rolling v8/third_party/googletest/src: https://chromium.googlesource.com/external/github.com/google/googletest/+log/9ca071b..1b18723

Rolling v8/tools/luci-go: git_revision:bf56a119c5f056a1f7a04c8dbe19cdd86728b540..git_revision:4cf9fa8105d30e3a6855bbfca50c5d6f88efb6b2

Rolling v8/tools/luci-go: git_revision:bf56a119c5f056a1f7a04c8dbe19cdd86728b540..git_revision:4cf9fa8105d30e3a6855bbfca50c5d6f88efb6b2

TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I59ae20fdf916dc2d1fd24cb6c5fd3229d252b466
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3279044Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#77885}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/f38f611..701766c

Rolling v8/third_party/aemu-linux-x64: eWKIKAWWZAJd3aNVfwGevVWupHnf0a31BNfVmvJfkucC.._9UC-vP_2UFSwkJLesq9YhIVywjThQvItoADZJtdSUcC

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/279fe4e..a7ad5b5

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/0b187dc..08a95d8

Rolling v8/third_party/instrumented_libraries: https://chromium.googlesource.com/chromium/src/third_party/instrumented_libraries/+log/380f371..e09c4b6

Rolling v8/third_party/zlib: https://chromium.googlesource.com/chromium/src/third_party/zlib/+log/6da1d53..f8964a5

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/92efe5e..32d7c38

TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I1242a5a0b8efa55c9fa5c979c107122b84407b31
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3279042Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#77884}

FLAG_wasm_dynamic_tiering is still off by default. When enabled,
it now uses the technique previously behind --new-wasm-dynamic-tiering.

Bug: v8:12281
Change-Id: I365c2c066e62418cd6abc7830f95d1fe0f950e33
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3275570
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77883}

The entered contexts stack must be in sync with the flags stack.

Bug: chromium:1269225
Change-Id: Ibb522286b47866d5f13aaec1a0a02914c13a5545
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3279680
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77882}

When incrementally marking a non-shared heap, shared values should not
be marked. Similarly, non-shared values should not be marked when
incrementally marking a shared heap.

Bug: v8:11708
Change-Id: Iecd799e7e3060e5fb3897b8be0c4e8158d9ff57f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3278673
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77881}

Bug: v8:12244,v8:12245
Change-Id: I4a57fbd187ffebb1c1f170865641caef7b193926
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3274017
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77880}

Change-Id: I8cd279059800567a81d8586944c8ed4c0ef9fa92
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3279101Reviewed-by: Milad Fa <mfarazma@redhat.com>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/main@{#77879}

Bug: v8:12244,v8:12245
Change-Id: I02e08e79a7b3a07531bfac753beff13a866247e8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3269170Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77878}

Under certain conditions GC could flush bytecode array from
SharedFunctionInfos. This CL ensures that the bytecode array is always
available for reconstructing source positions.

Bug: chromium:1265570
Change-Id: I2ce7eb04201f69121687ab0aaa2af42adb2caae0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3275569Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77877}

Switching stack affects all instances, therefore make the active
continuation a root object instead of an instance field.

Bug: v8:12191
Change-Id: Ia521bf4e7c3cbca035f916e47804c2f75bbd8f18
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3268296Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77876}

This shadows ATOM used in js-regxp.

Making this an enum class requires changing a lot of different places.

Atom is an Intel brand name, so INTEL_ATOM kinda make sense.

Bug: v8:12244,v8:12245
Change-Id: I80be342488328cde5aaca36f900375d2fb381253
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3276926Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77875}

Change-Id: Iff669f6272e2a95d5150108d5a3a77e903afbeb9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3275568Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#77874}

UnprotectAndRegisterMemoryChunk should only be called if we have
CodePageCollectionMemoryModificationScope or
CodeSpaceMemoryModificationScope open.

This also fixes cctests that create code objects without a
code modification scope.

Bug: v8:12054
Change-Id: Id931f1f8120050b2bb76ef3d5701b9a32e52ff37
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3277882
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77873}

Unify parse post-processing between main-thread and background-thread
parsing, now that we have LocalIsolate and can Internalize on background
threads.

As part of this, simplify the LocalIsolate parking pattern to explicitly
park during ParseOnBackground, rather than being implicitly parked when
ParseOnBackground is called. This reduces the amound of scoping needed
in the BackgroundCompileTask::Run method.

Change-Id: Ifdb128b763129bda78bd1bae89dac1c62f872350
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3277876
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77872}

When closing a concurrent allocator, for instance when closing a
LocalHeap, we need to make the LAB of the code space iterable.
We add then a CodePageMemoryModificationScope to allow
code space modification.

Bug: v8:12054
Change-Id: I438d7c1a50694930b7558dec2dd552bec22b7552
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3277887
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77871}

Speculative fix for a data race involving memory measurement. For memory
measurement we use JSGlobalObject::native_context_unchecked in
NativeContextInferrer::InferForJSObject when trying to infer the
NativeContext for a JS object from a concurrent marking thread. This
load can race e.g. with the context deserializer running on the main
thread. Fix this race by making the load relaxed atomic.

Bug: chromium:1269681
Change-Id: Id04a92572d7d722594b2f8465e579b7231e54e29
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3277885
Auto-Submit: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77870}

Due to streaming, the SFI enqueueing can happen concurrently with with
main-thread finalising, so we need to add locks around accesses to the
SFI->Job map.

Bug: v8:12370
Change-Id: I60281a954ef10f7fcde559b9529077a6b9a82c31
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3277874
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77869}

Diary  https://docs.google.com/document/d/1NqMw7DAVFCZRx67auC7sgOvrikHvCYuaB87JUf21yG8/edit#
https://chromium.googlesource.com/chromium/deps/icu.git/+log/eedbaf76..3e05d9da

chromium roll in https://chromium-review.googlesource.com/c/chromium/src/+/3224333

Bug: chromium:1260116
Change-Id: Ie1922a129310106985f3bf1bffd9101fce6bb73a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3237532Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77868}

The DCHECK ensures that a page that is going to be destroyed is not
anymore part of the vector of pages of a space. This DCHECK runs while
a potential concurrent sweeper task may add a page for a live object
to the vector, resulting in a broken iteration. Use the pages lock to
fix this.

Bug: chromium:1268969
Change-Id: Ice87026957b3e6b5d36cf28293f7aa6901e96ba2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3277132
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77867}

No-Try: true
Bug: v8:12054
Change-Id: I118d1680939d1282c580530f8aa12a4cf72e54d1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3277875Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77866}

- Add Wasm SIMD packing instruction:
  `LiftoffAssembler::emit_i8x16_{s,u}convert_i16x8`

- Add Wasm SIMD unpacking instructions:
  `LiftoffAssembler::emit_i64x2_{s,u}convert_i32x4_{low,high}`
  `LiftoffAssembler::emit_i32x4_{s,u}convert_i16x8_{low,high}`
  `LiftoffAssembler::emit_i64x2_{s,u}convert_i32x4_{low,high}`

- Add RVV instrucions: `vzext_vf{2,4,8}` and `vsext_vf{2,4,8}`

- Fixed simulator for `vslidedown_vi`

Bug: v8:11976
Change-Id: Idd383bc566589ce183f4fcef2201d2ccfe03519f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3273812Reviewed-by: ji qiu <qiuji@iscas.ac.cn>
Reviewed-by: Yahan Lu <yahan@iscas.ac.cn>
Commit-Queue: ji qiu <qiuji@iscas.ac.cn>
Cr-Commit-Position: refs/heads/main@{#77865}

Rolling v8/third_party/google_benchmark/src: https://chromium.googlesource.com/external/github.com/google/benchmark/+log/b3c08f6..a17480d

Fix dependency typo and unpin cibuildwheel version in wheel building … (#1263) (Nicholas Junge)
https://chromium.googlesource.com/external/github.com/google/benchmark/+/a17480d

TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com,mlippautz@chromium.org

Change-Id: Iee5b0189f850eba665fe60670b0bdaa7e5a3f779
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3275844Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#77864}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/2f14357..f38f611

Rolling v8/third_party/aemu-linux-x64: j1lOwTKOsgGUj2jDFDa6IhTVhwEoPPzmdxFksCvz278C..eWKIKAWWZAJd3aNVfwGevVWupHnf0a31BNfVmvJfkucC

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/0dab16a..279fe4e

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/2df8443..0b187dc

Rolling v8/third_party/googletest/src: https://chromium.googlesource.com/external/github.com/google/googletest/+log/79efd96..9ca071b

Rolling v8/third_party/instrumented_libraries: https://chromium.googlesource.com/chromium/src/third_party/instrumented_libraries/+log/286f857..380f371

Rolling v8/tools/luci-go: git_revision:d17c642c8c3c6d9e37bd9c25535c4c5b66b99781..git_revision:bf56a119c5f056a1f7a04c8dbe19cdd86728b540

Rolling v8/tools/luci-go: git_revision:d17c642c8c3c6d9e37bd9c25535c4c5b66b99781..git_revision:bf56a119c5f056a1f7a04c8dbe19cdd86728b540

TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: If831f3ede3b0e01ad34b4901448b7482f6c64d33
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3275842Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#77863}

Port 9a900169

The second parameter of Int64Mul may be a 64-bit immediate value,
treating it as a 32-bit value will lose the upper 32 bits.

Bug: v8:12373

Change-Id: Ib824db839219307ba390a6dc3c697bedb792046f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3275135
Auto-Submit: Yahan Lu <yahan@iscas.ac.cn>
Commit-Queue: ji qiu <qiuji@iscas.ac.cn>
Reviewed-by: ji qiu <qiuji@iscas.ac.cn>
Cr-Commit-Position: refs/heads/main@{#77862}

Bug: v8:12228
Change-Id: I9312716f78e79fd0759c2f7adfef065b5df5cfda
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3275566Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Yolanda Chen <yolanda.chen@intel.com>
Cr-Commit-Position: refs/heads/main@{#77861}

This fixes a -Wshadow warning for NO_FLAG. The other option is to
make it an enum class, which makes test-conversions.cc a bit verbose.

Bug: v8:12244,v8:12245
Change-Id: I3ea429eb45e31b25d4c6658ceb86c33ba280ae51
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3274015Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77860}

Bug: v8:12244,v8:12245
Change-Id: I1f0c7fa26e6db208f621470d4bcbea904909a799
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3274014
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77859}

This reverts commit 72e01a06.

Reason for revert: Failing on Linux 64, local bisect to this change, run with --random-seed-stress-count=1000

Original change's description:
> Reland "[baseline] Enable concurrent sparkplug on future"
>
> This is a reland of 0e4554b4
>
> Original change's description:
> > [baseline] Enable concurrent sparkplug on future
> >
> > Bug: v8:12054
> > Change-Id: I9d5040c806232ecbe71c26b7d65acbc8005bbd00
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3233139
> > Commit-Queue: Victor Gomes <victorgomes@chromium.org>
> > Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> > Cr-Commit-Position: refs/heads/main@{#77842}
>
> Bug: v8:12054
> Change-Id: I60849c6c9c7c7e6687422669e5636b2a283cc6ff
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3275560
> Commit-Queue: Victor Gomes <victorgomes@chromium.org>
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#77850}

TBR=leszeks@chromium.org,v8-scoped@luci-project-accounts.iam.gserviceaccount.com,victorgomes@chromium.org

Change-Id: I26b75edb26bd81128a2a266461e7a917dff3b176
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:12054
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3276912Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77858}

My previous change https://crrev.com/c/3160299 introduced a runtime
CHECK that crashes the process if V8 attempts to read a deoptimization
literal which has been cleared. That CHECK is indeed crashing the
process.

It appears that the trouble arises in cases where the deoptimization
data indicates that an object should be materialized as needed. In those
cases, one of the deoptimization literals is the Map to use when
materializing the object. It is possible to reach a part of the code
that requires the materialized object, and therefore the Map, without
there being any other owner of that Map. This is in contrast to most
other deoptimization literals, which are logically equivalent to omitted
values from the stack frame and therefore can't be reached without a
real owner somewhere to keep them alive.

To fix, I propose referring to Maps strongly from the deoptimization
literals. The cases I investigated in v8:4578 didn't involve Maps, so I
believe that the observed memory leaks are still fixed with this change.

Bug: chromium:1268681, chromium:1268683, chromium:1268825, v8:12300
Change-Id: Ifd32a7f9cc29e0384650013ab16e05646bf57895
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3272880
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77857}

Bug: v8:12244,v8:12245
Change-Id: I4adafe31ffc747f7184c8b868f97e4a549e619ce
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3273530Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77856}

Bug: v8:12244,v8:12245
Change-Id: I98c3f5e4aeed2d2179c61d482999fb498c676639
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3273527Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77855}

Bug: v8:12244,v8:12245
Change-Id: I2d1f9f24b8a78b8025c73e065e79c72c842a939b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3273528Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77854}

Bug: v8:12244,v8:12245
Change-Id: Ieb3129ec1e66024b5431a1deb231529b94c740f2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3273894Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77853}

Bug: v8:12244,v8:12245
Change-Id: Ibef9eaa7f1c3a58ef290b61a9f46b98fc30184af
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3274019Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77852}

Similar to previous bug v8:11771, this test needs deterministic GC
behavior so it is incompatible with concurrent inlining.

Bug: v8:12374, v8:4578
Change-Id: Ib3667744d1032524a0c2e697a970876dfc1677ae
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3272882
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77851}