Bug: v8:9909
Change-Id: I9145ac93392073f01e2df9fec8eeae0b6e75dd00
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2145238
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67132}

Bug: v8:9909
Change-Id: I38e3a8d8915148107b7ff810e1e28c97351da65a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2145237Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67131}

[1] has changed the layering between JavaScript and HTML substantially
with regards to queuing promise-related microtasks. This fixes up the
comments and parameter orders so that they match up with the current
spec.

[1]: https://github.com/tc39/ecma262/commit/c59502090e2c250cd7e457b5506b92db6b21d153

Change-Id: I75650f7dc1c0b1d1c2b67aaf19d9791a0391a06d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2106997Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Timothy Gu <timothygu@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67130}

A few notes:
1) Oilpan is a generic library, meaning that it can work with arbitrary
user types. The library is split in type-aware (include/) and
type-erased (src/) parts. The former comprises a lot of code that still
needs to be defended with dchecks;
2) Macros are prefixed with CPPGC_, so that they don't clash in the user
code with similar macros from other libraries;
3) The macros simply forward requests to V8 so that dcheck handlers can
be configured uniformly;
4) The CL doesn't contain CHECK_EQ and friends, but they can be added
later if needed.

Bug: chromium:1056170
Change-Id: I68e6f663247705233eaf030384164d81e53071e1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2148774
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67129}

Change-Id: Id55edb409f64b8dfd72530c95a3a5ca001d176b5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2144750Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#67128}

R=ahaas@chromium.org

Bug: v8:10328
Change-Id: I19ecad9161ea61b4c8a22f80f8ac10ebf23dee53
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2148783
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67127}

The CL also mooves the {ClearRegister} function to the
platform-independent LiftoffAssembler code.

R=clemensb@chromium.org

Bug: v8:10108
Change-Id: Ibf9f1829a525c859ad004636f678b82aa72d39ae
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2129637
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Jacob Bramley <jacob.bramley@arm.com>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67126}

This CL adds:
- Declaring and invoking prefinalizers
- NoAllocationScope

Bug: chromium:1056170
Change-Id: Ib0f688fa4a8bb5fde44b36597ce2d6d2664fdff5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2139588
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67125}

This reverts commit f2ea42d6.

Reason for revert: Makes UBSan unhappy: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20UBSan/10634

Original change's description:
> [wasm-debug-eval] Implement additional evaluator API methods
> 
> This CL implements the __getLocal and __sbrk APIs of the evaluator
> interface.  Also includes a drive-by fix of the imports' module: put
> them on the "env" module.
> 
> Change-Id: Ie16d1b1cf924b88734eda184d1ce98d52f32f828
> Bug: chromium:1020120
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2132786
> Commit-Queue: Philip Pfaffe <pfaffe@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#67122}

TBR=jkummerow@chromium.org,pfaffe@chromium.org

Change-Id: I23b078d37971e083c08c9b83994bbf38ac13f103
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:1020120
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2148787Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67124}

We were still occasionally failing tests because sometimes non-debug
Liftoff code was published *after* debug Liftoff code. This would
overwrite the debug code and we would not stop on function entry then.
This fixes this by only preferring Liftoff code in publishing if it has
been compiled for debugging.
As a side effect, this will also prefer TurboFan code which has been
compiled for debugging (i.e. Liftoff bailed out), but this would only
happen for experimental features and in this case we will just overwrite
TurboFan code with TurboFan code, which is fine.

R=thibaudm@chromium.org

Bug: v8:10410
Change-Id: I6516e9f474f6118f0f0c077e6789f604ca128e74
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2144122Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67123}

This CL implements the __getLocal and __sbrk APIs of the evaluator
interface.  Also includes a drive-by fix of the imports' module: put
them on the "env" module.

Change-Id: Ie16d1b1cf924b88734eda184d1ce98d52f32f828
Bug: chromium:1020120
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2132786
Commit-Queue: Philip Pfaffe <pfaffe@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67122}

For example, when --fuzzing is off, %OptimizeFunctionOnNextCall now
crashes when given a non-function argument.

The following behaviors remain unchanged for now:
- %DeoptimizeFunction continues to do nothing if the function is not
  optimized.
- %DeoptimizeNow continues to do nothing if the top-most JS function
  is not optimized.
- %OptimizeOSR continues to do nothing if the function already has
  optimized code.

Bug: v8:10249
Change-Id: I35d2f3d50ce3f94c8ffccabe50fb4df2b70ce028
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2137406
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67121}

Change-Id: I2183b08596874d41eece64d6bdecc8f174cd738e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2144547Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67120}

This adds a flag to {WasmCode} objects to store whether this code was
generated for debugging. This flag can be set for Liftoff code (in which
case the code will e.g. have an extended prologue for debugging), but it
can also be set for TurboFan, in case Liftoff bailed out when producing
the debugging code.

Having this flag allows us to remove the hack to pass the compilation
results to {OnFinishedUnits} just to check whether we actually wanted to
compile Liftoff functions.

Drive-by: Replace the {ReachedRecompilationTierField} by a
{MissingRecompilationField}, because all we need to know is if we are
still waiting for that function to get recompiled.

R=ahaas@chromium.org

Bug: v8:10330,v8:10410
Change-Id: Ia023df8955a60d9f5595a6cb2737e14d83baf716
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2142259
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67119}

Bug: v8:9891
Change-Id: I5e561e1ef93f0ed6712ea6477cbee0205f72e1c1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2145192Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67118}

This is a port of src/components/gc that was added recently.

Differences:
- Added back bucketing to the page pool, as that guarantees that
  arenas used for specific types do not have their pages used by other
  arenas.
- Replaced base::flat_map with std::map. This may cause performance
  regressions when using PageMemoryRegionTree in hot paths. A
  vector-like representation may be used to fix such a regression

This reverts commit a056cea5.

Bug: chromium:1056170
Change-Id: Iffb8b0d91c8cca1815d7a1cda9486e7716aea75f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2144060
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67117}

v8::V8::Initialize() will fail with meaningful error upon build
configuration mismatch.

Bug: v8:10041
Change-Id: Ic69ba68ef1764b356beef0f204fe58b45bae3c49
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2144953
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67116}

Before the "debug" flag was stored on the {CompilationEnv}. But each
background compilation task only gets the {CompilationEnv} once when
starting compilation, so by the time it picks up the "Liftoff for
debugging" compilation jobs, it might still compile them without the
debug flag being set. This leads to flakes in the "debug-step-into-wasm"
test, because we won't stop in the function prologue when stepping in
(because the function prologue does not check the "hook on function
call" flag if debug mode was not enabled).

This CL does not increase the size of a compilation unit, since both the
tier and the debug flag only need a single byte each.

As a nice side effect, this change allows us to remove the lock in
{CreateCompilationEnv}, because no modifyable flag is read any more.

R=thibaudm@chromium.org

Bug: v8:10410
Change-Id: Ic296ea0c4dd1d4dedde119f0536e87e5d301b5a1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2144116Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67115}

ArrayBuffer instances are serialized by first re-assigning a index
to the backing store field, then serializing the object, and then
storing the actual backing store address again (and the same for the
ArrayBufferExtension). If serialization of the object itself is deferred,
the real backing store address is written into the snapshot, which cannot be
processed when deserializing, leading to a crash.

This fixes this by not deferring ArrayBuffer serialization and adding a DCHECK
for the crash that previously occurred.

Change-Id: Id9bea8268061bd0770cde7bfeb6695248978f994
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2144123
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67114}

Port 4558c1df

Original Commit Message:

    As a drive-by, the order of rounding_average_u is adjusted according to src/wasm/wasm-opcodes.h.

R=zhiguo.zhou@intel.com, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: Ib5c72c9187ee3803c5c04b4fb62422be67382bf1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2148649Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#67113}

Bug: chromium:1056170
Change-Id: Idbbab7af430e3bc2791eba630b331a75a67e35a9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2142262Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67112}

- Minor improvements to the documentation for snapshotting.
- Add newlines to printed errors where necessary.

Change-Id: I822e7e850adb67eae73b51c23cf34e40ba3106f0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2144954Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67111}

Change the unittests Isolate mixin to create one Isolate per test,
rather than one per test suite. We usually run these tests independently
in separate processes anyway, so this shouldn't affect normal test
execution, but it will avoid Isolate state leaking across tests when
running the unittests binary directly.

Take this opportunity to also clean up the mixins, changing counter
initialization and forcing pointer compression into template traits.

Bug: v8:10142
Change-Id: If92046f9c6f2056252d099faed04d97844ef7319
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2143818Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67110}

Provides the infrastructure to register weak callbacks for
WeakMember<T> through visitor. The WeakCallbackInfo broker is used to
query objects for liveness. In a future CL the same broker object is
passed to custom weak callbacks.

Change-Id: I8b5a66354e0e457521989d40ae64a9558c339503
Bug: chromium:1056170
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2142265
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67109}

Bug: v8:10371, v8:10396
Change-Id: I55359ac5d96369962d472f8a7e5d01303b823be0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2145240
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67108}

Introduce LivenessBroker which is a temporary broker object to expose
liveness during specific garbage collection phases.

This broker can be used to handle:
- PreFinalizer
- Custom weak callbacks
- Internal weak callbacks used for WeakMember

Change-Id: I3870c2b89b2538f04feabf2eb7a4676ce2fe7d61
Bug: chromium:1056170
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2144059Reviewed-by: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67107}

This adds ownership of tests.

Bug: chromium:1056170
Change-Id: Ibed6ee0024d34c886817d273660922d5cc6865ec
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2141734Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67106}

Port c054847d
https://crrev.com/c/2131323

Change-Id: I21e534399eed573affd3bf65004b3e570c549ff4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2147573Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/master@{#67105}

As a drive-by, the order of rounding_average_u is adjusted according to src/wasm/wasm-opcodes.h.

Bug: v8:9909
Change-Id: Ia3a2ed5869f8df8a2191afa034e0b9438de98bc5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2141654Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Zhiguo Zhou <zhiguo.zhou@intel.com>
Cr-Commit-Position: refs/heads/master@{#67104}

v8.1 has a stability issue where we free code too early. Thus disable
for now, such that we can merge this back to v8.1.
v8.2 does not have this problem, since https://crrev.com/c/2078583 fixed
it. This CL is not easily backmergable though.

R=tebbi@chromium.org

Bug: chromium:1070199, chromium:1070182
Change-Id: I4bf468b3e7b5b1e66b314907f844d4195b3ff029
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2144966
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67103}

Port 445f9ef1
https://crrev.com/c/2107511

Change-Id: Ib3517c186da6e49574b873ac568afd0e8e4336c5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2143980Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/master@{#67102}

Port 445f9ef1

R=zhiguo.zhou@intel.com, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I3b383071ea26286e9d1d5121565020a0c6f31a91
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2147030Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#67101}

Port bd04ee08

R=fanchen.kong@intel.com, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I3b8e2625816a8517a0557882d6acdb6d6f28766b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2147029Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#67100}

Bug: v8:9909
Change-Id: I13d7ae7b304fe55645ef7bcc9ac404782bb55d4e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2131323Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Fanchen Kong <fanchen.kong@intel.com>
Cr-Commit-Position: refs/heads/master@{#67099}

Port bd04ee08
https://crrev.com/c/2143386

Change-Id: I547c9b5b341abe76d6983a07633129299c32e017
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2143978Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/master@{#67098}

Change-Id: Iaa39a9fd8ee0a80b04c5664328931383545e074b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2144747Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#67097}

Bug: v8:9909
Change-Id: I21980ee97e0d2483c064e40cae181297b4d563a1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2107511
Commit-Queue: Zhiguo Zhou <zhiguo.zhou@intel.com>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67096}

Bug: v8:9909
Change-Id: I5dd3e88ab6f7508a07b2a8e5adb033fff7e28fe2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2143386Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Fanchen Kong <fanchen.kong@intel.com>
Cr-Commit-Position: refs/heads/master@{#67095}

Port 04b6e0de
https://crrev.com/c/2135074

Original Commit Message:

  This reorders the SIMD opcodes together with their implementations
  on x64, ia32 according to src/wasm/wasm-opcodes.h.

Change-Id: I82c8b678eb65b616d02d20333d479ee4ae0564d0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2143974Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/master@{#67094}

Port 1a7f5689

R=mlippautz@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I4db697c6a0fab9bd3c9dda4761c3af3ade509ffa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2144691
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67093}