This moves several simple StateValuesAccess methods as well as
SparseInputMask::InputIterator::IsReal into their header files so they
can be more easily inlined. This gives about a 7% improvement to the
BackgroundSelectInstructions runtime call stat.

Also marks some methods called by the new methods as V8_PRIVATE_EXPORT
so component build test can build.

Bug: v8:10051
Change-Id: I3e34977a4fa660d3f4f55fd4f2c0b2370d5d2bc2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2023559Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66078}

This ports:
https://crrev.com/c/2026424

TBR=mslekova@chromium.org,liviurau@chromium.org

No-Tree-Checks: true
Bug: chromium:1000907
Change-Id: I436baadb8e8357f11a9150c5118c461b03140260
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2030907Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66077}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/7e7da8b..67cd3fb

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: I831ce7a7b68402df3a58806cf3548d54621c5afc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2031826Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#66076}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/96fd652..7e7da8b

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/a66ca23..0b01653

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/ae510e8..906bfde

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/23191fa..80ad0bd

Rolling v8/tools/luci-go: git_revision:37a855b64d59b7f079c9a0e5368f2757099d14d3..git_revision:8c17d4a7b01d6257e927c629cc623ebc6a6b3711

Rolling v8/tools/luci-go: git_revision:37a855b64d59b7f079c9a0e5368f2757099d14d3..git_revision:8c17d4a7b01d6257e927c629cc623ebc6a6b3711

Rolling v8/tools/luci-go: git_revision:37a855b64d59b7f079c9a0e5368f2757099d14d3..git_revision:8c17d4a7b01d6257e927c629cc623ebc6a6b3711

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: Ib1ff1120322bf8fa515b41f548693f79fa9c32ae
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2031825Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#66075}

Define a macro in code-generator-x64 to help identify cases when the
shift value is an immediate/constant. In those cases we can directly
emit the shifts without any masking, since the instruction selector
would have modulo-ed the shift value. We also don't need any temporaries
in this case.

This is only x64 codegen, optimizations for other archs will come in
future patches (and will probably look very similar to this).

The current test case passes the shifts as an immediate, so we add a new
path that loads the shift value from memory, thereby exercising the
slower path of non-immediate shift value.

Bug: v8:10115
Change-Id: Iaf13d81595714882a8f5418734e031b8bc654af3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2026067Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66074}

Fix changes caused by pull/75
Fix skeleton to unit code which missed the case of ...-per-percent.

https://github.com/tc39/proposal-unified-intl-numberformat/pull/75

Bug: v8:10112
Change-Id: I06f4668894c95234f36944cf3dcf2b8dbafb8b8c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2032713Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66073}

This relands commit e8832647.

The flaky test failures seems to be related to tiering, Liftoff
generating different call descriptors from TurboFan when Simd128
is unsupported (since TurboFan will lower the graph, but Liftoff
can continue running simd-call.js just fine).

We temporarily disable tiering for this test, until we get a proper fix,
like https://crrev.com/c/2029427/, but that fix requires this change
since more tests will fail without the lowering fixed.

Bug: v8:10169
Bug: v8:10154

Original change's description:
> [wasm-simd] Fix scalar lowering of kParameter
>
> Lowers the call descriptor of a wasm function if it contains simd.
>
> Also fixes a couple of issues with the lowering of kParameter:
> - the old_index == new_index check is incorrect, it would only work if
> the s128 parameter is the first parameter
> - the old_index was also not adjusted to account for Parameter[0] being
> the wasm instance object
> - new_index needs to be adjusted to account for the instance object too
>
> These fixes make it more similar to the lowering of kParameter in
> int64-lowering.c.
>
> Also add a new mjsunit test to exercise this logic.
>
> Bug: v8:10154
> Change-Id: Ia767a464c26a6a78fd931eab9e6897890a0904e8
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2020521
> Commit-Queue: Zhi An Ng <zhin@chromium.org>
> Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#66032}

Change-Id: I1e27825025aefc5a42aeeb87d0447d6594388fa4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2029147Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66072}

We will use this state in devtools via the inspector to indicate
whether a thread is currently stuck polling in atomics.wait.

VMState already distinguishes the important states we care about which
are idle vs. running JS. We also want to know the state for
atomics.wait(), which is commonly used in WebWorkers to poll the main
page for work to do.

This CL just adds and maintains the state and adds assertions in
atomics tests. Another CL will emit inspector notifications when the
VMState changes in a way that the inspector cares about.

Re-flow comments as a drive-by cleanup.

Bug: chromium:1025490
Change-Id: I961051bfb846aa20454a56214310370ea8e47d1c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2033168
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66071}

The flag is unused.

Bug: chromium:1044630
Change-Id: Ib499cdd559451c9f23c3c98b187755ef6748bffc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2030743
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66070}

When async stepping through code where only extension scripts are on the
stack, we the iterator is not gonna yield any frames, since it ignores
all extension frames.

Bug: chromium:1045863
Change-Id: Ifdb966e47bf1d090fa695d066003c7aff343f658
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2033167
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66069}

This adds two flags for whitelisting natives on fuzzers:
--allow-natives-for-fuzzing:
Enables a small subset of runtime functions and replaces others with
undefined.
--allow-natives-for-differential-fuzzing
Restricts the allowed runtime functions even further, excluding the
ones that break differential fuzzing.

Bug: chromium:1044942
Change-Id: I890bd4a6ff7c2e483dd74155290a7ace06f85239
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2020773Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66068}

Bug: v8:10155

Change-Id: I0ce8a71ab364f9281ab39df1f057bd93d7bef061
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2033165
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Auto-Submit: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66067}

Various accessors (like {has_eval_from_shared} or {is_wrapped}) are only
allowed on scripts that are not wasm. This currently makes printing wasm
scripts fail.
This CL fixes that by having separate paths for printing wasm scripts vs
non-wasm scripts.

R=jkummerow@chromium.org

Change-Id: I8771ded22999504f2fb2c55bc0a1d95c25e988c3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2033164Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66066}

No-Try: true
Bug: chromium:1047632
Change-Id: I01f02cf5ffa53d261311b8265e0005cfe5257f4a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2030739Reviewed-by: Mythri Alle <mythria@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66065}

Factory::NewFunction now requires names passed into it to be flat.
Make sure to flatten Wasm function names when creating new Wasm JS
functions.

Fixes: chromium:1047368
Change-Id: I7bd2d8bc83ae8fab901ab469872bce0f703fc3ec
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2030738
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66064}

This shipped in v7.9, which is stable since six weeks. We do not test
the previous configuration any more and don't plan to move back, hence
remove the flag and clean up the code.

R=ahaas@chromium.org

Bug: v8:10155
Change-Id: I6b981f4be686473a911f041952cb684749d9fe7e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2030732
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66063}

As discussed offline, the current implementation implement each
situation separately. I think we can simplify the code a lot by sharing
code between the different paths.
This CL does that by
1) implementing the kI64Store case separately, because it does not have
   all the register contraints that the others have, and
2) moving all logic to ensure that the {src} register is usable before
   the switch, such that it's shared by all the compare-exchange cases.

As a side produce, this also fixes issue 1045225, because for i64 stores
which actually only use the lower half of {src}, only that half will be
pinned.

R=ahaas@chromium.org

Bug: chromium:1045225, v8:10108
Change-Id: I0be025b9706d563835ae6337d45b88e0233eacad
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2029414Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66062}

Negating 1 << 31 as a signed integer overflows and
causes undefined behaviour hence SetS390OverflowCode
may never get set.

Change-Id: I4a479f0d3c71eaaa58ae0925d744e7779ecd833b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2031861Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#66061}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/25075ce..96fd652

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/707a874..a66ca23

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/1a0daf7..ae510e8

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/953ea7a..23191fa

Rolling v8/tools/swarming_client: https://chromium.googlesource.com/infra/luci/client-py/+log/885b3fe..0ac2847

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: I693b48fe867cb591b581c749445892d2f873aec1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2031906Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#66060}

Change-Id: I6f7d3a5f123edea8674c0f9217b03760f3af016f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2028451Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#66059}

This reverts commit 7c32fa05.

Reason for revert: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux/35618
Need to update expected test output.

Original change's description:
> [wasm-simd][liftoff] Check CpuFeatures for SIMD support
> 
> If Wasm simd128 is not supported on this particular hardware, we bail
> out to TurboFan.
> 
> Bug: v8:9909
> Change-Id: Ie46e154426783ba099b7c0facc906670cda1bdd0
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2029427
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Commit-Queue: Zhi An Ng <zhin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#66055}

TBR=gdeepti@chromium.org,clemensb@chromium.org,zhin@chromium.org

Change-Id: I7def513a619c609ff820ff1b9aefa92e1741e4a2
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:9909
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2031888Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66058}

Port e920b2e3

Original Commit Message:

    - Debugger stepping assumes that the pc points to the instruction
      that should get executed next, so we need to increment it when
      we hit a stop or a bkpt instruction or else we'll end up in an
      infinite loop.
    - The "break" and the "stop unstop" command write into code space, so
      they need to temporarily make code space writable or else they
      just crash. (Note that this doesn't work for embedded builtins.)

R=neis@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I1a9507f621c83dd94f2de230f7c75bc1fee95dd0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2031204Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#66057}

On backends that do not have s128 support in Liftoff, tests will bail
out to TurboFan, so tests will continue running and passing.

Bug: v8:9909
Change-Id: I3b596a73b6cb2e8645a99c65a935026f9e1a8d55
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2029332Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66056}

If Wasm simd128 is not supported on this particular hardware, we bail
out to TurboFan.

Bug: v8:9909
Change-Id: Ie46e154426783ba099b7c0facc906670cda1bdd0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2029427Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66055}

This reverts commit 410ca4c5.

Reason for revert: This was causing Chrome to hang when debugging large wasm binaries.

Clean revert except for modification to test/debugger/debugger.status

Bug: chromium:1047210, v8:9654

Original change's description:
> [wasm] Tierdown wasm module upon "Debugger.enable"
>
> Put a logic in Wasm Engine to tier down all existing modules per isolate
> when debugger is enabled. This CL does not handle new module added after
> debugger is enabled yet.
>
> Bug: v8:9654
> Change-Id: I87060f5c416506543fcaf231bff9999d06ba4c0d
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2013692
> Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
> Reviewed-by: Simon Zünd <szuend@chromium.org>
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#66017}

TBR=clemensb@chromium.org,bmeurer@chromium.org,duongn@microsoft.com,szuend@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:9654
Change-Id: Id49e8c69f8212e95e698d7e7267056fb2eb7e60a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2030737
Auto-Submit: Eric Leese <leese@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66054}

This uses the most common bottleneck for intercepting range-error
creation in correctness fuzzing. Previous abort conditions didn't
cover all cases, e.g. they didn't cover the generic NewError called
by wasm-results.

This also moves code for error-message suppression to the same
location for readability.

In a follow up we'll remove the other redundant abort conditions that
are scattered through the code.

Bug: chromium:1044942, chromium:1047197
Change-Id: I1b898247a304fd35112facd4048de3a02d512c96
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2030728Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66053}

Port c10153b4

R=zhin@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I6668e7d7b260b62838d609e27e240bb670977250
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2030744Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#66052}

TBR=machenbach@chromium.org

Change-Id: I2a60152b04301c835fa21c03cd879b3530c436bf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2030726Reviewed-by: Michael Hablich <hablich@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Hablich <hablich@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Auto-Submit: Michael Hablich <hablich@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66051}

This reverts commit 9781aa07.

Reason for revert: tsan bot failure: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20TSAN/30110

Original change's description:
> Reland "[wasm] Cache streaming compilation result"
> 
> This is a reland of 015f379a
> 
> Original change's description:
> > [wasm] Cache streaming compilation result
> > 
> > Before compiling the code section, check whether the
> > bytes received so far match a cached module. If they do, delay
> > compilation until we receive the full bytes, since we are likely to find
> > a cache entry for them.
> > 
> > R=clemensb@chromium.org
> > 
> > Bug: v8:6847
> > Change-Id: Ie5170d1274da3da6d52ff1b408abc7cb441bbe3c
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2002823
> > Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
> > Reviewed-by: Clemens Backes <clemensb@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#66000}
> 
> Bug: v8:6847
> Change-Id: I0b5acffa01aeb7dade3dc966392814383d900015
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2022951
> Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#66047}

TBR=clemensb@chromium.org,thibaudm@chromium.org

Change-Id: I76e3561835815ac3d5bca74e76079e82f9f3d581
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6847
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2030727Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66050}

There was a bug in the function body decoder where
type checking of brtable only happened if the brtable
instruction is reachable. However, type checking is
required in all cases where brtable "not unreachable".
The difference between reachable and "not unreachable"
is a state called spec-reachable where a clever
compiler can already infer that the code will be
unreachable (e.g. a memory access is out of bounds
just by the offset and therefore unconditionally
traps), but the spec can not. If an instruction is
only spec-reachable, it still has to be type checked.

R=clemensb@chromium.org
FIX=chromium:1046472

Change-Id: I7e9f1108597871615c0d443a0e94de35a0207b5e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2027990
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66049}

Change-Id: I22598152bd8763ae50b16adb84fa9c74a7bd26b3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2028835Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#66048}

This is a reland of 015f379a

Original change's description:
> [wasm] Cache streaming compilation result
> 
> Before compiling the code section, check whether the
> bytes received so far match a cached module. If they do, delay
> compilation until we receive the full bytes, since we are likely to find
> a cache entry for them.
> 
> R=clemensb@chromium.org
> 
> Bug: v8:6847
> Change-Id: Ie5170d1274da3da6d52ff1b408abc7cb441bbe3c
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2002823
> Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#66000}

Bug: v8:6847
Change-Id: I0b5acffa01aeb7dade3dc966392814383d900015
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2022951
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66047}

The JSArrayBuffer extension stores a pointer to native memory. Set it to
null before serialization and then restore the old value.

Bug: v8:10064
Change-Id: I11b6d5a02cad7da119308b280269a72e24ee2a80
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2029410Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66046}

MarkingWorklistHolder has two references to the shared marking worklist:
1) as a standalone worklist for general marking,
2) as a context worklist for per-context mode marking.

Because of that the shared worklist gets updated twice and breaks
the invariants of UpdateMarkingWorklistAfterScavenge.

Bug: chromium:1046791, chromium:973627
Change-Id: I61a8423f8b4d355adb5e8004bf200c67453c1e27
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2029411Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66045}

This patch adds a new BackingStore::Reallocate function that internally
uses a new ArrayBuffer::Allocator::Reallocate provided by the embedder.

The default implementation of the function simply copies the backing
store. The embedder can override the function and provide a more
efficient implementation e.g. using realloc.

Bug: v8:9908, v8:9380

Change-Id: I2179c80ba199c045b6900c620a813916150e7098
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2007274
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66044}

... by using random seed provided via --gtest_random_seed= flag.

Bug: chromium:1043117
Change-Id: I6114e9c71f3196a386a8457a6ec6f9e1fc80f6ea
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2027991Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66043}

Remove AstConsString "internalization", and instead make the conversion
to heap String be on-demand with an Allocate method. We never actually
need the heapified cons string more than once, so there's no need to do
the internalization walk or do the next/string union dance in the
AstConsString class.

This also allows us to specify how we want to allocate the String at the
call site. In particular, it allows us to allocate a flat SeqString rather
rather than a ConsString. This allows us to avoid allocating ConsStrings
which will just be passed to a flatten call, and especially avoid
allocating dead ConsStrings in the off-thread old space.

Bug: chromium:1011762
Bug: chromium:1043168
Change-Id: Id851f2f7529d92ad7e5388eb22823fd6d1959cd0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2020953Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66042}

'resumed' events are sent to the renderer from V8 and stored in a queue.
We didn't flush this queue previously, meaning these events would sit in
the queue until another message coincidentally flushed the queue.

Under some circumstances, the resumed event would not get flushed and
the UI would still be in a paused state, even when JS had resumed.

Bug: chromium:1044989
Change-Id: I5d92fcc0a40d4e3816501da98f6be8a46f227e0f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2023563Reviewed-by: Simon Zünd <szuend@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66041}

We will be able to collect test duration and later upload them in BQ.


Change-Id: Ie5610d4e872259857bf3f26ba698fa65d23058be
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2020952Reviewed-by: Tamer Tas <tmrts@chromium.org>
Commit-Queue: Liviu Rau <liviurau@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66040}

- Debugger stepping assumes that the pc points to the instruction
  that should get executed next, so we need to increment it when
  we hit a stop or a bkpt instruction or else we'll end up in an
  infinite loop.
- The "break" and the "stop unstop" command write into code space, so
  they need to temporarily make code space writable or else they
  just crash. (Note that this doesn't work for embedded builtins.)

Bug: v8:10164
Change-Id: Id77f5e97892076a9fdf8de0230632e0ce979da43
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2026732
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66039}