Change-Id: Idc2a9019f5b0e67860edd8620a6cb0ed7002b1df
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3910029Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Auto-Submit: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83369}

The string forwarding table invokes MakeThin even during a GC.
However during a GC we didn't update the invalidated object size for
OLD_TO_OLD because incremental marking was already stopped at that
point.

Change-Id: Ia2f0d2277b59b299c3c8bf5c3febbde634e3ec06
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3910028Reviewed-by: Patrick Thier <pthier@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83368}

- Use non-idle tasks to be able to process finalizers on time.
- Only process finalizers while concurrent marking is still running.

Bug: v8:13294
Change-Id: I1a2812c3fc350ea679c4c916c230cf736f2aa3ea
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3904648
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83367}

Change-Id: Ie5de6f4b7415c67eb77aa4b6e29764c595fca766
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3905123Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#83366}

- Add Turboshaft to the wasm pipeline (behind a flag).
- Add a few operators.
- Implement SimplifyLoopsPhase, which ensures each loop has at most
  two inputs.
- Remove the unneeded effect argument from
  {FlagContinuation::FromTrap}.

Bug: v8:12783
Change-Id: I03a3f8cf3af40fc75bf57cfbad973b754b13dd8c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3899126
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83365}

Bug: v8:9407
Change-Id: Ie7993fcacc3e518da7b4af4c4ab20d8e4c47870c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3905197Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Qifan Pan <panq@google.com>
Cr-Commit-Position: refs/heads/main@{#83364}

Bug: v8:11298, v8:13292
Change-Id: Ifabcbb64889012778439fb14e22a7cf885965b1e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3905724
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83363}

There is no -0n, and we'd therefore never serialize such a BigInt.
But we can't trust serialized data to not have gotten corrupted
(or be fuzzer-generated), so guard against this case when
deserializing.

Fixed: chromium:1359937
Change-Id: If11d9a364480bae51911cc4a0ce8a719853139fe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3904414Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83362}

Bug: chromium:1364974
Change-Id: Icfecc261cdb12fdd211cb821d48ae34a606b974e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3905187Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83361}

Bug: v8:12612
Change-Id: Iae827f12611d5028e25d72a9270bcf86240b4f20
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3904413Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83360}

This test breaks when interrupts occur with unfortunate timing. Maglev
increases flakiness of this test since finished Maglev compiles all
raise a new interrupt (and interrupts abort-and-retry regexp
execution).

Disable concurrent recompilation for this test, and drive-by fix the
--trace-regexp-tier-up flag.

Bug: v8:7700
Change-Id: I170c911fe2308b0b5ad9941e695f11f8925455f3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3904604Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Jakob Linke <jgruber@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83359}

Change-Id: I35d52bb53379023123a1c5cd25f8e7f6fe21a3f9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3906215Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Darius Mercadier <dmercadier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83358}

Port commit 3f998527

Change-Id: Idbe8d53990b8c09e083f64774eecb146ecd2dc90
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3905857
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Reviewed-by: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Auto-Submit: Liu Yu <liuyu@loongson.cn>
Cr-Commit-Position: refs/heads/main@{#83357}

... to avoid it being accessible from BG threads.

Bug: v8:7700
Change-Id: I8fa7ac66016cb1f70925ed84a6552128d419f330
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3899128Reviewed-by: Jakob Linke <jgruber@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83356}

The DeepForEachInput helper was not incrementing the input_location
index in the IsResultRegister case, while other paths (graph printing,
code gen) were. Change these to consistently only increment the index
when the input is used (i.e. match DeepForEachInput).

Bug: v8:7700
Change-Id: Iaa54ef4e44db54023e3c19a088d14ad204bb2620
Fixed: chromium:1360800
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3905722
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83355}

Correct the test expect result as the spec specifies the accumulator is 2*SEW
bits. Fix the simulator implementation as well.

R=qiuji@iscas.ac.cn

Change-Id: Ia5d11b3214cf32635c3767df75992b2a50ee6980
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3878452
Commit-Queue: Yahan Lu <yahan@iscas.ac.cn>
Reviewed-by: Yahan Lu <yahan@iscas.ac.cn>
Cr-Commit-Position: refs/heads/main@{#83354}

Correct the arguments for std::fma() to double as the instruction expects
both addend and destination are 2*SEW bits wide. Addressed corresponding
implementation in the simulator as well.

R=qiuji@iscas.ac.cn

Change-Id: Ib3963a61c00ee9dc73af019574a1665de406cc32
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3878448
Commit-Queue: Yahan Lu <yahan@iscas.ac.cn>
Reviewed-by: Yahan Lu <yahan@iscas.ac.cn>
Cr-Commit-Position: refs/heads/main@{#83353}

Port commit 3f998527

Change-Id: Ic82f9d08fbc6c6df524e0361141c9a5d22e8924e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3905856
Auto-Submit: Yahan Lu <yahan@iscas.ac.cn>
Reviewed-by: ji qiu <qiuji@iscas.ac.cn>
Commit-Queue: ji qiu <qiuji@iscas.ac.cn>
Cr-Commit-Position: refs/heads/main@{#83352}

.. and just the option for now, there's no logic behind this yet.

--maglev-function-context-specialization enables FCS globally, and the
MaglevCompilationInfo stores for each compilation job whether FCS is
enabled.

Bug: v8:7700
Change-Id: I4c32fe93fca70ae3644588902e282910a9673b74
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3905382Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83351}

... in Runtime_GrowArrayElements.

Runtime_GrowArrayElements is only used when the elements kind
is fast. And we could check the requested capacity according
to the elements kind and throw error early.

Bug: v8:13285
Change-Id: I68f59bc68995d622aac23be3e8daf05ac5fd5652
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3905062
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83350}

The last use was removed in this CLs:
https://chromium-review.googlesource.com/c/v8/v8/+/3401585/

Bug: v8:12552, v8:13312
Change-Id: I72c639957ed3b1c2491eb43a54a54b8a96977b6f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3905188Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Stephen Röttger <sroettger@google.com>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83349}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/29d7990..962a856

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/src/buildtools/+log/9e95466..dea2dd1

Rolling v8/buildtools/third_party/libc++/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxx/+log/d128f2b..cec1dd0

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/fcf15b9..0a4b3b9

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/18bdadc..0d126c9

Rolling v8/third_party/fuchsia-sdk/sdk: version:9.20220919.1.1..version:9.20220919.2.1

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/70967a5..0cb9db1

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I34ee778225cc1a732e8bbfb69bbcab5fd08164bf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3905132
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#83348}

Only apply this optimization to the conditions that have multiple
branch uses.

Bug: v8:12484
Change-Id: Ieb74b8e879e62aa96344f2903f1fea6a1b769549
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3902559Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Hao A Xu <hao.a.xu@intel.com>
Cr-Commit-Position: refs/heads/main@{#83347}

Change-Id: I23b2130798d28c479dfe6394ce6baf9503e74a1e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3904432
Commit-Queue: Junliang Yan <junyan@redhat.com>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83346}

Fixing an issue in WasmInstanceObject::GetGlobalBufferAndIndex.

Bug: v8:13309
Change-Id: I52e65c109e43ce0300513604e71e587e1949f70a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3907666Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Samuel Groß <saelo@chromium.org>
Commit-Queue: Paolo Severini <paolosev@microsoft.com>
Cr-Commit-Position: refs/heads/main@{#83345}

1. Correct the return type of RoundTowardsZero to fix issue with
double value > 2^64

2. In TemporalDurationToString:
a. Use std::fmod instead of % to get the remainder
b. Use extra xx_add variables to hold additional value which may
overflow the double during computation.
c. Use BigInt for days if the value is too large for double
to ensure the precision.
3. Add tests with Number.MAX_SAFE_INTEGER
and Number.MAX_VALUE in values for Duration toJSON in mjsunit



Bug: v8:11544
Change-Id: Icac4f669ed1c591e947b51c82dd48bdef7a6db6e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3900813Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83344}

https://chromium.googlesource.com/external/github.com/tc39/test262/+log/9215420..465cf4a

Bug: v8:7834, v8:13302
Change-Id: Ieb9d6215984b0f7eab201514e5b855f7efcdda65
Fixed: v8:13302
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3906921Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Auto-Submit: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83343}

Port 3f998527

R=sroettger@google.com, joransiu@ca.ibm.com, junyan@redhat.com, midawson@redhat.com
BUG=
LOG=N

Change-Id: I4a92ab1ba942f9303c4f083d9f0b846e924c25f8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3907868
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Reviewed-by: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/main@{#83342}

This reverts commit 67106ff4.

Reason for revert: Test failure bisected locally to this (failure link: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux%20-%20gc%20stress/40535/overview). Not clear why but reverting to keep the tree green.

Original change's description:
> [wasm-gc] JS interop: Do not wrap structs/arrays by default
>
> Bug: v8:7748
> Change-Id: I441fd294bc0f31c0396217bc55c27159abacdbd1
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3905725
> Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
> Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
> Auto-Submit: Matthias Liedtke <mliedtke@chromium.org>
> Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#83338}

Bug: v8:7748
Change-Id: Ifb5e980dedf8e9824d05171c431ad383af180e50
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3904416
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83341}

Bug: v8:13281
Change-Id: Ie61eb42ad6be565c8be76c9b4aa63282c7856f25
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3905190Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Stephen Röttger <sroettger@google.com>
Cr-Commit-Position: refs/heads/main@{#83340}

As part of moving export wrappers to the isolate, it was tried to
compile them lazily on the main thread. This resulted in large
slowdowns in some cases, therefore we restore the eager parallel
compilation.

Bug: chromium:1365726
Change-Id: I9cc8d5728f3a5c71099f0e0fdcc605b37d4d6618
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3905193Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83339}

Bug: v8:7748
Change-Id: I441fd294bc0f31c0396217bc55c27159abacdbd1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3905725Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Auto-Submit: Matthias Liedtke <mliedtke@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83338}

On x64.release for linux this didn't affect binary size at all but
should improve readability of usages.

Bug: v8:7748
Change-Id: I46ecc9c2b4814244f6b5114f9ea199cd4d0220cd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3904602Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83337}

Bug: v8:7748
Change-Id: Icde19a554042ce57420a1faa72492c53a07dbc66
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3905723
Auto-Submit: Matthias Liedtke <mliedtke@chromium.org>
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83336}

This reverts commit 0cb75429.

Reason for revert: Suspect for waterfall closure - https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Maa%20-%20arm64%20-%20no%20pointer%20compression%20debug%20builder/1072/overview

Original change's description:
> Remove some unused includes
>
> Bug: v8:13006
> Change-Id: Iee530e965786583330ff5e00ccfe58358a813f76
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3879500
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#83332}

Bug: v8:13006
Change-Id: I9d9d88a84786cb683042ab2ed665d61656d6de3b
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3904415
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Owners-Override: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83335}

Bug: v8:7748
Change-Id: Ie68be87805fe85c954209cd3257a0915deec84be
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3905191Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83334}

Change-Id: I154b7d70eb9cbcb2f71db7c88a18b81b3814415d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3904424Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#83333}

Bug: v8:13006
Change-Id: Iee530e965786583330ff5e00ccfe58358a813f76
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3879500Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83332}

Change-Id: Ia8d92151114c674b581ec2fa2b4e3297e9c7cf6f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3905927
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Auto-Submit: Andrey Kosyakov <caseq@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83331}

DCHECK that input registers that are clobbered (e.g. because they are
also an output register) are not used as register inputs into eager
deopts.

This is already the case because we're only allowed to mutate input
registers that alias the result register, and eager deopt input
allocation happens after result register allocation, but this DCHECK
makes this assumption explicit and will break if we ever change the
regalloc.

Bug: v8:7700
Change-Id: I4e00a8be88e0984044d8fc5b661eaf7bea801b17
Fixed: v8:13278
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3905189
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Jakob Linke <jgruber@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83330}