Change-Id: Iba7d3f528262b3979d3bfe83784c3cfe050cd6e6
No-Try: true
No-Presubmit: true
No-Tree-Checks: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3180241
Auto-Submit: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77025}

Change-Id: I71505f29cd1dba04f0e8cc14d33067a766495921
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3179719Reviewed-by: Milad Fa <mfarazma@redhat.com>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/main@{#77024}

Port: bba7c09a

Original Commit Message:
 .. by reusing the regexp stack from potentially multiple nested
 irregexp activations.

 To do this, we now maintain a stack pointer in RegExpStack. This stack
 pointer is synchronized at all boundaries between generated irregexp
 code and the outside world, i.e. when entering or returning from
 irregexp code, and when calling into C functions such as GrowStack.

Fixed: v8:11382
Change-Id: I0f97363a069c65f4fbe081b2f9fa796f9d950f43
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3179030Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#77023}

Scalar lowering pass is removed, so if hardware does not support SIMD,
compilation should fail.

Bug: chromium:1202671,v8:11613
Change-Id: I4cafd244d066121dc716ea880529603d9013a05d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3179762Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77022}

- create a helper class to set up Disassembler for testing
- add a helper macro to only compare disassembled instruction (ignore
the hex bytes), this is useful for comparing SSE instructions, whose
opcodes are defined in sse-instr.h, and use uppercase letters, but the
disassembly always uses lowercase
- emit and compare SSE instructions using macro list

Bug: v8:12207
Change-Id: I3580f5d756736cada4f7260efc4d90e2c894f43c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3173906Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77021}

'#x in expr' currently parses incorrectly and associates #x as an
operand of an existing binary expression continuation if the previous
operator was of higher precedence. For example, 0 << #x in foo gets
incorrectly parsed as (0 << #x) in foo.

Bug: v8:12259, v8:12086
Change-Id: Ie37ff49ff6e63b3ea91fd0fba6bc73ec839c580b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3176506Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77020}

Similar optimization to the one for x64 at https://crrev.com/c/3154347.

There is a change to VisitLoad, which should call
GetEffectiveAddressMemoryOperand on the value node. This allows us to
match the input operands to the value (S128Load64Zero node), while
emitting instructions for the node (F64x2PromoteLowF32x4 node).

Bug: v8:12189
Change-Id: I30ca09b567c12a43f7f3bbb4811bae53006bedaf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3171979Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77019}

emitted comparison differs depending on the input type (signed
or unsigned).

This patch is needed to fix test failures after this CL:
https://crrev.com/c/3172765.

Change-Id: If709920d609c94dd3fa5abf14e509978bd7b40ff
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3178970Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#77018}

The argument is no longer in use.

Bug: v8:11382
Change-Id: I7febc7fe7ef17ae462c700f0dba3ca1beade3021
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3173681
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77017}

The proposal has changed and we'll start on the new implementation
from scratch.

Bug: v8:11935, v8:7467
Change-Id: I29e39a414027d80fd91764ce02a05d7c032a41f7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3178964
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77016}

SetCodeModificationPermissions better reflects its current usage.

Change-Id: Ia9b42328a2d467613736878e2b560e0d5282ad3f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3173674Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77015}

Bug: v8:11965
Change-Id: Ifa8946b28aad681bf3a13861db8f02d8e1a51730
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3178960
Auto-Submit: Dan Elphick <delphick@chromium.org>
Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77014}

.. by reusing the regexp stack from potentially multiple nested
irregexp activations.

To do this, we now maintain a stack pointer in RegExpStack. This stack
pointer is synchronized at all boundaries between generated irregexp
code and the outside world, i.e. when entering or returning from
irregexp code, and when calling into C functions such as GrowStack.

Fixed: v8:11382
Change-Id: I5ed27630c1a64ebf3afb9ddf80fb60ea067c0c40
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3162604Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Patrick Thier <pthier@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77013}

The CL provides a way for the embedder to hook in a special malloc-like
allocator that will be used for zone allocations.

An alternative approach would be to use weak functions with branches,
checking whether the functions were available at link-time. Those
branches could be optimized away with LTOs, so they would essentially
be free. However, the weak function approach is not portable (e.g.
there is no easy way to emulate it with msvc). The approach can be
revisited if indirect call turns out to be expensive (e.g. on hardware
with weak branch target predictors).

The CL is a prerequisite for running PCScan in the renderer process.

Bug: chromium:1249550
Change-Id: I221dcb2486c13e8e6e6761839ba391978319bde4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3172760Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77012}

Port aa259e30

Original Commit Message:

    When kDontAdaptArgumentsSentinel is 0 (the receiver is included in the
    argument count), we don't need a dedicated check against the sentinel
    before comparing the formal parameter count to the actual argument count
    when calling a JS function.

R=pthier@chromium.org, joransiu@ca.ibm.com, junyan@redhat.com, midawson@redhat.com
BUG=
LOG=N

Change-Id: I055ce6d72da8140aa81acd41f917e1e9a7751f72
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3175663Reviewed-by: Junliang Yan <junyan@redhat.com>
Reviewed-by: Patrick Thier <pthier@chromium.org>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#77011}

Generate arbitrary struct and array types based on
the fuzzer random input stream.
They replace the hard-coded types.
Generated types include nested reference types and recursive types.

Bug: v8:11954
Change-Id: I2e40697f2ace3eb818360213e8a4dd40037e580e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3173683
Commit-Queue: Maria Tîmbur <mtimbur@google.com>
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77010}

R=clemensb@chromium.org

Bug: chromium:1251465
Change-Id: I09507f1f945252be54c916dcd7ac9e8b7c09643b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3177220Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77009}

i32 comparisons often compare against constants, in order to implement
conditional branches. This CL optimizes such code by not loading the
constant into a register first, but directly emitting the comparison.
The code is shared for implementing {if} and {br_if} (and thereby makes
those two methods more readable).

R=thibaudm@chromium.org

Change-Id: I3f2f071a1c9e4b02c7368a2757bf4aae2920bd69
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3172765Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77008}

Change-Id: I36d230fa3e51eb27109a8dd2adc0e7802fc77a7d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3177221Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77007}

This bailout applies only when young generation is disabled.
Otherwise, getting the caged heap is required and the global load
bailout becomes redundant.

Bug: chromium:1056170, chromium:1239030
Change-Id: I826b355f4356a5c20812d9c8bf6ebc7ea0997b8a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3173685
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77006}

Bug: chromium:1244626
Change-Id: I539a476bc683e3b40d85ee4c7579957bdf4fb5d9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3133145
Auto-Submit: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77005}

This fast path check protects the IsRegExp() path (which checks
RegExp.prototype[Symbol.match]) and thus we must use the appropriate
ForMatch check instead of the default check.

Fixed: chromium:1238033
Change-Id: I0b7ce280f1fa9bfacf20381d80c84f9513f45163
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3177222
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Patrick Thier <pthier@chromium.org>
Commit-Queue: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77004}

Bug: v8:11111
Change-Id: Id1e37770f0f196db0887fceb14f895e576b78b73
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3173673Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77003}

Deprecation happend in v9.4

Bug: v8:11165
Change-Id: I7a28a9c50c25dbaad91cf254b9153154065108b9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3173678
Auto-Submit: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77002}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/66bad00..d7f25a4

Rolling v8/third_party/abseil-cpp: https://chromium.googlesource.com/chromium/src/third_party/abseil-cpp/+log/48418f3..ba539c1

Rolling v8/third_party/aemu-linux-x64: UnrNXrNKJtnUOqrH_BbjXgZ_Ns1v0PZ9WNtFgoHrQZwC..93-xiCMBx8NRjVvu1v-vuwCsej5zB1Pj3FEUsphwCeUC

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/25814bb..e155ea5

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/eff810e..04d9c83

TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I8de9a089cbc144a8c2bb12e1f32cf97daf089aa0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3176786Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#77001}

Bug: v8:12228
Change-Id: If771a7526f2567d68e676f069223ac16b7303884
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3167036Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Jing Bao <jing.bao@intel.com>
Cr-Commit-Position: refs/heads/main@{#77000}

Bug: chromium:1203071
Change-Id: Iab81add0c71c4a37b7aa8d9d6f1272781a6bae3d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3152217
Auto-Submit: Peter Kasting <pkasting@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76999}

Some tests got fixed upstream.

Bug: v8:12227
Change-Id: I78108852ce4d10523edb3fd0dbb563852598394d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3173679
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76998}

Sparkplug code does not contain deoptimization data.

Bug: v8:12258
Change-Id: Ieb9f7f1469e00677d9533c6f05b17c80ef06b9d6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3175820
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76997}

Long term, ideally, these would be fixed and this flag can be removed.
For now, this is an expedient way to allow enabling -Wshadow in
Chromium.

Bug: chromium:794619
Change-Id: I038e5fc758fbb8284bb28cb4f7f8a4c44da0db66
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3173891
Commit-Queue: Peter Kasting <pkasting@chromium.org>
Auto-Submit: Peter Kasting <pkasting@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76996}

See https://github.com/WebAssembly/js-types/blob/main/document/js-api/index.bs#L866

R=manoskouk@chromium.org

Bug: v8:12227
Change-Id: I384483a7568d37c40d077487165ff9b1761da342
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3172768Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76995}

Change-Id: I91ed4bf22231c6080b2c5e445ea407d076baeadc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3175374Reviewed-by: Milad Fa <mfarazma@redhat.com>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/main@{#76994}

When kDontAdaptArgumentsSentinel is 0 (the receiver is included in the
argument count), we don't need a dedicated check against the sentinel
before comparing the formal parameter count to the actual argument count
when calling a JS function.

Bug: v8:11112
Change-Id: I8c9f64a538984cb3de9e35f16bc6adbd3c92d24f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3173671Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Auto-Submit: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76993}

Change-Id: I01c4a68377a70cfed425b3cd1ed56b120c9b5056
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3174627Reviewed-by: Milad Fa <mfarazma@redhat.com>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/main@{#76992}

Change-Id: I83611a53426efff35960b2d90de909f2a6b07264
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3175369Reviewed-by: Milad Fa <mfarazma@redhat.com>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/main@{#76991}

Change-Id: I74873db343b3103f12d47ca1a9617369d516424d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3174411Reviewed-by: Milad Fa <mfarazma@redhat.com>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/main@{#76990}

We should cancel tasks before we destroy objects like the string table
from the isolate. So far our concurrent tasks didn't interact with
the isolate much, but we now have tasks that can e.g. access the heap
concurrently. While this is not strictly necessary at the moment, I want
to see whether there might be problems with that approach. In the future
this order will be required e.g. for baseline batch compilation tasks.

Bug: v8:11708
Change-Id: I80d8a9447bb51e9ae84ed9b6c0da6183290dc70b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3164338
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76989}

Bug: v8:11165
Change-Id: Ic2c8c6e6b97f279941e8634bc6178511103edbca
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3173676Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76988}

Liftoff is fully supported on all officially supported platforms, thus
remove a TODO to implement it on more platforms.

R=thibaudm@chromium.org

Bug: v8:11879
Change-Id: I00a559286d67e7e377a36b68803ee30e8fa2f34e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3168341
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76987}

Add support for heap sandbox on arm64 when building with v8_enable_heap_sandbox=true

Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng
Bug: v8:10391
Change-Id: I3080f5970d2a604ca67827c732cd77761f7611a3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3165057
Commit-Queue: Martyn Capewell <martyn.capewell@arm.com>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76986}