... in favor of CodeAssembler's ScopedExceptionHandler.

Also remove unused exception arguments from some iterator
related methods.

Bug: v8:10187
Change-Id: I8eb7dfd4eb339e4f566970efa5757c3771926ba6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2060496
Commit-Queue: Georg Neis <neis@chromium.org>
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66306}

R=machenbach@chromium.org

Bug: v8:10220
Change-Id: I541adfd7d02ecbd68474acaf8e672c1838fc318f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2061551Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66305}

This adds tests for the mock logic used in differential fuzzing. The
tests uncovered a couple of issues in the mock files that are also
fixed.

This also does some minor code clean up in the mock code.

Bug: chromium:1044942
Change-Id: I5b67f70f8b104bb681548f742ab863395a88360f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2043843
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66304}

This CL reinstates the old pow implementation which calls out to the
system implementation of pow.

Bug: v8:9622
Change-Id: I3df997888ced3fb8b5bd4b810098e967649aaa55
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1774898Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66303}

Wasm stack traces now show the url to the wasm script.

Bug: v8:9762
Change-Id: Ie7feda499ec76bf001dea093efb720ffd691edad
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2051946
Commit-Queue: Kim-Anh Tran <kimanh@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66302}

REPL 'let' declared variables use VariableLocation::REPL_GLOBAL which
was not handled by a switch in the bytecode generator. The default
case ran into an UNREACHABLE.

This CL fixes this by properly handling VariableLocation::REPL_GLOBAL
for delete.

Drive-by: Replaced the default case with an explicit case for
VariableLocation::MODULE.

Bug: chromium:1052721
Change-Id: I1330ff2f2c6f042a596a8298599a5d58769894f3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2060488
Commit-Queue: Simon Zünd <szuend@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66301}

Bug: v8:9909
Change-Id: Ia74282eab46335235cf4f0e55589af3fcc836d9e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2036739Reviewed-by: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Zhiguo Zhou <zhiguo.zhou@intel.com>
Cr-Commit-Position: refs/heads/master@{#66300}

By replacing usage of the IsNotArrayIndex bit with IsNotIntegerIndex,
we get back one bit that we can use to increase the number of hash bits
stored. The price is that strings that represent array/integer indices
beyond the cacheable range will have to be scanned more often, but these
strings should be rare, and we expect that the additional hash bit is
more worthwhile to have.

Bug: v8:9904
Change-Id: I33f74b0a73f4754aee85805d4b7c409177668439
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2051947Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66299}

This also changes Heap::AllocateExternalBackingStore to avoid GC
inside AlwaysAllocateScope.

Bug: chromium:1042566
Change-Id: Ifa8fe8227af2d6492dbb4f9c52f43754d44926fb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2060295
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66298}

Implement the latest spec changes:
  - Allow declarative segments to behave like passive & dropped segments.
  - Enforce that only declared functions may be returned or used in globals
    as funcref.
  - Ensure that table fill does not modify any entries if OOB.

Spec tests for select and br_table are still failing due to proposal issue

Bug: v8:10156

R=ahaas@chromium.org

Change-Id: I5b95be36a67bc7482a84b848908cc4cbdf94af03
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2027458Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Emanuel Ziegler <ecmziegler@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66297}

Currently dirty FinalizationGroups are processed by the cleanup task in
LIFO order. This results in starvation when FinalizationGroups are added
to the dirty list faster than the cleanup task is run.

R=ulan@chromium.org

Bug: v8:8179
Change-Id: I6e4a5bbd490396120b07ca6053176beded7cef6e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2051619Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66296}

This is to fix the hang (rarely happen). The potential root cause is
that before initialing recompilation, the recompilation callback is
added and then already cleared out by other running threads from initial
compilation.

Bug: v8:10086, v8:9654
Change-Id: I769bac621cce4611ccde1f0998b0f2bc0e9c04cf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2053248
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66295}

Bug: v8:10204, v8:10219
Change-Id: Ie08692121811bf23b9e8ea2c3fc38f38a8705fbf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2060489
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66294}

There is a copy of the pointer decompression logic in
TypedArrayBuiltinsAssembler::SetJSTypedArrayOnHeapDataPtr,
which was not updated for the new ("smi-corrupting") pointer
compression scheme: it erroneously used a sign-extending cast
from compressed to full representation. This causes incorrect
values to be computed when the heap size can grow beyond 2GB.

Bug: v8:9706, chromium:1051005
Change-Id: I2220ce759df1147f255ffca93428888858929fd9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2060494Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66293}

Otherwise we report a spurious difference after OOM.

Bug: chromium:1052849
Change-Id: I795f7393a8061ff41178295d49bdaea411d3c461
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2060307Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66292}

This adds 3 flags to the numfuzz fuzzer depending on a probability:
--budget-for-feedback-vector-allocation=0
--interrupt-budget=100
--no-lazy-feedback-allocation

No-Try: true
Bug: v8:10204
Change-Id: I83dabcd0e3ca80bebe596d65d03b3e99d8ecbf03
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2060490
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66291}

This reduces the pointer-compression experiment by 3% as it is in
production since a while.

This also uses turbofan when comparing across architectures as tests
run faster and likely find the same or more relevant bugs.

No-Try: true
Change-Id: I35ec97188a101a7cb43454903f7bf9765e57893c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2059995
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66290}

Pass --no-lazy-feedback-allocation in all second runs depending
on a probability. Also combine with --interrupt-budget=100.

This also allows adding several extra flags behind one probability.
The tests are improved to ensure valid flags and configs.

No-Try: true
Bug: v8:10215
Change-Id: I2766ef5044cd8c7096f6b76f39b60b568f550bde
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2059991
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Tamer Tas <tmrts@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66289}

Make it explicit that AddShadowingKeys might allocate.

Bug: chromium:1049013
Change-Id: I938531a0324fa581422b74813518f3e85c9b3fbb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2046888
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66288}

This again improves readability and makes the code much shorter. It
might also allow us to generate a scheduled graph directly in the
future, for improved wrapper compile times.

R=jkummerow@chromium.org

Bug: v8:10123
Change-Id: I0225d685a0660adb265eedcd160dfac6b4b23c87
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2060001Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66287}

Bug: v8:6949, v8:10155
Change-Id: I0113efe2d4d3a462533c306a87ebee851b1cb85c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2056853Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66286}

... instead of first claiming space on the stack and then storing it,
which was sometimes causing the profiler to read the uninitialised frame
type slot right after it was claimed, but before it was written to.

Bug: v8:9907
Change-Id: I33318aec44b6083488317ec5e226a06e59c7560c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2056473Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Georgia Kouveli <georgia.kouveli@arm.com>
Cr-Commit-Position: refs/heads/master@{#66285}

The arm/arm64 simulators debugger has a command "mem" that prints
the content of the memory. It also prints a short summary for JS
objects (SMI, Array, JSFunction, ...). That is very handy, but
when trying to print incomplete initialized memory, it could raise
an exception.

It is useful to have a command that prints the content of the memory
for non-initialized or bogus values without the risk of raising
an exception. This CL adds the command "dump".

Change-Id: I682f97afa30a8d9dc572fe5e9dd256eeebf79de9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2056468Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66284}

Bug: v8:6949, v8:10155
Change-Id: I5f5b78cb57776d1022f206f09242768b3dd8d9e5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2056848Reviewed-by: Dan Elphick <delphick@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66283}

Bug: v8:6949, v8:10155
Change-Id: Iafd6b8172a67fa1b778d163259fe8d1400b004f3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2056847Reviewed-by: Dan Elphick <delphick@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66282}

port 9d3dc6f2 https://crrev.com/c/1914218

Original Commit Message:

  FunctionEntry StackChecks is one of the two cases where we generate a
  StackCheck bytecode. In these cases, we do stack check against the js
  limit (not to be confused with the real js limit). Their purpose is to
  be able to interrupt the running code.

  We can omit the FunctionEntry StackCheck by embedding its code into
  the InterpreterEntryTrampoline builtin. We save one bytecode per
  interpreted function.

  This change has rippling effects for optimized code, as well as the
  deoptimizer.

Change-Id: I2ad985959a3f55dfe80fabeffee3d344c1817c88
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2050055
Auto-Submit: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66281}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/25da366..797e96a

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: I22128e2371951c6d854519fade9664ca1a0762ed
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2059592Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#66280}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/b3e662d..25da366

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/0b15317..657c0f4

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/86fbe04..8515328

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: I3346181d4d34e945230240be58f0e7c255492ea9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2058208Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#66279}

This variable significantly slows down indexed-getter.html of blink_perf.bindings on linux-perf
https://pinpoint-dot-chromeperf.appspot.com/job/136cce54620000

V8_STACK_UNINITIALIZED macro is the same as http://crrev.com/c/1974951

Bug: chromium:977230

Change-Id: I3e7e91804e13b856d6b2ba0a5d67f0354636c510
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2046872
Commit-Queue: Vitaly Buka <vitalybuka@chromium.org>
Auto-Submit: Vitaly Buka <vitalybuka@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66278}

This reverts commit a872c393.

Reason for revert: break gc_stress

Original change's description:
> [Intl] Fix RelativeTimeFormat fatal
> 
> Intl.RelativeTimeFormat constructor crash while the locale or
> numberingSystem contains an "algorithmic" numberingSystem.
> Fix by fallback to the locale without the nu
> 
> Bug: chromium:1041319
> Change-Id: Ica520e8dec6ace21264504274b92cb2c3d16286f
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2055970
> Reviewed-by: Shu-yu Guo <syg@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Frank Tang <ftang@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#66276}

TBR=jkummerow@chromium.org,ftang@chromium.org,syg@chromium.org

Change-Id: I2ccfda197103d7de37d704494eb03fbe9e51ccea
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:1041319
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2057760Reviewed-by: Frank Tang <ftang@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66277}

Intl.RelativeTimeFormat constructor crash while the locale or
numberingSystem contains an "algorithmic" numberingSystem.
Fix by fallback to the locale without the nu

Bug: chromium:1041319
Change-Id: Ica520e8dec6ace21264504274b92cb2c3d16286f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2055970Reviewed-by: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66276}

Bug: v8:6949, v8:10155
Change-Id: Id170bafa2a5085bee6ff5b3cff8084254c67e113
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2056846Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66275}

Find out style from skeleton instead to reduce object size.

Bug: v8:10208
Change-Id: I7d26113311f51bc64ed0b259c3df81d526d5ab1b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2055660Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66274}

Use adoptSymbols(NumberingSystem *) API in Intl.NumberFormat to reduce string size

Bug: v8:10207
Change-Id: I3163c524612b61cfdad51743d58ece08b437520a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2055567Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66273}

Bug: v8:10155
Change-Id: Ia2eee32bface83bedeb52eb2b214809b5c657702
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2056471
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66272}

It was using nullptr to signal that it was empty.

Bug: v8:10155
Change-Id: I0844d6a2bfacb1fd35ba83c24307de86f77f4e40
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2056470Reviewed-by: Dan Elphick <delphick@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66271}

The method has been non-const since initially introduced in de070ccf.
Here's a minor change to make it const, for it may/shall be, for other
similar methods are, and for making it easier for future changes
(accessing this method in another const method, etc.).

Change-Id: I3449214fc086403fc9b24b6f502ca20ac0b1426a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2055123Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66270}

Change-Id: Ied0ee7f9c343dc802dec53c3d717a0ca359b504b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2050398Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Georgia Kouveli <georgia.kouveli@arm.com>
Cr-Commit-Position: refs/heads/master@{#66269}

Since the size of the parameters and locals inputs is already stored on
the FrameStateFunctionInfo, this skips the calls to size() and just
reuses the previous values. The stack parameter can only have a size of
0 or 1 depending on whether it's a InterpretedFunction frame or not.

It also extends the verifier to check that the values to match those
returned by StateValueAccess::size and changes a unit test that added
a TypedStateValues of size 2 to the stack input.

Bug: v8:10051
Change-Id: I3693c04b4677812b9f19491c198d0551df20f817
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2047045Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66268}

This skips gay-*.cc cctest files for lint checking. The files
contain 99.9% data not structures. Alternatively, maybe the
data could be moved to non-cc resource files.

This speeds up v8_presubmit without caching locally from 39s to 23s.
This is how it's executed on the continuous CI builder.

No-Try: true
Change-Id: Ide58618a0b1ecd5900b5c9633d584c59b559df32
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2056463Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66267}