Bug: v8:9810
Change-Id: Ie371220afd332322cc3d613f7c84ca254bd5dd78
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1895556
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64729}

This is a reland of 855591a5

Fixes break in builds that verify ReadOnlyHeap by relaxing the requirement for
Code objects to be in CODE_SPACE in PagedSpaceObjectIterator::FromCurrentPage.

Original change's description:
> Reland: [builtins] Move non-JS linkage builtins code objects into RO_SPACE
>
> Reland of https://chromium-review.googlesource.com/c/v8/v8/+/1795358.
>
> [builtins] Move non-JS linkage builtins code objects into RO_SPACE
>
> Creates an allow-list of builtins that can still go in code_space
> including all TFJ builtins and a small manual list that should be pared
> down in the future.
>
> For builtins that go in RO_SPACE a Code object is created that contains an
> immediate trap instruction. Generally these Code objects are still no
> smaller than CODE_SPACE Code objects because of the Code object alignment
> requirements. This will hopefully be addressed in a follow-up CL either by
> relaxing them or removing the instruction stream completely.
>
> In the snapshot, this reduces code_space from ~152k to ~40k (-112k) and
> increases by the same amount.
>
> Change-Id: I76661c35c7ea5866c1fb16e87e87122b3e3ca0ce
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1893336
> Commit-Queue: Dan Elphick <delphick@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#64700}

Change-Id: I4eeb7dab3027b42fa58c5dfb2bad9873e9fff250
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1893192
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64728}

Add a new LargeObjectSpace for off-thread allocation. Similar to the
paged OffThreadSpace, it always allocates pages, doesn't participate
in mark or sweep, and can be merged into the OldLargeObjectSpace once
its objects are ready.

Bug: chromium:1011762
Change-Id: I95e2d38b10a9cc5eae4ffd35afef95272e13c731
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1881153
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64727}

PR wasn't defined correctly and it was causing issues.

Added prettify to the npm packages, and removed the (not needed)
explicit prettify.css.

Bug: v8:7327
Change-Id: Ieb8999d63df6764354dd628516e0ed9270b8a862
Notry: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1893344
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64726}

chromium rolling in https://chromium-review.googlesource.com/c/chromium/src/+/1896236

Bug: v8:9741
Change-Id: I64e5cfc9200b59e8c7a908ddd8c46a525d2581c8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1896280
Auto-Submit: Frank Tang <ftang@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64725}

After fixing https://crbug.com/v8/8916, background compilation scales
far beyond 10 threads, especially for TurboFan (where much more work is
parallelizable). Thus, remove the limit of 10 background compilation
tasks, and use all available threads instead.

R=mstarzinger@chromium.org

Bug: v8:8916
Change-Id: I13c30777e3c85b2de7901b5eac3e6a41457a56f9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1893348Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64724}

Moves all of the KeyedSloppyArguments functions out of CodeStubAssembler
and into builtins-handler-gen.cc which is the only place they're used.

Bug: v8:9810
Change-Id: Ie52bdf24b7890943b89007f566dd18fe644a5996
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1895558Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64723}

This re-enables verification for RO_SPACE when V8_SHARED_RO_HEAP is
defined. This required refactoring PagedSpaceObjectIterator and methods
in its calling chain to explicitly pass the PagedSpace and Heap pointers
through as they cannot be obtained from the Page in this mode.

Also removes unused Page::Print() method.

Bug: v8:7464
Change-Id: Ibc2c147a7bde6723f43bbaf93cf1db93e76c611e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1893350Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64722}

This CL improves reporting for WeakMap entries: If a retaining chain
goes through a WeakMap entry (i.e. key and weak map are alive, and keep
value alive) then both the key and the value are reported. Additionally
the phrasing is clarified, such that entries in retaining paths are
easier to understand.

Bug: chromium:1020096
Change-Id: Ib05cd6f7939c6de41b554c682ad1fbf685b87608
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1893335Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64721}

Change-Id: I7993bf1d27c0b7a148e776c7c2eddf4ebe76da6e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1892951Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64720}

This fixes a compilation error in Node.js with Xcode:

initialize the const member 'blueprint_'.

error: constructor for 'v8::internal::compiler::Callee' must explicitly
Change-Id: Ia55398428d0de35a9ad5132eabd22d0adb694514
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1895561
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64719}

Port b875f466

Original Commit Message:

    Reland "[compiler] Optionally apply an offset to stack checks"

    This is a reland of 4a16305b

    The original CL adjust only one part of the stack check, namely the
    comparison of the stack pointer against the stack limit in generated code.
    There is a second part: Runtime::kStackGuard repeats this check to
    distinguish between a stack overflow and an interrupt request.

    This second part in runtime must apply the offset just like in generated
    code. It is implemented in this reland by the StackCheckOffset operator
    and a new StackGuardWithGap runtime function.

    Original change's description:
    > [compiler] Optionally apply an offset to stack checks
    >
    > The motivation behind this change is that the frame size of an optimized
    > function and its unoptimized version may differ, and deoptimization
    > may thus trigger a stack overflow. The solution implemented in this CL
    > is to optionally apply an offset to the stack check s.t. the check
    > becomes 'sp - offset > limit'. The offset is applied to stack checks at
    > function-entry, and is set to the difference between the optimized and
    > unoptimized frame size.
    >
    > A caveat: OSR may not be fully handled by this fix since we've already
    > passed the function-entry stack check. A possible solution would be to
    > *not* skip creation of function-entry stack checks for inlinees.
    >
    > This CL: 1. annotates stack check nodes with the stack check kind, where
    > kind is one of {function-entry,iteration-body,unknown}. 2. potentially
    > allocates a temporary register to store the result of the 'sp - offset'
    > in instruction selection (and switches input registers to 'unique'
    > mode). 3. Applies the offset in code generation.
    >
    > mode). 3. Applies the offset in code generation.
    >
    > Drive-by: Add src/compiler/globals.h for compiler-specific globals.
    >
    > Bug: v8:9534,chromium:1000887
    > Change-Id: I257191c4a4978ccb60cfa5805ef421f30f0e9826
    > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762521
    > Commit-Queue: Jakob Gruber <jgruber@chromium.org>
    > Reviewed-by: Georg Neis <neis@chromium.org>
    > Cr-Commit-Position: refs/heads/master@{#63701}

Change-Id: I77554bddde57153ec92c4b80c15d0a52efbaab2d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1893554Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Mu Tao <pamilty@gmail.com>
Cr-Commit-Position: refs/heads/master@{#64718}

Change-Id: I174d38cc33210c07d1a7596627e1b2d21bb06313
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1895560Reviewed-by: Mathias Bynens <mathias@chromium.org>
Commit-Queue: Michaël Zasso <mic.besace@gmail.com>
Cr-Commit-Position: refs/heads/master@{#64717}

Currently atomic operations are only allowed on shared WebAssembly.memory.
An attempt to use atomic operations otherwise is a validation failure, there
is an ongoing attempt to allow Wasm atomic operations on any memory object.

https://github.com/WebAssembly/threads/issues/144

This CL adds experimental support for allowing atomic operations on all
memory objects behind the --wasm-atomics-on-non-shared-memory flag. Note
that Wait/Notify may not work as expected as they have additional checks
to ensure that the memory is a SAB.

Bug: v8:9921
Change-Id: Ia65b1a4a96ec026430fcce028465423f600adacd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1895703
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64716}

Blink-dev intent to ship thread:
https://groups.google.com/a/chromium.org/forum/#!topic/blink-dev/TI4h1Gj5TYE

Bug: v8:9553
Change-Id: Icef9e4aeec1e519ab8ce11109e2529c61437a10b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1895427
Commit-Queue: Joshua Litt <joshualitt@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64715}

This reverts commit b8ac4eb4.

Reason for revert: https://bugs.chromium.org/p/chromium/issues/detail?id=1020533

Original change's description:
> [runtime] Correctly handle global stores when global object has proxies
> 
> When global object has proxies we should first call hasProperty and
> then call SetProperty if has property returns true. This cl fixes both
> StoreGlobal and StoreLookupGlobal to correctly handle these cases.
> 
> Bug: chromium:1018871
> Change-Id: I140514e2119c6bab2125abcdc1b19d46526be5ff
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1889885
> Commit-Queue: Mythri Alle <mythria@chromium.org>
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#64687}

TBR=mythria@chromium.org,verwaest@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: chromium:1018871
Change-Id: I5abbf9275cba17576e1b1e492abd36d6bc1ca1bf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1893194Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64714}

Intent to ship thread:
https://groups.google.com/a/chromium.org/forum/#!topic/blink-dev/7zLAOqxWxbE

Bug: v8:9547
Change-Id: I72ec9f62c7268cd1f05e87aed475092c4196c11c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1895421Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Joshua Litt <joshualitt@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64713}

--trace-ic now logs transitions X -> X

Bug: v8:9761
Change-Id: I594236a88d4b5a441442b7bab99b126d85043d0e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1893552Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Suraj Sharma <surshar@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#64712}

Also ports TriggerPromiseReaction and ExtractHandler to torque.

Bug: v8:9838
Change-Id: I35c07dcf4a0cca988dfb4706557cd6ee6bc66efe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1864583
Commit-Queue: Joshua Litt <joshualitt@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64711}

The {SetTraceValue} method was only defined for a set of integer types,
which sometimes lead to ambiguities when using types like {size_t},
{unsigned long} or the like (see https://crrev.com/c/1886912/1).
This CL fixes that by providing a method accepting any integer type.
It also changes the existing methods to avoid the "cast via union"
idiom, and uses memcpy instead.

R=petermarshall@chromium.org

Bug: v8:9810
Change-Id: I1530405640dc6cb0058153a8dbb860c7f3727ac5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1886918
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64710}

This moves a series of functions from dictionary.h and hash-table.h
to resp. dictionary-inl.h and hash-table-inl.h.
The functions that were moved all somehow use other functions that
are defined in -inl.h files.

This change fixes the Node.js Windows builds.

Change-Id: I0bbf0222beb3619a5e6f1fb451bc78691025de65
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1893346Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Michaël Zasso <mic.besace@gmail.com>
Cr-Commit-Position: refs/heads/master@{#64709}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/c6a9dde..bbcd1e4

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/762db8a..1ce01db

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/512f92b..540178c

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: I52b08b760dd55625231551966deb39d5e47a3128
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1894952Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#64708}

A window is a Blink concept. This API marks the context as backing
a detached window. This doesn't necessarily mean that the context is
detached.

Every time a JS function is called within a context that has a non-zero
DetachedWindowReason, Runtime::kReportDetachedWindowAccess is invoked,
which will report this call to Blink via a callback, which in turn can
report number of such calls via UKM metrics.

Bug: chromium:1018156
Change-Id: I67c89fef459f4efcb912229eed8a4f3ea3b60f54
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1862829
Auto-Submit: Bartek Nowierski <bartekn@chromium.org>
Commit-Queue: Bartek Nowierski <bartekn@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64707}

There is some duplication in the AVX definitions, which will be cleaned
up in a future change.

Bug: v8:9561
Change-Id: I78b134f536ec47d45c0a56f653148e8925f7def6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1893359Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64706}

This reverts commit 94456e5c.

Reason for revert: <INSERT REASONING HERE>

Original change's description:
> PPC/s390: Reland: [builtins] Move non-JS linkage builtins code objects into RO_SPACE
> 
> Port 855591a5
> 
> Original Commit Message:
> 
>     Reland of https://chromium-review.googlesource.com/c/v8/v8/+/1795358.
> 
>     [builtins] Move non-JS linkage builtins code objects into RO_SPACE
> 
>     Creates an allow-list of builtins that can still go in code_space
>     including all TFJ builtins and a small manual list that should be pared
>     down in the future.
> 
>     For builtins that go in RO_SPACE a Code object is created that contains an
>     immediate trap instruction. Generally these Code objects are still no
>     smaller than CODE_SPACE Code objects because of the Code object alignment
>     requirements. This will hopefully be addressed in a follow-up CL either by
>     relaxing them or removing the instruction stream completely.
> 
>     In the snapshot, this reduces code_space from ~152k to ~40k (-112k) and
>     increases by the same amount.
> 
> R=​delphick@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
> BUG=
> LOG=N
> 
> Change-Id: Ibd0713a17df9c873692553f2d57f4ba36bcdb342
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1893746
> Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
> Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
> Cr-Commit-Position: refs/heads/master@{#64704}

TBR=michael_dawson@ca.ibm.com,jyan@ca.ibm.com,joransiu@ca.ibm.com,delphick@chromium.org,miladfar@ca.ibm.com

Change-Id: I808a4220892dcfef66b4b9d90ab43bf403d2e9b0
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1894353Reviewed-by: Milad Farazmand <miladfar@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#64705}

Port 855591a5

Original Commit Message:

    Reland of https://chromium-review.googlesource.com/c/v8/v8/+/1795358.

    [builtins] Move non-JS linkage builtins code objects into RO_SPACE

    Creates an allow-list of builtins that can still go in code_space
    including all TFJ builtins and a small manual list that should be pared
    down in the future.

    For builtins that go in RO_SPACE a Code object is created that contains an
    immediate trap instruction. Generally these Code objects are still no
    smaller than CODE_SPACE Code objects because of the Code object alignment
    requirements. This will hopefully be addressed in a follow-up CL either by
    relaxing them or removing the instruction stream completely.

    In the snapshot, this reduces code_space from ~152k to ~40k (-112k) and
    increases by the same amount.

R=delphick@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: Ibd0713a17df9c873692553f2d57f4ba36bcdb342
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1893746Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#64704}

Currently, when debugging wasm, the internal script URL is shown, which
has the form wasm://wasm/wasm-<hex-script-id>. With this change, if the
module specifies a module name, it would report the URL as
wasm://wasm/<module-name>-<hex-script-id>, as this will help the user
identify what they are debugging.

Bug: chromium:1017678
Change-Id: I26ff6249bd1e832d62402619a68b61c115c24640
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1888810
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64703}

Port 9c3e94b2

R=clemensb@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I61d15d3314752408505cf91e4db454318efa2047
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1893587Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#64702}

This reverts commit 855591a5.

Reason for revert: Breaks arm64 sim tests
https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20arm64%20-%20sim%20-%20debug/17957
https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20arm64%20-%20sim%20-%20gc%20stress/16585

Original change's description:
> Reland: [builtins] Move non-JS linkage builtins code objects into RO_SPACE
> 
> Reland of https://chromium-review.googlesource.com/c/v8/v8/+/1795358.
> 
> [builtins] Move non-JS linkage builtins code objects into RO_SPACE
> 
> Creates an allow-list of builtins that can still go in code_space
> including all TFJ builtins and a small manual list that should be pared
> down in the future.
> 
> For builtins that go in RO_SPACE a Code object is created that contains an
> immediate trap instruction. Generally these Code objects are still no
> smaller than CODE_SPACE Code objects because of the Code object alignment
> requirements. This will hopefully be addressed in a follow-up CL either by
> relaxing them or removing the instruction stream completely.
> 
> In the snapshot, this reduces code_space from ~152k to ~40k (-112k) and
> increases by the same amount.
> 
> Change-Id: I76661c35c7ea5866c1fb16e87e87122b3e3ca0ce
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1893336
> Commit-Queue: Dan Elphick <delphick@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#64700}

TBR=ulan@chromium.org,jgruber@chromium.org,delphick@chromium.org

Change-Id: I4211c3bb7fe4741e0ba3898f92ce382dfc93c4f3
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1893636Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64701}

Reland of https://chromium-review.googlesource.com/c/v8/v8/+/1795358.

[builtins] Move non-JS linkage builtins code objects into RO_SPACE

Creates an allow-list of builtins that can still go in code_space
including all TFJ builtins and a small manual list that should be pared
down in the future.

For builtins that go in RO_SPACE a Code object is created that contains an
immediate trap instruction. Generally these Code objects are still no
smaller than CODE_SPACE Code objects because of the Code object alignment
requirements. This will hopefully be addressed in a follow-up CL either by
relaxing them or removing the instruction stream completely.

In the snapshot, this reduces code_space from ~152k to ~40k (-112k) and
increases by the same amount.

Change-Id: I76661c35c7ea5866c1fb16e87e87122b3e3ca0ce
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1893336
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64700}

Remove fixed tests

Bug: v8:9876, chromium:1014272
Change-Id: Idde035073f630f29ad00d1c764bdef0a8528d2dc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1891511
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64699}

Previously only Builtins declared TFJ or CPP in builtins-definitions.h
were converted to direct calls in ReduceJSCall. This allows all
builtins with JS linkage to be converted. To facilitate this, it adds
Builtins::HasJSLinkage(id) that returns true for any builtins with
JSTrampolineDescriptor as their call descriptor.

It also ensures that any JS functions installed by the bootstrapper are
also required to have JS linkage to catch early errors.

Change-Id: I2fddca41f9ab1c7c9633aa0ab4847a5c108e2bb2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1883549Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64698}

Move rcpps, rsqrtps, sqrtps to SSE_INSTRUCTION_LIST.

Bug: v8:9810
Change-Id: Ib95a789dbeb4fc4472da11359cafe76db2027934
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1874513Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64697}

Bug: v8:9810, v8:6949
Change-Id: If40852159e67b9bd0d6e5c7c6259fadf8b8ec3bc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1893345
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64696}

Bug: v8:9728
Change-Id: If45c7f9fcadef1c18d4889e407920861892cff1e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1866684Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64695}

- Adds a counter to measure time from creating the async compile job
  to either baseline compilation or deserialization completion, so we
  can evaluate the benefit from code caching.
- Eliminates the counter that measures deserialization.

Bug: chromium:719172
Change-Id: Iefa707ef73ac20377d5164a1bd5f1e462573ce06
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1888829Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64694}

I noticed that SeqOneByteString and SeqTwoByteString have generated
functions to get and set their "chars" field which just get or set the
first character in the array. That's unhelpful and potentially
dangerous, so we shouldn't emit these functions.

Change-Id: Iff328fc744e5bd3e70536619d5928df6d959f12f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1890540Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#64693}

This gets rid of a bunch of compiler warnings with MSVC.

Change-Id: I73440f0d203603fe39a2408d2b9cc647700aa5fc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1893334Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Michaël Zasso <mic.besace@gmail.com>
Cr-Commit-Position: refs/heads/master@{#64692}

Afer the getBestPattern, replace the HhKk by the hour cycle char.
Not fix formatRange yet.

Bug: v8:9930
Change-Id: I0833539ba308d4b2f58f20ae1a137f782a82fe49
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1892126Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64691}

This is a cleanup before we introduce StoreTypedElementJSAny<T: type>()
which are necessary for porting  %TypedArray%.from to Torque.

Drive-by-fix: formatted third_party/v8/builtins/array-sort.tq

Bug: v8:8906
Change-Id: Ic84cb763ae7e5d400b5d7f7b102baa497fe9fe91
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1893331
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64690}