Fine grain events are showing that LiveObjectVisitor::VisitBlackObjectsNoFail
is the suspiciously slow step, breaking it down further.
https://docs.google.com/document/d/1bdlWAWeP3j2yo2DYfeok6URqFCrt57yx-nucGMybGGQ/edit#heading=h.97pqg2eosnw8
https://drive.google.com/file/d/1FKZHkXtWK2fZCk_3PClPcbpzKilnbuOr/view

R=mlippautz@chromium.org

Bug: chromium:813824
Change-Id: Idcebcbb268d3e00f5f1e304c66564b4b9c85a064
Reviewed-on: https://chromium-review.googlesource.com/929161Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Gabriel Charette <gab@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51447}

https://chromium-review.googlesource.com/911731 made things build with
this on x64, and https://chromium-review.googlesource.com/923528 added
x86, arm, arm64, mips, mips64.  This are all the configs covered by
v8's trybots.  If this breaks yet another config I don't know about,
these two CLs should give you a good idea how to fix them.

Bug: chromium:812686
Change-Id: Ib9a9714a070dd876a8f5911a1bc974ffd7aa3995
Reviewed-on: https://chromium-review.googlesource.com/928842
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51446}

Crankshaft is gone, and this function is not used anywhere.

R=mstarzinger@chromium.org

Bug: v8:7310,v8:6408
Change-Id: Ic1f859e659008c891cc35d20e95a8214de42bd21
Reviewed-on: https://chromium-review.googlesource.com/928981Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51445}

Replace bitwise arithmetic with conditional move / select instructions
on ia32, x64, Arm and Arm64. In local tests this improves --noopt Ignition
performance by between 2-5%.

BUG=chromium:798964

Change-Id: I82832e5d28469a574a575119c1a665b5c2c93bb2
Reviewed-on: https://chromium-review.googlesource.com/916561
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51444}

The compilation logic never used the saved FeedbackVector for Script
compiles when looking up the CompilationCache, so remove it and
simplify the return value of LookupScript to be a
MaybeHandle<SharedFunctionInfo>

Change-Id: Ib1d833f997b299e2e79621bd8509bdfd911d4e10
Reviewed-on: https://chromium-review.googlesource.com/924002
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51443}

Bug: v8:7310
Change-Id: I54f16a65d478d65cb7df611626397376df22a975
Reviewed-on: https://chromium-review.googlesource.com/928702Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51442}

This is a first testing CL to add tests for mjsunit assertions to the
message tests.

R=clemensh@chromium.org

Bug: v8:7310
Change-Id: Ibbeafebb116f9608c70687f141986ab4534c6b2a
Reviewed-on: https://chromium-review.googlesource.com/803555Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51441}

They were disabled for some reason, but they are working, so reenable
them.

R=titzer@chromium.org

Change-Id: I24cab05d01060b9eae3d6191a978cdb04daf626b
Reviewed-on: https://chromium-review.googlesource.com/928648Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51440}

Refactor existing and add new Move instructions that get uint32_t
and uint64_t to prevent compiler to set quiet-nan on passing
float and double by value.

Change-Id: I544e98e1bb288666140a3b1d2437b31d9e36ca55
Reviewed-on: https://chromium-review.googlesource.com/928722
Commit-Queue: Sreten Kovacevic <sreten.kovacevic@mips.com>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#51439}

Unifies GetSharedFunctionForStreamedScript with GetSharedFunctionForScript
so that both share a more similar API and some common code can be moved to
common helpers.

Introduces a Compiler::ScriptDetails struct to hold script meta-data
used to build new script objects.

BUG=v8:5203

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I3e6b4cd50da9bb92ef5a2bfd666a09b3619c34a4
Reviewed-on: https://chromium-review.googlesource.com/924189
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51438}

x86, arm, arm64: no change in behavior
mips, mips64: disasm-mips(64).cc grows an UNREACHABLE that's
              maybe optimistic (but if it's not true, then that
              looks like a current unintentional fallthrough at
              that spot)
test-js-typed-lowering.cc: looks like a clear bug, but test-only code

Follow-up to https://chromium-review.googlesource.com/c/v8/v8/+/911731 which
did this for x64.

Doesn't turn on the warning yet.

Bug: chromium:812686
Change-Id: I7dd79c9885c90f41dd7e3a595256a954ab0ae643
Reviewed-on: https://chromium-review.googlesource.com/923528Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Nico Weber <thakis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51437}

Bug: v8:5368
Change-Id: I92874d5ea190cd892f3cb5216e0f4bb5373d5350
Reviewed-on: https://chromium-review.googlesource.com/927345Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51436}

Bug: v8:7310
Change-Id: Ia14a5ce3d675be745c71ec3994f3ef58ba9e995b
Reviewed-on: https://chromium-review.googlesource.com/928764Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51435}

This is a step towards off-heap (and eventually isolate-independent)
builtins.

Off-heap code cannot use the standard CallStub/CallRuntime mechanisms,
since they directly embed the callee code object pointer within the
caller.  There are two main issues with that: 1. the callee may be
moved by GC, and 2. the pc-relative addressing we currently use breaks
(i.e. ends up pointing to a random spot on the heap) when moving the
caller off-heap.

This CL addresses that by introducing a constants list stored on the
roots array.  Instead of embedding code targets, we now have the option
of loading them from constants list. The code sequence is:

REX.W movq rax,[r13+0x4a0]  // Load the constants cache.
REX.W movq rdx,[rax+0xf]    // From there, load the code target.
...
REX.W addq rdx,0x5f         // Add instruction_start.
call rdx

There's no visible performance impact on the web tooling benchmark.

This list will later be extended to also contain other constants such
as Strings.

Bug: v8:6666
Change-Id: Ifcf67d1f682804ba0b6d3d0383216e16575b6bf5
Reviewed-on: https://chromium-review.googlesource.com/923729
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51434}

Make --max_old_space_size and friends work with values >= 2**31.
Such values did not work reliably (or sometimes not all) due to
signed integer overflow in size computations, which is UB.

Fixes https://github.com/nodejs/node/issues/18786.

Bug: chromium:814138
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Ibe23cef2417fd5b4a727022b8b0d4b50f1417182
Reviewed-on: https://chromium-review.googlesource.com/927063
Commit-Queue: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51433}

Bug: chromium:811925
Change-Id: I0b2d9562fa77d6d198a689769705a2d5e977abf9
Reviewed-on: https://chromium-review.googlesource.com/928701Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51432}

WriteBarrierKindFor would always return kMapWriteBarrier in
SimplifiedLowering even if the map that's to be stored is part
of the immortal immovable roots which don't need write barriers
ever.

Bug: v8:7310
Change-Id: I0a87a1c3ddd7f71ccf8ebacba8409067dc00cd1c
Reviewed-on: https://chromium-review.googlesource.com/928564
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51431}

Reland reason : the failure was

Check failed: IsGlobalEmpty().
    v8::base::debug::StackTrace::StackTrace()
    v8::platform::(anonymous namespace)::PrintStackTrace()
    V8_Fatal(char const*, int, char const*, ...)
    v8::internal::Worklist<v8::internal::HeapObject*, 64>::~Worklist()
    v8::internal::MarkCompactCollector::~MarkCompactCollector()
    v8::internal::MarkCompactCollector::~MarkCompactCollector()
    v8::internal::Heap::TearDown()
    v8::internal::Isolate::Deinit()
    v8::internal::Isolate::TearDown()
    v8::Shell::OnExit(v8::Isolate*)
    v8::Shell::Main(int, char**)

this is believed to be fixed by the change to flush the shared
worklist to global in
https://chromium-review.googlesource.com/c/v8/v8/+/925267

Follow-up to https://chromium-review.googlesource.com/c/v8/v8/+/924867

(cherry picked from commit 8b53b9d9)

Bug: chromium:812178
Change-Id: I796204656e2c89e7efecda2c275a1888c31aba7b
Reviewed-on: https://chromium-review.googlesource.com/925268
Commit-Queue: Gabriel Charette <gab@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51430}

R=petermarshall@chromium.org

Bug: v8:7433
Change-Id: Ibeef2c6855b8ffb6076be889a859da513877171f
Reviewed-on: https://chromium-review.googlesource.com/928563
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51429}

This CL removes a GC invocation which might not be needed anymore.

Change-Id: I27c57936677ba2ec0bc32588c485a2c3b6ffed01
Reviewed-on: https://chromium-review.googlesource.com/928241Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51428}

This CL changes the WASM implementation to access indirect function
tables through the WasmContext, whereas previously indirect function
tables and their sizes were constants that were inlined into compiled
into code, requiring code patching. This is a necessary step for sharing
code between instances and eventually, isolates.

R=clemensh@chromium.org,mstarzinger@chromium.org

Bug: v8:7424
Change-Id: Ida4138ed92729730dfbc0a81a84d8484b233d808
Reviewed-on: https://chromium-review.googlesource.com/895683
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51427}

This CL also adds speculation to all Math builtins,
and refactors the JSCallReducer.

Bug: v8:7250, v8:7240
Change-Id: Icdaddb767e875bb191939d907f65c7a8dcf79b8b
Reviewed-on: https://chromium-review.googlesource.com/873916
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51426}

Add support for CSDB in the 32-bit assembler, disassembler and simulator.

Change-Id: I0e5432e4d219dd4699d5f9b7f911791acc87114c
Reviewed-on: https://chromium-review.googlesource.com/928522Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Martyn Capewell <martyn.capewell@arm.com>
Cr-Commit-Position: refs/heads/master@{#51425}

(Simplifying the code in preparation for in-place weak references.)

BUG=v8:7308

Change-Id: I8348e108ae12bcd5b218f2d987f34017a1eb5394
Reviewed-on: https://chromium-review.googlesource.com/928421
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51424}

Reland reason : fixed errors, see PS1->PS4 diff.

Follow-up to https://chromium-review.googlesource.com/c/v8/v8/+/924867

This is the core goal of the initial CL @
https://chromium-review.googlesource.com/c/v8/v8/+/922103
which was since split into multiple to diagnose a bots-only failure.

R=ulan@chromium.org

(cherry picked from commit e9750cb8)

Bug: chromium:812178
Change-Id: Ib9474b5c90bf11f4741a93ac35c99b4979e8b4f9
Reviewed-on: https://chromium-review.googlesource.com/925267
Commit-Queue: Gabriel Charette <gab@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51423}

R=titzer@chromium.org

Bug: v8:6600
Change-Id: Id2bd29b89a0db47d7e9ea957521df1558baa6e4a
Reviewed-on: https://chromium-review.googlesource.com/926201
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51422}

Moves BackgroundParsingTask to compiler.cc and renames as BackgroundCompileTask.
This moves code out api.cc and parsing/ into compiler.cc where it belongs.

BUG=v8:7311,v8:5203

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I08a72ab8a6bdb480f519d42b36875d347b801ddc
Reviewed-on: https://chromium-review.googlesource.com/919481
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51421}

Add support for CSDB, equivalent to HINT #20, in the system instruction space.

Additionally, relax the "unallocated" identification of hint instructions that
we don't support, such that they'll now disassemble as "unimplemented (System)"
rather than "unallocated".

Change-Id: Ia36d13fe17a98edb872f234e7cdda33d033618e8
Reviewed-on: https://chromium-review.googlesource.com/926806Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Martyn Capewell <martyn.capewell@arm.com>
Cr-Commit-Position: refs/heads/master@{#51420}

Simplifies boolean logic since shortcuts mean most will never be
executed and also replaces variables with constants to improve
readability.

Change-Id: Ic1678bc60c3e85daced758ce139f7d03c25632dc
Reviewed-on: https://chromium-review.googlesource.com/928320Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51419}

Implemented fp binops for both 32-bit and 64-bit operands.

Bug: v8:6600
Change-Id: Ide223ad0df58f625adef2b2232d0e93c7dcb3524
Reviewed-on: https://chromium-review.googlesource.com/926802
Commit-Queue: Sreten Kovacevic <sreten.kovacevic@mips.com>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51418}

This adds a frame state for the call to the executor in inlined promise
constructors. We provide a continuation function in case of deopts which
just returns the created promise. This is not totally correct yet: if
the executor function also throws, we need to catch it and call the
reject function instead.

We also still need to add a frame state for the isCallable check on the
executor, so that the stack is correct for the thrown TypeError.

Bug: v8:7253
Change-Id: I3ee042ec82f1a9a35d59e576f6c8efe9bc98698c
Reviewed-on: https://chromium-review.googlesource.com/926523Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51417}

We don't use parser caches anymore and request code caches
explicitly using ScriptCompiler::CreateCodeCache. Hence
removing the support for both parser cache and code cache options.
They are still retained in CompileOptions for backwards
compatibility. Apart from the api.cc, no other part should see
this option.

Bug: chromium:779254, chromium:783124
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Ic8ad9afe3fa44bbb5adc71bdde59c0b4057a523d
Reviewed-on: https://chromium-review.googlesource.com/916261
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51416}

- Use CallCFunction to call C implementation of copying elements for
slice, instead of Runtime call
- Copy elements without allocating handles when copying different types
of typed arrays

Bug: v8:5929
Change-Id: Icd4fed8846542e71b623e600ba9aaac64062f0d4
Reviewed-on: https://chromium-review.googlesource.com/920563
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51415}

This allows liftoff compiled functions to receive f64 values as
parameters and pass f64 values as arguments to called functions.

R=titzer@chromium.org

Bug: v8:6600
Change-Id: Ie7467b424ccdf1ec8b7f7625d9439ab4ea427022
Reviewed-on: https://chromium-review.googlesource.com/926105
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51414}

Bug: v8:7327

Change-Id: Id1dbe6ad2cbf790075e360c5d0b5422d2ca4271b
Reviewed-on: https://chromium-review.googlesource.com/928221Reviewed-by: Daniel Clifford <danno@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51413}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/10345cd..3206b7c

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/8273e47..7ae2122

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: I215ea4470dc201c588ee5e270db83795bc6071e8
Reviewed-on: https://chromium-review.googlesource.com/927981Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51412}

Change-Id: I5a706b015a36a7a176a03e740f3fc3c406e6a837
Reviewed-on: https://chromium-review.googlesource.com/927263
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51411}

Before, configurations were chosen on clusterfuzz side. This migrates
the choice to the V8 repo, to enable easier changing it and to allow
sharing it between different fuzzers.

NOTRY=true
TBR=sergiyb@chromium.org

Bug: chromium:813833
Change-Id: I9890a36fd6aab171d3e13172fc55b274f189e532
Reviewed-on: https://chromium-review.googlesource.com/927681Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51410}

This is the same treatment we give other numeric literals, and seems
sensible since they end up referenced from Ignition's constant pool.

R=jkummerow@chromium.org

Bug: v8:6791
Change-Id: Ia689c709d402e4e87b7d2d22c582108400c25580
Reviewed-on: https://chromium-review.googlesource.com/922283
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51409}

There were two failure paths where the CodeProtectionInfo object would not be
freed. This adds a free() on those paths to prevent a memory leak.

Bug: v8:7434
Change-Id: I48d60aee3255d829bf39b51cc30fabaf76b1fb07
Reviewed-on: https://chromium-review.googlesource.com/927746Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Commit-Queue: Eric Holk <eholk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51408}