{memory-protection-unittest} assumes that code objects exist after
compilation. This is not true with lazy compilation. Therefore this
CL disables lazy compilation in the test.

R=clemensb@chromium.org

Bug: v8:12852
Change-Id: I66039319fdfe4354afb32064e3e9105d334f5b07
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3819643Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82325}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/664331e..93068bf

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/src/buildtools/+log/1453422..b11e87a

Rolling v8/third_party/android_platform: https://chromium.googlesource.com/chromium/src/third_party/android_platform/+log/de32b18..04b3350

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/5a9c565..22963c3

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: Ib29e7bf1f76cd478649042b72b1ef206253be05d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3822343
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#82324}

Rolling v8/buildtools/third_party/libc++/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxx/+log/75bbec9..fe1bc75

Rolling v8/buildtools/third_party/libunwind/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind/+log/c38cbd4..a097a1a

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/4755386..743fa6c

Rolling v8/third_party/fuchsia-sdk/sdk: version:9.20220808.1.1..version:9.20220809.0.1

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: Ie2465a278282d628e045424bcb333a4428d6023e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3822341
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#82323}

form"

This is a reland of commit 6ca3adb9

Fix build failed with V8_MAP_PACKING.

Original change's description:
> [ptr-compr][x64][compiler] Support load map in compressed form
>
> ...to allow pointer decompression at use-site.
>
> Bug: v8:13056, v8:7703
> Change-Id: If369286814c76340a945cc2a9fd863888a813080
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3811737
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Commit-Queue: Hao A Xu <hao.a.xu@intel.com>
> Cr-Commit-Position: refs/heads/main@{#82242}

Bug: v8:13056, v8:7703
Change-Id: Ic753558058f70f6ee7850019aac9235b87d0e56a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3815779
Commit-Queue: Hao A Xu <hao.a.xu@intel.com>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82322}

Black allocation is already enabled when starting incremental marking.

Bug: v8:12775
Change-Id: I492c3ab89a3a3251ab005d2f3fc4ee46f28f5615
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3820067
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82321}

This reverts commit 97d1ab6c.

Reason for revert: simplified lowering verifier crashes on GPU bots:
https://ci.chromium.org/ui/p/v8/builders/ci/Linux%20V8%20FYI%20Release%20(NVIDIA)/20848/overview

Original change's description:
> Reland "[turbofan] Support Phi nodes in SL Verifier"
>
> This reverts commit 82a876b0.
>
> Bug: v8:13086, v8:12619
> Change-Id: Idcc42f36b642fefb3ed706214e7385cccc89effc
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3779687
> Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#82285}

Bug: v8:13086, v8:12619
Change-Id: I7a2fb19eb752403337d45de0a7ca02a5d8842766
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3820904
Auto-Submit: Adam Klein <adamk@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#82320}

This CL tries to improve readability of TryMarkingComplete() by
splitting it up into multiple smaller methods.

It also removes StepResult::kWaitingForFinalization since this was
only used in one test which could easily be rewritten to not need this
value. This makes CombineStepResult() and Step()s return value simpler
to understand.

Bug: v8:12775
Change-Id: I981bc7b736246ab53058d1e61e3c67db0d1130b7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3816668Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82319}

Port e5524920

Original Commit Message:

    This might or might not give clang-tidy a hint that the reported case
    (see issue) cannot happen. It might also generate slightly better code
    by giving hints to the compiler.
    Note that V8_ASSUME is actually a DCHECK in DEBUG builds, so we do not
    loose any checks here.

    Some DCHECKs were removed because they are redundant
    (RegisterBase::code() assumes to be only called on valid registers).

R=clemensb@chromium.org, joransiu@ca.ibm.com, junyan@redhat.com, midawson@redhat.com
BUG=
LOG=N

Change-Id: I653d398eb4b6b10fa769de62a9900edda95dd5db
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3820583
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Reviewed-by: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/main@{#82318}

Port 1067c6ac

Original Commit Message:

    ... - a code range size agnostic version of InterpreterEntryTrampoline
    builtin. The new builtin is fully compatible with the default version
    and used as a template for creating interpreter entry trampoline
    Code objects when --interpreted-frames-native-stack is enabled.

    This CL introduces a new assembler option "position_independent_code"
    which affects the way builtin calls are generated.
    This mode is enabled only for InterpreterEntryTrampolineForProfiling.

    Motivation:

    * InterpreterEntryTrampoline uses RelocInfo::CODE_TARGET for calling
      other builtins which requires the code range to be small enough to
      allow PC-relative jumps/calls between Code objects. This is the
      reason why --interpreted-frames-native-stack was not supported on
      arm and might not work on arm64 because the code range is bigger
      than the max PC-relative distance for call/jump instructions.
      The new builtin calls other builtins via builtins entry table which
      makes the code fully relocatable and usable for any code range size.

    * RelocInfo::CODE_TARGET requires a target code to be materialized
      as a Code object which contradicts the Code-less builtins goal.

    * The --interpreted-frames-native-stack is rarely used in the wild but
      we have to pay the price of deserializing InterpreterEntryTrampoline
      builtin as a Code object which consumes address space in the code
      range and thus limits the number of V8 isolates that can be created
      because of code range exhaustion. Now the pointer compression cage
      becomes the limiting factor instead of the code range.

    * We can remove complicated logic of Factory::CopyCode() and respective
      support on GC side.

R=ishell@chromium.org, joransiu@ca.ibm.com, junyan@redhat.com, midawson@redhat.com
BUG=
LOG=N

Change-Id: I2ed5edbffc5c33717f4becf8370369f7a4d000fb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3816765Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#82317}

Change-Id: I18190e902929d5b513b0a897faaddb8750f9b27a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3820066
Auto-Submit: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82316}

The new PagedNewSpace composes a PagedSpaceBase subclass
(PagedSpaceForNewSpace) to avoid a diamond inheritance since both
PagedSpaceBase and NewSpace inherit from SpaceWithLinearArea.
Both use the same LinearAllocationArea, LinearAreaOriginalData, and
AllocationCounter, but use_lab_ remained a field of SpaceWithLinearArea.
As a result, disabling inline allocations for new space only updated one
of the use_lab_ instances (the one in PagedNewSpace) while allocations
were using the other.
Moving this field to LinearAllocationArea lets both use the same field
and keep in sync.

Bug: v8:12612
Change-Id: I47eccc6444040efc3a3e5d93f6015fd2bdb611b1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3820065Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82315}

This pr refactor all usage of v8_str in unittests/ into NewString
method in test-utils.h

Change-Id: I8ffc456851488e8c050d7a38f5459aebfa3f314f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3813064Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Cr-Commit-Position: refs/heads/main@{#82314}

This reverts commit 6953b555.

Reason for revert: Failing on CI: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux%20-%20full%20debug/22876/overview

Original change's description:
> [handles] Remove precise on-stack representation of global handles
>
> Since https://crrev.com/c/3806439 on-stack traced handles are marked
> conservatively when being used in combination with CppHeap.
>
> This change removes the precise on-stack representation of the
> internal traced nodes as they nodes would anyways be marked
> conservatively. The effects are:
> - cheaper representation (just a single node space);
> - uniform handling: no checks to distinguish on-stack vs on-heap;
> - no brittleness around cleaning on-stack handles when the event loop
>  is empty;
>
> Change-Id: Id859623bfed77a66bdd064ea8065536264515eae
> Bug: v8:13141
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3812039
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#82306}

Bug: v8:13141
Change-Id: I5ebb2ed9eeec1394c2dd48504e91f6ff789b0711
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3820584
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#82313}

Bug: chromium:1351242
Change-Id: I3805c53e3103d105754474a48a94fa0888c635f4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3820062
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Auto-Submit: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82312}

Exit with a non-zero exit code on OOM crashes such that Fuzzilli can discard
these samples. Otherwise Fuzzilli treats these as valid samples and adds them
to the corpus.

Bug: v8:10571
Change-Id: Ia450a86288d9c2e8ee1cf0eb57bd8808de2f7dd7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3816665Reviewed-by: Samuel Groß <saelo@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Carl Smith <cffsmith@google.com>
Cr-Commit-Position: refs/heads/main@{#82311}

With only 2GB reservation we can make sure that the heap allocated in
such a way, that all the pointer to it have the most significant bit
in the low halfword set. This allows us to quickly distinguish between
normal pointers and nullptr/sentinel when performing sign-extension
inside decompression.

Bug: chromium:1325007
Change-Id: Ie3a653796bb9dc875ec50103e05cb9aaf55515cf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3793614Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82310}

This check is not needed any more after https://crrev.com/c/3805887.

Plus minor drive-by reformatting.

R=tebbi@chromium.org

Change-Id: I4891b297b5c1a79e11338100a269e4682bc64085
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3805888
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82309}

Add the receiver to the IteratorSymbolNonCallable error
message.

Bug: v8:12918
Change-Id: Ib863a357474282ec3723cc4e7e012052979ca2d6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3813069Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Cr-Commit-Position: refs/heads/main@{#82308}

Bug: v8:9407
Change-Id: Id7a04bbdd795bd91a62f3984b760a7f42db96a7f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3803225Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Qifan Pan <panq@google.com>
Cr-Commit-Position: refs/heads/main@{#82307}

Since https://crrev.com/c/3806439 on-stack traced handles are marked
conservatively when being used in combination with CppHeap.

This change removes the precise on-stack representation of the
internal traced nodes as they nodes would anyways be marked
conservatively. The effects are:
- cheaper representation (just a single node space);
- uniform handling: no checks to distinguish on-stack vs on-heap;
- no brittleness around cleaning on-stack handles when the event loop
 is empty;

Change-Id: Id859623bfed77a66bdd064ea8065536264515eae
Bug: v8:13141
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3812039Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82306}

This is no longer necessary, because `EnsureSplitEdgeForm` no longer
adds new blocks.

Change-Id: I48daaa556ff1be5c9641b054937699ac401613f9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3810464Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Georgia Kouveli <georgia.kouveli@arm.com>
Cr-Commit-Position: refs/heads/main@{#82305}

This is a reland of commit 30ee0690

Avoid terminating from another thread in unit tests to make the termination of optimized bigint multiplication deterministic on windows

Original change's description:
> Reland "[TurboFan] Support BigIntMultiply"
>
> This is a reland of commit ccde4205
>
> Added a test case for terminating optimized bigint multiply and attached frame_state to the runtime call to provide deopt information to determine the throw location
>
> Original change's description:
> > [TurboFan] Support BigIntMultiply
> >
> > Bug: v8:9407
> > Change-Id: Iab0a4ca8dd5d83444d1addd6043a5c8e3a8577a7
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3773773
> > Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> > Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
> > Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
> > Cr-Commit-Position: refs/heads/main@{#82140}
>
> Bug: v8:9407
> Change-Id: Ia691d758265148da1de291365d41c7c1d1f98ddd
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3810391
> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#82232}

Bug: v8:9407
Change-Id: I7d04897f4e8f260aba31dbad55ce1263406473d9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3819621
Commit-Queue: Qifan Pan <panq@google.com>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82304}

This reverts commit 9cca4e60.

Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20-%20debug%20-%20single%20generation/6185/overview

Original change's description:
> [heap] Handle old-to-new slot promotion to shared heap
>
> The GC might promote an in-place internalizable string from new space
> directly into the shared heap. This means that the GC might need to
> create OLD_TO_SHARED slots when updating OLD_TO_NEW slots.
>
> This CL implements this both for minor and full GCs.
>
> Bug: v8:11708
> Change-Id: I6102b9024d1dd5dd602d654b006ea5897ab5baa6
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3804604
> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#82298}

Bug: v8:11708
Change-Id: I4cfdcff22552ff92ec85497d58021e83a6e038b0
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3819647
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Auto-Submit: Tobias Tebbi <tebbi@chromium.org>
Owners-Override: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82303}

This reverts commit 55c2566c.

Reason for revert: msan failures: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/45213/overview

Original change's description:
> Reland "[d8] Dump stack trace on d8 tests timeouts on posix systems"
>
> This is a reland of commit 5592bad9
>
> Disable timeout signal handler with --fuzzing
>
> Original change's description:
> > [d8] Dump stack trace on d8 tests timeouts on posix systems
> >
> > - Add a SIGTERM handler in d8 that dupms the stack trace
> > - Send SIGTERM before SIGKILL in the test runner
> >
> > Bug: v8:13115
> > Change-Id: I75285f33caabab61ff6ae83c1fbc6faf45cf595a
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3791906
> > Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> > Reviewed-by: Igor Sheludko <ishell@chromium.org>
> > Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> > Cr-Commit-Position: refs/heads/main@{#82173}
>
> Bug: v8:13115
> Change-Id: I8ddbf2a5e601737c2326384d832902b38c371f81
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3816670
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#82296}

Bug: v8:13115
Change-Id: Iea5a808f1ba3b06f53568e6b4af6c973a5ba5e1b
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3819646
Owners-Override: Tobias Tebbi <tebbi@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Auto-Submit: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#82302}

Bug: chromium:1350916

Change-Id: I161dc57506e87b997508b07a0b4f4a206439cb02
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3816651
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82301}

This reverts commit b67385d2.

Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20TSAN%20-%20no-concurrent-marking/10251/overview

Original change's description:
> [wasm] Enable lazy compilation on --future
>
> This should increase test coverage of lazy compilation.
>
> R=​clemensb@chromium.org
>
> Bug: v8:12852
> Change-Id: I205f4b642576add07db5851126370becdad52fb8
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3784597
> Commit-Queue: Andreas Haas <ahaas@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#82291}

Bug: v8:12852
Change-Id: I7cb5a60aa5cf093c12371877b98c72ad754c5ed3
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3819622
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Auto-Submit: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82300}

In order to support a larger heap cage (8GB, 16GB), the cage offset
will take up more than 32 bits. As a consequence, for 8GB cages, the
least significant bit of the cage offset will overlap with the most
significant bit of the tagged offset. To avoid this, allocations need
to be aligned to 8 bytes to free up one bit from the offset.
All changes are deactivated behind the build flag
`v8_enable_pointer_compression_8gb`.

Bug: v8:13070
Change-Id: Ibb0bd0177f3e88dcd24fc0ee7526335df0faa987
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3791052Reviewed-by: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Teo Dutu <teodutu@google.com>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82299}

The GC might promote an in-place internalizable string from new space
directly into the shared heap. This means that the GC might need to
create OLD_TO_SHARED slots when updating OLD_TO_NEW slots.

This CL implements this both for minor and full GCs.

Bug: v8:11708
Change-Id: I6102b9024d1dd5dd602d654b006ea5897ab5baa6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3804604
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82298}

Change-Id: I00acbcac8bbd86b502ef5d921bfcc9b2fa0f3860
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3816672
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82297}

This is a reland of commit 5592bad9

Disable timeout signal handler with --fuzzing

Original change's description:
> [d8] Dump stack trace on d8 tests timeouts on posix systems
>
> - Add a SIGTERM handler in d8 that dupms the stack trace
> - Send SIGTERM before SIGKILL in the test runner
>
> Bug: v8:13115
> Change-Id: I75285f33caabab61ff6ae83c1fbc6faf45cf595a
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3791906
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#82173}

Bug: v8:13115
Change-Id: I8ddbf2a5e601737c2326384d832902b38c371f81
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3816670Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82296}

Splitting off cosmetics and unrelated test refactorings from a larger
CL reworking traced global handles.

Bug: v8:13141
Change-Id: I675cdbd4898346ab55b0db65d53e992f2eb95744
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3816671
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82295}

StepOrigin is enough to infer the right completion action: Either
finalization by task (for StepOrigin::kTask) or stack guard
(for StepOrigin::kV8).

Only tests with StepOrigin::kV8 were violating this but they also just
pass when enabling the stack guard.

Bug: v8:12775
Change-Id: I5df50198d8e3612ee97142f84bd497820a5cec78
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3816664Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82294}

.. since these functions will also be used by Maglev codegen.

Bug: v8:7700
Change-Id: I6fdf830976369aa0dc70ca54be2165a1186eab06
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3816666Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82293}

This reverts commit b1020a43.

Reason for revert: Causes timeout for `condition-workers`: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux%20-%20debug/40516/overview

Original change's description:
> Reland "[shared-struct] Add Atomics.Condition"
>
> This is a reland of commit e2066ff6
>
> Changes since revert:
> - Rebased against c9918524, which
>   uses the external pointer table for the WaiterQueueNode stored
>   in the state field when compressing pointers. This relaxes
>   the alignment requirement of the state field to be 4-bytes when
>   compressing pointers.
> - Moved the state field into the JSSynchronizationPrimitive base
>   class, since alignment and padding can now be made simpler.
>
> Original change's description:
> > [shared-struct] Add Atomics.Condition
> >
> > Bug: v8:12547
> > Change-Id: Id439aef9cab3348171a23378cdd47ede5f4d7288
> > Cq-Include-Trybots: luci.v8.try:v8_linux_arm64_rel_ng,v8_linux64_tsan_rel_ng
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3630350
> > Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> > Reviewed-by: Adam Klein <adamk@chromium.org>
> > Commit-Queue: Shu-yu Guo <syg@chromium.org>
> > Cr-Commit-Position: refs/heads/main@{#81734}
>
> Bug: v8:12547
> Change-Id: I638304c3d5722c64bd04708ed4cf84863cdebb81
> Cq-Include-Trybots: luci.v8.try:v8_linux_arm64_rel_ng,v8_linux64_tsan_rel_ng
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3763787
> Reviewed-by: Adam Klein <adamk@chromium.org>
> Commit-Queue: Shu-yu Guo <syg@chromium.org>
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#82278}

Bug: v8:12547
Change-Id: I27c2aeb131f1b68c2240323189db88d552aa92f9
Cq-Include-Trybots: luci.v8.try:v8_linux_arm64_rel_ng,v8_linux64_tsan_rel_ng
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3817187
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Auto-Submit: Tobias Tebbi <tebbi@chromium.org>
Owners-Override: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#82292}

This should increase test coverage of lazy compilation.

R=clemensb@chromium.org

Bug: v8:12852
Change-Id: I205f4b642576add07db5851126370becdad52fb8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3784597
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82291}

Mark objects as grey when pushing to worklist and mark as black when
objects are visited.

Bug: v8:12612
Change-Id: I5ad28c4481052f41588f43dc39dd44f132a27dfb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3810467
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82290}

JSArrayBuffer::Setup may trigger GC during PostProcessNewJSReceiver.
This is Ok if we drop the raw_obj parameter and instead always reference
the object through a Handle.

Bug: v8:13121
Change-Id: I70361b16a48599ff83094d11008f6288a1402c7f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3810342
Auto-Submit: Samuel Groß <saelo@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82289}

Rolling v8/buildtools/linux64: git_revision:9ef321772ecc161937db69acb346397e0ccc484d..git_revision:3d773bba0927e67eae8fdaee5e28b0f6203d3bee

Rolling v8/buildtools/third_party/libc++/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxx/+log/6c8f712..75bbec9

Rolling v8/buildtools/third_party/libunwind/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind/+log/012c343..c38cbd4

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/84a7988..4755386

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/2cd4823..647cfe6

Rolling v8/third_party/fuchsia-sdk/sdk: version:9.20220728.1.1..version:9.20220808.1.1

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/src/buildtools/+log/56cc5bc..1453422

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I497e392a7c7690f422550d966d553b1ffa8a8c76
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3816766
Owners-Override: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82288}

builtin

Port commit 1067c6ac

Change-Id: Ibbe4aa66f988a55ed4201d87019ac9f31bbfa9cc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3819043Reviewed-by: Philip Pfaffe <pfaffe@chromium.org>
Auto-Submit: Yahan Lu <yahan@iscas.ac.cn>
Reviewed-by: ji qiu <qiuji@iscas.ac.cn>
Commit-Queue: Philip Pfaffe <pfaffe@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82287}

Bug: v8:7748
Change-Id: I511d5016ae5106a1e4aa148038b3ab2f43da1a6d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3810177
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82286}