Bug: chromium:1082438,chromium:1083860
Change-Id: I8f0defe0db0e420e970311bcaf0aebb3ccebb4b3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2219928
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Auto-Submit: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68042}

Port 51847be8

Original Commit Message:

    Implementation for ia32 and x64, arm and arm64 simply bailout now, will
    be implemented later.

R=zhin@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: Ibc6e0b02893ef49b82c34e03742a0cbd54c92789
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2219814Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#68041}

Bug: v8:8906
Change-Id: Ie83540f9dd9448a09c5a8af0c7b7e1ea58aaf497
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2110029Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68040}

Since the interpreter is only used for internal testing now, it does not
have an associated frame type any more. We thus cannot call external
functions any more, since a stack walk would not know how to handle
interpreter frames.

All code for calling external (imported) functions is dead by now, so
this CL removes it.

R=thibaudm@chromium.org

Bug: v8:10389
Change-Id: If4b56b93e63002a1e5463f278f0271eb413762eb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2218287
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68039}

In BinaryOpAssembler::Generate_BinaryOperationWithFeedback, the
feedback is stored only after the respective builtin/runtime call.
If this call throws an exception, the feedback is lost, leading
to a deopt loop in some cases. This CL fixes that issue by writing
the gathered feedback before passing control to the builtin.

Bug: chromium:1077197, v8:9441
Change-Id: I20e4b14815520224e2c6f8af1af6a89f754ccddf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2202904
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68038}

This is a reland of 6204768b

The original issue exposed the problem that NumberEqual performs
implicit conversion of oddballs to numbers, which is incorrect for
abstract equality comparison (i.e. 0 == null must not be true).

This reland fixes this by applying the following steps:
* Introduced a new kNumberOrBoolean value for CompareOperationFeedback,
  CompareOperationHint, TypeCheckKind and CheckedTaggedInputMode.
* In CodeStubAssembler::Equal: Further distinguish between boolean and
  non-boolean oddballs and set feedback accoringly.
* In JSTypedLowering: Construct [Speculative]NumberEqual operator with
  CompareOperationHint::kNumberOrBoolean, when this feedback is present.
  JSOperatorBuilder and operator cache are extended accordingly.
* In SimplifiedLowering: Propagate a UseInfo with new
  TypeCheckKind::kNumberOrBoolean.
* This leads to the generation of CheckedTaggedToFloat64 in
  RepresentationChanger with new CheckedTaggedInputMode::kNumberOrBoolean.
* In EffectControlLinearizer: Handle this new mode. Accept and convert
  number and boolean and deopt for rest.

Original change's description:
> [turbofan] Improve equality on NumberOrOddball
>
> This CL cleans up CompareOperationFeedback by replacing it with a
> composable set of flags. The interpreter is changed to collect
> more specific feedback for abstract equality, especially if oddballs
> are involved.
>
> TurboFan is changed to construct SpeculativeNumberEqual operator
> instead of the generic JSEqual in many more cases. This change has
> shown a local speedup of a factor of 3-10, because the specific
> operator is way faster than calling into the generic builtin, but
> it also enables additional optimizations, further improving
> runtime performance.
>
> Bug: v8:5660
> Change-Id: I856752caa707e9a4f742c6e7a9c75552fb431d28
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2162854
> Reviewed-by: Mythri Alle <mythria@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#67645}

TBR: tebbi@chromium.org
Bug: v8:5660
Change-Id: I12e733149a1d2773cafb781a1d4b10aa1eb242a7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2193713
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68037}

This was postponed until the changes to struct and array types
were implemented
(https://chromium-review.googlesource.com/c/v8/v8/+/2215049).

Bug: v8:7748
Change-Id: I2c7a7d6bcbc1b93f82240f5e245ac1a066d74511
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2214832
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68036}

Port 6b228044
https://crrev.com/c/2209268

Port e505ce95
https://crrev.com/c/2207664

Change-Id: I29fb541a998f7b75eeecc91d48143f023e83214f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2217536Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/master@{#68035}

See https://github.com/tc39/proposal-promise-any/pull/64/

Bug: v8:9808
Change-Id: I5f11a5e306d17372ba7c24f313165de985444470
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2214826
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68034}

Embarrassingly, while integrating VerifyRegExpSyntax into SpiderMonkey,
I realized that I had refactored away the RegExpCompileData* argument,
which is necessary for emitting error messages when parsing fails.

Bug: v8:10406
Change-Id: Iaa8cd1f944bbf058ccc03c052b5ec0563b7c2e99
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2219415Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68033}

Change-Id: I20d5d22e424bf2327e201afe4d395939a862bdcd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2218057
Auto-Submit: Georg Neis <neis@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68032}

This reverts commit b9d2c22a.

Reason for revert: Reverting due to regressions in multiple JS
performance/memory benchmarks. 

Original change's description:
> [codegen] Reduce kScratchDoubleReg usage
> 
> Bug: v8:10506
> Change-Id: I3fccaf640e23b5fcc7722164e2437b247684f824
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2207919
> Reviewed-by: Zhi An Ng <zhin@chromium.org>
> Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#67909}

TBR=gdeepti@chromium.org,zhin@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:10506
Change-Id: I9a1c960c577f0e0d42c817d03bc56895268a0718
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2219339Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68031}

This reverts commit dfdef885.

Reason for revert: https://ci.chromium.org/p/v8/builders/ci/V8%20Blink%20Mac/2718?

Original change's description:
> [wasm-simd] Fix extract lane unsigned extend
> 
> The interpreter is missing a static cast when extracting lanes smaller
> than int32_t and doing an unsigned extend. The array in Simd128 is
> signed, so a direct cast to uint32_t will be a signed extension. The fix
> is to, in the unsigned case, cast to unsigned (of the appropriate size)
> first, then cast to uint32_t.
> 
> Change-Id: Ifabb5b9690f08ad505ac94b84908db0970581818
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2216721
> Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
> Commit-Queue: Zhi An Ng <zhin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#68029}

TBR=gdeepti@chromium.org,zhin@chromium.org

Change-Id: Icdd0e705f4c7252aef2cadaa39ec52204b5c6093
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2219412Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68030}

The interpreter is missing a static cast when extracting lanes smaller
than int32_t and doing an unsigned extend. The array in Simd128 is
signed, so a direct cast to uint32_t will be a signed extension. The fix
is to, in the unsigned case, cast to unsigned (of the appropriate size)
first, then cast to uint32_t.

Change-Id: Ifabb5b9690f08ad505ac94b84908db0970581818
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2216721Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68029}

This is a partial reland of https://crrev.com/c/v8/v8/+/2199640 .

Change-Id: I244174446c52b05e70042d7f4d03eb67a0c725b7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2216304Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#68028}

all_true uses pcmpeqd which takes a memory operand, but needs to be
128-bit aligned, which we don't support yet.

Bug: v8:9198
Change-Id: Ia0caaaa76b1103ba538252181ef93e8557fb4739
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2218887Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68027}

- Converts the last builtin, Add to Torque.

Bug: v8:9891
Change-Id: Iefa16b0d4c586ff91b54ead13fa9846064e6eda8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2204155
Commit-Queue: Bill Budge <bbudge@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68026}

Implementation for ia32 and x64, arm and arm64 simply bailout now, will
be implemented later.

Bug: v8:9909
Change-Id: Ieea02baeb68f5c947d1182450f9f80c3e19e07ca
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2216930
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68025}

Port 839e9695

Original Commit Message:

    Implemented for ia32, x64, arm, arm64, all in one patch (phew). The
    code is simple enough (short paragraph) that are the same as TurboFan
    codegen.

R=zhin@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I7731e12622bbc04a5fe043217597e4dd749df030
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2218640Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#68024}

Port 043ac205

Original Commit Message:

    Implement i8x16.bitmask, i16x8.bitmask, i32x4.bitmask on x64.

R=zhin@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I1bb6439abb3db27c50e1f06a833954c473119bcd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2219007Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#68023}

Implemented for ia32, x64, arm, arm64, all in one patch (phew). The
code is simple enough (short paragraph) that are the same as TurboFan
codegen.

Bug: v8:9909
Change-Id: Idbc1cbd58c16e455b1656c2367c8d9db10308e35
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2208610
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68022}

This is a partial reland of https://crrev.com/c/v8/v8/+/2199640 . It
includes removing an unused field.

Change-Id: Iffc56a2bee751758dcba5c1ec162dcf9258db62d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2216303Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#68021}

Bug: v8:10180
Change-Id: Idd9a3bbda5163fce480376d2c57c7175b34fa34f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2211228Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68020}

Display register allocation live ranges alongside sequences in
turbolizer.

The existing --trace-turbo flag now also outputs the register
allocation data as part of the json file alongside the
instruction sequence data that is already produced before and
after register allocation is performed. This data includes live
range intervals for each virtual and fixed register and the state
of their assignments.

This json data can now be displayed in turbolizer alongside the
instruction sequences. The information is presented as a grid,
with each grid cell representing a LifeTimePosition of a certain
virtual register, determined by the column and row indices
respectively. Each LifeTimePosition is shown to be part of an
instruction id which itself is shown to be part of a block id.
Each interval is shown as a coloured rectangle positioned over
the relevant cells, and displaying text to indicate the state of
their assignment.

The Resizer object has been extended to allow the grid's html
panel to be varied in size in the same manner that the left and
right panels can be. The size of the grid itself must also be
adjusted whenever the div container changes size.

The RangeView class is introduced and is created and held by the
single SequenceView object used to display the
InstructionSequence data before and after register allocation.
A checkbox allows the user to show/hide the range view, this is
disabled when register allocation data is not provided or more
than 249 instructions are in the sequence. The latter being
required due to the css grid-row-col limit of 1000 alond with
helping alleviate performance issues. The SequenceView object
tracks the phase index currently selected as well as whether or
not it is currently being shown. This ensures that the RangeView
is not hidden and shown when switching between before and after
register allocation, allowing for a smoother transition between
the two. The scroll position is also saved and restored for
convenience.

The data about the instruction sequence required for the display
is held by the RangeView object and reset whenever a new
instruction sequence is shown. The grid div must sync its scroll
with the headers and row labels so as to ensure a consistent
view. The register allocation data is extracted from the json,
with each register row showing all intervals within the relevant
ranges. When the view is switched between before and after
register allocation, the relevant intervals are swapped in.

Bug: v8:7327
Notry: true
Change-Id: I183535a2410a7d663382f387199885250fb98691
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2184232Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68019}

This is a partial reland of https://crrev.com/c/v8/v8/+/2199640 . It
allows scoped lookups to not crash during CompileCurrentAst, fixes the
formatting in an error message, and includes an extra line for
convenience when generating macros for bitfields.

Change-Id: I7ed9f7d76b3ce5e2cc0f2580d7ba1953da340ae8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2216301Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#68018}

- Moves some CSA macros back into the global namespace, and uses
  Torque's new global namespace feature to disambiguate the calls.

Bug: v8:9891
Change-Id: I6a94ee04daed1e6a8f672b2eaa12161ab998f14c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2216932Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68017}

Bug: v8:9708, v8:6949
Change-Id: I80fa9b813d6ce80e52a42a02b42f8c98e2f3f75f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2212267
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68016}

Add docs for:
- cppgc namespace (to have doxygen generate the namespace doc)
- Heap
- LivenessBroker

Bug: chromium:1056170
Change-Id: I5e4664458b7209f4adebb4d5e7b5119c341f59a9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2214834
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68015}

All strings in the internalized string list now have them.

Bug: v8:10506

Change-Id: I68feb34d0dc424465a53ac73a5d6b5297e29dd00
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2218032
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68014}

Port 0f624aae

R=fanchen.kong@intel.com, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I4f2aebe38e05bb6f92da96a3f7aea1cc4c4cbf2d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2215258Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#68013}

Change-Id: I15aefc6ecfc6a8d65b6bd74af9e2331cdc49fdc4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2202986
Auto-Submit: Georg Neis <neis@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68012}

Change-Id: Ifadaffdd7e846f51accc51cc14898ddf05c98f88
Bug: v8:10201
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2214836
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68011}

Bug: v8:9708, v8:6949
Change-Id: Id3eeab803d50c95d53eef1806859b85e857c4d2b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2212266Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68010}

INTPTR_PARAMETERS is deduced from reg, which is an TNode<IntPtrT>.

Bug: v8:9708, v8:6949
Change-Id: I84c4e5803602ecc2d9284bce46409a384e93a035
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2212265Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68009}

Since now all phases have the same order (or the reverse) we can share
only one container that would specify the traversal order.

We still need a queue that will be used for revisiting purposes in
PROPAGATE and RETYPE.

Bug: v8:10424
Change-Id: Iab1e3c3cf6ffd342240d43be3b8ac77812aff211
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154201
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68008}

We now have one initial phase (before PROPAGATE) that generates the
traversal that the subphases are going to take. Generates post-order
starting from End for RETYPE and LOWER, and the reverse for PROPAGATE.

As a note, LOWER could use either PO or RPO.

Bug: v8:10424
Change-Id: I7435d681aba012b4f5e5ecd971bfa1d88bfb8b3a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154785Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68007}

Also remove a version that was only used once.

Bug: v8:9708, v8:6949
Change-Id: Ifd65af3866a3740d8da6d4501445b25a48d7219a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2212264Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68006}

The `slot` parameter is expected to be a UintPtr.

Bug: v8:8888
Change-Id: Ia1137cd5af3d3aa0b00e9bf194661067c37332b4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2215047
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68005}

This CL brings unary op assembler structure closer to that of binary
ops assemblers:

- Decrement, Increment, Negate call into UnaryOpWithFeedback,
- which takes lambdas specifying smi, float, and bigint logic.
- BitwiseNot is different in that it still dispatches using
  TaggedToWOrd32OrBigIntWithFeedback.
- These methods are all implemented in the (hidden)
  UnaryOpAssemblerImpl class.
- The header only exposes UnaryOpAssembler with the bare minimum of
  API.

The last point is the remaining major divergence from binary op
assemblers. I just like how this avoids useless implementation details
in the header.

Bug: v8:8888
Change-Id: I0ac4695483950356885301234d58c1900904aa92
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2214830
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68004}

Object shapes or sizes shouldn't change during the string fixup, but
we're seeing crashes that indicate that they might do anyway, so add
some more exhaustive checking to make sure they don't.

Bug: chromium:1086478
Change-Id: I36d41e036a32d8dd072000d900ba1900343d4608
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2214839
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68003}