This is a reland of 45227ffd
Differences:
- Handle one more flags conflict in variants.py.
- Disallow %VerifyType without --concurrent-recompilation.

Original change's description:
> [turbofan] extend type asserts to cover all JS types
>
> Extend type assertions to all types covering JavaScript values.
> This is achieved by allocating type representations on the heap using
> newly defined HeapObject subclasses. To allocate these in the compiler,
> we disable concurrent compilation for the --assert-types flag for now.
>
> Fix two type errors that came up with the existing tests:
> 1. JSCreateKeyValueArray has type Array (i.e., a JSArray) instead of
>    OtherObject.
> 2. OperationTyper::NumberToString(Type) can type the result as the
>    HeapConstant Factory::zero_string(). However, NumberToString does
>    not always produce this string. To avoid regressions, the CL keeps
>    the HeapConstant type and changes the runtime and builtin code to
>    always produce the canonical "0" string.
>
> A few tests were failing because they check for truncations to work
> and prevent deoptimization. However, AssertType nodes destroy all
> truncations (which is by design), so these tests are incompatible
> and now disabled for the assert_types variant.
>
> Drive-by fix: a few minor Torque issues that came up.
>
> Change-Id: If03b7851f7e6803a2f69edead4fa91231998f764
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3234717
> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
> Reviewed-by: Omer Katz <omerkatz@chromium.org>
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#77565}

Change-Id: I5b3c6745c6ad349ff8c2b199d9afdf0a9b5a7392
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3247035
Auto-Submit: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77596}

Implement `LiftoffAssembler::emit_i16x8_sconvert_i32x4` for riscv.
Add tests for rvv integer and floating-point instructions.
Add simulator support for rvv instructions, e.g. `vfmadd`, `vnclip`.
Fixed order of operands for `vfdiv.vv`.

Bug: v8:11976
Change-Id: I0691ac66771468533c5994be1fc8a86b09d3c738
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3225319Reviewed-by: Yahan Lu <yahan@iscas.ac.cn>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Yahan Lu <yahan@iscas.ac.cn>
Cr-Commit-Position: refs/heads/main@{#77595}

The stack-switching test is not expected to pass yet if a GC happens
in the runtime call or in the wasm call.

R=ahaas@chromium.org

Bug: v8:12191, v8:12344
Change-Id: Iba66be58c1abd2ffbb22bbd7d34f8df0246a2a92
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3250900Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77594}

TracedReferenceBase use (traced) global handles to implement the
referencs. Provide a write barrier in the corresponding handle
methods. Doing so
- avoids bugs by having embedders taking care of write barrier
  management.
- speeds up the barrier as it is better integrated in the handle
  methods.

Drive-by: We don't need write barriers on initializating stores.

Bug: v8:12165
Change-Id: Ie49cc3783aeed576fd46c957c473c61362fefbf2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3247039
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77593}

1. Skip leading zeros when parsing date string
2. Add necessary unittests

Bug: v8:12256
Change-Id: Ibc1f320382a2e33175f7f57542c8fe48afd05fa8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3223239Reviewed-by: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77592}

A "store own" slow runtime was missing, and the slow handler on the
StoreOwnIC was using the non-own slow runtime function, incorrectly
causing setters to be called.

For baseline, [1] invalidates the invariant that StoreOwnIC is only used
for storing properties already in the literal boilerplate, since it's
also used when the new literal is cloned from an object spread.

[1] https://chromium-review.googlesource.com/c/v8/v8/+/3224666

Bug: chromium:1263389, v8:11429
Change-Id: I0284396f306f937d1b8ff96adda6cc133c19726a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3244308Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77591}

This reverts commit 0e006a15.

Reason for revert: MSan failures: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/41031/overview

Original change's description:
> [heap-snapshot] Preventing overflow in progress counter
>
> This prevents an overflow to happen in the heap snapshot generator.
> Furthermore it changes the relation of progress_counter_ and
> progress_total_ to always adhere to:
> * progress_counter_ <= progress_total_,
> * if: progress_counter_ == progress_total_, then it is done.
>
> With this change, if progress_counter_ happens to be bigger
> than progress_total_ (latter is an estimate), it will continue
> to report the same progress (<100%) until it is done. Before,
> it would repeatedly report 100% until it is done.
>
> Fixed: chromium:1246860
> Change-Id: Iffd3f52355632f2b35abdbb3752912ba7b8bd821
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3250310
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Commit-Queue: Kim-Anh Tran <kimanh@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#77589}

Change-Id: I81e8bb563a48ce6b877e83e30a5f426bef0bb58d
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3250901
Auto-Submit: Clemens Backes <clemensb@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Owners-Override: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77590}

This prevents an overflow to happen in the heap snapshot generator.
Furthermore it changes the relation of progress_counter_ and
progress_total_ to always adhere to:
* progress_counter_ <= progress_total_,
* if: progress_counter_ == progress_total_, then it is done.

With this change, if progress_counter_ happens to be bigger
than progress_total_ (latter is an estimate), it will continue
to report the same progress (<100%) until it is done. Before,
it would repeatedly report 100% until it is done.

Fixed: chromium:1246860
Change-Id: Iffd3f52355632f2b35abdbb3752912ba7b8bd821
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3250310Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Kim-Anh Tran <kimanh@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77589}

Bug: chromium:1263504
Change-Id: I32091478eb1662b72e0b9507e7cd17314cb277d7
Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3247634Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Samuel Groß <saelo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77588}

When evaluating a top-level expression while paused on a breakpoint, we
don't support an await expression as top-level statement. In these
cases, the error was not informative and could be improved.

To do so, we now propagate the information from DebugEvaluate to
ParseInfo and use the parse_info in parser-base to throw a more
informative error while parsing.

R=jarin@chromium.org

Fixed: chromium:1132245
Change-Id: I200c5af7391258256d1d86a09cbcae326327a0d9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3247037Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Tim van der Lippe <tvanderlippe@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77587}

R=leszeks@chromium.org

Change-Id: Iffe5593f3e6e5766f057ad872d16758527b252a8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3248211
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77586}

Rolling v8/third_party/google_benchmark/src: https://chromium.googlesource.com/external/github.com/google/benchmark/+log/fca3482..da01c5e

use docker container for ubuntu-16.04 builds (#1265) (Dominic Hamon)
https://chromium.googlesource.com/external/github.com/google/benchmark/+/da01c5e

[RFC] Adding API for setting/getting benchmark_filter flag? (#1254) (Vy Nguyen)
https://chromium.googlesource.com/external/github.com/google/benchmark/+/4f47ed2

TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com,mlippautz@chromium.org

Change-Id: I8834f9239f19947468375c13dabd73271ed47e6c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3249752Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#77585}

Rolling v8/base/trace_event/common: https://chromium.googlesource.com/chromium/src/base/trace_event/common/+log/68d8169..7f36dbc

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/7edf446..b726d24

Rolling v8/buildtools/third_party/libunwind/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind/+log/bbd954d..05a4a03

Rolling v8/third_party/aemu-linux-x64: anmoXU7qoa185RNsOxsBoD0U-T6rHNnNeGfdCNx1LB0C..b-T2kzVLYko3mxZ2RVSJ3g5BmJMV1y3_xKMFUOTVsaYC

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/3a3fedc..60bc327

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/480c91d..673e8ed

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/819fa96..1ffcd5a

TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I4cbc471b466e41b031a9be7a4613afef004386da
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3248219Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#77584}

    Not all the SSE2 instructions can be extended to
256-bit wide AVX instructions, AVX only supports 128-bit
wide packed integer operands, while AVX2 supports both
128-bit and 256-bit wide packed integer operands. Moreover,
the 256-bit shift instructions use XMM register/m128 to store
the shift count, while all the operands of others are YMM
registers/m256 operands,so we have to divide the
SSE2_INSTRUCTION_LIST into 3 lists, packed double, packed
integer and packed integer shift.

Bug: v8:12228
Change-Id: Ieb240673ec51eec4315871e873e145a59bf16d5a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3246760Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Jie Pan <jie.pan@intel.com>
Cr-Commit-Position: refs/heads/main@{#77583}

Bug: v8:12329
Change-Id: I51c38d70537889b7534fb7e6b4066e6ab440234a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3248163
Auto-Submit: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77582}

As of the normative change [1] of spec, the export name can be
arbitrary strings. Element accesses on module namespace objects
will be interpreted as indexed properties, so those element key
exports should be setup as elements.

[1]: https://github.com/tc39/ecma262/pull/2154

Bug: v8:11690
Change-Id: I3b724d11b9306739268fc5348bae87911a8da18c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3219945Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: legendecas <legendecas@gmail.com>
Cr-Commit-Position: refs/heads/main@{#77581}

This runtime function is now also used for setting properties in object
literals.

Bug: v8:9888
Change-Id: I869a3feff6237a13bb777278b1d0a0062ac1825c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3244316
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Joyee Cheung <joyee@igalia.com>
Cr-Commit-Position: refs/heads/main@{#77580}

https://chromium.googlesource.com/external/github.com/tc39/test262/+log/1ad9bb762..ba82d462

Bug: v8:7834
Change-Id: Iee35bbd770344eb6bd697e4d297888ee100e8e24
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3246763Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77579}

This reverts commit f300a01a.

Reason for revert: Makes TSAN unhappy: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20TSAN%20-%20stress-incremental-marking/5299/overview

Original change's description:
> unittests: Provide Context in TestWithHeapInternals
>
> Change-Id: I54e658325dfbfb425c41cab2fd7b32253b380e37
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3247038
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Commit-Queue: Omer Katz <omerkatz@chromium.org>
> Auto-Submit: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Omer Katz <omerkatz@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#77577}

Change-Id: I3806a40847d327cc86e2816e00a74c80ba7b512e
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3247633
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Owners-Override: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#77578}

Change-Id: I54e658325dfbfb425c41cab2fd7b32253b380e37
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3247038
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Auto-Submit: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77577}

Using the jslimit can race with a concurrent interrupt request.
Also remove one unnecessary indirection.

R=ahaas@chromium.org

Bug: v8:12343
Change-Id: I8b6cc726124797e3687854b1eb2cd57d822c4769
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3247036Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77576}

This object will be used for the 'ref' field of WasmCapiFunctionData and
WasmJSFunctionData, replacing the currently used pair.
Design doc: https://bit.ly/3jEVgzz

Bug: v8:11510
Change-Id: Ic5dec88458b562883d571b3463269b2308f489c5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3236718Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77575}

s/LT/LE/.

Fixed: chromium:1263912
Bug: v8:11069
Change-Id: I0e3378dc62e4912332deeefcfce00f23a2ec63d8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3247192
Commit-Queue: Mathias Bynens <mathias@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77574}

Bug: v8:12253
Change-Id: I71094a61649763db1d71d0c8fe757b16439b72a4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3245345Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Almothana Athamneh <almuthanna@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77573}

R=ahaas@chromium.org

Change-Id: Ic9d7430549fe78c5a97d551aa813bafe881a5c48
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3247193Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77572}

... to Builtins class.

Bug: v8:12244, v8:11880
Change-Id: Ia96e476b904618b5fc45d2e401cedc2f67e36e7d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3245346Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77571}

Drive-by fix: Fix some typos in comments.

Bug: v8:12319
Change-Id: Ieb4f9ab26bd4e07125ff17df9c048681733cf758
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3222263Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Hao A Xu <hao.a.xu@intel.com>
Cr-Commit-Position: refs/heads/main@{#77570}

Bug: chromium:1056170
Change-Id: I14fc220f3184b3472f60d54e3a2d6e554869b945
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3247191
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Auto-Submit: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77569}

This CL exposes the helper class publicly to facilitate sequences
implementation, as discussed in
https://chromium-review.googlesource.com/c/chromium/src/+/3111815.

Bug: chromium:1052746
Change-Id: I3f3c24412c022014fc15b563201a63ee0691f6bc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3236549
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77568}

Log FeedbackVectors for optimised code and show them in the code-panel.

Drive-by-fixes:
- Fix off-by-one in SourcePositionIteration, making sure we always show
  the last element
- Ensure we process all SourcePositions in SourcePositionIteration
- Fix first load error in script-panel
- Allow expanding all text with SHIFT-click

Bug: v8:10644
Change-Id: Ic40a36ea82f0dfa2386c3196f27ca6978cf23643
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3245931Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77567}

This reverts commit 45227ffd.

Reason for revert: Breaks on gc_stress mode, see https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux%20-%20gc%20stress/35988/overview

Original change's description:
> [turbofan] extend type asserts to cover all JS types
>
> Extend type assertions to all types covering JavaScript values.
> This is achieved by allocating type representations on the heap using
> newly defined HeapObject subclasses. To allocate these in the compiler,
> we disable concurrent compilation for the --assert-types flag for now.
>
> Fix two type errors that came up with the existing tests:
> 1. JSCreateKeyValueArray has type Array (i.e., a JSArray) instead of
>    OtherObject.
> 2. OperationTyper::NumberToString(Type) can type the result as the
>    HeapConstant Factory::zero_string(). However, NumberToString does
>    not always produce this string. To avoid regressions, the CL keeps
>    the HeapConstant type and changes the runtime and builtin code to
>    always produce the canonical "0" string.
>
> A few tests were failing because they check for truncations to work
> and prevent deoptimization. However, AssertType nodes destroy all
> truncations (which is by design), so these tests are incompatible
> and now disabled for the assert_types variant.
>
> Drive-by fix: a few minor Torque issues that came up.
>
> Change-Id: If03b7851f7e6803a2f69edead4fa91231998f764
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3234717
> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
> Reviewed-by: Omer Katz <omerkatz@chromium.org>
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#77565}

Change-Id: Ia779a11fc811846194c7a8d1e40b372b265e7ea4
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3247034
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Owners-Override: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#77566}

Extend type assertions to all types covering JavaScript values.
This is achieved by allocating type representations on the heap using
newly defined HeapObject subclasses. To allocate these in the compiler,
we disable concurrent compilation for the --assert-types flag for now.

Fix two type errors that came up with the existing tests:
1. JSCreateKeyValueArray has type Array (i.e., a JSArray) instead of
   OtherObject.
2. OperationTyper::NumberToString(Type) can type the result as the
   HeapConstant Factory::zero_string(). However, NumberToString does
   not always produce this string. To avoid regressions, the CL keeps
   the HeapConstant type and changes the runtime and builtin code to
   always produce the canonical "0" string.

A few tests were failing because they check for truncations to work
and prevent deoptimization. However, AssertType nodes destroy all
truncations (which is by design), so these tests are incompatible
and now disabled for the assert_types variant.

Drive-by fix: a few minor Torque issues that came up.

Change-Id: If03b7851f7e6803a2f69edead4fa91231998f764
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3234717Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77565}

- Introduce v8::ScriptCompiler::CompileFunction
- Deprecate v8::ScriptCompiler::CompileFunctionInContext
- Add v8::Function::GetUnboundScript
- Add v8::Script::GetResourceName

The ScriptOrModule out-parameter is only used by NodeJS since we don't
allow arbitrary objects has host-defined options and they need a way to
keep the options alive.

This CL deprecates the out-parameter and adds helper methods to
address the most common use-cases.

The final fix still requires more fundamental changes on how host-defined
options are handled.

Bug: chromium:1244145
Change-Id: Id29de53521ad626c41391b8300146ee37a1b8a51
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3245117Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Auto-Submit: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77564}

Using v8::Object::GetCreationContext().ToLocalChecked() causes needless
binary size regression on android due to the additional call after
migrating to the non-deprecated GetCreationContext API.

Bug: chromium:1166077, v8:11451, v8:11165
Change-Id: Ic5e2aada4d47392c5d61b419c19b5bcdbf869f0b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3244411
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77563}

Bug: chromium:1261812
Change-Id: I9ccf7a75c8d8b1ba92ae17f785bd9daefc184347
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3246591
Auto-Submit: Nico Weber <thakis@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77562}

Rolling v8/third_party/google_benchmark/src: https://chromium.googlesource.com/external/github.com/google/benchmark/+log/365670e..fca3482

Allow template arguments to be specified directly on the BENCHMARK macro (#1262) (Vy Nguyen)
https://chromium.googlesource.com/external/github.com/google/benchmark/+/fca3482

TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com,mlippautz@chromium.org

Change-Id: I0d0214ba85748e56f6ffa6a3b011a0360191e50b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3246790Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#77561}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/0afcdef..7edf446

Rolling v8/buildtools/linux64: git_revision:693f9fb87e4febdd4299db9f73d8d2c958e63148..git_revision:79c6c1b1a24c46df5a773cc61604bb5051ca6cf4

Rolling v8/buildtools/third_party/libc++abi/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi/+log/9b8228b..26b1018

Rolling v8/buildtools/third_party/libunwind/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind/+log/21acd3f..bbd954d

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/e9a87dc..3a3fedc

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/7bd4c88..480c91d

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/e193c0a..819fa96

TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I99e49eba9b632b9376e22ed52bd945a8f0381eae
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3246571Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#77560}

This covers all the AVX instructions.

Bug: v8:12207
Change-Id: Idee66a55e1da5a2e88797002d25c6affb2d0c564
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3238149Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77559}

Change-Id: Ie419fe63a0d63574a155b48a040beb0b633989e9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3245930
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77558}

Bug: chromium:1263462
Change-Id: I8b367201f1141921a0b34d6fbf1453d72a6fae37
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3244420Reviewed-by: Samuel Groß <saelo@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77557}