A couple of customers have asked about using devtools to get information
about temporary allocations, with the goal of reducing GC time and/or
peak memory usage. Currently, the sampling heap profiler reports only
objects which are still alive at the end of the profiling session. In
this change, I propose adding configuration options when starting the
sampling heap profiler so that it can optionally include information
about objects which were discarded by the GC before the end of the
profiling session. A user could run the sampling heap profiler in
several different modes depending on their goals:

1. To find memory leaks or determine which functions contribute most to
   steady-state memory consumption, the current default mode is best.
2. To find functions which cause large temporary memory spikes or large
   GC pauses, the user can request data about both live objects and
   those collected by major GC.
3. To tune for minimal GC activity in latency-sensitive applications
   like real-time audio processing, the user can request data about
   every allocation, including objects collected by major or minor GC.
4. I'm not sure why anybody would want data about objects collected by
   minor GC and not objects collected by major GC, but it's also a valid
   flags combination.

Change-Id: If55d5965a1de04fed3ae640a02ca369723f64fdf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3868522Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/main@{#83202}

When regenerating v8heapconst.py, the v8 sandbox now has to be enabled
explicitly (using the v8_enabe_sandbox=true gn arg) as it is enabled by
default in Chromium builds, but not standalone v8 builds.

Bug: v8:13281
Change-Id: I1a0861b1d63f340465d7433e042b27eace706ca7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3895622
Commit-Queue: Adam Klein <adamk@chromium.org>
Auto-Submit: Samuel Groß <saelo@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83201}

Change-Id: Id691009bddafdbb5a53c234fe00995b6e0733586
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3893417
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Reviewed-by: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/main@{#83200}

We count the calls to `createTask` to track adoption.

Chromium CL: https://crrev.com/c/3894138

R=kimanh@chromium.org

Bug: chromium:1334585
Change-Id: I091f738e5b0dfdbb5843cda09eed7d3f906ea681
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3892783
Commit-Queue: Simon Zünd <szuend@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Kim-Anh Tran <kimanh@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83199}

JumpIfTagged access the stack for 4 byte compressed ptrs
so we need to add stack bias for that for big endian

Change-Id: Ifefa56018cf4ddccb337704775b38937e47ac3ed
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3893419Reviewed-by: Milad Farazmand <mfarazma@redhat.com>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/main@{#83198}

Check whether the exception phi for the accumulator (i.e. the exception
message object) is dead, and don't assign rax to it if yes. Note that
maglev node liveness can differ from bytecode liveness, since the
bytecode accumulator could have been considered "live" just because of a
move to a (dead) register.

Bug: v8:7700
Change-Id: If1384284f6f55a565e2ae94e5e7a32455fdedb93
Fixed: chromium:1359382
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3892353
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Jakob Linke <jgruber@chromium.org>
Commit-Queue: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83197}

Bug: v8:7700
Change-Id: I0eaf1ffaaa2d759226b675b367a58bc0ea9a5da2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3895813Reviewed-by: Jakob Linke <jgruber@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83196}

Use Script as the key for the template object cache, instead of the
SharedFunctionInfo. This is because SharedFunctionInfos can be garbage
collected and then later recompiled, which would mean that we break the
spec's expectation that the template object stays constant.

Now the association of cached template object with SharedFunctionInfo is
via the function_literal_id of the SharedFunctionInfo, stored on the
CachedTemplateObject. These are linearly searched, similar to the linear
search over slot ids.

Bug: v8:13190
Change-Id: I3f67811c16ea4cd39c99b2fa034aa7e1f03c171e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3892787Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83195}

This reverts commit 10756bea.

Reason for revert: Test failures on GPU and other Chromium bots:
https://ci.chromium.org/ui/p/v8/builders/ci/Linux%20V8%20FYI%20Release%20(NVIDIA)/21271/overview
https://luci-milo.appspot.com/ui/inv/build-8803047917676096065/test-results?q=V8MemoryDumpProviderTest.DumpGlobalHandlesSize

Original change's description:
> [heap] Add shared spaces for --shared-space
>
> This CL adds shared spaces for regular and large objects in the shared
> space isolate. Spaces aren't used for allocation yet.
>
> Bug: v8:13267
> Change-Id: If508144530f4c9a1b3c0567570165955b64cc200
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3876824
> Reviewed-by: Jakob Linke <jgruber@chromium.org>
> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#83178}

Bug: v8:13267
Change-Id: Iefa01243ae8bebaba5cda8426a5aa0f4fd306bf3
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3892788
Owners-Override: Michael Achenbach <machenbach@chromium.org>
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#83194}

This struct represents the freelist of an ExternalPointerTable and
contains both the size and the head of the freelist. It is encoded and
stored as a single Atomic64 field (freelist_) inside the
ExternalPointerTable class. This ensures that the freelist head and size
are always synchronized.

Previously, the freelist size was encoded in freelist entries in the top
bits. This only works as long as the maximum table size is relatively
small however, as it requires both the freelist size and the index of
the next entry on the list to fit into 24 bits. To allow for bigger
maximum table sizes in the future, this CL moves the freelist size
directly into the table as part of the freelist_ field.

Bug: v8:10391
Change-Id: Id09c9b28d09d79b704ac47e6566029cfb209ecd1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3891256
Commit-Queue: Samuel Groß <saelo@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83193}

This reverts commit 6d342fa5.

Reason for revert: Needed to land:
https://crrev.com/c/3892788

Original change's description:
> [heap] Use std::unique_ptr for space_ array
>
> Document ownership with using std::unique_ptr<Space> for the space_
> array.
>
> Bug: v8:13267
> Change-Id: I12861d97cd52d2a8cf9ceb43a2f90008be87b2a3
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3890913
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#83187}

Bug: v8:13267
Change-Id: Ieeb29454e146ee763130c0031af3f7a48b4eec94
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3895811
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Owners-Override: Michael Achenbach <machenbach@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83192}

This reverts commit 7c64e5b4.

Reason for revert: MinorMC passes all CQ bots again (crrev.com/c/3872266)

Original change's description:
> [heap] Remove MinorMC variant from bots
>
> As part of revising MinorMC, it would soon be broken and bots should
> not be red because of it.
>
> Bug: v8:12612
> Change-Id: I0551d0a115ac2f4fa7fc32190458850f80b84cf5
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3810353
> Commit-Queue: Omer Katz <omerkatz@chromium.org>
> Reviewed-by: Almothana Athamneh <almuthanna@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#82197}

Bug: v8:12612
Change-Id: I4a08f79efc3b5fc133a0a920a11d2af559b5bf4f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3885890
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Almothana Athamneh <almuthanna@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83191}

Based on bots and local testing, MinorMC has reached a stable state in
terms of correctness.
Enable fuzzing with MinorMC to flush out additional issues.

Bug: v8:12612
Change-Id: I9cf8c5791d7256ff63c777b295863506436ee165
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3872265Reviewed-by: Almothana Athamneh <almuthanna@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83190}

Fix build error:
    ../../v8/src/wasm/module-compiler.cc:147:10: error: ‘unique_lock’ is not a member of ‘std’
      147 |     std::unique_lock<std::shared_mutex> queues_guard{queues_mutex_};
          |          ^~~~~~~~~~~

Bug: chromium:957519
Change-Id: I0d14730d5b8dd76820fcc0a47d66ab0bd3e38f24
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3880498
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83189}

The numfuzz fuzzer.py has a loop to send a new test after receiving
a result. When all test processors go into stopped state, attempts
of sending new tests return False. That case wasn't handled here
and we kept looping forever.

Bug: v8:13113
Change-Id: Ief2686614d9703fb590400ac3e73b6ac9008c8f6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3891373Reviewed-by: Alexander Schulze <alexschulze@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83188}

Document ownership with using std::unique_ptr<Space> for the space_
array.

Bug: v8:13267
Change-Id: I12861d97cd52d2a8cf9ceb43a2f90008be87b2a3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3890913Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83187}

SimulateFullSpace starts with no LAB, iterates over pages and allocates
all free space on each page. After the first page, the LAB is empty but
is no longer null.

Bug: v8:12612
Change-Id: I2c00b9ba68fdd5f60eda086ea940cb6e211a986e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3891294
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83186}

Change-Id: I2a35ae0d07bcd5c570bcaae8ae6ef886a5b5e926
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3852484Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83185}

During a stack switch, the stack state is temporarily inconsistent when
the old stack is marked as "inactive" and the new stack is not yet
marked as "active".

Ensure that the WasmAllocateSuspender runtime function is not called in
an inconsistent state. It can trigger a GC, and we need a consistent
state to iterate the roots.

Wait until the end of the function to mark the current stack as
"inactive", so that it is still marked as "active" when it is
potentially visited.

R=clemensb@chromium.org

Bug: v8:13272
Change-Id: I65fe76c3d222d9fa47d17b66069443ceabba47ad
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3890919Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83184}

Before, import and export wrappers were cached based on their
signature. This change
- makes wrapper canonicalization consistent with that of types and
  call_indirect signatures under --wasm-type-canonicalization,
- removes the last uses of signature maps, which will enable us to
  remove them in a future CL.

Change-Id: I512bc234f0ae10e50bd94237e8e675ca47ed13c5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3891250
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83183}

Bug: chromium:1092804
Change-Id: I9f4385d00af464eb2b9251b7c1dcfe0d4b69cdf2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3891279
Auto-Submit: Greg Thompson <grt@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83182}

Ignition remembers the correct context to restore when entering an
exception handler by moving the context to an interpreter register
when entering a try block, and restoring it from there when unwinding
the frame and entering the catch block.

Maglev code has to do the same by taking the context from the
appropriate register for the handler's frame state.

Bug: v8:7700
Change-Id: I294fcccc845c660b2289b6d7b40f49f1aa46283d
Fixed: chromium:1359928
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3892352Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Jakob Linke <jgruber@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83181}

This error type is very common and deserves its own error message
instead of the generic "Unexpected value" one.

Change-Id: I07a0de8b190db58e97fae98d0f7347872efd9995
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3892694
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83180}

Move the CompilationInfo out of the GraphProcessor and into the
individual NodeProcessors, allowing them to hold it as a field rather
than getting it passed in via the various process methods. This will
allow us to write graph processors that don't have/need access to the
compilation info.

Bug: v8:7700
Change-Id: I8b91cbeaf632f05ae8bbbe8783e5a7381b5c8e53
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3892698
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Jakob Linke <jgruber@chromium.org>
Commit-Queue: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83179}

This CL adds shared spaces for regular and large objects in the shared
space isolate. Spaces aren't used for allocation yet.

Bug: v8:13267
Change-Id: If508144530f4c9a1b3c0567570165955b64cc200
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3876824Reviewed-by: Jakob Linke <jgruber@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83178}

Joining a queue-using process can deadlock if the child process is
about to write to the queue, but the parent process wants to join the
child. To fix this, we now drain elements from a separate thread of
the main process.

Bug: v8:13113
Change-Id: Ic279e66ab84eb89a4034ff1f2c025eb850b65013
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3891116
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Alexander Schulze <alexschulze@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83177}

Besides, fix a wrong instruction in mips64.

Port commit ac0cedf1

Change-Id: I3c8c73eacc2aa1b5f4a583a0187261455917ad7a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3892526
Auto-Submit: Liu Yu <liuyu@loongson.cn>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Reviewed-by: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/main@{#83176}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/7fcb69a..4157fb6

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/src/buildtools/+log/4276428..e713c13

Rolling v8/buildtools/third_party/libc++/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxx/+log/60f9078..c1e647c

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/4864449..37391a1

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/2d25dbd..9ebcfa6

Rolling v8/third_party/fuchsia-sdk/sdk: version:9.20220912.3.1..version:9.20220913.3.1

Rolling v8/third_party/zlib: https://chromium.googlesource.com/chromium/src/third_party/zlib/+log/05e137d..f48cb14

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/2a5ebae..02a202a

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I5cc2b3bdb94bd9786f11095169c3e193f8876ad9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3893427
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#83175}

Bug: v8:8594
Change-Id: I734a548b074567af3cad6359ef96640cbf0eb6f3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3892137
Commit-Queue: Fabrice de Gans <fdegans@chromium.org>
Auto-Submit: Fabrice de Gans <fdegans@chromium.org>
Reviewed-by: Alexander Schulze <alexschulze@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83174}

Trap if the suspender argument provided to the JSPI import
wrapper is invalid.

For now, the suspender argument is expected to be the active
suspender. In the future, it will also be possible to suspend
to a parent of the current suspender. This will only be possible
once wasm-to-wasm suspending wrappers are supported, or if and
when JSPI suspenders become compatible with their core
stack-switching counterpart (e.g. Fibers in the fiber proposal).

R=jkummerow@chromium.org

Bug: v8:12191
Change-Id: I650454ed076bd251b0aa18656774d4c4b2d3bfdc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3892697Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83173}

Remove RegulateISODate after BalanceISODate and inline one call to AddISODate
https://github.com/tc39/proposal-temporal/pull/2291/files

Spec Text:
https://tc39.es/proposal-temporal/#sec-temporal-addisodate
https://tc39.es/proposal-temporal/#sec-get-temporal.zoneddatetime.prototype.hoursinday

Bug: v8:11544
Change-Id: I4d5faaa48a26d37015c82bc06b3414698db9945d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3893558
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83172}

1. Return null if the transition is out of bound.
2. Remove incorrect MAYBE_RETURN which is handled by the IsNothing check.


Bug: v8:11544
Change-Id: Ia54f68831120bd2460cb813464168b1a2c92da3d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3893595
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83171}

Instead of having e.g. `string.new_wtf8` that takes an immediate
specifying the particular UTF-8 flavor to parse, make one instruction
per flavor.

See https://github.com/WebAssembly/stringref/pull/46.

Bug: v8:12868
Change-Id: I2e9f2735c557b2352b6e75314037e473710d87a9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3892695Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Andy Wingo <wingo@igalia.com>
Cr-Commit-Position: refs/heads/main@{#83170}

This also allows allocation folding to be tested in cctests.

Bug: v8:13070
Change-Id: I7b6991461dd7ad4423539b33f59a05d6b247c3e7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3891257
Auto-Submit: Teo Dutu <teodutu@google.com>
Commit-Queue: Teo Dutu <teodutu@google.com>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83169}

1) Cast to PagedSpaceBase instead of PagedSpace in sweeper.cc
2) Free LAB before filling space in heap-utils.cc

Bug: v8:12612
Change-Id: I5820c2d2f4ab832a4b5a829fc55973d93296ec10
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3892690
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Auto-Submit: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83168}

Bug: v8:12547
Change-Id: I89dbaea6b8559ada651b6ed986c842c1dc2b6df9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3892129Reviewed-by: Milad Farazmand <mfarazma@redhat.com>
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#83167}

Double-representation field loads were DCHECKing that the entry in the
descriptor array for a double-representation IC is also double
representation. With in-place map updates, however, the IC may be out of
date, so weaken this DCHECK to take into account in-place updates, and
rely on compilation dependency commit making this lookup safe.

Bug: v8:7700
Change-Id: Iff3c80d396274d14034e010dbe98f5640c9e4495
Fixed: chromium:1358872
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3892692
Commit-Queue: Jakob Linke <jgruber@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83166}

ElementAccessFeedback transition groups can contain multiple maps in a
transition group if feedback is polymorphic on elements kind but not
otherwise the map kind. Maglev should treat this case as polymorphic.

Bug: v8:7700
Change-Id: I779299e4cf9d1c3a30e77f7a953d057ea5a69935
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3892691
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83165}

For frame inspection (i.e. not deoptimization), no RegisterValues are
available to TranslatedState and thus any register-allocated value is
unavailable.

Stack trace collection require `function` and `receiver` values to be
available and thus stack-allocated. Both are immutable and have fixed
stack slots so this is not a problem; we just lost track of the receiver
inside Maglev when function parameters were wrapped inside exception Phi
nodes.

We solve this for now by special-casing the `receiver` to reuse the
InitialValue node instead of creating a new Phi.

Bug: v8:7700
Change-Id: I4f4de9a643b98e2fcbc7ee7a53688cc97a8d6f1d
Fixed: chromium:1359428
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3893856Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Jakob Linke <jgruber@chromium.org>
Commit-Queue: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83164}

BE machines use a 4 byte bias to spill/fill 32-bit values on
the stack. This is done so because TF always fills 64-bit values
even if the spilled value was 32-bits. To make sure this holds between
LO and TF we have added a 4 byte bias in this CL:
crrev.com/c/2756712

LoadSpillAddress needs to also take this into account and
add a bias if the spilled value was 4 bytes.

Change-Id: Ibd2b2071ce1fb11a9c5884611ae8edd1f17cb0c9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3891196
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83163}