Port 360c9294
https://chromium-review.googlesource.com/c/v8/v8/+/2355189

And support storing kS128 value in liftoff.

Change-Id: I4429088bf6205aa24bfa61c2e4dbaf7bdab79132
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2402431Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/master@{#69830}

This is a reland of f25cb50a

Removed the problematic tests.
The problem with the test was that we try to pop from an empty segment.
GCC flags that as accessing beyond the array (i.e. index is uint16_t
equivalent of -1). Preceding the actual pop is a DCHECK that asserts
the segment isn't empty. In practice, since we have the DCHECK and
access to the segment is always via a Local, this shouldn't be a
problem.
Unfortunately, GCC flags the access regardless. The DCHECK goes through
a function pointer so GCC cannot determine that in our unittest the
DCHECK would crash if index is 0 and the access would not happen (The
indirection was added to allow for test DCHECK handlers that don't
crash, so we can't mark the function pointer as noreturn).

Drive-by: Segment::Pop and Segment::Push rely on the their Local
counterparts checking of emptiness/fullness, so we should always
access segments via Locals. Making the Segment ctor private.

Original change's description:
> Reland "cppgc, heap: Don't eagerly allocate worklist segments"
>
> This is a reland of c99147c6
>
> Original change's description:
> > cppgc, heap: Don't eagerly allocate worklist segments
> >
> > Bug: chromium:1056170
> > Change-Id: I75a6b5f52bfe8dd71abc086e5d1e060759ad7fc0
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2391254
> > Commit-Queue: Omer Katz <omerkatz@chromium.org>
> > Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> > Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#69778}
>
> Bug: chromium:1056170
> Change-Id: I4633da065976a6b2710d2f23b946fd2af0e65c83
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2401425
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Commit-Queue: Omer Katz <omerkatz@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69806}

Bug: chromium:1056170
Change-Id: I7a122d1a2d20cd4e7c824d249975b4d3df30e03e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2403251Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69829}

Bug: chromium:1126469
Change-Id: Ia05590ef2e727ce3ac810610f579f6446682e8fa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2403242Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69828}

Add a bunch of lowering for I64x2 operations. This allows us to enable
most of the I64x2 tests in test-run-wasm-simd.cc.

Most of these lowering are straightforward. The load splat and load
extends need an additional operation to convert the loaded Word32 nodes
to Word64.

Bug: v8:10507
Change-Id: I6c948918c03904d2b6778223a95bb2e34b692a5e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2401954Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69827}

Tests failed from time-to-time with --stress-concurrent-allocation. So
run those tests with that flag disabled.

Bug: v8:10315
Change-Id: I8a2b9f03d7bcd8a797134510f608dffb78dd1cdf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2403257Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69826}

Factor out common loop for copying MutableHeapNumbers in newly copied
objects.

Bug: v8:10763
Change-Id: I6cf2fc52c9ac72253dceaba518deacfde9905a9c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2402035
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69825}

This reverts commit abb7cdc9.

Reason for revert: regressions in jetstream2/gaussian-blur_sum

Original change's description:
> [regalloc] Loop-top values can be backedges too
> 
> When counting which backedges conflict with a loop-top phi value, we
> should include values introduced at the start of the loop.
> 
> I don't expect this change to make performance differences on its own,
> but it is a step toward changing the heuristic so that we're less likely
> to introduce unnecessary load/store pairs across the backedge.
> 
> Bug: v8:10606
> Change-Id: I299e388b0b964573119ba0b775d50f398c467c46
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2385715
> Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
> Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
> Cr-Commit-Position: refs/heads/master@{#69752}

TBR=sigurds@chromium.org,yolanda.chen@intel.com,seth.brenith@microsoft.com,thibaudm@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:10606, chromium:1126663
Change-Id: Idde0b7c89f2376ae016e834fa37c38f3d9eb5c1e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2404020Reviewed-by: Seth Brenith <seth.brenith@microsoft.com>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#69824}

This reverts commit 120eb388.

Reason for revert: Maybe perturbed GC and caused optimization test to fail: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/33042?

Original change's description:
> Reland "[d8] Add d8 global variable"
> 
> This is a reland of 6798619a
> 
> Original change's description:
> > [d8] Add d8 global variable
> >
> > - Add a a "d8" global variable where d8 can provide helpers.
> >   This in in preparation of adding d8.log for testing our log parsers
> >   written in JavaScript.
> >
> > - Separate d8 helper creation into individual functions.
> >
> > Bug: v8:1064
> > Change-Id: I84e434452463afb93ae403f890d8841b20b00703
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2400990
> > Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> > Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#69801}
> 
> TBR=verwaest@chromium.org
> 
> Bug: v8:1064
> Change-Id: I656d550b5ec87dc52dbe6cbbdddf7151ce25031f
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2403247
> Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> Reviewed-by: Mythri Alle <mythria@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69819}

TBR=cbruni@chromium.org,mythria@chromium.org,verwaest@chromium.org

Change-Id: If6df69e30b097c78eb0ff2676f5e5c219edfae5b
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:1064
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2404323Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69823}

This is a reland of d3b295fa

Got speculatively reverted in https://crrev.com/c/v8/v8/+/2403256 but
doesn't seem to have been causing the TSAN failures

Original change's description:
> [compiler] Replace Symbol with direct reads
>
> Bug: v8:7790
> Change-Id: I49120a6349777fd992a97d697940e79b2e71dbd1
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2400988
> Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69812}

Bug: v8:7790
Change-Id: I459f4bfc881c641258dcc46fc55fce21f9e03dec
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2403921
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Auto-Submit: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69822}

Recheck flag in StressConcurrentAllocationObserver to allow tests
to not run the StressConcurrentAllocatorTask even though Isolate was
already initialized.

Bug: v8:10315
Change-Id: Ia683458216821c103d1ae455330ebbd32d253905
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2403240Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69821}

Bug: v8:10763
Change-Id: I959661854e5b138186406d4d6fda77558200d454
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2402878Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69820}

This is a reland of 6798619a

Original change's description:
> [d8] Add d8 global variable
>
> - Add a a "d8" global variable where d8 can provide helpers.
>   This in in preparation of adding d8.log for testing our log parsers
>   written in JavaScript.
>
> - Separate d8 helper creation into individual functions.
>
> Bug: v8:1064
> Change-Id: I84e434452463afb93ae403f890d8841b20b00703
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2400990
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69801}

TBR=verwaest@chromium.org

Bug: v8:1064
Change-Id: I656d550b5ec87dc52dbe6cbbdddf7151ce25031f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2403247
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69819}

This reflects the change made in chrome:
https://chromium-review.googlesource.com/c/chromium/src/+/2387554

I somehow thoughts that DefaultJob didn't need the fence, but
TSAN detected the same kind of failures after
9e8c54f8 started using AcquireTaskId.

Drive-by: move delegate outside the loop in Join() to avoid releasing
the task_id many times.

Change-Id: I2ab6bf1bd3eeb7a66e39f20a7e0aa61a9c1ebc44
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2401964Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Etienne Pierre-Doray <etiennep@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69818}

This reverts commit e8976cf9.

Reason for revert: Mark f32x4_cmp as fail, lowering is not fully implemented yet.

Original change's description:
> Revert "[wasm-simd] Stage SIMD"
> 
> This reverts commit 1d2726dd.
> 
> Reason for revert: ODROID failure: https://ci.chromium.org/p/v8/builders/ci/V8%20Arm%20-%20debug/15814?
> 
> Original change's description:
> > [wasm-simd] Stage SIMD
> > 
> > SIMD has been pretty stable for a while now, we are not expecting big
> > changes (like opcode renumbers), there might be new instructions added,
> > and they will all be backwards-compatible.
> > 
> > The reference interpreter in the SIMD proposal is now capable of
> > generating JS files for all test cases, so we can now run them.
> > 
> > There is a bit of tweaking necessary, since SIMD tests are in
> > tests/core/simd subfolder in the spec, so we need to change the glob
> > into a find that will traverse into subdirectory.
> > 
> > Bug: v8:10835
> > Change-Id: I1f7e3cf37f21b2aa2537d1e34242da2373bbf626
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2378587
> > Commit-Queue: Zhi An Ng <zhin@chromium.org>
> > Reviewed-by: Andreas Haas <ahaas@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#69793}
> 
> TBR=bbudge@chromium.org,ahaas@chromium.org,zhin@chromium.org
> 
> Change-Id: I3a90c616109ca048691d97ab45698bc15a678e18
> No-Presubmit: true
> No-Tree-Checks: true
> No-Try: true
> Bug: v8:10835
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2402379
> Reviewed-by: Shu-yu Guo <syg@chromium.org>
> Commit-Queue: Shu-yu Guo <syg@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69794}

TBR=bbudge@chromium.org,ahaas@chromium.org,zhin@chromium.org,syg@chromium.org

# Not skipping CQ checks because this is a reland.

Bug: v8:10835
Change-Id: I3d87dd2adba6ada2ec3ebf5e13bff378a74b03e8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2402386Reviewed-by: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69817}

This reverts commit ff0c5cfa.

Reason for revert: speculative revert for https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20TSAN/33146

Original change's description:
> [offthread] Enable off-thread finalization in --future
> 
> Enable the new LocalHeap-based off-thread finalization behind --future.
> 
> Bug: chromium:1011762
> Change-Id: I4b33fc300a34530d75aa1a3e197e0d1326994efa
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2403252
> Commit-Queue: Leszek Swirski <leszeks@chromium.org>
> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
> Auto-Submit: Leszek Swirski <leszeks@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69813}

TBR=ulan@chromium.org,leszeks@chromium.org,verwaest@chromium.org,dinfuehr@chromium.org

Change-Id: I76d883c69a611ae5603c5025a5f525208ca197a6
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:1011762
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2403259Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69816}

This reverts commit d3b295fa.

Reason for revert: speculative revert for https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20TSAN/33146?

Original change's description:
> [compiler] Replace Symbol with direct reads
> 
> Bug: v8:7790
> Change-Id: I49120a6349777fd992a97d697940e79b2e71dbd1
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2400988
> Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69812}

TBR=neis@chromium.org,solanes@chromium.org

Change-Id: I10f69213e906e9b482ce4f8456ed7d5bcb039051
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7790
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2403256Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69815}

Changes:
- Add possibility to define and emit all reference types.
- Simplify function locals definition.
- Change 'type' to 'type_index' where appropiate.

Bug: v8:7748
Change-Id: Ie35a6204369e678298ee2ff2ec7c7793c5315c3e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2390144
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69814}

Enable the new LocalHeap-based off-thread finalization behind --future.

Bug: chromium:1011762
Change-Id: I4b33fc300a34530d75aa1a3e197e0d1326994efa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2403252
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69813}

Bug: v8:7790
Change-Id: I49120a6349777fd992a97d697940e79b2e71dbd1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2400988
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69812}

Namely:
 * ObjectBoilerplateDescription
 * ArrayBoilerplateDescription

Bug: v8:7790
Change-Id: I05d106b5e557604e67e0cebaef7489fa3faf3562
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2398641
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69811}

TBR: machenbach@chromium.org
Bug: v8:10894
Change-Id: Ie36e7cb3fe8e52478d96d24aab3517fbed29a817
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2403250Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69810}

This reverts commit f25cb50a.

Reason for revert: Fails compilation on gcc https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20gcc%20-%20debug/9026?

Original change's description:
> Reland "cppgc, heap: Don't eagerly allocate worklist segments"
> 
> This is a reland of c99147c6
> 
> Original change's description:
> > cppgc, heap: Don't eagerly allocate worklist segments
> >
> > Bug: chromium:1056170
> > Change-Id: I75a6b5f52bfe8dd71abc086e5d1e060759ad7fc0
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2391254
> > Commit-Queue: Omer Katz <omerkatz@chromium.org>
> > Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> > Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#69778}
> 
> Bug: chromium:1056170
> Change-Id: I4633da065976a6b2710d2f23b946fd2af0e65c83
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2401425
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Commit-Queue: Omer Katz <omerkatz@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69806}

TBR=ulan@chromium.org,mlippautz@chromium.org,omerkatz@chromium.org

Change-Id: I004173e2a82518a88e68eae3a6f7e96656c0ad7e
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:1056170
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2403249Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69809}

This is the final part of the tier-up commit series. It implements:

- A prologue in NCI code objects that checks and acts upon the
optimization marker.
- Currently, handling is deferred to the InterpreterEntryTrampoline
but this will change in the future.
- The lifecycle is otherwise like Ignition-to-Turbofan; the runtime
profiler marks a function for optimization, the next call to that
function triggers optimization by calling into runtime, and the
finished code object is installed both on the JSFunction and the
optimized code cache.
- The feedback vector's kOptimizedCodeWeakOrSmiOffset slot is
currently reused for the mid-to-top tier up.

Cq-Include-Trybots: luci.v8.try:v8_linux64_fyi_rel_ng
Bug: v8:8888
Change-Id: Iff50b05ddcc68b25d7ed0f1e0d20af076a1522a0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2361466Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69808}

- Simplify some macros.
- Simplify some handle creations.
- Make various accessors more uniform.
- Remove leftover assumptions about serialized children.

Change-Id: Iee2951065c442aba1b479a48de33f0b8e0c7b057
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2402033
Commit-Queue: Georg Neis <neis@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Auto-Submit: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69807}

This is a reland of c99147c6

Original change's description:
> cppgc, heap: Don't eagerly allocate worklist segments
>
> Bug: chromium:1056170
> Change-Id: I75a6b5f52bfe8dd71abc086e5d1e060759ad7fc0
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2391254
> Commit-Queue: Omer Katz <omerkatz@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69778}

Bug: chromium:1056170
Change-Id: I4633da065976a6b2710d2f23b946fd2af0e65c83
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2401425Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69806}

This reverts https://chromium-review.googlesource.com/c/v8/v8/+/2372545
in favour of different solution. In order to simulate filling up a page,
it's not suitable to look at the limit() since there might be observers
that have lowered it, so the page will not actually be full.

Instead, let's relax the CHECK() in CreatePadding() to not look at the
limit() but all available space.

For instance, the test-heap/Regress978156 cctest uses FillCurrentPage()
to fill the current page. However if there's an observer on the current
page, it will not be filled entirely and the test will fail. This works
because by default, when the new space is empty, the scavenger observer
happens to be on the second page of the space. However if one changes
the V8 page size to 512k, then it fails.

This can be reproduced as such:

    # Make sure the scavenge trigger is on the first page.
    ./cctest test-heap/Regress978156  --scavenge-task-trigger=10

    # Stress marking adds random observers to trigger incremental
    # marking.
    ./cctest test-heap/Regress978156  --stress-marking=100

This issue also causes crashes when using the %SimulateNewspaceFull()
runtime test function, as found by fuzzing and you can find more details
in the bug.

Bug: v8:10808, v8:9906, chromium:1122848
Change-Id: Ie043ae0a1d3754d2423cb5d97f2b3e1ee860e5c8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2401427Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Pierre Langlois <pierre.langlois@arm.com>
Cr-Commit-Position: refs/heads/master@{#69805}

This reverts commit 6798619a.

Reason for revert: causing spurious optimisation failures.

Original change's description:
> [d8] Add d8 global variable
> 
> - Add a a "d8" global variable where d8 can provide helpers.
>   This in in preparation of adding d8.log for testing our log parsers
>   written in JavaScript.
> 
> - Separate d8 helper creation into individual functions.
> 
> Bug: v8:1064
> Change-Id: I84e434452463afb93ae403f890d8841b20b00703
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2400990
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69801}

TBR=cbruni@chromium.org,verwaest@chromium.org

Change-Id: I23b0c0a2ce28c13b3eba10a0eb15cd61967711d1
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:1064
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2403246Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69804}

Simd128ReverseBytes needs to handle inputs of type F64x2
and I64x2 when lowered.

Bug: v8:10507
Change-Id: If4de5abd264f01d6515a83310e008d256ad57836
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2401920Reviewed-by: Bill Budge <bbudge@chromium.org>
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#69803}

Add a DCHECK during deserializer allocation that the previous allocation
is sufficiently initialized to be iterable. This is an step towards
allowing GC during deserializer execution.

Bug: v8:10815
Change-Id: I29da21b93e6b826bdb7b5f9f5a9723da1698a225
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2396079
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69802}

- Add a a "d8" global variable where d8 can provide helpers.
  This in in preparation of adding d8.log for testing our log parsers
  written in JavaScript.

- Separate d8 helper creation into individual functions.

Bug: v8:1064
Change-Id: I84e434452463afb93ae403f890d8841b20b00703
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2400990Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69801}

Refactors weak prefix handling, in particular the post-hoc weak prefix
read and HeapObjectReference creation, to a few function calls. This
simplifies ReadDataCase sufficiently that it can be inlined into
ReadData, which removes the need for a) having two places where we
branch on the bytecode value (ReadData and ReadDataCase), and b)
removes the need for the macro helper which calls ReadData. With a
bit of refactoring we can therefore make the big switch much more
explicit.

This patch also moves that switch into a per-bytecode helper, so that
switch entries can return the updated slot, rather than remembering to
update in-place and continue looping.

It also moves the weak prefix handling from the deserializer allocator
to the deserializer itself, as weak prefixes don't have anything to do
with allocation.

Change-Id: I84fbda021cb65d5bfb91fc3ef27f72823acee05a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2395557
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69800}

My last CL introduced a null-pointer bug there.

Bug: chromium:1126771, v8:7790
Change-Id: Ib16317dea14c9fbad7951cb28ce7bb8bb9ce41c3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2402037
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69799}

Monomorphic loads are quite common and it is important to keep these
load accesses fast. Dynamic map checks increases the overhead for these
monomorphic accesses by having to actually verify the IC state and check
against a map from the feedback vector This was causing a significant
(~2-3%) regression in JavaScript duration. To keep the common case of
monomorphic checks fast, we now want to add a check against expected
map (which passes in most cases) and move the rest of the checks to a
builtin. i.e. we want dynamic map checks (when generating the code for
loads in monomorphic state) to look like:

if (incoming_map != HeapConstant(expected_map))
  call_builtin;

This helps us to keep the most common case fast and still gets the
benefits of dynamic map checks.

This cl is the first in the series of cls that will add this
functionality. This cl makes the expected_map available for dynamic map
checks operator. In follow up cls, we will add a builtin and update
the code to use the builtin.


Bug: v8:10582
Change-Id: I10992c6ba1fb005592de962310c208cff6829119
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2397894Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69798}

The dynamic map checks operator loads the feedback vector and performs
map checks against each map and handler entry in the feedback against
the incoming map and handler.

Instead of emitting code to iterate over this feedback vector at
runtime, we unroll this loop at compile time.

The generated code is similar to this pseudocode:

  length = feedback_slot.length
  if length >= 4: goto labels[3]
  if length == 3: goto labels[2]
  if length == 2: goto labels[1]
  if length == 1: goto labels[0]

  labels[3]:
    map = load(feedback_slot, 6)
    if incoming_map == map goto handler_check(7)
    goto labels[2]
  labels[2]:
    map = load(feedback_slot, 4)
    if incoming_map == map goto handler_check(5)
    goto labels[1]
  labels[1]:
    map = load(feedback_slot, 2)
    if incoming_map == map goto handler_check(3)
    goto labels[0]
  labels[0]:
    map = load(feedback_slot, 0)
    if incoming_map == map goto handler_check(1)
    bailout

  handler_check (index):
    handler = load(feedback_slot, index)
    if incoming_handler ==  handler goto done
    deoptimize

Bug: v8:10582, v8:9684
Change-Id: I64d64ff8eda664e4d476bf1b2612e26a344e98a6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2339960
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69797}

Change-Id: Ic2bbf2b3ff542d916da43929445bd83553b5091f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2401952Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/master@{#69796}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/9c1d422..471a6cd

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/src/buildtools/+log/ff93f3e..a90362b

Rolling v8/buildtools/linux64: git_revision:6f13aaac55a977e1948910942675c69f2b4f7a94..git_revision:e002e68a48d1c82648eadde2f6aafa20d08c36f2

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/dc9083e..70f34e0

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I11a42e1b54914893affa6fddb390cb5eb0d76472
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2401774Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#69795}

This reverts commit 1d2726dd.

Reason for revert: ODROID failure: https://ci.chromium.org/p/v8/builders/ci/V8%20Arm%20-%20debug/15814?

Original change's description:
> [wasm-simd] Stage SIMD
> 
> SIMD has been pretty stable for a while now, we are not expecting big
> changes (like opcode renumbers), there might be new instructions added,
> and they will all be backwards-compatible.
> 
> The reference interpreter in the SIMD proposal is now capable of
> generating JS files for all test cases, so we can now run them.
> 
> There is a bit of tweaking necessary, since SIMD tests are in
> tests/core/simd subfolder in the spec, so we need to change the glob
> into a find that will traverse into subdirectory.
> 
> Bug: v8:10835
> Change-Id: I1f7e3cf37f21b2aa2537d1e34242da2373bbf626
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2378587
> Commit-Queue: Zhi An Ng <zhin@chromium.org>
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69793}

TBR=bbudge@chromium.org,ahaas@chromium.org,zhin@chromium.org

Change-Id: I3a90c616109ca048691d97ab45698bc15a678e18
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10835
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2402379Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69794}

SIMD has been pretty stable for a while now, we are not expecting big
changes (like opcode renumbers), there might be new instructions added,
and they will all be backwards-compatible.

The reference interpreter in the SIMD proposal is now capable of
generating JS files for all test cases, so we can now run them.

There is a bit of tweaking necessary, since SIMD tests are in
tests/core/simd subfolder in the spec, so we need to change the glob
into a find that will traverse into subdirectory.

Bug: v8:10835
Change-Id: I1f7e3cf37f21b2aa2537d1e34242da2373bbf626
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2378587
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69793}

https://chromium.googlesource.com/external/github.com/tc39/test262/+log/24c6732..e8cdf92

Bug: v8:7834
Change-Id: I99d104f9b071ff2abed11e54a3c2832400e84ac4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2393218Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69792}

Apple's upcoming arm64 devices will prevent rwx access to memory,
but in turn provide a new per-thread way to switch between write
and execute permissions. This patch puts that system to use for
the WebAssembly subsystem.
The approach relies on CodeSpaceWriteScope objects for now. That
isn't optimal for background threads (which could stay in "write"
mode permanently instead of toggling), but its simplicity makes
it a good first step.

Background:
https://developer.apple.com/documentation/apple_silicon/porting_just-in-time_compilers_to_apple_silicon

Bug: chromium:1117591
Change-Id: I3b60f0efd34c0fed924dfc71ee2c7805801c5d42
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2378307
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69791}