Change-Id: I7f2d0ba0e544267a9f97838e2904d8dfeecd9a99
Reviewed-on: https://chromium-review.googlesource.com/1095615Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53647}

Bug: chromium:844008
Change-Id: If248ca90213c5cb3dfb0e3936a9ac824ed3c3119
Reviewed-on: https://chromium-review.googlesource.com/1095276Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@google.com>
Cr-Commit-Position: refs/heads/master@{#53646}

The current implementation allocates a new {NativeModule} if trap
handlers are disabled. Afterwards, all export wrappers need to be
patched to call to the code objects in this new native module (this
patching is done in {CodeSpecialization}).
With the jump table, we want to get rid of this patching, hence we need
to reuse the same jump table, hence we cannot allocate a new
{NativeModule}. Instead, we should update the existing one with the new
code.

R=mstarzinger@chromium.org
CC=eholk@chromium.org

Bug: v8:7143, v8:7758
Change-Id: If2f395d462752b9084ed1e5f0a81f71d400ccfca
Reviewed-on: https://chromium-review.googlesource.com/1095262Reviewed-by: Eric Holk <eholk@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53645}

This switches Liftoff code to use WebAssembly runtime stubs instead of
builtin calls for handling traps, similar to what we use in TurboFan
generated code as well.

R=clemensh@chromium.org
BUG=v8:7424

Change-Id: If2554067b3e294220306c67861bb1fb14db7b492
Reviewed-on: https://chromium-review.googlesource.com/1087275
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53644}

Now that V8 uses EphemeronHashTable as backing store for
JSWeakCollections one pass over the heap is enough. In the old
implementation a second pass was necessary to find the owner
of the FixedArray to determine if its entries are strong or weak
references.

Bug: chromium:844008
Change-Id: I04bdf7d480c9be301831698571be5b226d20ac20
Reviewed-on: https://chromium-review.googlesource.com/1090910Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Alexei Filippov <alph@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@google.com>
Cr-Commit-Position: refs/heads/master@{#53643}

Fix afd6351d

After `[csa][builtins] Port CompileLazy* to CSA` landed,
there is an implicit expectation that the address of the JS code
is stored in the target register. Due to optimizations on MIPSR6,
this address was not properly loaded.

We fix this by loading target address explicitly before performing
the jump.

TEST=mjsunit/json2,mjsunit/packed-elements

Change-Id: Ida9cb062910415bf15aa40dd20a17fc42fdba719
Reviewed-on: https://chromium-review.googlesource.com/1095155Reviewed-by: Sreten Kovacevic <sreten.kovacevic@mips.com>
Commit-Queue: Sreten Kovacevic <sreten.kovacevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#53642}

Mark JSWeakCollections and EphemeronHashTables concurrently to
the application to reduce pause times.

Bug: chromium:844008
Change-Id: I0a8fe592e651b368c5c12846d02d55bbf4058ff2
Reviewed-on: https://chromium-review.googlesource.com/1095035Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@google.com>
Cr-Commit-Position: refs/heads/master@{#53641}

This adds a new gn arg v8_custom_deps to add a dependency that's dynamically
added under v8/custom_deps. E.g. for depending on a target in
v8/custom_deps/test_root/BUILD.gn set
v8_custom_deps = "custom_deps/test_root:target_name".

Bug: chromium:846711
Change-Id: If03d48dba07cb36dc1b981602e5dc267deec086b
Reviewed-on: https://chromium-review.googlesource.com/1095218Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53640}

R=sigurds@chromium.org

Change-Id: I544b804fd7ccb90e64a945e0da9e43b01b5afdf3
Reviewed-on: https://chromium-review.googlesource.com/1095294Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53639}

The graph_zone_ field in PipelineData was initialized to nullptr
instead of the correct zone when running the wasm compilation pipeline.
Now it is set to the actual zone of the graph that is being compiled.

Bug: chromium:844591
Change-Id: I8d9a688a292471a45dedcd01b03244baed60e378
Reviewed-on: https://chromium-review.googlesource.com/1095254Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Stephan Herhut <herhut@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53638}

Bug: v8:7327
Change-Id: Id354b039977a82af8b2c6bba416cf5a1f804ca71
Reviewed-on: https://chromium-review.googlesource.com/1095257
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53637}

This CL allows selection/highlighting of wasm source when a graph node
is clicked.

Bug: v8:7327
Change-Id: I4a3347a83c8a38804feabffefaefd761596005c3
Reviewed-on: https://chromium-review.googlesource.com/1092712
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53636}

This new scope allows to avoid emitting calls to {Builtin::kAbort} in
debug code when requested, but still trap when the debug code fails. It
can be used to keep generated code independent of builtins.

R=jgruber@chromium.org

Change-Id: I77864a1a10ec5b52bccfd76981ab5f4ff33bc727
Reviewed-on: https://chromium-review.googlesource.com/1095179
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53635}

TBR=gsathya@chromium.org
NOTRY=true

Bug: v8:7841
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: Idb77549e6ede9ea903bfd706db10f6d7ce701a97
Reviewed-on: https://chromium-review.googlesource.com/1095038
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53634}

Bug: v8:7327
Change-Id: I445a6589612f12c5fffa2bd23831b961c94d960e
Reviewed-on: https://chromium-review.googlesource.com/1092535Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53633}

D3.v5 needs a merge before applying combined update and
enter actions.

Bug: v8:7327
Change-Id: If5a044c18e4229c5eadb18c18aea191bcbacef32
Reviewed-on: https://chromium-review.googlesource.com/1095188Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53632}

- Improve typing by introducing PhaseView interface.
- Recalculate scale extent after resizing.
- Fix null sentinel which should have been undefined.

Bug: v8:7327

Change-Id: I06881ac3f5681cb419b5da9c6b8aa3a6b2652088
Reviewed-on: https://chromium-review.googlesource.com/1090914Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53631}

This CL adds a TFS stub for RegExp#test and moves several checks to
the JSCallReducer. In particular, the JSCallReducer checks that
 - property {exec} on the regexp is still the original exec
 - property {lastIndex} on the regexp is a non-negative smi
The stub does not repeat these checks in release mode.

This effectively means that if the regexp is known, we can perform these
checks at compile time, and get away with a map dependency.

Bug: v8:7779, v8:7200

Change-Id: I0c6d711d4f1d2f6f325a1c02855b0e1b62e014c8
Reviewed-on: https://chromium-review.googlesource.com/1074654
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53630}

Whenever an Isolate is available on a variable, field, or method
parameter, use that instead of GetIsolate(). Also convert simple
cases of the one-argument handle constructor to either use an
available Isolate, or use GetIsolate() if their first parameter
is a variable.

Bug: v8:7786
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I52805905a9ca8729615ead78859f43d5e8f605f1
Reviewed-on: https://chromium-review.googlesource.com/1092853
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53629}

Emphasize this code handles ephemerons (key-value pairs)
and not ephemeral objects (short-lived objects).

Bug: chromium:844008
Change-Id: I1dbf97f69ea5d17b1eb446d92dffef0cc3d5d08f
Reviewed-on: https://chromium-review.googlesource.com/1095101Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@google.com>
Cr-Commit-Position: refs/heads/master@{#53628}

...and add a js-perf-test instead.

Bug: v8:7726
Change-Id: I0cd17642c76887a5a24f54792625d62b9cee3667
Reviewed-on: https://chromium-review.googlesource.com/1094637
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Daniel Clifford <danno@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53627}

R=jgruber@chromium.org
BUG=v8:7424

Change-Id: I15fa004b52229ab808401e45fb9d8885f99d8b5e
Reviewed-on: https://chromium-review.googlesource.com/1092735Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53626}

For errors, it just printed "Failure: expected <Error()> found
<Error()>" and completely omitted the specific error type and the
message.

The new output is:
Failure:
expected:
Error(Error: my explicit error)
found:
Error(ReferenceError: ffi is not defined)

R=mstarzinger@chromium.org

Change-Id: Ie17a97e4413c4585b9560fd1c408018ee8c06701
Reviewed-on: https://chromium-review.googlesource.com/1092746Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53625}

ExistingCodeLogger was behaving incorrectly when the CodeEventHandler
API was used in combination with --interpreted-frames-native-stack.
Instead of collecting copied trampolines as InterpretedFunction:functionName,
they were being collected as Builtin:IntepreterEntryTrampolines.
This patch adds special handling for copied trampolines when
using ExistingCodeLogger.

R=yangguo@google.com

Change-Id: I3ee4be03800122d28d53b51b20c60dcf6263e4c1
Reviewed-on: https://chromium-review.googlesource.com/1087813Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53624}

Internal references create absolute pointers within the code and must
therefore be disallowed for embedded builtins to remain
position-independent.

Drive-by: remove related cctest. This test used to be relevant before
embedding was fully implemented, but by now it is useless and rather
misleading since it gives a false sense of safety.

Bug: v8:6666
Change-Id: I57a62274b57c3ef1303d5114c68e2a9b1f92bda4
Reviewed-on: https://chromium-review.googlesource.com/1092732
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53623}

OrderedHashTableHandler (to be renamed to OrderedHashTable) is the
interface that abstracts away the two different ordered hash tables.

All operations on the two ordered hash tables must be performed
through this new interface so that we can seamlessly migrate from one
table to another behind the scenes.

Bug: v8:6443, v8:7569
Change-Id: Ifc0a38974605b63e0a2a36b4aafb8dc68a081f4a
Reviewed-on: https://chromium-review.googlesource.com/1059865
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53622}

NOTRY=true

Bug: chromium:846711
Change-Id: I5d7f366db2e80fbe539b34a5dcb7475e4e38bd29
Reviewed-on: https://chromium-review.googlesource.com/1088694Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53621}

The GC now stores EphemeronHashTables in a Worklist.

Bug: chromium:844008
Change-Id: I6ad95b3b49484901d75c6fd92b59065c438fcd03
Reviewed-on: https://chromium-review.googlesource.com/1093092
Commit-Queue: Dominik Inführ <dinfuehr@google.com>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53620}

JSWeakCollections used to be chained in a singly-linked list. The GC now
stores the JSWeakCollection's backing store EphemeronHashTable in a
Worklist. This should allow easier parallelization in the future.

Bug: chromium:844008
Change-Id: Icc0c1b537c23e8d24dc5b27452fb8106562c9a09
Reviewed-on: https://chromium-review.googlesource.com/1092496
Commit-Queue: Dominik Inführ <dinfuehr@google.com>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53619}

Bug: v8:7834
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: I1fcbcf0b019a0fbf0f17a676bd31a686a6d5377d
Reviewed-on: https://chromium-review.googlesource.com/1091880
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53618}

Bug: chromium:845409
Change-Id: Id8b89e6dac48bba9065ac9f04ce48f951aa2186b
Reviewed-on: https://chromium-review.googlesource.com/1092860
Commit-Queue: Rodrigo Bruno <rfbpb@google.com>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53617}

The mock histogram functions cannot be cleared and can be called on
isolate tear down if incremental marking is in progress.

Bug: chromium:850508
Tbr: mlippautz@chromium.org
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Change-Id: I99e52aaa81c863f71e195aeed691b37da9e71da6
Reviewed-on: https://chromium-review.googlesource.com/1093073Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53616}

Bug: chromium:850508

Tbr: mlippautz@chromium.org
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Change-Id: I99adf68c4b3e26decf3b68c8062ce74cbf27874d
Reviewed-on: https://chromium-review.googlesource.com/1093071Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53615}

This adds the following histograms recorded corresponding to
V8.GCFinalizeMC phases:
- V8.GCFinalizeMC.Clear
- V8.GCFinalizeMC.Epilogue
- V8.GCFinalizeMC.Evacuate
- V8.GCFinalizeMC.Finish
- V8.GCFinalizeMC.Mark
- V8.GCFinalizeMC.Prologue
- V8.GCFinalizeMC.Sweep

Bug: chromium:850508
Change-Id: I47adc125a9a28436d09e35db68a8e8198cbee2dd
Reviewed-on: https://chromium-review.googlesource.com/1091311
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53614}

Emit full header and key/value-pairs.

Bug: chromium:844008
Change-Id: Ia94b841ff97d024d6ba27b1bcc2f993f95fc11fa
Reviewed-on: https://chromium-review.googlesource.com/1092698Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@google.com>
Cr-Commit-Position: refs/heads/master@{#53613}

Reland "[turbofan] enable switch jump tables with --no-untrusted-code-mitigations, also for stubs and Wasm"

But for builtins, jump tables are disabled
to be compatible with embedded builtins.

This is a reland of 884bec9f

Original change's description:
> [turbofan] enable switch jump tables with --no-untrusted-code-mitigations,
> also for stubs and Wasm
>
> Bug: chromium:845851
> Change-Id: I9b860dc26f8b35d629235b82fc5fffe04bf10493
> Reviewed-on: https://chromium-review.googlesource.com/1076151
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#53525}

Bug: chromium:845851
Change-Id: I66c300f875a46a3f2a68730fda94b8196f38aa97
Reviewed-on: https://chromium-review.googlesource.com/1087468
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53612}

This CL implements NumberIsNaN in Torque and removes it from the
CodeStubAssembler. It is currently used in TypedArray.p.sort and
Array.p.sort.

R=jgruber@chromium.org

Change-Id: Iaaa81901f89c0df68997d4501607b302a0449012
Reviewed-on: https://chromium-review.googlesource.com/1092532
Commit-Queue: Simon Zünd <szuend@google.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53611}

Since we never extract pools from a {DisjointAllocationPool}, the
{Allocate} method can just return an {AddressRange}, and also {Merge}
just needs to merge a single {AddressRange}.

Drive-by: Make {AddressRange} a proper struct, for DCHECKs and better
accessors.

R=mstarzinger@chromium.org

Bug: v8:7754
Change-Id: I19fd02b2c6d8eb5316a5e994835b89be9cfa792b
Reviewed-on: https://chromium-review.googlesource.com/1090723
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53610}

This class can contain members and functions common across all
platforms.

Bug: v8:6666
Change-Id: I8f232f806457164a2401f74c7140fd035ad05096
Reviewed-on: https://chromium-review.googlesource.com/1086940
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53609}

Bug: chromium:845409
Change-Id: If1fbb03258fdfae528069ba37bbef0395ddb230d
Reviewed-on: https://chromium-review.googlesource.com/1090920Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Rodrigo Bruno <rfbpb@google.com>
Cr-Commit-Position: refs/heads/master@{#53608}