This is a reland of 3fb07882

Original change's description:
> [wasm-simd][ia32][x64] Only use registers for shuffles
>
> Shuffles have pattern matching clauses which, depending on the
> instruction used, can require src0 or src1 to be register or not.
> However we do not have 16-byte alignment for SIMD operands yet, so it
> will segfault when we use an SSE SIMD instruction with unaligned
> operands.
>
> This patch fixes all the shuffle cases to always use a register for the
> input nodes, and it does so by ignoring the values of src0_needs_reg and
> src1_needs_reg. When we eventually have memory alignment, we can
> re-enable this check, without mucking around too much in the logic in
> each shuffle match clause.
>
> Bug: v8:9198
> Change-Id: I264e136f017353019f19954c62c88206f7b90656
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2504849
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Reviewed-by: Adam Klein <adamk@chromium.org>
> Commit-Queue: Adam Klein <adamk@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70848}

Bug: v8:9198
Change-Id: I40c6c8f0cd8908a2d6ab7016d8ed4d4fb2ab4114
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2505250Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70862}

Introduce a new option for Format, 'size, to print element sizes for
Advanced SIMD instructions. Then convert some disassembly to use this
new Format option.

Bug: v8:10933
Change-Id: I9eab0e3f6d951c315c49b723db01bcdc93dbde02
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2504856Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70861}

We can move the esize (element size) calculation into the other scope,
since all but 1 instruction share this.

Bug: v8:10933
Change-Id: I43cfef46fdf7e962d54c29949488c2a7c0900334
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2504854Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70860}

This reverts commit b16c7e5b.

Reason for revert: Suspect for lots of crashes on GPU bots, e.g.:
https://ci.chromium.org/p/v8/builders/ci/Mac%20V8%20FYI%20Release%20(Intel)/11228
https://chromium-swarm.appspot.com/task?id=4f88d01781db5a10

Original change's description:
> Reland "[Heap]: Convert Sweep to Job"
>
> This is a reland of 795c0b1c
> Reason for revert:
> TSAN failures https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20TSAN/33884
> Safe to reland as-is with fix to EagerUnmappingInCollectAllAvailableGarbage
> https://chromium-review.googlesource.com/c/v8/v8/+/2502809
>
> Original change's description:
> > [Heap]: Convert Sweep to Job
> >
> > max concurrency is inferred from queue size for OLD_SPACE & MAP_SPACE.
> > Extra Sweeper::TearDown() in MarkCompactCollector::TearDown() is needed
> > to cancel job.
> >
> > Change-Id: Iafba7d7d24e8f6e5c5a1d5c0348dea731f0ac224
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2480783
> > Commit-Queue: Etienne Pierre-Doray <etiennep@chromium.org>
> > Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#70767}
>
> Change-Id: Id9a5baceed4664f53da39597af56a2067e4f3c6f
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2502808
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Commit-Queue: Etienne Pierre-Doray <etiennep@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70845}

TBR=ulan@chromium.org,etiennep@chromium.org

Change-Id: Id6e9fe99f016652dd0fedbdbf65662f8e02ed67a
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2505974Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70859}

Change-Id: I7991225d49797f292c7e565e00c79f418154449f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2506234
Commit-Queue: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Auto-Submit: Junliang Yan <junyan@redhat.com>
Reviewed-by: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#70858}

PPC has a larger page size than other platforms, so increase the page
size in the test to account for this.

Change-Id: I392064e9ef3f87c5bddb7763b35661aee5b4669d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2502330
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Milad Fa <mfarazma@redhat.com>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70857}

This is a reland of 44f46def with a
fix for failures with --turbonci_as_mid_tier

Original change's description:
> [turboprop] Pass required parameters as value inputs to TierUpCheck node
>
> TierUpCheck node tail calls interpreter entry trampoline when additional
> processing is needed for tiering up. Calling IET requires target,
> new_target, input count and context as parameters. Earlier these were
> created as parameter nodes in effect-control-linearizer. This causes
> problems with Turboprop since TurboProp doesn't use the second scheduler
> and cannot reschedule these nodes to the start block. We should instead
> create these parameter nodes in bytecode-graph-builder and pass them
> as value inputs to TierUpCheck node.
>
> Bug: v8:9684
> Change-Id: Icfe5a33b4e628d5a3ba9a3121b2b0746be6aed5c
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2498695
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Commit-Queue: Mythri Alle <mythria@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70790}

Bug: v8:9684
Change-Id: Ic1a7d39aab0a599d0dd421f237e7bc640fcd6eb1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2504258
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70856}

This has no effect on our normal V8 builds as we don't set an
alternate stack.

Embedders like Go have to use alt stacks so this makes them work
with V8 if they have set up an alt stack themselves.

Change-Id: Icf3f4b39c026948875f5b2762ea6ffabaab03e8b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2505718Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70855}

Port d7ece57e

Original Commit Message:

    Optimization marker and the optimized code used to share the same slot
    in the feedback vector as they were mutually exclusive. With turboprop
    we would want to mark the function for tier up to Turbofan while holding
    the optimized code for Turboprop. So this cl uses the existing padding
    field to hold the optimization marker instead.

    As a driveby, removes unused JSFunction::ClearOptimizedCodeSlot function
    and fixes a minor bug in Runtime_GetOptimizationStatus.

R=mythria@chromium.org, joransiu@ca.ibm.com, junyan@redhat.com, midawson@redhat.com
BUG=
LOG=N

Change-Id: Ie635fd05c26f70124076b9c51c0c70a2b948af69
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2505621Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#70854}

This CL splits the class definitions per .tq file, to realize the
following relationship:
A class defined in src/objects/foo.tq has a C++ definition in
src/objects/foo.h. Torque then generates:

- torque-generated/src/objects/foo-tq.inc
  An include file (no proper header) to be included in src/objects/foo.h
  containing the Torque-generated C++ class definition.

- torque-generated/src/objects/foo-tq-inl.inc
  An include file (no proper header) to be included in
  src/objects/foo-inl.h containing inline function definitions.

- torque-generated/src/objects/foo-tq.cc
  A source file including src/objects/foo-inl.h that contains non-inline
  function definitions.

Advantages of this approach:
- Avoid big monolithic headers and preserve the work that went into
  splitting objects.h
- Moving a definition to Torque keeps everything in the same place
  from a C++ viewpoint, including a fully Torque-generated C++ class
  definition.
- The Torque-generated include files do not need to be independent
  headers, necessary includes or forward declarations can just be added
  to the headers that include them.

Drive-by changes:
A bunch of definitions and files had to be moved or created to realize
a consistent 1:1 relationship between .tq files and C++ headers.


Bug: v8:7793
TBR: hpayer@chromium.org
Change-Id: I239a89a16d0bc856a8669d7c92aeafe24a7c7663
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2470571
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#70853}

This reverts commit 3fb07882.

Reason for revert: failing noavx tests:
https://ci.chromium.org/p/v8/builders/ci/V8%20Linux/39390?


Original change's description:
> [wasm-simd][ia32][x64] Only use registers for shuffles
>
> Shuffles have pattern matching clauses which, depending on the
> instruction used, can require src0 or src1 to be register or not.
> However we do not have 16-byte alignment for SIMD operands yet, so it
> will segfault when we use an SSE SIMD instruction with unaligned
> operands.
>
> This patch fixes all the shuffle cases to always use a register for the
> input nodes, and it does so by ignoring the values of src0_needs_reg and
> src1_needs_reg. When we eventually have memory alignment, we can
> re-enable this check, without mucking around too much in the logic in
> each shuffle match clause.
>
> Bug: v8:9198
> Change-Id: I264e136f017353019f19954c62c88206f7b90656
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2504849
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Reviewed-by: Adam Klein <adamk@chromium.org>
> Commit-Queue: Adam Klein <adamk@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70848}

TBR=adamk@chromium.org,ahaas@chromium.org,zhin@chromium.org

Change-Id: Icc7cc1ceb7ca5aa5d859239330743dde2e5f213c
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:9198
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2505719Reviewed-by: Francis McCabe <fgm@chromium.org>
Commit-Queue: Francis McCabe <fgm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70852}

Change-Id: I4ab54dac771bb551c2435a98f9e53194a6f27853
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2495494
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70851}

This reverts commit 145c6f7b.

Reason for revert: Wasm tests failing: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20debug/32598?

Original change's description:
> Add Noavx tests to Linux 32 bots
>
> Bug: v8:11072
> Change-Id: Idfd6a3dbd3492eda3f3bc9f4b8851a386c927e12
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2504261
> Commit-Queue: Almothana Athamneh <almuthanna@chromium.org>
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70847}

TBR=machenbach@chromium.org,liviurau@chromium.org,almuthanna@chromium.org

Change-Id: I482005b718d16eb182f70bd29d6155cbe0a84c0a
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:11072
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2505715Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70850}

This simplifies the logic since we can guarantee to have a
Handle<String>. The removed constructor was only used in tests.

Change-Id: I13519e474fe92892e9e8a39802d84cfab2c5b5ed
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2505711
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70849}

Shuffles have pattern matching clauses which, depending on the
instruction used, can require src0 or src1 to be register or not.
However we do not have 16-byte alignment for SIMD operands yet, so it
will segfault when we use an SSE SIMD instruction with unaligned
operands.

This patch fixes all the shuffle cases to always use a register for the
input nodes, and it does so by ignoring the values of src0_needs_reg and
src1_needs_reg. When we eventually have memory alignment, we can
re-enable this check, without mucking around too much in the logic in
each shuffle match clause.

Bug: v8:9198
Change-Id: I264e136f017353019f19954c62c88206f7b90656
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2504849Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70848}

Bug: v8:11072
Change-Id: Idfd6a3dbd3492eda3f3bc9f4b8851a386c927e12
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2504261
Commit-Queue: Almothana Athamneh <almuthanna@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70847}

Disable the BackgroundCompileTask and CompilerDispatcher unittests when
--finalize-streaming-on-background is enabled. The inner function API to
concurrent compilation doesn't yet support off-thread finalization, so
these tests break under that configuration.

Bug: chromium:1011762
Change-Id: If8d8d8e814161668e12f309e8d69ef8e8a29ab4a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2502329
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70846}

This is a reland of 795c0b1c
Reason for revert:
TSAN failures https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20TSAN/33884
Safe to reland as-is with fix to EagerUnmappingInCollectAllAvailableGarbage
https://chromium-review.googlesource.com/c/v8/v8/+/2502809

Original change's description:
> [Heap]: Convert Sweep to Job
>
> max concurrency is inferred from queue size for OLD_SPACE & MAP_SPACE.
> Extra Sweeper::TearDown() in MarkCompactCollector::TearDown() is needed
> to cancel job.
>
> Change-Id: Iafba7d7d24e8f6e5c5a1d5c0348dea731f0ac224
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2480783
> Commit-Queue: Etienne Pierre-Doray <etiennep@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70767}

Change-Id: Id9a5baceed4664f53da39597af56a2067e4f3c6f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2502808Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Etienne Pierre-Doray <etiennep@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70845}

With --always-opt it is possible that we set optimized code even
when the marker is LogFirstExecution.

Bug=v8:9684
TBR=rmcilroy@chromium.org

Change-Id: Ic45db4a6344a7345bee7ffd075b390d442c540fa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2505710Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70844}

This reverts commit e68285e2.

Reason for revert: ASAN test failing:
https://ci.chromium.org/p/v8/builders/ci/V8%20Mac64%20ASAN/29838?

Original change's description:
> cppgc-js: heap snapshot: Add logic for querying detachedness
>
> Adds infrastructure to allow embedders specifying a detachedness state
> that is queried when encountering an object with a TraceReference that
> has a non-zero wrapper class id set.
>
> Change-Id: Ie7f2f253544ee25a25565eb08d82e9df5f0a74d2
> Bug: chromium:1056170
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2502345
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Omer Katz <omerkatz@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70841}

TBR=ulan@chromium.org,mlippautz@chromium.org,omerkatz@chromium.org

Change-Id: Ic13337b9c5b336a81efa5f2672f5a501084b5326
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:1056170
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2505613Reviewed-by: Francis McCabe <fgm@chromium.org>
Commit-Queue: Francis McCabe <fgm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70843}

https://github.com/tc39/proposal-dynamic-code-brand-checks

An experimental implementation of the TC39 "Dynamic Code Brand Checks". This
implementation sticks an API-only symbol on each "code kind" object, which
is more flexible, but costs memory for each instance.

Bug: chromium:1096017
Change-Id: Idfeca035c61204ca0cea8ec735fdfa40a49d85e4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2339618
Commit-Queue: Daniel Vogelheim <vogelheim@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70842}

Adds infrastructure to allow embedders specifying a detachedness state
that is queried when encountering an object with a TraceReference that
has a non-zero wrapper class id set.

Change-Id: Ie7f2f253544ee25a25565eb08d82e9df5f0a74d2
Bug: chromium:1056170
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2502345
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70841}

Tbr: cbruni@chromium.org
Bug: v8:11073
Change-Id: Iceb85d403428d73004c60ae98041f2626be45b55
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2504254Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70840}

Forward reference resolution writes didn't have a write barrier,
which means the slot wouldn't be recorded if there was an active
slot recording marker running.

Now use the same SlotAccessor interface as the other deserializer
writes, to make sure that the correct write barrier is called.

As a drive-by, clean up SlotAccessorForHeapObject into two static
constructors, to differentiate between access by slot index and
offset.

Fixed: v8:11065
Bug: v8:10460
Change-Id: I5b3a3d94057763324d6e1727d96b65c73ba5d7b4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2504263
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70839}

The flag has been enabled by default for two version now, so it is time
to remove it.

R=binji@chromium.org

Bug: v8:9921
Change-Id: I833e04a3f9d238e7bcf27e93148c9492776af3c6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2402034Reviewed-by: Ben Smith <binji@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70838}

This is a reland of 397ddfee

The benchmark does not expect the counter anymore, so we can reland
the CL now.

Original change's description:
> [wasm] Remove V8.LiftoffCompileMicroSeconds counter
>
> The counter gets created but isn't used anywhere.
>
> R=clemensb@chromium.org
>
> Bug: v8:10933
> Change-Id: I480e601f8118475a3ce750ba97fdae6780342d49
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2497166
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Commit-Queue: Andreas Haas <ahaas@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70756}

Bug: v8:10933
Change-Id: I74c490916efa8ddf80491097fe358865d3bfab2c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2498697
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70837}

This replaces kBytecodeToBuiltinsMapping (an array with currently 549
32-bit integers = 2196 bytes) with kWideBytecodeToBuiltinsMapping which
is an array of uint8_t with only 183 values. The new array contains just
the mappings from wide handlers to builtins but only once since the
mapping is the same for extra wide handlers. (No mapping array is
required for normal handlers since they map 1:1).

This reduces d8's binary size by 2008 bytes on x64.

As a result Interpreter::GetBytecodeHandler will be slightly slower than
before, but its only use in non-test code is in
Runtime_DebugBreakOnBytecode which does not need to be fast.

Bug: v8:11066
Change-Id: Iafc28fba2d1b62c1d49ceabe731d8b52a82dd2fd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2502291
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70836}

Within "ExecuteCompilationUnits", we now have separate events for
baseline compilation and top-tier compilation. But there is still a
larger chunk that is not reflected in the default "v8.wasm" category
yet: wrapper compilation.
This CL adds a trace event for that.

R=ahaas@chromium.org

Change-Id: I0e74b8f5f95f7a6d674582f2d386cc58d4ad547a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2502344Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70835}

This is a reland of d7ece57e with
a fix to failures on NumFuzz.

Original change's description:
> [turboprop] Add a slot for optimization marker in feedback vector
>
> Optimization marker and the optimized code used to share the same slot
> in the feedback vector as they were mutually exclusive. With turboprop
> we would want to mark the function for tier up to Turbofan while holding
> the optimized code for Turboprop. So this cl uses the existing padding
> field to hold the optimization marker instead.
>
> As a driveby, removes unused JSFunction::ClearOptimizedCodeSlot function
> and fixes a minor bug in Runtime_GetOptimizationStatus.
>
> Bug: v8:9684
> Change-Id: I18c551a69648a0837d16c5453d023c0b295b1521
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2467836
> Commit-Queue: Mythri Alle <mythria@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70789}

Bug: v8:9684
Change-Id: Ie6aa3c061a852bb047b5921e4e747d43505568e3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2502871
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70834}

The value of a node was accessed without prior HasValue check. With
WebAssembly this node is not guaranteed to be a value.

R=mslekova@chromium.org

Change-Id: I62170183f3940a04b0550dfbb78cb49d2f5d7f72
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2504250Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70833}

The current tracing (in the "v8.wasm" category) has no indication about
the compilation tiers, which makes it hard to see when baseline
compilation finished and how long top tier compilation takes. The
disabled-by-default "v8.wasm.detailed" category on the other hand is
much too detailed for bigger modules, such that we run into a tracing
buffer overflow pretty quickly, and lose subsequent events.

This CL adds general trace events for baseline compilation and top tier
compilation, which are not per-unit but per-thread. Hence their number
is much lower than the number of events in "v8.wasm.detailed". Because
the events for baseline compilation and top tier compilation have
different colors, it's pretty easy to see whether baseline compilation
or top-tier compilation happens.

R=ahaas@chromium.org

Change-Id: Ic581a335f74018681fa552d14b81c48217b5a80c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2502337Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70832}

We made array-concat run faster in https://crrev.com/c/2504853.

Bug: v8:7783
Change-Id: Iabefb58f92e24ffa4e0589a7c8b9e2b3e12c6e47
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2504859
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70831}

.. if --enable-embedded-constant-pool (ppc-only) is not set. In this
case, the field simply doesn't exist, so we shouldn't read from it,
and definitely not write to it.

Tbr: leszeks@chromium.org
Bug: v8:11036
Change-Id: I8b2cf8cdd084f29060377790c882850bd9ec43c5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2504255Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70830}

This calls Heap::CollectAllAvailableGarbage() in the heap snapshot
generator.

Bug: chromium:1113467
Change-Id: Ia7f58893a36f11f80f1bffafcea0e73f5ec49901
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2456687
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70829}

The immediate might not be 2 bytes from start of instruction, because
the opcode is leb encoded.

Bug: chromium:1143053
Change-Id: I3c514e771419470ce34e02d4faa24e9e59676aa6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2504852Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70828}

.. and add a --text-is-readable flag to support non-readable .text
sections.

This splits the embedded blob hash into two dedicated hashes for data
and code sections. The main benefit is that we can now keep at least a
partial hash even with non-readable .text sections.

The second part of this CL adds a --text-is-readable runtime flag to
support such platforms (with non-readable .text).

It currently doesn't do much; setting it enables a few additional
DCHECKs, disables the constant pool on x64, and and disables
verification of the embedded blob's *code* hash.

Bug: v8:10707
Change-Id: Ib91ed8b50b50f2cd81677f62920bea6fb92af453
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2504251Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70827}

Currently MockPlatformForUnmapper has shorter lifetime than the isolate that
uses it. This leads to use-after-free races in concurrent tasks that fetch
the mock platform just before it is freed.

This CL ensures that MockPlatformForUnmapper is valid throughout the whole
lifetime of the isolate

Change-Id: I94a658bf7eb70d924a19522dab09744f21782972
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2502809Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70826}

This test creates an array that is 500000 elements long. Calling
assertEquals on this with another array is really slow, especially on
simulator runs. Most of this array is empty, only the first few elements
and last few elements contain meaningful items, so we check those
specific indices.

On a local run this test goes from ~250s (--jitless) or ~111s to <1s.

out/arm64.build/d8 --test test/mjsunit/mjsunit.js
test/mjsunit/array-concat.js --random-seed=1 --nohard-abort
--testing-d8-test-runner [--jitless]

(using --jitless makes the test even slower)

Bug: v8:7783
Change-Id: I660d3a9f1b3fe3afaa58fce28f493641059ba226
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2504853
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70825}

Bug: chromium:1056170
Change-Id: I6512792cc088f1ffaf1d6f3e367db02a1f2c8277
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2504511
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Auto-Submit: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70824}

When switching buffers, the last_call_pc_ should be adjusted like
pc_, because the buffer's start address is changed.

Besides, add a missing BlockTrampolinePoolScope.

Change-Id: Iee6d9795a256e041bb2dbf7d8ca63f346a248539
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2504855Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/master@{#70823}