R=ahaas@chromium.org

Bug: v8:8091
Change-Id: Id069ffbf76bf836b613287788b1b1fccbb577475
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3021173Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75815}

All these methods are called in compiler/concurrent contexts and
should therefore use refs where possible. This mostly just pushes code
around, but does avoid a few completely unnecessary ref-handle-ref
round-trips.

Bug: v8:7790
Change-Id: I18e6f45ddcd16373b5349bdb7d2dccd205f5c9ef
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3038522Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75814}

This means we only have to maintain the arch list in one place.

Bug: v8:11420, v8:11421
Change-Id: I1618e2ab1396ad85aca60923111e5966e547e65a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3041420
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Patrick Thier <pthier@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75813}

If any logging is enabled (for instance with --prof), the calls into
Logger:ApiEntryCall become quite expensive.

Move the FLAG_log_api checks to the header to speed up these
high-frequency events.

Change-Id: Iba718c856cd57a890ad6b63bcf4b6836bfd5d3f0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3024156Reviewed-by: Patrick Thier <pthier@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75812}

With -Wimplicit-fallthrough enabled, ittapi fails to compile on
V8 Linux Vtune bot due to a missing fallthrough annotation:
https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux%20-%20vtunejit/43006/overview

Updating ittapi to latest version 3.18.13 to get the fix for that.

Change-Id: Iaa98ca6b893ec43ee6396e57df9948313d7b36cc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3040846
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75811}

This is a reland of ea55438a. Relanding
after a fix lands here:
https://chromium-review.googlesource.com/c/v8/v8/+/3030711. The failures
were caused because baseline code could be flushed during the process
of deoptimization after we choose which entry (InterpreterEnterAt* /
BaselineEnterAt* ) builtin to use. BaselineEnterAt* builtins expect
baseline code but it could be flushed before we execute the builtin. The
fix is to defer the decision.

Original change's description:
> [sparkplug] Support bytecode / baseline code flushing with sparkplug
>
> Currently with sparkplug we don't flush bytecode / baseline code of
> functions that were tiered up to sparkplug. This CL adds the support to
> flush baseline code / bytecode of functions that have baseline code too.
> This CL:
> 1. Updates the BodyDescriptor of JSFunction to treat the Code field of
> JSFunction as a custom weak pointer where the code is treated as weak if
> the bytecode corresponding to this function is old.
> 2. Updates GC to handle the functions that had a weak code object during
> the atomic phase of GC.
> 3. Updates the check for old bytecode to also consider when there is
> baseline code on the function.
>
> This CL doesn't change any heuristics for flushing. The baseline code
> will be flushed at the same time as bytecode.
>
> Change-Id: I6b51e06ebadb917b9f4b0f43f2afebd7f64cd26a
> Bug: v8:11947
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2992715
> Commit-Queue: Mythri Alle <mythria@chromium.org>
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#75674}

Bug: v8:11947
Change-Id: I63dce4cd9f6271c54049cc09f95d12e2795f15d1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3035774Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75810}

This is a reland of 431fff66.
The fix is in BUILD.gn: We need to also include chromeos, which is a
linux target which is not covered by "is_linux" in gn.

R=ahaas@chromium.org

Original change's description:
> [traphandler] Add simulator support
>
> This prepares the trap handler to support being used from simulators.
> Modifications to the arm64 simulator will be done in a follow-up CL. For
> now, the trap handler will be registered but not used in Wasm (we emit
> explicit bounds checks instead, as before).
>
> The implementation uses inline assembly, so it is only available on x64
> POSIX systems for now. This is the main platform we use for testing and
> for fuzzing, so it should give us the test coverage we need. If needed,
> inline assembly for other platforms can be added later.
> The new code will be executed by the existing arm64 simulator bots, e.g.
> "V8 Linux - arm64 - sim".
>
> R=ahaas@chromium.org, mseaborn@chromium.org
>
> Bug: v8:11955
> Change-Id: Idc50291c704d9dea902ae0098e5309f19055816c
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3011160
> Commit-Queue: Clemens Backes <clemensb@chromium.org>
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#75780}

Bug: v8:11955
Change-Id: I8af39dea5b2cd3fa5418170a458832b3d6075107
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3040844
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Auto-Submit: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75809}

The x64 binary will work with Rosetta, but not requiring
Rosetta is nicer.

Change-Id: I34f9e5304022c33ffd3bac5ae881bd4d94681356
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3038529
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Mark Mentovai <mark@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75808}

Intel Optimization Manual update the suggestion for code alignment from 16B to 16B(for codes in legacy decoded pipeline) and 64B (for codes in Decoded Icache).

Since the loop often goes to the Decoded Icache, so align the loop header at 64B.

Change-Id: I1092e6dd5ea5937d5512865ce847ee00d1e8cb21
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3017311
Commit-Queue: Hao A Xu <hao.a.xu@intel.com>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75807}

Bug: chromium:1066980
Change-Id: I5c5e34b970a3b7a87abbec23110588518e99f6af
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3036345
Auto-Submit: Peter Kasting <pkasting@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75806}

.. instead of handles and update all uses. Likewise with
ElementAccessInfo. Essentially, this creates the needed refs up-front
and removes useless MakeRef calls from PAI users.

Bug: v8:7790, v8:11671
Change-Id: I175e77dcca27760101606587de615e3497e68c68
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3030701
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75805}

.. and explicitly mark behavior through tags/naming conventions:

 // This method is never called when concurrent inlining is enabled.
 void SerializeFoo(NotConcurrentInliningTag);

 // This method is thread-safe and may be called at any time.
 void CacheBar();

It turns out that all our remaining SerializeFoo methods are already
either of the former or latter category and thus do not block removal
of the serialization phase for concurrent inlining.

Bug: v8:7790
Change-Id: If8f3bc2e407bc2824f83bfcd1f520f3b14dc58ec
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3026709
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75804}

- Remove ResizableArrayBuffer / GrowableSharedArrayBuffer constructors,
use options bags
- Add AB.prototype.resizable and SAB.prototype.growable
- Update receiver checks in (S?)AB.prototype methods

Previous try: https://chromium-review.googlesource.com/c/v8/v8/+/3021174

Bug: v8:11111
Change-Id: Ib4e98aa987826fd01bfdcf7688310ec0665f33ca
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3035770
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75803}

GC may change heap state and make this dependency fail. That's okay -
it passed once before, meaning that compilation saw a self-consistent
JSFunctionRef state.

Bug: chromium:1230930
Change-Id: I367b10e4aa88101f1ca83a46f596c5f289f6cab2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3040838
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75802}

An object got allocated as part of a parameter expression, which may
have caused GC issues.

R=bmeurer@chromium.org

Bug: chromium:1230041
Change-Id: I94537db7d0be5200049fbc6bd3eda0d49b6d7c17
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3038525Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75801}

Rolling v8/third_party/google_benchmark/src: https://chromium.googlesource.com/external/github.com/google/benchmark/+log/e451e50..ab74ae5

downgrade warnings for googletest (#1203) (Dominic Hamon)
https://chromium.googlesource.com/external/github.com/google/benchmark/+/ab74ae5

Add wheel and sdist building action to GH Workflow (#1180) (Nicholas Junge)
https://chromium.googlesource.com/external/github.com/google/benchmark/+/9433793

TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com,mlippautz@chromium.org

Change-Id: I6c21e4b3864403e82bb3f997b192ffdb4275ae8a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3040127Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#75800}

This reverts commit 3847b33f.

Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux%20-%20vtunejit/43006/overview

Original change's description:
> Update V8 DEPS.
>
> Rolling v8/base/trace_event/common: https://chromium.googlesource.com/chromium/src/base/trace_event/common/+log/d5bb24e..d41864d
>
> Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/fd86d60..33763d1
>
> Rolling v8/buildtools/linux64: git_revision:b2d77ab1373192d1532af94b68fb8bab727b0e5b..git_revision:61a0153b5e60f11100a04e51393cae15268d1ee3
>
> Rolling v8/buildtools/third_party/libc++abi/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi/+log/7d5c92f..e8bf577
>
> Rolling v8/third_party/aemu-linux-x64: eghzU3LI6jsGYPkSzAoCDHeiVyaydZjwxB5kjkPImaMC..XSfC0vpqwj2Qzz0hAfMHYCCe5KDFiXqzb4M3U-cT6i4C
>
> Rolling v8/third_party/logdog/logdog: https://chromium.googlesource.com/infra/luci/luci-py/client/libs/logdog/+log/88ab863..17ec234
>
> Rolling v8/tools/luci-go: git_revision:d10ff2af1182ccaad573bc5acb84a36f4c280876..git_revision:6387586e5b3279aebdf22bdab7ae619dbc156b66
>
> Rolling v8/tools/luci-go: git_revision:d10ff2af1182ccaad573bc5acb84a36f4c280876..git_revision:6387586e5b3279aebdf22bdab7ae619dbc156b66
>
> Rolling v8/tools/luci-go: git_revision:d10ff2af1182ccaad573bc5acb84a36f4c280876..git_revision:6387586e5b3279aebdf22bdab7ae619dbc156b66
>
> TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com
>
> Change-Id: Icb2300e3fddbb5c8550312216de5daedde164221
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3040126
> Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
> Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
> Cr-Commit-Position: refs/heads/master@{#75797}

Change-Id: I30319935c00a5b2b438a2e40827ef0e3988bfd70
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3040840Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75799}

This reverts commit 431fff66.

Reason for revert: Causes link error in chrome: https://ci.chromium.org/ui/p/chromium/builders/ci/Linux%20ChromiumOS%20MSan%20Builder/24667/overview

Original change's description:
> [traphandler] Add simulator support
>
> This prepares the trap handler to support being used from simulators.
> Modifications to the arm64 simulator will be done in a follow-up CL. For
> now, the trap handler will be registered but not used in Wasm (we emit
> explicit bounds checks instead, as before).
>
> The implementation uses inline assembly, so it is only available on x64
> POSIX systems for now. This is the main platform we use for testing and
> for fuzzing, so it should give us the test coverage we need. If needed,
> inline assembly for other platforms can be added later.
> The new code will be executed by the existing arm64 simulator bots, e.g.
> "V8 Linux - arm64 - sim".
>
> R=​ahaas@chromium.org, mseaborn@chromium.org
>
> Bug: v8:11955
> Change-Id: Idc50291c704d9dea902ae0098e5309f19055816c
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3011160
> Commit-Queue: Clemens Backes <clemensb@chromium.org>
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#75780}

Bug: v8:11955
Change-Id: I74d2e41864fc515bd9727898f12ec1498b97ee62
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3040839
Auto-Submit: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#75798}

Rolling v8/base/trace_event/common: https://chromium.googlesource.com/chromium/src/base/trace_event/common/+log/d5bb24e..d41864d

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/fd86d60..33763d1

Rolling v8/buildtools/linux64: git_revision:b2d77ab1373192d1532af94b68fb8bab727b0e5b..git_revision:61a0153b5e60f11100a04e51393cae15268d1ee3

Rolling v8/buildtools/third_party/libc++abi/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi/+log/7d5c92f..e8bf577

Rolling v8/third_party/aemu-linux-x64: eghzU3LI6jsGYPkSzAoCDHeiVyaydZjwxB5kjkPImaMC..XSfC0vpqwj2Qzz0hAfMHYCCe5KDFiXqzb4M3U-cT6i4C

Rolling v8/third_party/logdog/logdog: https://chromium.googlesource.com/infra/luci/luci-py/client/libs/logdog/+log/88ab863..17ec234

Rolling v8/tools/luci-go: git_revision:d10ff2af1182ccaad573bc5acb84a36f4c280876..git_revision:6387586e5b3279aebdf22bdab7ae619dbc156b66

Rolling v8/tools/luci-go: git_revision:d10ff2af1182ccaad573bc5acb84a36f4c280876..git_revision:6387586e5b3279aebdf22bdab7ae619dbc156b66

Rolling v8/tools/luci-go: git_revision:d10ff2af1182ccaad573bc5acb84a36f4c280876..git_revision:6387586e5b3279aebdf22bdab7ae619dbc156b66

TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: Icb2300e3fddbb5c8550312216de5daedde164221
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3040126Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#75797}

I've noticed a few places where class fields as defined in Torque have
different names than the corresponding accessors in the C++ class. I
think they should match. Most of this change is just mechanically
updating the various places that use k##Field##Offset for those fields.

Change-Id: I8ba52aed7f6a1cd6b2d71158f71150b66c2c0da0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3027263
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75796}

Change-Id: Id3bd334dcd7ee028d2843b7ab4dd616d48afb947
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3038531Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#75795}

Change-Id: I61d07f61a344422a2048530a0497a2dc1a17b640
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3038252Reviewed-by: Milad Fa <mfarazma@redhat.com>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/master@{#75794}

On Aix, thread_cputime and clock_gettime (with CLOCK_THREAD_CPUTIME_ID)
can both be used to get time consumed by a thread. However,
thread_cputime is preferable, as it is has better resolution
(nanoseconds vs 10ms for clock_gettime).

Change-Id: I8a698f85defa011f6ed1eb5f47a6dbd4e21d1f67
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3036281
Commit-Queue: Vasili Skurydzin <vasili.skurydzin@ibm.com>
Reviewed-by: Milad Fa <mfarazma@redhat.com>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75793}

Bug: v8:9974
Change-Id: I801f55687808bb5bd0c1ad19f37cd97264889962
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3035087Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75792}

Change-Id: I643bca82ee86d15e6cc65ab8856fb8b4bf5fd8e2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3038247Reviewed-by: Milad Fa <mfarazma@redhat.com>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/master@{#75791}

Bug: v8:7790
Change-Id: I5d9815f479bc009d280595cf0dac75dea17c3738
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3024339Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75790}

This wraps up the transition away from kSerialized ref kinds.

Since JSFunctionRef is a complex type, we don't attempt full
consistency on the background thread. Instead, we serialize functions
on the background in a partially-racy manner, in which consistency
between different JSFunction fields is *not* guaranteed. Consistency
is later verified through a new compilation dependency kind during
finalization.

Bug: v8:7790, v8:12004
Change-Id: Ic2b78af9c9fe183c8769d323132bb304b151dc75
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2968404
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75789}

A stray 0xfeff character was accidentally added in
https://crrev.com/c/2952864, causing compilation problems on some
platforms. This CL removes it.

In case your diff looks empty, this is the change:
-<feff>// Copyright 2012 the V8 project authors. All rights reserved.
+// Copyright 2012 the V8 project authors. All rights reserved.

It was generated via
> git checkout -p 9c904a8f^ src/utils/alloca*.cc

R=leszeks@chromium.org

Bug: v8:11968
Change-Id: Ief3eba7875383c4a4c4238a4af47083304fc9782
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3038526Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75788}

... for visiting slots containing pointers to Code objects when
external code space mode is enabled.
These slots will require different handling once the code space is
moved out of the V8 heap cage.

This CL also introduces IsValidCodeObject() predicate similar to
IsValidHeapObject() for checking if given HeapObject is a valid Code
object.

Tbr: cbruni@chromium.org
Bug: v8:11880
Change-Id: I430940f4503cebfd2a6d387e44349810991a93e9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3032085Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75787}

Since {CodeSpaceWriteScope} is now used from cctests (since
https://crrev.com/c/3024150), its constructor and destructor need to be
exported.

R=jkummerow@chromium.org

Change-Id: I30627d632a9f4e4fde51bcb037bad69ceaedf6fd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3038062
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75786}

This is a reland of 0b091e9b

Some blink web tests have been temporarily disabled to allow landing
changes to the JS API in V8.

Original change's description:
> [wasm][eh] Rename Exception to Tag in the JS API
>
> See:
> https://github.com/WebAssembly/exception-handling/issues/159
>
> This change only does the rename where it's observable. This should also
> be renamed throughout the codebase for consistency and will be done
> separately.
>
> R=ahaas@chromium.org
>
> Bug: v8:8091
> Change-Id: Iec1118194981dfd33be6e30256b6e72d12143e1f
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3021172
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#75718}

Bug: v8:8091
Change-Id: Id5375b5287fff81b8e0096377a55ef63e6d9b985
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3035083
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75785}

The new flags implementation can handle these kinds of implications.

Change-Id: I97cb5adbe00e4c6d92d13b4378582b4035c36475
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3030707
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75784}

This is in preparation for baseline code flushing. After a deopt we
choose to execute baseline or bytecode based on whether
SharedFunctionInfo has any baseline code. With baseline code flushing,
it is possible that baseline code is flushed after this point and before
we start executing the unoptimized code (for ex: materializing objects).
To handle such situations this CL updates the BaselineEnterAt* builtins
to check for baseline code and restart either at baseline / bytecode.

Bug: v8:11947
Change-Id: I2084e38196c882f802d1186ff8c9ab881a35b16b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3030711
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Patrick Thier <pthier@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75783}

We add a struct type and array type to the fuzzed module.
Since the interpreter does not support wasm-gc,
we only do so if liftoff is used as a reference implementation.
Also, adding liftoff parameter to all GenerateModule definitions.

Bug: v8:11954
Change-Id: Ia8d2d7a8e1e12d375605f15d1393dd64f426607d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3024160Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Rakhim Khismet <khismet@google.com>
Cr-Commit-Position: refs/heads/master@{#75782}

This reverts commit 09b06657.

Reason for revert: Failures in TSan future: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20TSAN%20-%20no-concurrent-marking/4731/overview

Original change's description:
> [Turboprop] Turboprop is the future.
>
> Enable --turboprop in the --future config.
>
> BUG=v8:9684
>
> Change-Id: I405832c2ef0e1b80200a8b8090d7672461cd9e00
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3035762
> Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
> Reviewed-by: Mythri Alle <mythria@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#75779}

Bug: v8:9684
Change-Id: I4ae2a51174565b3e773f4b5cb0f0cb652ca20111
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3035776
Auto-Submit: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#75781}

This prepares the trap handler to support being used from simulators.
Modifications to the arm64 simulator will be done in a follow-up CL. For
now, the trap handler will be registered but not used in Wasm (we emit
explicit bounds checks instead, as before).

The implementation uses inline assembly, so it is only available on x64
POSIX systems for now. This is the main platform we use for testing and
for fuzzing, so it should give us the test coverage we need. If needed,
inline assembly for other platforms can be added later.
The new code will be executed by the existing arm64 simulator bots, e.g.
"V8 Linux - arm64 - sim".

R=ahaas@chromium.org, mseaborn@chromium.org

Bug: v8:11955
Change-Id: Idc50291c704d9dea902ae0098e5309f19055816c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3011160
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75780}

Enable --turboprop in the --future config.

BUG=v8:9684

Change-Id: I405832c2ef0e1b80200a8b8090d7672461cd9e00
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3035762
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75779}

This reverts commit 6207d61f.

Reason for revert: Incorrect implementation of the flag-not-on case.

Original change's description:
> [rab/gsab] Update to the new spec
>
> - Remove ResizableArrayBuffer / GrowableSharedArrayBuffer constructors,
> use options bags
> - Add AB.prototype.resizable and SAB.prototype.growable
> - Update receiver checks in (S?)AB.prototype methods
>
> Bug: v8:11111
> Change-Id: I4f8cb71a4c8e07483a3ffad83d98129da162b839
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3021174
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Shu-yu Guo <syg@chromium.org>
> Commit-Queue: Marja Hölttä <marja@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#75761}

Bug: v8:11111, chromium:1230129, chromium:1230408
No-Try: True
Tbr: mlippautz@chromium.org
Change-Id: I25aa10cb3dc20fdaeb45e6169fc01eec9a89f72c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3038061Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#75778}

An object got allocated as part of a parameter expression, which may
have caused GC issues.

Bug: chromium:1230041
Change-Id: I9a046fe36cd3b84e5df7b1400670b76e201ac026
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3035765Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75777}

Bug: v8:7790
Change-Id: I763fcf7049b1b0157ebf2bd026674e2f2b05ae9c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3008637
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75776}