Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/5ed00b7..f95480f

Rolling v8/buildtools/linux64: git_revision:5667cc61018864b17542e0baff8b790f245583b0..git_revision:a95c8a3ccc7de65eb740aa68a0d021cdc8550205

Rolling v8/third_party/aemu-linux-x64: 3rPTIlJKMg1Z5vCo_OfxOVIQD_pJ1XvXE7OcYDYNk8cC..RDM8t3fsvkJHrC_GtCTB1D0dnK1Xv1ZqnZI2DXJ6_4wC

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/3d2081b..13c4bd1

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/e9b86a1..db62979

TBR=v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: Ica14332bc7d6e3905a5f029670f224dbe683fbef
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2807159Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#73796}

This is a reland of e28dadc2

The original failure was due to a stale Win32 bot. The reland failure
was due to idempotent task deduplication returning the exact same
failure. See crbug/1196064

Original change's description:
> [ptr-cage] Rename IsolateRoot to PtrComprCageBase
>
> Currently, IsolateRoot is both the address of the Isolate root and the
> base address of the pointer compression reservation. This CL teases the
> two uses apart by renaming IsolateRoot to PtrComprCageBase.
>
> - In addition to V8_COMPRESS_POINTERS, add a
>   V8_COMPRESS_POINTERS_IN_ISOLATE_CAGE (vs SHARED_CAGE).
>
> - Rename GetIsolate* helpers to GetPtrComprCageBase. When
>   V8_COMPRESS_POINTERS_IN_ISOLATE_CAGE is true, the helpers remain as
>   aliases to GetPtrComprCageBase.
>
> - Rename kPtrComprIsolateRootAlignment to kPtrComprCageBaseAlignment.
>
> Bug: v8:11460
> Change-Id: I1d715f678ce9a0b5731895612ca14f56579b1c48
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2783672
> Commit-Queue: Shu-yu Guo <syg@chromium.org>
> Auto-Submit: Shu-yu Guo <syg@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#73790}

Bug: v8:11460
No-Try: true
Tbr: ishell@chromium.org
Tbr: rmcilroy@chromium.org
Change-Id: Id69311cf3267ebe1297fff159de0be48b15b65a3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2806546Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73795}

These functions have the same signature for both SSE and AVX versions.
We move them all into SharedTurboAssembler. Need to fixup a couple of
callsites, since now we use a template helper to call the right
function, whereas previously it was overloaded and there was implicit
conversions from int to uint8_t.

Bug: v8:11589
Change-Id: I8b4146ba1fb838f6b0d6f78f6b95495b8988fc4c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2800569
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73794}

This reverts commit 15c78b45.

Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Win32/32277/overview

Original change's description:
> Reland "[ptr-cage] Rename IsolateRoot to PtrComprCageBase"
>
> This is a reland of e28dadc2
>
> Relanding to see if Win32 rel failures from
> https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Win32/32275/overview
> were infra flakes. Could not repro on try bots.
>
> Original change's description:
> > [ptr-cage] Rename IsolateRoot to PtrComprCageBase
> >
> > Currently, IsolateRoot is both the address of the Isolate root and the
> > base address of the pointer compression reservation. This CL teases the
> > two uses apart by renaming IsolateRoot to PtrComprCageBase.
> >
> > - In addition to V8_COMPRESS_POINTERS, add a
> >   V8_COMPRESS_POINTERS_IN_ISOLATE_CAGE (vs SHARED_CAGE).
> >
> > - Rename GetIsolate* helpers to GetPtrComprCageBase. When
> >   V8_COMPRESS_POINTERS_IN_ISOLATE_CAGE is true, the helpers remain as
> >   aliases to GetPtrComprCageBase.
> >
> > - Rename kPtrComprIsolateRootAlignment to kPtrComprCageBaseAlignment.
> >
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2783672
> > Reviewed-by: Igor Sheludko <ishell@chromium.org>
> > Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
>
> No-Try: true
> Bug: v8:11460
> Tbr: ishell@chromium.org
> Tbr: rmcilroy@chromium.org
> Change-Id: I0a8c3a48999d6737c8c64d2c2703607f14f3fdd0
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2806169
> Reviewed-by: Shu-yu Guo <syg@chromium.org>
> Commit-Queue: Shu-yu Guo <syg@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#73792}

Bug: v8:11460
Change-Id: Ifee92d622c43a91c15f45ef94ff739237bd2024b
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2806545
Auto-Submit: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73793}

This is a reland of e28dadc2

Relanding to see if Win32 rel failures from
https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Win32/32275/overview
were infra flakes. Could not repro on try bots.

Original change's description:
> [ptr-cage] Rename IsolateRoot to PtrComprCageBase
>
> Currently, IsolateRoot is both the address of the Isolate root and the
> base address of the pointer compression reservation. This CL teases the
> two uses apart by renaming IsolateRoot to PtrComprCageBase.
>
> - In addition to V8_COMPRESS_POINTERS, add a
>   V8_COMPRESS_POINTERS_IN_ISOLATE_CAGE (vs SHARED_CAGE).
>
> - Rename GetIsolate* helpers to GetPtrComprCageBase. When
>   V8_COMPRESS_POINTERS_IN_ISOLATE_CAGE is true, the helpers remain as
>   aliases to GetPtrComprCageBase.
>
> - Rename kPtrComprIsolateRootAlignment to kPtrComprCageBaseAlignment.
>
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2783672
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>

No-Try: true
Bug: v8:11460
Tbr: ishell@chromium.org
Tbr: rmcilroy@chromium.org
Change-Id: I0a8c3a48999d6737c8c64d2c2703607f14f3fdd0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2806169Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73792}

This reverts commit e28dadc2.

Reason for revert: failed test262 tests;; see https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Win32/32275/steps?succeeded=true&debug=false

Original change's description:
> [ptr-cage] Rename IsolateRoot to PtrComprCageBase
>
> Currently, IsolateRoot is both the address of the Isolate root and the
> base address of the pointer compression reservation. This CL teases the
> two uses apart by renaming IsolateRoot to PtrComprCageBase.
>
> - In addition to V8_COMPRESS_POINTERS, add a
>   V8_COMPRESS_POINTERS_IN_ISOLATE_CAGE (vs SHARED_CAGE).
>
> - Rename GetIsolate* helpers to GetPtrComprCageBase. When
>   V8_COMPRESS_POINTERS_IN_ISOLATE_CAGE is true, the helpers remain as
>   aliases to GetPtrComprCageBase.
>
> - Rename kPtrComprIsolateRootAlignment to kPtrComprCageBaseAlignment.
>
> Bug: v8:11460
> Change-Id: I1d715f678ce9a0b5731895612ca14f56579b1c48
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2783672
> Commit-Queue: Shu-yu Guo <syg@chromium.org>
> Auto-Submit: Shu-yu Guo <syg@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#73790}

Bug: v8:11460
Change-Id: I19d0e28194fcdb28e89f129a7694ca3fe29fa17a
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2806168
Auto-Submit: Francis McCabe <fgm@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#73791}

Currently, IsolateRoot is both the address of the Isolate root and the
base address of the pointer compression reservation. This CL teases the
two uses apart by renaming IsolateRoot to PtrComprCageBase.

- In addition to V8_COMPRESS_POINTERS, add a
  V8_COMPRESS_POINTERS_IN_ISOLATE_CAGE (vs SHARED_CAGE).

- Rename GetIsolate* helpers to GetPtrComprCageBase. When
  V8_COMPRESS_POINTERS_IN_ISOLATE_CAGE is true, the helpers remain as
  aliases to GetPtrComprCageBase.

- Rename kPtrComprIsolateRootAlignment to kPtrComprCageBaseAlignment.

Bug: v8:11460
Change-Id: I1d715f678ce9a0b5731895612ca14f56579b1c48
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2783672
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Auto-Submit: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73790}

Bug: v8:11460
Change-Id: Ib9243c1ed3c0cf8f5effd6d9b321f92367ca92e7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2783671
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73789}

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/6412f1c..3d2081b

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/afd983d..e9b86a1

TBR=v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I5a3867322bae58d0e6e793ad910bab9ba42c62c6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2803837Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#73788}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/78cec98..5ed00b7

Rolling v8/third_party/aemu-linux-x64: mAkAmWQOG_3Yi-STt7JV1kfCSro_GtZ3D7vtsV21J6sC..3rPTIlJKMg1Z5vCo_OfxOVIQD_pJ1XvXE7OcYDYNk8cC

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/a6cbca9..6412f1c

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/9a94a95..da76875

Rolling v8/third_party/requests: https://chromium.googlesource.com/external/github.com/kennethreitz/requests/+log/bfb93d4..2c2138e

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/f7cbd24..afd983d

Rolling v8/tools/luci-go: git_revision:34ae8f13bb2156451655ec53b360942a502469df..git_revision:d6d24b11ecded4d89f3dfd1b2e5a0072a3d4ab15

Rolling v8/tools/luci-go: git_revision:34ae8f13bb2156451655ec53b360942a502469df..git_revision:d6d24b11ecded4d89f3dfd1b2e5a0072a3d4ab15

Rolling v8/tools/luci-go: git_revision:34ae8f13bb2156451655ec53b360942a502469df..git_revision:d6d24b11ecded4d89f3dfd1b2e5a0072a3d4ab15

TBR=v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I188881fdaddf911704ff3a8a94faf85fa7134ff3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2803911Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#73787}

Bug: chromium:1019938
Change-Id: I00fd990329887ca5d9b2aa7e992a7f5aa9df695b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2801170Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Auto-Submit: Chong Gu <chonggu@google.com>
Cr-Commit-Position: refs/heads/master@{#73786}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/b962cf8..78cec98

Rolling v8/buildtools/third_party/libc++abi/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi/+log/77b3c6b..a136a3b

Rolling v8/buildtools/third_party/libunwind/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind/+log/c9174a6..08f35c8

Rolling v8/third_party/aemu-linux-x64: WdwDIQC1_Ug_YFwjZ39W0oe0J4kXmVVQJba0vkkqNmsC..mAkAmWQOG_3Yi-STt7JV1kfCSro_GtZ3D7vtsV21J6sC

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/da171bf..a6cbca9

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/053a717..9a94a95

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/15a4172..f7cbd24

TBR=v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I8646723bf3a04d3825222e841bcaab78a5405f79
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2801751Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#73785}

Feedback from Microsoft partners indicates that it would be beneficial
to enable ETW stack-walking events by default.

This is difficult, because the --interpreted-frames-native-stack flag
comes with a significant perf degradation. Ideally, we would turn
this flag on dynamically, only when a ETW recorder is actively
triggering the provider. Unfortunately, the flag in its current state
cannot be enabled dynamically.

In light of this, we have decided to only flip the build flag.

Bug: v8:11043
Change-Id: Id883b9bcd635b41139450ab2d5c92511422525a3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2773792Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Sara Tang <sartang@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#73784}

- v8.runtime category should be disabled by default (duplicate entry)
- V8.HandleInterrupts is not a trace category name. It's only used as
  a trace name with v8.execute (unused entry)

Change-Id: I2528f575d00dd92b3a029e07f46f3ab3e36e1674
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2791563Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73783}

This includes the simulator, PPC64 Linux (little endian)
and PPC64 AIX (Big endian) running on P9.

Also enable the related simd tests for PPC64.

Qfma opcodes are added to the selector as part of the enablement.

Change-Id: Idf2bf2eaa9cee489e7315031976bc412358b9868
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2799942Reviewed-by: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#73782}

Change-Id: Iafe2b5635287fea5bd3c687b4ed897edbce4b0aa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2798978Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73781}

We are overwriting rhs when dst == rhs && dst != lhs. This is not a
problem on TurboFan because we specify unique registers and dst == lhs
in the instruction-selector.

The fix is to use the helper EmitSimdCommutativeBinOp, which will check
for dst == rhs (pmuludq is commutative).

Bug: v8:11612
Change-Id: I38c3a2b7f3c7bcf2d7e8faec1a67f0814d44ed20
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2798527
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73780}

This is a reland of 9a6567b4

The fix is to specialize float/double compare ops to fix msvc build.
On msvc builds, we were selecting the overloaded Equal/NotEqual (etc)
functions that takes float/double as arguments, but we intended to
refer to the function templates.

Original change's description:
> [wasm-simd] Move test helpers into wasm-simd-utils
>
> Move many test helpers into wasm-simd-utils. These helper functions can
> potentially be useful for relaxed-simd test in the future. I left behind
> simd specific test helpers, like load extend helpers, because those are
> for simd instructions.
>
> Bug: v8:11583,v8:11384
> Change-Id: Id9ed452b06eaf5c97a5dda174b53a37aede2a937
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2783295
> Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
> Commit-Queue: Zhi An Ng <zhin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#73675}

Bug: v8:11583
Bug: v8:11384
Change-Id: Id8895900af2688aee8c67eb937acca12c2d65944
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2792668Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73779}

Bug: v8:11589
Change-Id: I3d5c72105d682913e192bcec340f16267b5707d2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2797543Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73778}

Mostly a port of changes from chromium to support building from
directories other than out/Release or out/Debug.

Also moved tools/ninja/ninja_output.py to tools/vim/ninja_output.py to
be more consistent with chromium's layout.

Change-Id: I73199f10e48b6d9a229bef6af14b84b1ae6be1c2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2797536Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73777}

Change-Id: If3bcdafa9be33065b96bb5737b69a095ccdba559
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2799932Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#73776}

... in CallBoundFunction builtin.

Bug: chromium:1194358
Change-Id: I8ddd4fff39cf399d4af332cff8eddc40e217cfdb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2800111
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73775}

Change-Id: I92cb514b6ed09d1e691b78abe64066f95f5394ed
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2797285
Commit-Queue: Junliang Yan <junyan@redhat.com>
Reviewed-by: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#73774}

It's locked exclusively in the MapUpdater API methods, and locked
shared in ComputePropertyAccessInfo (CPAI).

This lock is a step towards running CPAI on background threads. The
simple lock portion is landed separately in this CL to get an early
signal on potential lock overhead perf impact.

The lock is implemented and used very conservatively at the moment:

- it's a single global lock (and not e.g. per-map).
- it's locked for the entire method call duration (instead of only in
  relevant parts).

Both points can potentially be improved in the future.

Bug: v8:7790
Change-Id: I073423497e01b4901101973387a19962f953a576
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2797286Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73773}

This fixes a bug introduced in crrev.com/c/2660995.
String.prototype.indexOf must clamp the `position` argument as per
step:

  7. Let start be the result of clamping pos between 0 and len.

Source: tc39.es/ecma262/#sec-string.prototype.indexof

Previously, this was done in the StringIndexOf builtin, but the recent
refactor changed builtin implementations to match the spec more
closely (i.e. to clamp in String.prototype.indexOf, not
StringIndexOf). This means we now have to clamp in
JSCallReducer::ReduceStringPrototypeIndexOf.

Tbr: neis@chromium.org
Bug: chromium:1194869
Change-Id: I5af8d41b50f4905453f03079e3ee6d46186536db
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2799359Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73772}

Main change: Remove CALL_INTERFACE macro. Use
CALL_INTERFACE_IF_REACHABLE or invoke interface directly instead.
Reasoning: Interfaces assume the Decoder is in a non-error state,
therefore CALL_INTERFACE invoked DCHECK(this->ok()). However,
CALL_INTERFACE (1) was sometimes erroneously called with an error in the
decoder, especially in cases where the error occurred inside immediate
argument parsing, (2) was always called in contexts where the current
control was guaranteed to be reachable. Due to (1) and (2),
CALL_INTERFACE is equivalent to CALL_INTERFACE_IF_REACHABLE (there are
a few exceptions where we can call the interface directly).

Additional change:
- Rename current_code_reachable_ to current_code_reachable_and_ok_
  to make its name reflect its meaning better.

Bug: chromium:1194784
Change-Id: I52055161a802e6981506b2a8dc8bb8233198aa2c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2799351
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73771}

.. and enable it on fyi bots. Skip one test in this variant due to
incompatible flags.

Bug: v8:7790
Change-Id: I5b8fdd8572435c6f4474c505464ff1a22c830757
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2797287
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73770}

... for primitive receivers. We should use initial map taken from
constructor function as a prototype chain lookup root instead of the
receiver map.

Bug: v8:11248
Change-Id: I91fde2f1102029654c7fdd8890d265ae8bad2791
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2797281Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73769}

It printed the pointer instead of the block and when run from gdb the
output was swallowed because there was no newline.

Change-Id: I55cdd3c791ff639d5b81e480aef77ac211490f77
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2799357
Commit-Queue: Georg Neis <neis@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73768}

Bug: v8:11604
Change-Id: Ic4aa3ae64aa9c9a60aceade9072a5ead1c894b7d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2799356
Commit-Queue: Georg Neis <neis@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73767}

That test is already slow on non-tsan bots, and we do not need TSan
coverage here. Thus keep it skipped, but update the comment.

R=mslekova@chromium.org

Fixed: v8:11610
No-Try: true
Change-Id: I1dedcc7b4d5736aca7c4cc0dc0526e4df7502440
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2797290Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73766}

Introduce two machine nodes for FABD and fold Float32/64 Abs,Sub
during instruction selection.

This gives ~1% speed improvement of the Bullet physics engine
compiled as wasm.

Change-Id: Ifd985538e6ebb280bc0eaf11b0ebfc687891cf91
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2786854Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Martyn Capewell <martyn.capewell@arm.com>
Cr-Commit-Position: refs/heads/master@{#73765}

Check directly whether there is runtime support for traps instead of
encoding this in the trap ID. For OOB traps we always use the actual
trap ID, so we always emitted the code that assumes runtime support,
which is not true in some cctests.

R=ahaas@chromium.org

Bug: v8:11587
Change-Id: I29df463561bcfb3452e75b209a70c4f4d9941044
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2797289Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73764}

This is a reland of e70cbb83

Moved the ConsString comparison logic out-of-line, both to make gcc
happy, and to reduce the size of the fast-path in IsEqualToImpl.

Original change's description:
> [string] Fix non-SeqStrings in IsEqualTo
>
> Bug: chromium:1193903
> Change-Id: I80704dd3cba5754779432356b20bd3ea99630291
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2794426
> Commit-Queue: Leszek Swirski <leszeks@chromium.org>
> Commit-Queue: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Auto-Submit: Leszek Swirski <leszeks@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#73746}

Bug: chromium:1193903
Change-Id: Iae6f078853438427e86d3ac68bcfed0712a85bf7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2797288
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73763}

Assembler::EmitVeneers has potential quadratic behavior, which appears
as hangs on chromecrash (see the linked bug). We iterate a list of
branches (unresolved_branches_), and for each branch iterate yet another
list of branches (the label link list in
RemoveBranchFromLabelLinkChain).

Ordering decisions increase the problem, by iterating in the outer loop
in ascending pc offset order, and in the inner loop (which removes the
branch from the linked list) in descending order.

This CL mostly refactors the outer loop:

- Instead of iterating over the whole unresolved_branches_ list, iterate
only the relevant part.
- Call RemoveBranchFromLabelLinkChain in descending pc offset order.
- Keep veneer emission in ascending pc offset order.

Bug: chromium:1162080
Change-Id: I77bb3d961c1b19ef1c31e777b640b213869bc1d6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2794435
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73762}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/d01f8cf..b962cf8

Rolling v8/third_party/aemu-linux-x64: 2zvSiyDoNIOA05-NfIzaaqrW2-5iI24Lkw3TJ8uGtFAC..WdwDIQC1_Ug_YFwjZ39W0oe0J4kXmVVQJba0vkkqNmsC

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/1178627..da171bf

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/f2cfd3d..053a717

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/ddfad9c..15a4172

Rolling v8/tools/luci-go: git_revision:84c2e8c00bcf3bcea776a4b4a62134921d8a177a..git_revision:34ae8f13bb2156451655ec53b360942a502469df

Rolling v8/tools/luci-go: git_revision:84c2e8c00bcf3bcea776a4b4a62134921d8a177a..git_revision:34ae8f13bb2156451655ec53b360942a502469df

Rolling v8/tools/luci-go: git_revision:84c2e8c00bcf3bcea776a4b4a62134921d8a177a..git_revision:34ae8f13bb2156451655ec53b360942a502469df

TBR=v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I8d229d890ade0268e5e37fd2b61635d8dcad3a46
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2798974Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#73761}

Bug: chromium:1194026
Change-Id: I3f92b6b36279cc71b97df20ce5a8b4c8ec2b6b8e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2794436Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73760}

This is a reland of de5f8614

Original change's description:
> [atomics] Fix critical section for Atomics.waitAsync
>
> Loading the value at the index for the futex wait should be protected by
> the waiterlist mutex for both sync and async waits.
>

TBR=marja@chromium.org

Bug: chromium:1194026
Change-Id: Id495a7778adf23a7d9dcd80f58179fe8d22fde2c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2798511Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73759}

Change-Id: Icec47ff9263368a0f061e71648e99ffbe5f1a0ea
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2798214Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#73758}

Change-Id: I1cd09c6743d1b94686140bf3cfe942fc87df2ee0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2798213Reviewed-by: Milad Fa <mfarazma@redhat.com>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/master@{#73757}