Change-Id: Ifdeda00ad55aa937a6a414e7e566e6640ccd83c0
Reviewed-on: https://chromium-review.googlesource.com/980936Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Daniel Clifford <danno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52278}

All conversions, reinterpretations, promotions and demotions are
implemented in Liftoff on MIPS.

Bug: v8:6600
Change-Id: I8920aea1cabdb59676c2c03fbb6de6156ebf0a62
Reviewed-on: https://chromium-review.googlesource.com/983554Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#52277}

We need to bypass shortcuts when executing accessors defined via FunctionTemplate
if we have break points at function entry.

R=ishell@chromium.org, jgruber@chromium.org

Bug: v8:7596
Change-Id: I0e1bdbbba0f7dcd0fb7fe90d35b18234d073fe94
Reviewed-on: https://chromium-review.googlesource.com/980316
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52276}

This reverts commit 61195eb6.

Reason for revert: breaks gc stress

Original change's description:
> [in-place weak refs] Replace the WeakCell potentially in Map::raw_transitions_.
> 
> BUG=v8:7308
> 
> Change-Id: I3021df5f6dfd02d85ed9fe1903f9c0850f92168d
> Reviewed-on: https://chromium-review.googlesource.com/972962
> Commit-Queue: Marja Hölttä <marja@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52272}

TBR=ulan@chromium.org,marja@chromium.org

Change-Id: I218b4d767da5095e5c5fee650567eb41343b347e
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7308
Reviewed-on: https://chromium-review.googlesource.com/983812Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52275}

Since embedded builtins will be disabled by default until after the
M67 branch point, let's enable them on two specific bots to at least
have some continued coverage.

release_x64_internal is a release build (with an internal snapshot).
release_x64_verify_csa is a pseudo-debug build with DEBUG set.

Bug: v8:6666
Change-Id: I7e81c24e3cefc6eeba5d6e5823d47ab52f3e5941
Reviewed-on: https://chromium-review.googlesource.com/983597Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52274}

This is a reland of 712b66da

Breakage is fixed on infra side by:
https://crrev.com/c/983417

Original change's description:
> [build] Remove legacy isolate configurations
>
> Bug: chromium:669910
> Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
> Change-Id: Iad58563fd4bb35501493f88af83362b1206a186c
> Reviewed-on: https://chromium-review.googlesource.com/982630
> Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52267}

Bug: chromium:669910
Change-Id: I6c06a1fe9587206aa4e983befb105327bfec4154
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/983573Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52273}

BUG=v8:7308

Change-Id: I3021df5f6dfd02d85ed9fe1903f9c0850f92168d
Reviewed-on: https://chromium-review.googlesource.com/972962
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52272}

TBR=sergiyb@chromium.org
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true

Bug: chromium:669910
Change-Id: I13ac32f3177677f4cf86602bee4038241933f38e
Reviewed-on: https://chromium-review.googlesource.com/983599Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52271}

Removes the deferred handle reference to the native context that
caused a cyclic dependency, which resulted in a memory leak. Instead of
keeping a reference to the native context, we use a phantom reference
to the WasmCompiledModule in order to get the context.
All foreground tasks are now registered in its own foreground task
manager, in order to make sure that we cancel all scheduled
foreground tasks as soon as the CompilationState is collected.

Bug: chromium:825741
Also-by: ahaas@chromium.org
Change-Id: Id69426a15280a14a1dc3ecd035415e7cfa61780b
Reviewed-on: https://chromium-review.googlesource.com/982622Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Kim-Anh Tran <kimanh@google.com>
Cr-Commit-Position: refs/heads/master@{#52270}

Change-Id: I3255e2ed0e370e019cf06e95aaf4fe2eb9ce5de1
Reviewed-on: https://chromium-review.googlesource.com/980760
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52269}

This reverts commit 712b66da.

Reason for revert:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20builder/builds/32049

Original change's description:
> [build] Remove legacy isolate configurations
> 
> Bug: chromium:669910
> Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
> Change-Id: Iad58563fd4bb35501493f88af83362b1206a186c
> Reviewed-on: https://chromium-review.googlesource.com/982630
> Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52267}

TBR=machenbach@chromium.org,yangguo@chromium.org,sergiyb@chromium.org,jgruber@chromium.org

Change-Id: I1955325b0b419b38d793ab205131de8de08cb50a
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:669910
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/983418Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52268}

Bug: chromium:669910
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: Iad58563fd4bb35501493f88af83362b1206a186c
Reviewed-on: https://chromium-review.googlesource.com/982630Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52267}

... to avoid breaking jumbo builds.

TBR=cbruni@chromium.org, rmcilroy@chromium.org

Bug: v8:6949, v8:7310, v8:7339
Change-Id: Ifa3ff13fb064fc8716f237f90c82834e41ed7440
Reviewed-on: https://chromium-review.googlesource.com/983392Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52266}

R=delphick@chromium.org

Change-Id: Iad00b090d1576a4a556e0971bbea3003a3aedb3f
Reviewed-on: https://chromium-review.googlesource.com/982631Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52265}

This results in a roughly 10KB reduction in snapshot_blob.bin on x64.

Change-Id: I72aab2db4e3b2a896f624c3c2afc1ac2e9610e23
Reviewed-on: https://chromium-review.googlesource.com/981911Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Kanghua Yu <kanghua.yu@intel.com>
Cr-Commit-Position: refs/heads/master@{#52264}

This prevents the flag from being set from e.g. Chromium. Instead, just use
relative paths like everything else in the build system.

Bug: chromium:825347, v8:7601

Change-Id: I080d9999b0b63bafc2c1978f70322eb48814a3b8
Reviewed-on: https://chromium-review.googlesource.com/980557
Commit-Queue: Raphael Kubo da Costa <raphael.kubo.da.costa@intel.com>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52263}

R=jarin@chromium.org

Bug: v8:7584
Change-Id: I299e49452d70891190490f44f2db299dfa7d864c
Reviewed-on: https://chromium-review.googlesource.com/981150Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52262}

This reverts commit 16aecc5d.

Reason for revert: Breaks several layout tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/22624

Original change's description:
> Ship BigInts
> 
> Intent to ship:
> https://groups.google.com/d/msg/v8-users/ShhW0Xewph0/1-OT9q0_DQAJ
> 
> Bug: v8:6791
> Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
> Change-Id: Ibcf5ac09c0099496ef2c6a3c23bef9f9e72658f1
> Reviewed-on: https://chromium-review.googlesource.com/981596
> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
> Reviewed-by: Mathias Bynens <mathias@chromium.org>
> Reviewed-by: Adam Klein <adamk@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52256}

TBR=adamk@chromium.org,jkummerow@chromium.org,neis@chromium.org,mathias@chromium.org

Change-Id: I32e9f32b501cb72aa364e89d5b2210c0861c68fc
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6791
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/983293Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52261}

Embedding builtins regresses speedometer by roughly 2-3%. Unship
them until M67 is branched.

Bug: v8:6666
Change-Id: Icaddc2cfbc0e52cd6999c648479cb008509a7bf2
Reviewed-on: https://chromium-review.googlesource.com/982053Reviewed-by: Michael Hablich <hablich@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52260}

Windows toolchain still needs relies on gyp.

R=sergiyb@chromium.org

Bug: v8:6105, chromium:826218
Change-Id: If7fba3cf986daa23a748681c3e6f1527af68b622
Reviewed-on: https://chromium-review.googlesource.com/980494Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52259}

Port 1ef6c437

Original Commit Message:

    This CL changes the poisoning in the interpreter to use the
    infrastructure used in the JIT.

    This does not change the original flag semantics:

    --branch-load-poisoning enables JIT mitigations as before.

    --untrusted-code-mitigation enables the interpreter mitigations
      (now realized using the compiler back-end), but does not enable
      the back-end based mitigations for the Javascript JIT. So in effect
      --untrusted-code-mitigation makes the CSA pipeline for bytecode handlers
      use the same mechanics (including changed register allocation) that
      --branch-load-poisoning enables for the JIT.

R=tebbi@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I46ee60541c48ad1e9c5ca1c2aac0d89d81c65333
Reviewed-on: https://chromium-review.googlesource.com/981935Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#52258}

Rolling v8/base/trace_event/common: https://chromium.googlesource.com/chromium/src/base/trace_event/common/+log/e0009bb..8c1ce86

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/9004761..cc2d66c

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/bffbf16..db4e76d

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/7d56ff9..82ac1c9

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: I19d5e07ee4b0ca5686848a13c30af31a14ed521b
Reviewed-on: https://chromium-review.googlesource.com/983112
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52257}

Intent to ship:
https://groups.google.com/d/msg/v8-users/ShhW0Xewph0/1-OT9q0_DQAJ

Bug: v8:6791
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: Ibcf5ac09c0099496ef2c6a3c23bef9f9e72658f1
Reviewed-on: https://chromium-review.googlesource.com/981596
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52256}

Add Cvtdq2ps macro.
Add pblendw/vpblendw.

Change-Id: I5c8232d17c220fbbb4845cbfad4ce765f0bbbb90
Reviewed-on: https://chromium-review.googlesource.com/961973
Commit-Queue: Jing Bao <jing.bao@intel.com>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52255}

This reverts commit 9732f422.

Reason for revert.

Original change's description:
> [inspector] queryObjects returns result
> 
> queryObjects command line API return array instead of sending
> inspectRequest notification.
> 
> R=​pfeldman@chromium.org
> 
> Bug: chromium:825349
> Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel
> Change-Id: Ie6c64419cb108b313c43b66eab533c5a7d5d9024
> Reviewed-on: https://chromium-review.googlesource.com/978464
> Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
> Reviewed-by: Pavel Feldman <pfeldman@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52197}

TBR=pfeldman@chromium.org,kozyatinskiy@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: chromium:825349
Change-Id: I90f93b96981d8218b9ad1dc0f4ebfb5a7cb671bc
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel
Reviewed-on: https://chromium-review.googlesource.com/982431Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52254}

Bug:v8:6532

Change-Id: I62e62f6584d1d42dc8af713b874daafa1f8d4436
Reviewed-on: https://chromium-review.googlesource.com/969991Reviewed-by: Ben Smith <binji@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52253}

When a wasm function has a large stack frame, the x64 code generator
performs the stack overflow check before constructing the frame. This
requires using the `address_of_real_stack_limit` external reference, as
well as the `ThrowWasmStackOverflow` runtime function.

`ThrowWasmStackOverflow` is called via a generated trampoline, but it is
not a builtin, so the serializer adds it to the `stub_lookup_` map. This
map is encoded by using a monotonically increasing `stub_id` that starts
at 0.

When the function is serialized, a stub is differentiated from a builtin
by which half of the `i32` bits is used, upper or lower. A stub only
uses the lower 16 bits and a builtin only uses the upper 16 bits.

The deserializer checks whether the lower 16 bits are 0; if so, it is
determined to be a builtin. But if the `stub_id` is 0, then it will be
confused with builtin 0 (`RecordWrite`). Calling the builtin instead of
the stub causes a crash.

This CL starts all `stub_id`s at 1, which prevents the builtin/stub
confusion.

There is an additional bug that is not fixed by this CL:
`ThrowWasmStackOverflow` shouldn't be called at all. Currently it is
called because `address_of_real_stack_limit` is a thread-local value
that is not properly relocated.

Bug: chromium:808848
Change-Id: I06b3e650ea58ad717dcc47a3716443e16582e711
Reviewed-on: https://chromium-review.googlesource.com/981687Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Ben Smith <binji@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52252}

Also annotate maps with the space, now that this can be RO_SPACE as well
as MAP_SPACE.

Bug: v8:7464
Change-Id: Id597b2195c179b38f93b0e1c6b2ce9ef04e4f0e4
Reviewed-on: https://chromium-review.googlesource.com/980554
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52251}

Change-Id: I7d5d9ff4d69628573586c1a8e5704d2b6009adc8
Reviewed-on: https://chromium-review.googlesource.com/980534Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52250}

Bug: v8:6949, v8:7310
Change-Id: I8647d385355f357e8825648d6da2757efdcbc6c2
Reviewed-on: https://chromium-review.googlesource.com/980496Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52249}

Change-Id: I41c3945d72116dd501bf34bafd8d21c205aed17c
Reviewed-on: https://chromium-review.googlesource.com/973445Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Sreten Kovacevic <sreten.kovacevic@mips.com>
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#52248}

This reduces time it takes for the compiled module to be reclaimed. It
switches the reference in question from a weak reference with finalizer
to a phantom reference, because the finalizer was only clearing the
reference by now anyways.

R=ahaas@chromium.org
BUG=chromium:824443

Change-Id: I51f0dbd487281184f82fd6c79fcf27514721b819
Reviewed-on: https://chromium-review.googlesource.com/978243
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52247}

This reverts commit 496d0596.

Reason for revert: https://logs.chromium.org/v/?s=chromium%2Fbb%2Fclient.v8%2FV8_Linux64_-_internal_snapshot%2F14705%2F%2B%2Frecipes%2Fsteps%2FCheck__flakes_%2F0%2Flogs%2FOutOfMemoryIneffectiv..%2F0

Original change's description:
> [heap] Detect ineffective GCs near the heap limit.
> 
> Currently V8 can enter CPU thrashing GC loop near the heap limit. In
> such cases it is better to trigger an out-of-memory failure earlier to
> avoid wasting CPU time and to avoid unresponsiveness.
> 
> This patch adds a mechanism for tracking consecutive ineffective GCs.
> A GC is considered ineffective if the heap size after the GC is still
> close to the heap limit and if the average mutator utilization dropped
> below a fixed threshold.
> 
> V8 execution is aborted after four consecutive ineffective GCs.
> 
> Bug: chromium:824214
> Change-Id: I647032707d49e5383e1317c5e7616dd57077ea32
> Reviewed-on: https://chromium-review.googlesource.com/978178
> Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Hannes Payer <hpayer@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52244}

TBR=ulan@chromium.org,hpayer@chromium.org

Change-Id: I267d247010a90224be60c27c83eeb37c3878fba5
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:824214
Reviewed-on: https://chromium-review.googlesource.com/982072Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52246}

Since the flags are used for more than just giving hints to the
compiler, the name isn't appropriate anymore.

Change-Id: I4b2f87a117490e7f1e1a693394e46633e751b444
Reviewed-on: https://chromium-review.googlesource.com/982012Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52245}

Currently V8 can enter CPU thrashing GC loop near the heap limit. In
such cases it is better to trigger an out-of-memory failure earlier to
avoid wasting CPU time and to avoid unresponsiveness.

This patch adds a mechanism for tracking consecutive ineffective GCs.
A GC is considered ineffective if the heap size after the GC is still
close to the heap limit and if the average mutator utilization dropped
below a fixed threshold.

V8 execution is aborted after four consecutive ineffective GCs.

Bug: chromium:824214
Change-Id: I647032707d49e5383e1317c5e7616dd57077ea32
Reviewed-on: https://chromium-review.googlesource.com/978178
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52244}

This CL changes the poisoning in the interpreter to use the
infrastructure used in the JIT.

This does not change the original flag semantics:

--branch-load-poisoning enables JIT mitigations as before.

--untrusted-code-mitigation enables the interpreter mitigations
  (now realized using the compiler back-end), but does not enable
  the back-end based mitigations for the Javascript JIT. So in effect
  --untrusted-code-mitigation makes the CSA pipeline for bytecode handlers
  use the same mechanics (including changed register allocation) that
  --branch-load-poisoning enables for the JIT.

Bug: chromium:798964
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel
Change-Id: If7f6852ae44e32e6e0ad508e9237f24dec7e5b27
Reviewed-on: https://chromium-review.googlesource.com/928881Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52243}

- Allow deserializer to add entries to the StringTable without
  causing a gc.

This is a reland of 868ed8ee

Original change's description:
> [runtime] Decrease StringTable shrink limit
>
> Given that we have not seen any regressions yet we're trying a more aggressive
> limit.
>
> Bug: chromium:818642, v8:5443
> Change-Id: Ic45001ed6c042fc31cbba0d417d5060d2de8fb3a
> Reviewed-on: https://chromium-review.googlesource.com/975126
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52145}

Bug: chromium:818642, v8:5443
Change-Id: I051c6a79e59ec40cf87cab5bf06c4c449f8113d0
Reviewed-on: https://chromium-review.googlesource.com/975643
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52242}

The instruction scheduler is not supported on these platforms.

Bug: v8:7577
Change-Id: If89494153407c6223e30d856dd0f3152eb0c5817
Reviewed-on: https://chromium-review.googlesource.com/973362Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Georgia Kouveli <georgia.kouveli@arm.com>
Cr-Commit-Position: refs/heads/master@{#52241}

Bug: v8:7310
Change-Id: Ic4a3c3326a1643d9a662a11ccdb75c8121587c71
Reviewed-on: https://chromium-review.googlesource.com/980943Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52240}

--cleanup-code-caches-at-gc flag was removed in
https://chromium.googlesource.com/v8/v8/+/b8b25e1c27b6634b764245671b5fcaacb19278bf,
rendering the test obsolete.

Change-Id: I34331d230102924899c89d3330379df51a489029
Reviewed-on: https://chromium-review.googlesource.com/980937Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Franziska Hinkelmann <franzih@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52239}