Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/4070870..e78873c

Rolling v8/third_party/aemu-linux-x64: LUFkW5GTwXItfKWgJt7kkk1hEf35ZueIbx73KwUN5K0C..zVhDYckO5pABaht9PlF8y1S_JicWTnMzwymJyNabQj4C

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/244d770..cc29098

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/92b3622..7c1d1f3

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: Ief975fc418bf135578e441c849e41f1635897980
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2422777Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#70039}

Instantiating a module that contains a function (exported) with a v128
in its signature is fine, but then later calling it will trap.

So v128 values are technically not callable from JS, but we can give it
a default argument of 0, and will later trap anyway. This is useful when
fuzzers generate functions with v128 in the signature of the main
function that we then later try to call.

Bug: chromium:1129068
Change-Id: I93f239a0355b8059e25b8bd5f1274d151d71ee11
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2419657
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70038}

StopRequest is removed in favor of:
COMPLETE_TASKS_FOR_TESTING -> JoinForTesting()
PREEMPT_TASKS -> Pause()
COMPLETE_ONGOING_TASKS now has the same behavior as PREEMPT_TASKS
- we should avoid waiting on the main thread as much as possible.

Change-Id: Icceeb4f0c0fda2ed234b2f26fe308b11410fcfb7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2376166
Commit-Queue: Etienne Pierre-Doray <etiennep@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70037}

Avoid resetting log flags as this could cause data races with
allocating background threads.

Bug: v8:10315
Change-Id: I7be01ff54e349652f182b944ed3f3366d1239ad7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2421814
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70036}

Test doesn't finish in 60s with --stress-concurrent-allocation, similar
to --stress-gc.

Bug: v8:10315
Change-Id: Id46231616387605ee49bfb54512828c0c8e84745
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2422000
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70035}

Test was asserting heap size before and after GC. With background
thread allocation those assertions might not hold.

Bug: v8:10315
Change-Id: I4f8c0f6d0b80040b3c89f85e801416abb29ed30e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2421999Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70034}

This CL introduces a fast path for transforming JavaScript
parameters to WebAssembly when calling an exported WebAssembly
function from JavaScript.

A transformation is considered fast when it does not require a call
to a built-in function, thus spilling registers for the call can be
avoided.

Bug: v8:10943
Change-Id: I5563bfdf77a68bef7ab8afc6d0f4ab2d2ea67bd4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2418857Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Vicky Kontoura <vkont@google.com>
Cr-Commit-Position: refs/heads/master@{#70033}

Changes:
- When checking if a table is a function table, check for subtyping to
  funcref instead of equality.
- Add WasmModuleObject argument to GetFunctionTableEntry.
- Implement WasmTableObject::Get/Set for all legal table types.
- Factor out SetFunctionTableEntry from WasmTableObject::Set.
- Write unittests and JS tests.

Bug: v8:9495
Change-Id: I4f0c7a7013f17c561afb3039c5e0811634a4d313
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2416387
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70032}

Change-Id: I65ed798968b602891e7f8d13c08c9065ab58d6d7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2418367Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#70031}

regarding --no-enable-experimental-regexp-engine

Bug: v8:10941
Change-Id: I9c3d9f8616b4ba9464ae699e1edf458c1f994952
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2421812
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70030}

Drive-by: add const modifier to some StructType fields

Bug: v8:7748
Change-Id: Ic0b4bb51ed01502f19d082c669683f69b85e76e7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2419015
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70029}

Remove the hack introduced in https://crrev.com/c/2412176, use the
existing {ValueTypeToConstantName} function instead.

R=ahaas@chromium.org

Bug: chromium:1127717
Change-Id: I4ac50346825d7b00ea8dadccd7798a273ae84499
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2421568Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70028}

Bug: v8:7790
Change-Id: Ibe41dcc3d1717326b8ce7bf3491bf32a8d0882b0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2421810
Commit-Queue: Georg Neis <neis@chromium.org>
Auto-Submit: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70027}

Assertions are implemented with the new ASSERTION instruction.  The nfa
interpreter evaluates the assertion based on the current context in the
subject string every time a thread executes ASSERTION.  This is
analogous to what re2 and rust/regex do.

Alternatives to this approach:
- The interpreter could calculate eagerly for all assertion types
  whether they are satisfied whenever the current input position is
  advanced.  This would make evaluating the ASSERTION instruction itself
  cheaper, but at the cost of making every advance in the input string
  more expensive.  I suspect this would be slower on average because
  assertions are not that common that we typically evaluate >= 2
  assertions at every input position.
- Assertions in a regexp could be desugared into CONSUME_RANGE
  instructions, so that no new instruction would be necessary.  For
  example, the word boundary assertion \b is satisfied at a given
  position/state if we have just consumed a word character and will
  consume a non-word character next, or vice-versa.  The tricky part
  about this is that the assertion itself should not consume input, so
  we'd have to split (automaton) states according to whether we've
  arrived at them via a word character or not.  The current compiler is
  not really equipped for this kind of transformation.  For {start,end}
  of {line,file} assertions, we'd need to introduce dummy characters
  indicating start/end of input (say, 0x10000 and 0x10001) which we feed
  to the interpreter before respectively after the actual input.
  I suspect that this approach wouldn't make much of a difference for
  NFA execution. It would likely speed up (lazy) DFA execution though
  because assertions would be dealt with in the fast path.

Cq-Include-Trybots: luci.v8.try:v8_linux64_fyi_rel_ng
Bug: v8:10765
Change-Id: Ic2012c943e0ce54eb8662789fb3d4c1b6cd8d606
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2398644
Commit-Queue: Martin Bidlingmaier <mbid@google.com>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70026}

Return MaybeHandle directly instead of converting to Handle first and
then back to MaybeHandle.

Bug: v8:10315
Change-Id: I7d0b67ea3931ad4eba48fc58d934d5722ff70905
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2418402Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70025}

emit_u32_to_intptr should zero-extend the low 32 bits of the src.

Bug: v8:10925
Change-Id: I48135da054d5f30d7aa4d67918c839debc7cdb2f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2418031Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/master@{#70024}

When a compaction space allocates a new code page, that pages needs to
be added to the Isolate::code_pages_ array used for stack unwinding.
Since the array is owned by the main thread, compaction thread cannot
directly modify it. Because of that code pages are added upon merging
of the compaction space to the main space in MergeLocalSpace.

The bug was that all code pages coming from the compaction space
were added to the code_pages_ array. However, some of the pages are
not newly allocated but merely borrowed from the main space.

This CL keeps track of all newly allocated paged by a compaction space.

Bug: v8:10900
Change-Id: Iff3ff5d608df60fb752d2e0ffc29e51f2d967936
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2418718
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70023}

Since the flag is enabled by default, it is more useful to have the
reverse implications so that disabling the flag is guaranteed to work.

Bug: v8:10315
Change-Id: I191c35682442925f3fed691460d074ba6715fc99
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2409498
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70022}

That DCHECK could fail even though GC was in the right state. It could
happen that the first load gets the old value NOT_IN_GC, since this
isn't TEAR_DOWN a second load needs to be performed. The load then
returns TEAR_DOWN but that doesn't match NOT_IN_GC either.

Fix this by only loading gc_state() once.

Bug: v8:10315
Change-Id: Ibcad540fa4d5f578c9936c472b294bbccebdc09a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2418719Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70021}

No-Try: true
Bug: v8:10942
Change-Id: I1c99c30ece27c67215629a0f5dbaa8d0aef9863a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2419014
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70020}

No-Try: true
Bug: chromium:1129854, v8:10937
Change-Id: I5e8f1afe582a10fe3d1bad989b197df01a557f90
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2418721
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70019}

For js frame, we want to display currently executing function.

Change-Id: If33b04279dafdf6e4834bfb6c7240e8e7e799fc7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2411483Reviewed-by: Seth Brenith <seth.brenith@microsoft.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#70018}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/ca471fc..4070870

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I368aa130c3f09f957cfab72c613e4e78a6e424be
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2420950Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#70017}

Test fails flakily with concurrent allocation. The test checks
heap size after GC, therefore simply disable concurrent allocation.

Bug: v8:10315
Change-Id: If0b7a5c12f23322f992c0c9568f7d3aa81f4a245
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2418715Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70016}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/d77db9e..ca471fc

Rolling v8/third_party/aemu-linux-x64: UncMpcoIeFj9FKkqbpkwnPCh8YmqHZcucJu-mi7jF1MC..LUFkW5GTwXItfKWgJt7kkk1hEf35ZueIbx73KwUN5K0C

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I60c55187182f5e19dd677838779757795e82df73
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2420451Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#70015}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/153ad0b..d77db9e

Rolling v8/third_party/aemu-linux-x64: QxDL1Bk85zKmALn9xHGhro_uZAytSTHjJ--QwZLaT7oC..UncMpcoIeFj9FKkqbpkwnPCh8YmqHZcucJu-mi7jF1MC

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/d949c91..244d770

Rolling v8/third_party/jinja2: https://chromium.googlesource.com/chromium/src/third_party/jinja2/+log/61cfe2a..a82a494

Rolling v8/tools/luci-go: git_revision:b022173f8069cf8001d4cf2a87ce7c5f0eae220f..git_revision:83c3df996b224edf5061840744395707a0e513e7

Rolling v8/tools/luci-go: git_revision:b022173f8069cf8001d4cf2a87ce7c5f0eae220f..git_revision:83c3df996b224edf5061840744395707a0e513e7

Rolling v8/tools/luci-go: git_revision:b022173f8069cf8001d4cf2a87ce7c5f0eae220f..git_revision:83c3df996b224edf5061840744395707a0e513e7

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I3305d8fa9f2a741f1f6fdd14b9754f4f42b76bc9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2419992Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#70014}

The DCHECK is only guaranteed to hold after checking that is_logging()
still returns true.

Bug: v8:10315
Change-Id: Ia43657faffa4c7eda70c95a446bee1389d08e6fd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2418713Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70013}

TBR=tebbi@chromium.org

Bug: v8:10577
Change-Id: I3367c31afb9f38f9151d3c5787a7838da4db327a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2418717Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70012}

This reverts commit c0564971.

Reason for revert: Speculative revert, ASAN is failing consistently:
https://ci.chromium.org/p/v8/builders/ci/V8%20Win64%20ASAN/15103

Original change's description:
> [parser] Use SmallVector(1) for DeclarationParsingResult::declarations
> 
> Typically we'll parse a single declaration when parsing variable declarations.
> Using on-stack storage rather than std::vector that requires malloc is much
> more efficient.
> 
> Change-Id: Id99515bb4ce7ea2dae46498f8f9f9d49c33c7353
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2418393
> Commit-Queue: Toon Verwaest <verwaest@chromium.org>
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69995}

TBR=leszeks@chromium.org,verwaest@chromium.org

Change-Id: I6e46c058f16c965e905f20b8df473a8fb22cc6cc
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2419037Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70011}

This reverts commit cfe9544a.

Reason for revert: Some spec tests fail:
https://ci.chromium.org/p/v8/builders/ci/V8%20Arm%20-%20debug/15933

Original change's description:
> [wasm-simd][scalar-lowering] Enable some spec tests
> 
> These tests can now be enabled as we implemented more scalar lowering
> support.
> 
> Bug: v8:10507
> Change-Id: Ida5f896300e074db079ec24720302729b0582d9d
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2411774
> Reviewed-by: Bill Budge <bbudge@chromium.org>
> Commit-Queue: Zhi An Ng <zhin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70006}

TBR=bbudge@chromium.org,zhin@chromium.org

Change-Id: Idb2da40178860f045ffab9ab5b2c8b1f2ebafcf6
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10507
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2419036Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70010}

This reverts commit 66e4c99c.

Reason for revert: Causes TSAN data races:
https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20TSAN%20-%20isolates/11350

Original change's description:
> [d8] Avoid recursive unhandled rejected Promise processing
> 
> Bug: chromium:1126309
> Change-Id: I9d9d33cd151ed8af5ee8af09b8957eae9df2dcb1
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2410059
> Commit-Queue: Toon Verwaest <verwaest@chromium.org>
> Auto-Submit: Camillo Bruni <cbruni@chromium.org>
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69986}

TBR=cbruni@chromium.org,verwaest@chromium.org

Change-Id: I39e6e40ade8d0fd8d3260d41513e68b4763753fe
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:1126309
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2419034Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70009}

Cast to int32_t after checking the range.

Bug: v8:10921

Cq-Include-Trybots: luci.v8.try:v8_linux64_ubsan_rel_ng,v8_linux64_asan_rel_ng,v8_linux64_tsan_isolates_rel_ng,v8_linux64_msan_rel_ng,v8_linux64_tsan_rel_ng,v8_mac64_asan_rel_ng,v8_win64_asan_rel_ng,v8_linux64_gcc_compile_dbg,v8_linux_gcc_compile_rel,v8_linux_gcc_rel_ng,v8_linux64_gc_stress_custom_snapshot_dbg_ng,v8_linux_arm64_gc_stress_dbg_ng,v8_linux_gc_stress_dbg_ng,v8_mac64_gc_stress_dbg_ng;luci.chromium.try:linux_chromium_ubsan_rel_ng

Change-Id: I9c3631a2f3aa34bc9c87a6f40a2888b38832978c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2414622
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70008}

Bug: v8:10904
Bug: chromium:1129706
Change-Id: I11a06ed3afbc9d11ad0956392758c22484a9ea1f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2418995Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70007}

These tests can now be enabled as we implemented more scalar lowering
support.

Bug: v8:10507
Change-Id: Ida5f896300e074db079ec24720302729b0582d9d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2411774Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70006}

vmin should return the default NaN if any input is a NaN (regardless of
the default NaN mode), so turn the default NaN mode, canonicalize, then
reset it.

Bug: v8:10835
Change-Id: Ia83c9fbcbc2070029f35bbd07cbb4abf857b594d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2416399Reviewed-by: Bill Budge <bbudge@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70005}

Implement f32x4 and f64x2 nearest, trunc, ceil, and floor for arm and
arm64. arm implementation will check for ARMv8 support, and bail out to
runtime call if not supported.

Bug: v8:10906
Change-Id: Ia473f63de3717d02d4cea2fc888befb3681e20aa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2415769Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70004}

This will allow minimorphic ICs the best chance of succeeding as they
only check the first FLAG_max_minimorphic_map_checks maps in the
feedback vector.

Bug: v8:10582
Change-Id: I1c78dcc8b6f7072b2563fdc8bf69b349a99c4bb5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2400340
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70003}

Change-Id: Ibd414806c5f8688486fec169d523876d0ef74c8f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2415047Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70002}

Changes:
- Rename IsSignatureEqual -> MatchesSignature for consistency
- Add WasmInstanceObject field to WasmTableObject.
- Improve some error messages related to tables in
  function-body-decoder-impl.h.
- Introduce WasmTable::IsValidTableType. Use it wherever appropriate.
- Overload equality operators in HeapType to work with
  HeapType::Representation.
- Rename DynamicTypeCheckRef -> TypecheckJSObject.
- Handle WasmCapiFunctions in TypecheckJSObject.
- Use TypecheckJSObject in WasmTableObject::IsValidElement.
- A few more minor improvements.

Bug: v8:9495
Change-Id: I2867dd3486d7c31717ac26b87a50e15cf2b898be
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2416491
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70001}

This is a reland of 2000aea5
Changes compared to last reland:
- Add rule in variants.py for --enable_experimental_regexp_engine.
- Make sure --abort-on-contradictory-flags works as well as --fuzzing
  to disable the checking for fuzzers, including for d8 flags.

Original change's description:
> Reland^4 "[flags] warn about contradictory flags"
>
> This is a reland of 0ba115e6
> Changes compared to last reland:
> - Fix Python code trying to write to expected_outcomes, which is now a
>   computed property.
> - Fix remaining place in d8.cc that ignored the --fuzzing flag.
> - Expect flag contradictions for --cache in code_serializer variant.
>
> Original change's description:
> > Reland^3 "[flags] warn about contradictory flags"
> >
> > Changes:
> > - Also allow second parameter influenced by --cache to be reassigned.
> > - Fix --stress-opt to only --always-opt in the last iteration as before.
> >
> > Original change's description:
> > > Reland^2 "[flags] warn about contradictory flags"
> > >
> > > This is a reland of d8f8a7e2
> > > Change compared to last reland:
> > > - Do not check for d8 flag contradictions in the presence of --fuzzing
> > > - Allow identical re-declaration of --cache=*
> > >
> > > Original change's description:
> > > > Reland "[flags] warn about contradictory flags"
> > > >
> > > > This is a reland of b8f91666
> > > > Difference to previous CL: Additional functionality to specify
> > > > incompatible flags based on GN variables and extra-flags, used
> > > > to fix the issues that came up on the waterfall.
> > > >
> > > > This also changes the rules regarding repeated flags: While
> > > > explicitly repeated flags are allowed for boolean values as long
> > > > as they are identical, repeated flags or explicit flags in the
> > > > presence of an active implication are disallowed for non-boolean
> > > > flags. The latter simplifies specifying conflict rules in
> > > > variants.py. Otherwise a rule like
> > > >
> > > > INCOMPATIBLE_FLAGS_PER_EXTRA_FLAG = {
> > > >   "--gc-interval=*": ["--gc-interval=*"],
> > > > }
> > > >
> > > > wouldn't work because specifying the same GC interval twice
> > > > wouldn't actually count as a conflict. This was an issue with
> > > > test/mjsunit/wasm/gc-buffer.js, which specifies
> > > > --gc-interval=500 exactly like the extra flag by the stress bot.
> > > >
> > > > Also, this now expands contradictory flags checking to d8 flags
> > > > for consistency.
> > > >
> > > > Original change's description:
> > > > > [flags] warn about contradictory flags
> > > > >
> > > > > Design Doc: https://docs.google.com/document/d/1lkvu8crkK7Ei39qjkPCFijpNyxWXsOktG9GB-7K34jM/
> > > > >
> > > > > Bug: v8:10577
> > > > > Change-Id: Ib9cfdffa401c48c895bf31caed5ee03545beddab
> > > > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154792
> > > > > Reviewed-by: Clemens Backes <clemensb@chromium.org>
> > > > > Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> > > > > Reviewed-by: Georg Neis <neis@chromium.org>
> > > > > Reviewed-by: Tamer Tas <tmrts@chromium.org>
> > > > > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > > > > Cr-Commit-Position: refs/heads/master@{#68168}
> > > >
> > > > Bug: v8:10577
> > > > Change-Id: I268e590ee18a535b13dee14eeb15ddd0a9ee8341
> > > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2235115
> > > > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > > > Reviewed-by: Tamer Tas <tmrts@chromium.org>
> > > > Reviewed-by: Clemens Backes <clemensb@chromium.org>
> > > > Reviewed-by: Georg Neis <neis@chromium.org>
> > > > Cr-Commit-Position: refs/heads/master@{#68989}
> > >
> > > Bug: v8:10577
> > > Change-Id: I31d2794d4f9ff630f3444210100c64d67d881276
> > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2339464
> > > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > > Reviewed-by: Clemens Backes <clemensb@chromium.org>
> > > Cr-Commit-Position: refs/heads/master@{#69339}
> >
> > Bug: v8:10577
> > Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_rel_ng
> > Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_isolates_rel_ng
> > Change-Id: I4a69dc57a102782cb453144323e3752ac8278624
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2352770
> > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> > Reviewed-by: Clemens Backes <clemensb@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#69433}
>
> Change-Id: Ib6d2aeb495210f581ac671221c265df58e8e5e70
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2398640
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Reviewed-by: Tamer Tas <tmrts@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69954}

Bug: v8:10577
TBR: clemensb@chromium.org, tmrts@chromium.org
Change-Id: Iab2d32cdcc2648934fc52255ccf3ae3ec9ca4d9b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2416386Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70000}