Extend the flag parameter with a bit that decides if the input should
be converted (-0 to 0, and a string to the array index it represents).
Instruct redundancy elimination to never replace x with CheckBounds(x)
when this CheckBounds is of the converting kind.

Bug: chromium:1070892, chromium:1071743
Change-Id: I3125a6e267d56dae6bf6cb2f5f52d27ef65d7c79
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2157365
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67408}

Bug: v8:9909
Change-Id: I4bb2250125a1686295460813979196175c43c3b6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2165874
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67407}

This relands commit 1a38573f.

The original change used a sequence of instruction in the test that
could not be scalar lowered properly.

Original change's description:
> [arm] Change fp_fixed registers to be allocatable registers
>
> fp_fixed1 and fp_fixed2 are used by the S8x16Shuffle operation. They
> need to be allocatable, so that they can be correctly marked as fixed
> and spilled as required. The previous value of fp_fixed2, d29, is not in
> the list of allocatable double registers, and not marked as fixed
> appropriately.
>
> One fix could be to extend the list of allocatable double registers, but
> there is a comment there saying that the list is kept even-length to
> make stack alignment easier. So rather than messing with that, we
> instead change what fp_fixed1 and fp_fixed2 is, since S8x16Shuffle is
> the only user, this is a simpler change.
>
> Bug: chromium:1070078
> Change-Id: Id7de9b256bad2cfb11b0f06b66eb80a48ff7827c
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2161565
> Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
> Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
> Commit-Queue: Zhi An Ng <zhin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#67372}

Bug: chromium:1070078
Change-Id: I02bb4b3ad03817318cbd0ee706c5ef4f20c845ba
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2165867Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67406}

This patch has the following improvement on v8.browsing_mobile:
- total-main-thread:duration improved by 1.7%
- js:duration improved by 1.3%

Change-Id: I1cdf2c181bfd991b67f31c5c2f32e3c2f909c67e
Bug: v8:9684, v8:10431
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2149433
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67405}

Rolling v8/third_party/depot_tools:
https://chromium.googlesource.com/chromium/tools/depot_tools/+log/2b2aec6..dd2f620

The roller is blocked since a few weeks, but we need this roll now to
fix a depot_tools version mismatch between the presubmit bots on CQ and
on the waterfall.

R=zhin@chromium.org
TBR=machenbach@chromium.org,tmrts@chromium.org
NOTREECHECKS=true

Bug: chromium:1075618
Change-Id: Ib3e4b2ad4d79a1b35db1b320c7f7aa682b1eab90
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2166198
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67404}

The category name changed in https://crrev.com/c/2159690 (in
depot_tools), hence presubmit tests start failing whenever someone
touches a file which still refers to the old category.

R=zhin@chromium.org
TBR=machenbach@chromium.org

No-Try: true
No-Tree-Checks: true
Change-Id: I62813a42d63e512d421c4fe94229d04a56056978
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2165760Reviewed-by: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67403}

This is a CL in a string of CLs that template SimplifiedLowering.
It is done with the purpose of decoupling the implementation in the
three phases that SimplifiedLowering has (Propagate, Retype, Lower).

Template lower(), retype() and propagate(). Remove phase_ since it is
not needed anymore.

Template methods that used the old version of lower() and similar:
 * EnqueueInput
 * SetOutput
 * ProcessInput
 * VisitLeaf
 * VisitSelect
 * VisitPhi
 * VisitStateValues
 * VisitFrameState
 * VisitObjectState

Bug: v8:10424
Change-Id: Ic7c22104a77892303d825ad2d75e0eda56cca754
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2135638
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67402}

The ScriptDetails passed into a compilation may include a source
mappping URL. We should make sure that this does not overwrite an
existing source mapping URL on a script object, which will have been
inferred from source (and will take priority).

Bug: chromium:1011762
Change-Id: I5591005f86087b635764be980e00db76ed2a826d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2126912
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67401}

This reverts commit 7ae30cb7.

Reason for revert: https://ci.chromium.org/p/v8/builders/ci/V8%20Presubmit/10185

Original change's description:
> [heap] Skip memory reducer on AdjustAmountOfExternalAllocateMemory
> 
> V8 performs GC based on external memory limit. Additionally triggering
> memory reducing GCs may be problematic for large heaps and increases
> the chances of multiple V8 isolates performing GCs after
> IsolateInBackgroundNotification.
> 
> Bug: chromium:1072746
> 
> Change-Id: I7649a176504803ba666e6367b008593bbcfe6312
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2159488
> Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Hannes Payer <hpayer@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#67398}

TBR=ulan@chromium.org,hpayer@chromium.org,mlippautz@chromium.org

Change-Id: I008b1a0db2b4902190a6fa7e0861b5366f25b7fd
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:1072746
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2168113Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67400}

This reverts commit 14ebea15.

Reason for revert: CountUsage() can't be called without a C entry frame.

Note this counter was never hooked up in chromium. Besides removing the
problematic CountUsage() call, this CL also makes the call path more
robust against similar future issues by adding {gc,handle,js} disallow
scopes.

Original change's description:
> Add counter to track `Date::getTimezoneOffset()`.
>
> Bug: chromium:915620
> Change-Id: I75579080098632639b125b2252b3ab9615c7ea95
> Reviewed-on: https://chromium-review.googlesource.com/c/1379876
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Commit-Queue: Mike West <mkwst@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#58306}

TBR=yangguo@chromium.org,mkwst@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Tbr: ulan@chromium.org
Bug: chromium:915620,v8:10460
Change-Id: I2dd2e14947fe527de24ea644b4b33897f437a119
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2165790
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67399}

V8 performs GC based on external memory limit. Additionally triggering
memory reducing GCs may be problematic for large heaps and increases
the chances of multiple V8 isolates performing GCs after
IsolateInBackgroundNotification.

Bug: chromium:1072746

Change-Id: I7649a176504803ba666e6367b008593bbcfe6312
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2159488
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67398}

This reverts commit 313ad531.

Reason for revert: https://ci.chromium.org/p/v8/builders/ci/V8%20Presubmit/10183?

Original change's description:
> cppgc: Fix NOLINT exception
> 
> Bug: chromium:1056170
> Change-Id: I6a0fdd867caa7fc49ff586d878bc57b621260afc
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2167863
> Commit-Queue: Omer Katz <omerkatz@chromium.org>
> Commit-Queue: Anton Bikineev <bikineev@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Anton Bikineev <bikineev@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#67396}

TBR=mlippautz@chromium.org,bikineev@chromium.org,omerkatz@chromium.org

Change-Id: Icb016aec744160e84ee02148dba5b383403d27cc
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:1056170
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2167444Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67397}

Bug: chromium:1056170
Change-Id: I6a0fdd867caa7fc49ff586d878bc57b621260afc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2167863
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67396}

Bug: v8:8179, chromium:1074621
Change-Id: I5a5e01df1e91937451041cd945a8cc72868c175c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2166944Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67395}

This is a CL in a string of CLs that template SimplifiedLowering.
It is done with the purpose of decoupling the implementation in the
three phases that SimplifiedLowering has (Propagate, Retype, Lower).

Template VisitBinop (and Binop specific ones like
VisitSpeculativeInt32Binop), for which we need to template:
 * VisitSpeculativeAdditiveOp
 * VisitSpeculativeNumberModulus
 * VisitCheckBounds

Bug: v8:10424
Change-Id: I51764cb2e9ea9c2aa14829888d352e1947be77b5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2135637Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67394}

This CL introduces a new XX1-Form instruction as well as
separates VX-Form instructions to be used for implementing
simd Splat:

- I32x4
- I8x16
- I16x8

Change-Id: If81bbc87b45993ba6fa3e0146dd34496e247dd50
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2165866Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#67393}

Add Nico, remove Ben and Jaro who left V8.

Change-Id: I6bee6f45e4933f286d8672114fdb5b89115172d2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2167439
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67392}

This adds a test which I suspected would fail, but luckily it doesn't.
The idea is to catch a proper wasm exception in JS, then construct a new
exception, but set the catched exception as the prototype. My suspicion
was that we would still handle that new exception like a wasm exception,
since the `WasmExceptionGetTag` and `WasmExceptionGetValues` runtime
functions to a standard property lookup, which includes a prototype
walk.
Interestingly, the prototype walk is already skipped automatically when
loading private symbols, so the implementation already supports this
case correctly.
Let's still add this test to have coverage for this case.

R=jkummerow@chromium.org
CC=aheejin@chromium.org

Bug: v8:8091
Change-Id: Idf9944cf47f96cca38e9678e9200bf03a39ea126
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2167438Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67391}

This is a CL in a string of CLs that template SimplifiedLowering.
It is done with the purpose of decoupling the implementation in the
three phases that SimplifiedLowering has (Propagate, Retype, Lower).

Template:
 * VisitInputs
 * EnqueueInputs
 * Finish ProcessRemainingInputs, which ends up templating some VistXXX
   methods

Bug: v8:10424
Change-Id: I10a22ca9a2e472d3177e910c640507cab861846d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2135636Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67390}

Change-Id: I25618b4516fe90eb563bd6b02a8ff1c5081d8f15
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2165731Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67389}

Change-Id: I0ad1aaa128c544b44139da5fd7ad19e46c9e0adc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2165730Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67388}

- Add template specialization for DataRange::get<bool> to avoid undefined behavior of the template DataRange::get<T> which uses memcpy to assign the result variable

Change-Id: I129773251c063ea6863c4b2318dbc18574588d99
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2165728Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67387}

Bug: v8:10378
Change-Id: Ida53679c819e0a1427f31a31526142348510ca78
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2166906Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67386}

This is the first in a string of CLs that template SimplifiedLowering.
It is done with the purpose of decoupling the implementation in the
three phases that SimplifiedLowering has (Propagate, Retype, Lower).

Template:
 * VisitNodes
 * SetOutput
 * ProcessInput
 * ProcessRemainingInputs

Bug: v8:10424
Change-Id: I2d55148f5a4aafae5ec54d58a6690fc755806340
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2126916
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67385}

The call sequence for snapshot creation is quite involved. Details
should not be exposed outside src/snapshot. This CL pulls more details
of snapshot creation into Snapshot::Create, which is intended to be the
single chokepoint for API, tests, and other internal use.

Bug: v8:10416,chromium:1043058
Change-Id: I610293b5f70fec12e5513e5f803b5dd9118fd3b2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2150589
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67384}

WeakRef and FinalizationRegistry are intrinsically observably
nondeterministic because they depend on GC timing.

TBR=clemensb@chromium.org,machenbach@chromium.org

Bug: chromium:1074235
Change-Id: I8f28fdc46a3109218d69b106406860211ee9f258
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2165880Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67383}

Intl.DisplayNames was shipped in m81 and we now can remove the flag.
https://www.chromestatus.com/features/4965112605573120


Bug: v8:8703
Change-Id: Ib65d787c1871aa1da38a22fdb9e369c680c7d2c9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2163820
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67382}

I2S https://groups.google.com/a/chromium.org/forum/#!searchin/blink-dev/fractionalSecondDigits%7Csort:date/blink-dev/ISa0b6fOefY/pBlgkvZhBAAJ
I2P https://groups.google.com/a/chromium.org/forum/#!searchin/blink-dev/Intent$20to$20Implement$3A$20Add$20millisecondDigits$20option$20to$20Intl.DateTimeFormat%7Csort:date/blink-dev/WXd9nh03a1M/z7QeIMgrBgAJ
Chrome Status: https://www.chromestatus.com/feature/5704965743968256

Latest spec: https://github.com/tc39/ecma402/pull/347
LGTMs: bratell.d@gmail.com / chrishtr@chromium.org / mkwst@chromium.org

Bug: v8:9284
Change-Id: I4d2cca515ce65d41b38ebdef00b429fa873ea624
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2116989
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67381}

This reverts commit ff22ae80.

Reason for revert: new test fails on UBSAN
https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20UBSan/10831

Original change's description:
> [turbofan][csa] optimize Smi untagging better
> 
> - Introduce new operator variants for signed right-shifts with the
>   additional information that they always shift out zeros.
> - Use these new operators for Smi untagging.
> - Merge left-shifts with a preceding Smi-untagging shift.
> - Optimize comparisons of Smi-untagging shifts to operate on the
>   unshifted word.
> - Optimize 64bit comparisons of values expanded from 32bit to use
>   a 32bit comparison instead.
> - Change CodeStubAssembler::UntagSmi to first sign-extend and then
>   right-shift to enable better address computations for Smi indices.
> 
> Bug: v8:9962
> Change-Id: If91300f365e8f01457aebf0bd43bdf88b305c460
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2135734
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#67378}

TBR=neis@chromium.org,tebbi@chromium.org

Change-Id: I2617d7a44e5ae33fd79322d37c8b722c00162d22
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:9962
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2165873Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67380}

Change-Id: Ibbf0b2fd183d40445930c4197b92fd3b5bb2c40b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2158487Reviewed-by: Nebojša Ćirić <cira@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67379}

- Introduce new operator variants for signed right-shifts with the
  additional information that they always shift out zeros.
- Use these new operators for Smi untagging.
- Merge left-shifts with a preceding Smi-untagging shift.
- Optimize comparisons of Smi-untagging shifts to operate on the
  unshifted word.
- Optimize 64bit comparisons of values expanded from 32bit to use
  a 32bit comparison instead.
- Change CodeStubAssembler::UntagSmi to first sign-extend and then
  right-shift to enable better address computations for Smi indices.

Bug: v8:9962
Change-Id: If91300f365e8f01457aebf0bd43bdf88b305c460
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2135734
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67378}

Remove harmony-intl-{other-calendars,add-calendar-numbering-system}
https://www.chromestatus.com/features/5440249461211136

Bug: v8:9154
Change-Id: I8331d3cbd55e19ab1b1f983fef2e772fa7dc856c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2163816Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67377}

Normative spec change: https://github.com/tc39/ecma262/pull/1814

Bug: v8:10382
Change-Id: Ib17ece9f0c8f75702c828b5336e75cab5d173e5e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2163876
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67376}

This reverts commit 390ed4b9.

Reason for revert: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux/36714?


Original change's description:
> [arm] Change fp_fixed registers to be allocatable registers
> 
> fp_fixed1 and fp_fixed2 are used by the S8x16Shuffle operation. They
> need to be allocatable, so that they can be correctly marked as fixed
> and spilled as required. The previous value of fp_fixed2, d29, is not in
> the list of allocatable double registers, and not marked as fixed
> appropriately.
> 
> One fix could be to extend the list of allocatable double registers, but
> there is a comment there saying that the list is kept even-length to
> make stack alignment easier. So rather than messing with that, we
> instead change what fp_fixed1 and fp_fixed2 is, since S8x16Shuffle is
> the only user, this is a simpler change.
> 
> Bug: chromium:1070078
> Change-Id: Id7de9b256bad2cfb11b0f06b66eb80a48ff7827c
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2161565
> Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
> Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
> Commit-Queue: Zhi An Ng <zhin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#67372}

TBR=gdeepti@chromium.org,zhin@chromium.org,thibaudm@chromium.org

Change-Id: I00b4b34771b5832cc3d5fe6eac7aac506ec82d50
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:1070078
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2165865Reviewed-by: Francis McCabe <fgm@chromium.org>
Commit-Queue: Francis McCabe <fgm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67375}

Bug: chromium:1044942
Change-Id: If7caf955f5aab954a57c46aab7830830b1a64d04
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2162872Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67374}

We change a bunch of static_cast to a cleaner and shorter brace
initialization. I did not change every use of static_cast in the files,
just those that relate to SIMD, so as to not cause churn in the
diff/blame.

Change-Id: I7e90c1b81f09a1e7a3ae7c9825db4fdbd21db919
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2159737Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67373}

fp_fixed1 and fp_fixed2 are used by the S8x16Shuffle operation. They
need to be allocatable, so that they can be correctly marked as fixed
and spilled as required. The previous value of fp_fixed2, d29, is not in
the list of allocatable double registers, and not marked as fixed
appropriately.

One fix could be to extend the list of allocatable double registers, but
there is a comment there saying that the list is kept even-length to
make stack alignment easier. So rather than messing with that, we
instead change what fp_fixed1 and fp_fixed2 is, since S8x16Shuffle is
the only user, this is a simpler change.

Bug: chromium:1070078
Change-Id: Id7de9b256bad2cfb11b0f06b66eb80a48ff7827c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2161565Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67372}

error when "r7" is used (starting in commit d85b3877)

Bug: chromium:1073270
Change-Id: I7ec8112f170b98d2edaf92bc9341e738f8de07a3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2163435Reviewed-by: Nico Weber <thakis@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Nico Weber <thakis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67371}

If module bytes end in a prefix like 0xfc (numeric prefix), we read out
of bounds (pc + 1). So, if validate flag is set, check the length.

Bug: chromium:1073553
Change-Id: Ia9771419d01f2315723d19dd96630172b5a7a1f5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2161404Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67370}

Port c47d1631

R=zhiguo.zhou@intel.com, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I126b610d69234c0eaa5599978a5fd25223b657c5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2164945Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#67369}