If streaming compilation has been triggered on a worker, it can be
problematic to schedule a foreground task for the callback, since
workers might never return to the event queue. Hence, deliver the
callback in background. This is possible after this blink-side change:
https://crrev.com/c/1901592

R=ahaas@chromium.org
CC=​bbudge@chromium.org

Bug: chromium:1018029
Cq-Include-Trybots: luci.v8.try:v8_linux_blink_rel
Change-Id: I568c39cf97e94f6d1cec01090ece81e4521fa47c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1914199Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64946}

This reverts commit 6dad771a.

Reason for revert: Possible cause for purple Android builders.

Original change's description:
> [deps] Realign dependencies manually after auto-roller failure
> 
> Auto-roller fails to update the depency changes that were operated here:
> https://crrev.com/c/1824130/9/DEPS#717
> 
> Bug: chromium:1024152
> Change-Id: I9c0bdb5cc53b3faf18ef4ba8b262afaa20d6d0af
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1914200
> Commit-Queue: Liviu Rau <liviurau@chromium.org>
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#64936}

TBR=machenbach@chromium.org,hpayer@chromium.org,liviurau@chromium.org

Change-Id: I47fd9b0c75022e790745110bd8c0ce6ea73f084b
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:1024152
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1916199Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64945}

SIMD shifts was changed to use register in https://crrev.com/c/1722198
so all this code to deal with shift immediates can be removed.

SimdOp was also removed from the interface, so now Liftoff does not need
to implement it.

Bug: v8:9810
Change-Id: I845e28b4f5712ff188d68beea7121eebddebdd9e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1913506Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64944}

This is part of a general move of math builtins away from
builtins-math-gen.cc.

Change-Id: Ifb6e5d4779bb9e6f69ff7c58d09ca8fc94f4cc66
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1914210
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64943}

Bug: v8:9810
Change-Id: I5bf191a77c79c96f25eb97d0fbbc05d967af17fb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1906572Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64942}

This is in preparation for having unfixed slot sizes, where each push
operation will need to record the slot offset of the value.

Bug: v8:9909
Change-Id: I04734d4e67bbae70bdf4351f3afe9d0cc5f3f532
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1913500Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64941}

Change-Id: Ie2c7462e336de22aa1b91019a4e06bd44475b95c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1914003Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Auto-Submit: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/master@{#64940}

The gap is chosen unneccessarily large, leading to too early growing of
the assembler buffer.

R=mstarzinger@chromium.org

Change-Id: I9ddbe1d59929f2a76511cbc2d18c054fb8eafa74
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1914213Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64939}

Instead of always using {AssemblerBase::kMinimalBufferSize}, this CL
computes the expected code size per function compiled with Liftoff, and
uses that size to allocate the initial assembler buffer. This saves
reallocations especially for big functions.

R=jkummerow@chromium.org

Change-Id: I0031033c6be986f9d0d7bb10db0d213669044603
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1910951Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64938}

R=jkummerow@chromium.org
TEST=mjsunit/object-is

Change-Id: Ic933c71d8d7baa252644a69cd7816a8fc0ac85ab
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1914206Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64937}

Auto-roller fails to update the depency changes that were operated here:
https://crrev.com/c/1824130/9/DEPS#717

Bug: chromium:1024152
Change-Id: I9c0bdb5cc53b3faf18ef4ba8b262afaa20d6d0af
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1914200
Commit-Queue: Liviu Rau <liviurau@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64936}

This reverts commit 837556be.

Reason for revert: Breaks V8 Linux https://cr-buildbucket.appspot.com/build/8896896548394462912

Original change's description:
> [wasm] Improve test coverage of s128 exception handling.
> 
> This adds test coverage for the encoding and decoding of s128 values as
> part of an exception package. The encoding within an exception package
> is not specified (and not observable), but the full bit-pattern needs to
> survive an encoding/decoding round trip.
> 
> R=​clemensb@chromium.org
> TEST=mjsunit/wasm/exceptions-simd
> BUG=v8:8091
> 
> Change-Id: I4cf6c1f00c64757512f66d068640a7e772eb0127
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1905769
> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#64932}

TBR=mstarzinger@chromium.org,clemensb@chromium.org

Change-Id: I9276c6f6600a0f4e8a06dd1a7907cac25c761577
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:8091
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1914211Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64935}

Bug: v8:9810
Change-Id: I30c6265904c43ec86abc91a28d789fe5bfb22694
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1910106
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64934}

This reverts commit 1d493d31.

Reason for revert: Fails on clusterfuzz:
https://crbug.com/1024241

Original change's description:
> [foozzie] Refactor command abstraction
> 
> This moves code for running d8 into its own class. No functional
> changes intended.
> 
> No-Try: true
> Bug: chromium:1023091
> Change-Id: I7cbfeebd2911dc758322f89cf93666550f2956d9
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1906378
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Reviewed-by: Tamer Tas <tmrts@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#64928}

TBR=machenbach@chromium.org,tmrts@chromium.org,almuthanna@google.com,liviurau@chromium.org

Change-Id: I22aede0d2c8bd3cde48c45f4663b43caa4d60b65
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:1023091,chromium:1024241
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1914208Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64933}

This adds test coverage for the encoding and decoding of s128 values as
part of an exception package. The encoding within an exception package
is not specified (and not observable), but the full bit-pattern needs to
survive an encoding/decoding round trip.

R=clemensb@chromium.org
TEST=mjsunit/wasm/exceptions-simd
BUG=v8:8091

Change-Id: I4cf6c1f00c64757512f66d068640a7e772eb0127
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1905769
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64932}

Change-Id: I88adc527fea64c8ab6e9b32cfd8d40927e78da9a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1874087Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#64931}

This reverts commit 4d1b7af7.

Reason for revert: Broke clusterfuzz asan build

Original change's description:
> [turbofan][64] Remove Smi Untagging extra nodes for 31 bit smis
>
> There are some cases where we can ignore some truncations or
> change nodes for Smi Untagging, when we are using 31 bit smis
> in 64 bit architectures.
>
> Updated DecompressionOptimizer to match the new pattern.
>
> Change-Id: I89d34407e6f780ec0399cd427cf9d3e24ee5669a
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1889877
> Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#64909}

TBR=jgruber@chromium.org,tebbi@chromium.org,solanes@chromium.org

Bug: chromium:1023972
Change-Id: I7773455a970a11c345a020c1421c961314c8eb5c
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1914202
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64930}

When simulating bytecode, we store the current environment at the
site of the appropriate catch handler when entering a try range.
If the start of the try range is dead, we don't bother to store
an environment. However, generators can create alive regions
inside the try range. At such moments, we should recognize
we're in a try range and store the environment for the handler.

Bug: chromium:1017159
Change-Id: Icccc2ccf530895099bc62b97d9aaec8b97d5f4e8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1879247Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64929}

This moves code for running d8 into its own class. No functional
changes intended.

No-Try: true
Bug: chromium:1023091
Change-Id: I7cbfeebd2911dc758322f89cf93666550f2956d9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1906378
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Tamer Tas <tmrts@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64928}

Patch af608d4b https://crrev.com/c/1903969 removed some functions used on mips platform.

Original Commit Message:

  [utils] Remove unused classes and functions

  This removes dead classes and functions from utils.h.

Change-Id: I558de38370b51a3f7dd0ea9712d9c9dc47fa05a1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1909747
Auto-Submit: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64927}

After allocation of an object, we need to initialize it to make it safe
for the GC to see it. For complex objects like SharedFunctionInfo, this
initialization code is long and requires understanding of the object. So,
it makes sense for the initialization to live in the SharedFunctionInfo
code itself (as an Init method) rather than in the factory.

Aside from being a neat cleanup, this will allow us to share this
initialization logic between different allocation methods, as part of the
off-thread allocation project:
https://docs.google.com/document/d/1-_96kok0AcavkbcdqqZvpqt_2q-_XWAsAJwbRXlfwCo/

Bug: chromium:1011762
Change-Id: Ie276eb711423272f85abfeb3d88df1826a77b984
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1872402
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64926}

port 80dc6a33 https://crrev.com/c/1903445

Original Commit Message:

  [ptr-compr] Remove CompressedSigned MachineRepresentation

  Since smi-corrputing, TaggedSigned (aka known smis) only have the lower
  bits used. This renders CompressedSigned useless.

Change-Id: I3d656752bb81a09bd3985bd39ab9f656504f4da1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1911268
Auto-Submit: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64925}

Change-Id: I2b1cf44670e12b22bbf5115742e1d62dafec7304
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1912220
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Auto-Submit: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64924}

Bug: v8:9838
Change-Id: I8f1ca56517c4de097cab7e5fbd63ef3fe56d8f8c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1904120Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Joshua Litt <joshualitt@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64923}

This reverts commit d46bd852.

Reason for revert: I suspect this breaks the 'V8 Linux - predictable' bot. Specifically, 'typedarray-copywithin' has been failing since this landed. I am not exactly sure what is wrong from the tests error message, but see this link for more information:
https://logs.chromium.org/logs/v8/buildbucket/cr-buildbucket.appspot.com/8896980452133814304/+/steps/Check_-_d8__flakes_/0/logs/typedarray-copywithin/0

Original change's description:
> [ic] Migrate Code-based handlers to use data driven handler.
> 
> All usage of KeyedLoadIC_Slow, HasIC_Slow, StoreInArrayLiteralIC_Slow
> and KeyedStoreIC_Slow now use data driven handlers
> 
> Bug: v8:9779
> Change-Id: Idd888c5c10b462a5fe155ba0add36f95169bd76d
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1895988
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Commit-Queue: Suraj Sharma <surshar@microsoft.com>
> Cr-Commit-Position: refs/heads/master@{#64918}

TBR=rmcilroy@chromium.org,verwaest@chromium.org,surshar@microsoft.com

Change-Id: Id7c2b553f85b46048bed2c633b8bd24098f67147
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:9779
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1912092Reviewed-by: Joshua Litt <joshualitt@chromium.org>
Commit-Queue: Joshua Litt <joshualitt@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64922}

This allows us to use them in constexpr contexts, just as DCHECK.
There were some "constexpr" keywords missing, and we cannot have
explicit template instantiations for constexpr.

R=jkummerow@chromium.org

Bug: v8:9810
Change-Id: Iba7c6ed4a16ea5077324880f59f7f0e17d1757a4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1910956Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64921}

Optimizes BitVector::Iterator::Advance by using base::bits::CountTrailingZeros to
skip through bitvector. Also inlines Advance in the header. This reduces the
LiveRangeAnalysis phase of TurboFan/Prop by about 2-5% on Octane.

BUG=v8:9684

Change-Id: I3954d50d8ae9bd062a153e1fa2cb0abfd43d73eb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1910948
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64920}

This reverts commit f616b372.

Reason for revert: Might break incremental build: https://crbug.com/v8/9966

Original change's description:
> [build] Simplify snapshot target
> 
> Drops unnecessary visibility exception and uses minimum deps required
> for snapshot target.
> 
> Change-Id: I4098a443e9df31c25551540a0b6edfe9500f7bcd
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1910943
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#64907}

TBR=machenbach@chromium.org,jgruber@chromium.org

Change-Id: I01b087406e913faca42e21572d2fb62116c8c222
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:9966
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1912219Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64919}

All usage of KeyedLoadIC_Slow, HasIC_Slow, StoreInArrayLiteralIC_Slow
and KeyedStoreIC_Slow now use data driven handlers

Bug: v8:9779
Change-Id: Idd888c5c10b462a5fe155ba0add36f95169bd76d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1895988Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Suraj Sharma <surshar@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#64918}

Fixed: v8:9949
Change-Id: I3e27660f3f3e679988e780a050050ffd5ae9f584
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1910946Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Auto-Submit: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64917}

Out of the six masks (for 64 bit value), three can be skipped because
the values are known to be within certain bounds.

R=jkummerow@chromium.org

Bug: v8:9810
Change-Id: I50c3bf2d374b14456aa0cbec076e894f25779151
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1910110Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64916}

This reverts commit 75a61325.

Reason for revert: Fails arm64 gc stress (see bisect): https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20arm64%20-%20sim%20-%20gc%20stress/16691

Original change's description:
> [turbofan] Simplified LowerCheckedInt(32|64)ToTaggedSigned
> 
> Merge duplicate LowerCheckedInt32ToTaggedSigned code.
> 
> Skip ChangeInt32ToInt64:
> * In 32 bit archs, ChangeInt32ToInt64 is a no-op.
> * In 64 bit archs with 31 bit smis and smi corrupting enabled,
> ChangeInt32ToIntPtr can be skipped. This is because it would only
> change the upper bits, and those upper bits are not significant
> since we are smi-corrupting.
> 
> Change-Id: Ia217773fc7fccdd6227f66fbd600326ebbe9b86d
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1893193
> Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#64906}

TBR=jgruber@chromium.org,tebbi@chromium.org,solanes@chromium.org

Change-Id: I6586a6f226537acba988afa1be7454c2c3e6ee54
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1910955Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64915}

This allows the tests to continue running on the gc fuzzers while
staying compatible with the --force-slow-path flag being passed
randomly.

When run in slow_path variants these tests are no-ops, but that's
negligible as the tests are also fast without slow_path.

Change-Id: I461c47b669b163e1e1594ea1a941f63e90f2221e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1910947Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64914}

UMA data shows that we currently still allocate up to ten code spaces
per module. This is because the code size estimates are vastly off,
especially if both Liftoff and TurboFan is being used.
Also, code sizes differ by platform.

This CL adds more logic to the {EstimateNativeModuleCodeSize} function
to distinguish Liftoff and TurboFan, and to use different constants per
platform. A largeish comment explains how the numbers were generated,
and that they are an extreme over-generalization. However, without
further information about the module, this is the best we can do.
After all, being off even by a factor of two does not hurt too much, as
explained in the comment.

R=jkummerow@chromium.org

Change-Id: Icd178f5f4d0c7c8fa29b11b6eff7d14e64a1af1c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1910102
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64913}

This reverts commit b3d748a2.

Reason for revert: Regressions, see https://crbug.com/1023423.

Original change's description:
> [regalloc] Use an adaptive data structure for live sets
> 
> Live sets represent sets of live virtual registers at block entry and
> exit points. They are usually sparsely populated; for example, a sample
> taken from Octane2 shows 80% of sampled live sets with a fill ratio of
> 10% or less.
> 
> Prior to this CL, live sets were implemented as a statically-sized bit
> vector. This is fine for low-ish virtual register counts, but becomes
> wasteful at higher numbers.
> 
> This CL attempts to address this issue through an adaptive
> implementation. Small live sets remain bit vectors, while larger sets
> switch to a PersistentMap-based implementation. PersistentMap has very
> memory-efficient add/remove/copy operations.
> 
> Of course, with adaptive data structures we enter the territory of
> parameter fiddling. In this case, two parameters are used:
> kMaxSmallSetSize controls when to switch implementations, and
> kMaxDeletionsBeforePrune controls when pruning (= managing the # of
> deleted entries in the map) sets in.
> 
> On the (degenerate) test case from the linked bug, the register
> allocation zone shrinks from 1008MB to 475MB. For more realistic cases
> I expect savings on the order of 10s of KB.
> 
> Bug: v8:9574
> Change-Id: Id903bbe23f030b418e8d887ef4839c8d65126c52
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1891693
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#64872}

TBR=jgruber@chromium.org,tebbi@chromium.org,thibaudm@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:9574
Change-Id: I5d684198f9c4575a0c892076459cc2c20dce9aec
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1910944Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64912}

On platforms that do not require the far jump table for wasm calls (32
bit platforms currently), we do not need to include a far jump table
slot per wasm function. Other places already used the
{NumWasmFunctionsInFarJumpTable} helper function, but in the actual
allocation of the far jump table, it was missing.

R=jkummerow@chromium.org

Change-Id: I30734a1a25cc80e38c47abfd39059d56c9e5de57
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1910101Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64911}

We used the same random seed for all test cases of a fuzz session
for transitioning from choosing the flags on V8 side.

Since the grace period for stable bisection is over, we now use
the same random number generator throughout the fuzz session which
leads to a wider range of differently chosen flags.

TBR=tmrts@chromium.org

No-Try: true
Bug: chromium:813833
Change-Id: I07b9fe5de378c01344afd486bfd85fcbf0fcd8d2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1906377Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64910}

There are some cases where we can ignore some truncations or
change nodes for Smi Untagging, when we are using 31 bit smis
in 64 bit architectures.

Updated DecompressionOptimizer to match the new pattern.

Change-Id: I89d34407e6f780ec0399cd427cf9d3e24ee5669a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1889877
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64909}

Wasm code GC is on by default now.

R=machenbach@chromium.org

No-Try: true
Change-Id: Ib24e68f431876ecb91e7ae6ef6bc6cc08c2ea0c0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1910942Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64908}

Drops unnecessary visibility exception and uses minimum deps required
for snapshot target.

Change-Id: I4098a443e9df31c25551540a0b6edfe9500f7bcd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1910943Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64907}