Add ParkedScopes in d8 where it blocks.

Change-Id: I369fbdb361b4e357ff6ceef53fbf52f543979438
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3704903Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Auto-Submit: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81314}

Changes for TF instruction selector will be pasted
in the CL comments and will get applied once all
relaxed opcodes have been implemented in codegen/liftoff.

Change-Id: I231aa6fcc702a19704b7707331eba549c44232d7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3718393Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#81313}

This reverts commit c801d529.

Reason for revert: Broke perfetto builder:
https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20-%20debug%20-%20perfetto%20-%20builder/19620/overview

Original change's description:
> Refactor dynamic name to perfetto::DynamicString
>
> Recently perfetto introduced `perfetto::DynamicString` to allow clients
> to wrap dynamic event name strings. So that clients don't have to
> manually set event name inside trace lambda.
>
> With that:
>
> TRACE_EVENT("cat", nullptr, [&](EventContext ctx) {
>   ctx.event().set_name(dynamic_name_str)
> });
>
> is simplified to:
>
> TRACE_EVENT("cat", perfetto::DynamicString{dynamic_name_str});
>
> In this change we are making use of perfetto::DynamicString to pass
> dynamic event name string.
>
> Change-Id: Ic6b501df67409d6faa4d60b59095ad0e79ce585e
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3716473
> Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
> Commit-Queue: Mohit Saini <mohitms@google.com>
> Cr-Commit-Position: refs/heads/main@{#81298}

Change-Id: I06d1d6baa4413e53acfd7ac1e3163c5a6a15597c
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3718436
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Auto-Submit: Shu-yu Guo <syg@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#81312}

With recent changes, we resolve the promise of e.g. WebAssembly.compile
with the external API, and not the V8-internal API. The external API,
however, also handles microtasks, and depending on the MicrotasksPolicy,
may also execute microtasks immediately. This means the then-handler of
WebAssembly.compile may get executed within all the scopes that were
open when the external API was called. One of the open scopes is the
CancelableTask that finishes WebAssembly compilation.

The deadlock seen in the issue arises now when {quit()} gets called in
the then-handler of WebAssembly compilation.  The reason is that
{quit()} terminates the isolate, and during isolate termination, we wait
for all running CancelableTasks to finish. This, however, means a
deadlock, because the task that terminates the isolate is waiting for
itself to finish.

R=jkummerow@chrommium.org

Bug: chromium:1338150
Change-Id: I89243daffc76a456293519e24bfaad88277bb99a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3717990Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81311}

Also remove the unused AllocateTwoByteInternalizedString method.

Change-Id: I28e2c39a0196c48e56942efc263009aa3676cdec
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3714988Reviewed-by: Patrick Thier <pthier@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81310}

- "Remember graph layout" button
- Graph layout caching (almost 10x speed up)
- Camera position and zoom saving
- Refactored graph.ts, graph-layout.ts and graphmultiview.ts

Bug: v8:7327
Change-Id: I6a9db1ddbbaf506bff0b9d1c1e015f245c7c3974
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3714248
Commit-Queue: Danylo Boiko <danielboyko02@gmail.com>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81309}

Following change in https://github.com/WebAssembly/stringref/pull/22.

Bug: v8:12868
Change-Id: Ic7728bff5d03ab547cb26ff41d6966f95bfb6b62
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3717986
Commit-Queue: Andy Wingo <wingo@igalia.com>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81308}

SourceTextModule::ExecuteAsyncModule asserts the execution of
the module's async function to succeed without exception. However,
the problem is that TerminateExecution initiated by embedders is
breaking that assumption. The execution can be terminated with an
exception and the exception is not catchable by JavaScript.

The uncatchable exceptions during the async module evaluation need
to be raised to the embedder and not crash the process if possible.

Refs: https://github.com/nodejs/node/issues/43182

Change-Id: Ifc152428b95945b6b49a2f70ba35018cfc0ce40b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3696493Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Chengzhong Wu <legendecas@gmail.com>
Cr-Commit-Position: refs/heads/main@{#81307}

... which might fail during map configuration.

Bug: v8:12993, v8:12547
Change-Id: Ia57fe60abf4164d81a1352966f9d07016e882be9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3717993Reviewed-by: Patrick Thier <pthier@chromium.org>
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81306}

This CL also makes the PGO-related scripts executable.

Bug: v8:10470
Change-Id: Iedf81464ff591e641aae4f1f0aa37312875f2637
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3716482Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81305}

There seems to be a bug in gcc which causes link errors after
this CL: https://crrev.com/c/3714238

Issue seems to happen when using default template argument
of function type. A related bug report on bugzilla:
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105848

A workaround is to explicitly instantiate the template
for type <bool>.

Bug: v8:12991
Change-Id: I74db7d42d7b41e8af5d721b8c10130a7a0f2a999
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3718379
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81304}

- Check that internalized strings always have a computed hash value.
- Check that ThinStrings never have a forwarding index.
- Add a simple test of various property access with
  --always-use-string-forwarding-table to make the CF aware of the flag.

Change-Id: Ie047c9f635d5e0ed999208ec3379ef09c395b3f5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3717988Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81303}

Rolling v8/buildtools/linux64: git_revision:8883070fe77f9b484818e73e5892c08ca8a0fe7f..git_revision:ae474cc51337c3fe823f936371c5e92891e86b48

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/4ea19a6..c083518

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/39e4055..28190a2

Rolling v8/third_party/fuchsia-sdk/sdk: version:8.20220614.2.1..version:8.20220622.0.1

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I0654e6e87504c32d8f82c78afabd5d5eeb4b2ead
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3717741
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#81302}

Part 1:
Revert "PPC: skip slow tests on the ppc simulator"

This reverts commit 9dfac00a.

Part 2:
Make the slow test faster.

Bug: v8:11111
Change-Id: I8f0291098d29917fa65c4b5b28bf03cbdbe7ebc6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3714229
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81301}

If parsing fails in ScopeIterator::TryParseAndRetrieveScopes, the
intention was to fail silently (see the TODO there). However,
closure_scope_ being nullptr caused us to fail less silently.

This alone is not enough for fixing chromium:1316811 but the other
fixes needed are sufficiently unrelated.

Bug: chromium:1316811
Change-Id: I4eb0f5a13fa4da5fd5dd7ff76a1aa1a6a8ee4c63
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3716477Reviewed-by: Simon Zünd <szuend@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81300}

Bug: v8:11525
Change-Id: I5a29542032692c106bba14d010605e90954097b8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3706964
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81299}

Recently perfetto introduced `perfetto::DynamicString` to allow clients
to wrap dynamic event name strings. So that clients don't have to
manually set event name inside trace lambda.

With that:

TRACE_EVENT("cat", nullptr, [&](EventContext ctx) {
  ctx.event().set_name(dynamic_name_str)
});

is simplified to:

TRACE_EVENT("cat", perfetto::DynamicString{dynamic_name_str});

In this change we are making use of perfetto::DynamicString to pass
dynamic event name string.

Change-Id: Ic6b501df67409d6faa4d60b59095ad0e79ce585e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3716473Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Commit-Queue: Mohit Saini <mohitms@google.com>
Cr-Commit-Position: refs/heads/main@{#81298}

When the sandbox is enabled, an empty ArrayBuffer does not have a
nullptr backing store but instead points to a special EmptyBackingStore
pseudo-object inside the sandbox. This then requires special handling
during deserialization. This CL fixes two cases where this was not done
correctly, which caused some crashes when --stress-snapshot is active.

Bug: v8:10391
Change-Id: I412adace229b979b317864a3e8c12ed4c601b850
Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3716480Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Samuel Groß <saelo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81297}

0x65 is unavailable after
https://github.com/WebAssembly/gc/pull/295/files.

Bug: v8:12868
Change-Id: I8bdffb279c7e7cf72242c1565cf3401e5fa3f4d5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3717984
Commit-Queue: Andy Wingo <wingo@igalia.com>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81296}

This CL introduces a compile flag v8_enable_inner_pointer_resolution_osb
behind which lies the experimental implementation of the object start
bitmap. It disassociates the object start bitmap from the compile flag
v8_enable_conservative_stack_scanning. At the moment the former flag is
a prerequisite for the latter, as conservative stack scanning requires
some mechanism for inner pointer resolution and the object start bitmap
provides one such mechanism.

Bug: v8:12851
Change-Id: I24c6b389453fbaefc79ae50c34c5ec7a1bf23347
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3717322Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81295}

This should not be necessary, but something was failing previously
when removed. Now that we have the blocklist just merging once seems
to work.

Bug: v8:7700
Change-Id: I6534506263ae739f28043eef2dee7aba8f28eadf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3717983Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81294}

Check against copying around a TracedReference containing a zap value.

Bug: chromium:1322114
Change-Id: Ie97ecaf18931006516fc70be262829a267d1285c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3717323Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Auto-Submit: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81293}

This reverts commit 319e747a.

Reason for revert: it brought unexpected performance regressions.

Original change's description:
> [arm64] Increase code alignment to 64
>
> This should fix unexpected regressions which occur after builtins
> modifications.
>
> This CL affects alignment of embedded builtins on all configurations
> and Code header size only for non-pointer compression configuration.
>
> Bug: v8:11708
> Change-Id: I8058197c5b768a699e7f52446424013e86203b57
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3700392
> Commit-Queue: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#81113}

Bug: v8:11708
Change-Id: I238e799284d59e80dee244b240fe2a72c33e83b0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3716485
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#81292}

When a GC was requested via stack guard, we don't restart incremental
marking anymore on finding new objects but rather finish the GC cycle.

This regressed in https://crrev.com/c/3702801

Bug: v8:12985, chromium:1338071, v8:12775
Change-Id: Ie515cea6d5345ad1111a4fb9f042cffc52083453
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3716486Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81291}

This reverts commit 6ddf042f.

Revert did not fix the crasher.

Bug: v8:12967, chromium:1336850
Change-Id: I6d474644e3d94c14df17af6efa70747bae6ad652
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3716487Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81290}

This reverts commit 3366abb2.

Reason for revert: Speculative revert.

Original change's description:
> [heap] Add CHECKs for empty worklists in scavenger
>
> Shrink life range of worklists and add IsEmpty-CHECKs for them. Also
> move some logic into its own method ProcessChunksWithEmptyBuckets.
>
> Bug: chromium:1336158
> Change-Id: Ia2f34c824f5b1c5d61391a1a1243a46881040de1
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3704511
> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#81158}

Bug: chromium:1336158, chromium:1336850
Change-Id: Icb3207238f027d7ecca3292cac06544a243c7183
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3716488
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81289}

Bug: v8:12978
Change-Id: Ic8c73eafbd080714915268c8bcb9f2c30614b9b2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3711712
Auto-Submit: Adam Klein <adamk@chromium.org>
Reviewed-by: Frank Tang <ftang@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81288}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/7eec98d..3a562c9

Rolling v8/buildtools/linux64: git_revision:fcda46cf40422284f2e74b770da8b22f7f5d7006..git_revision:8883070fe77f9b484818e73e5892c08ca8a0fe7f

Rolling v8/buildtools/third_party/libc++abi/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi/+log/2dba7d2..92ef8d4

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/9a3c4bc..39e4055

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/f0cfef3..f575df1

Rolling v8/tools/luci-go: git_revision:df39938896c4603fb2a214a2430450a85d9cca81..git_revision:5d9b6ecf87cdfb928e1112d2838d26bc7ede2b48

Rolling v8/tools/luci-go: git_revision:df39938896c4603fb2a214a2430450a85d9cca81..git_revision:5d9b6ecf87cdfb928e1112d2838d26bc7ede2b48

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I53ed1615267c094189506a11ee7cd693fb27a59a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3717722
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#81287}

ICU 71 added new enum value UNUM_APPROXIMATELY_SIGN_FIELD
need to map to "approximatelySign"

We also discover a spec bug in
https://github.com/tc39/proposal-intl-numberformat-v3/issues/99

All the parts of formatRangeToParts should have a source "shared" for
the case that start and end are the same or very close.

Bug: chromium:1336865
Change-Id: I89142479989d3d2017d8cb89194db737710c38ed
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3717278Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81286}

Initial implementation for concurrent shared arrays. Current implementation exposes a `SharedArray` constructor, but its syntax might
change in the future.

Shared arrays can be shared across Isolates, have a fixed size, have no
prototype, have no constructor, and can only store primitives, shared structs and other shared arrays. With this CL shared structs are also allowed to store shared arrays.

The Backing storage for the SharedArrays is a `FixedArrayBase`. This CL introdces a new ElementKind: `SHARED_ARRAY_ELEMENTS`. The new kind should match the overall functionality of the `PACKED_SEALED_ELEMENTS` kind, but having it as standalone kind allows for easier branching in CSA and turbofan code.

Bug: v8:12547
Change-Id: I054a04624d4cf1f37bc26ae4b92b6fe33408538a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3585353Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Luis Fernando Pardo Sixtos <lpardosixtos@microsoft.com>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81285}

Rolling v8/third_party/icu: https://chromium.googlesource.com/chromium/deps/icu/+log/1658259..1da9170

Add "delimiters" resources needed by ulocdata_getDelimiter (Frank Tang)
https://chromium.googlesource.com/chromium/deps/icu/+/1da9170

Cherry-Pick PR2085 to fix numbering system resolution in NumberRangeFormatter (Frank Tang)
https://chromium.googlesource.com/chromium/deps/icu/+/6fff4cf

Cherry-Pick PR2096 to fix TimeZone name (Frank Tang)
https://chromium.googlesource.com/chromium/deps/icu/+/12de966

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com,ftang@chromium.org

Change-Id: Iaf6a2c2f1557331efbd17127a75925ebee829ca5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3714902Reviewed-by: Frank Tang <ftang@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81284}

Creates a feature (flag): transition from Done -> Wait
schedules a timer after 30s instead of 8s.
In local benchmark, this reduces by 50% cpu time spent doing
incremental marking and sweeping.

Bug: chromium:1330940
Change-Id: Iff9121243b88d0ed87d0b921e285ece52a83eaa9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3696168
Commit-Queue: Etienne Pierre-Doray <etiennep@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81283}

Bug: v8:12986
Change-Id: I5aa8dbc7f387856cc017ac9fd72ff57bc1d44af9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3716469Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81282}

This is a reland of commit 15f372af

Change since revert: TSan fix for tier-up budget reset.

Original change's description:
> [wasm] Fix tier-up budget tracking for recursive calls
>
> In the previous implementation, functions overwrote any budget
> decrements caused by recursive invocations of themselves, which
> could cause tier-up decisions for certain unlucky functions to
> get delayed unreasonably long.
> This patch avoids this by working with the on-instance value
> directly instead of caching it in a stack slot. That generates
> the same amount of Liftoff code as the status quo, but handles
> recursive functions properly.
> The "barista3" benchmark's peak performance improves by almost 20%.
>
> Bug: v8:12281
> Change-Id: I8b487a88da99c2d22e132f2cc72bdf36aa5f6e63
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3693710
> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#81249}

Bug: v8:12281,v8:12984
Change-Id: Ia6ce776848dc86617546ec514660c9a840484cb1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3716479Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81281}

This merges the separate opcode name definitions from wasm-opcodes-inl.h
into the main opcode-defining macros in wasm-opcodes.h. This is simpler
(avoids a bunch of fairly complex macros) and easier to update when we
add new opcodes in the future.
The tests become obsolete because they would simply repeat the implementation.

Change-Id: Ib6421da5670079e7725659c1f4008251f8ff7aed
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3714244
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81280}

The tier-up check in any backwards jumps in a br_table list cause the
instance to get cached if it wasn't cached before. When the branch is
not taken, we must not rely on this caching to have happened.
This is a variant of crbug.com/1314184.

Fixed: chromium:1338075
Change-Id: Id511e98f29ec13f0a38b5595ceb4a607c58b92a4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3716478
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81279}

This is likely just an issue in non-PGO builds, but it might skew
the results locally. JetStream2 seems to profit from this CL.

Change-Id: Id70030074dbabf2669fd42fb5fd9399e8692bed6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3716475
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81278}

This is a reland of commit 5b9401dd

Now also skip tests that require large amounts of virtual address space
if tsan is enabled as tsan may cause V8 to create a smaller sandbox
which is then unable to allocate the required amount of memory.

Original change's description:
> [sandbox] Also enable the sandbox outside of Chromium builds
>
> Drive-by: include the right header in sandboxed-pointer-inl.h and fix
> missing sandbox initialization in generate-bytecode-expectations.cc.
>
> Bug: v8:10391
> Change-Id: Ic39ba04b7c98eaa58ea3943189c23b297f581f5a
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3630082
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Commit-Queue: Samuel Groß <saelo@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#81216}

Bug: v8:10391
Change-Id: I141080fdf61a77ef48b22e353e3cfbc1ff816e5a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3716474Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Samuel Groß <saelo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81277}

When picking an arbitrary register for an input, prefer picking a
register that's already used as input. If there's no such register,
block the newly picked register.

Bug: v8:7700
Change-Id: I5926ae33482aa615060fef3500c1d2d6079090a4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3716476
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Auto-Submit: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81276}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/37b3bee..7eec98d

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/9ccf839..f0cfef3

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: Ie2cc0a1d0d801774ff76d377f5caf752ae17ab0c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3716545
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#81275}