Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/00d8280..2123428

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/src/buildtools/+log/b0912f9..20b1d0f

Rolling v8/third_party/aemu-linux-x64: JANUSSL6vlpZwl7eeXT1Jv3TTKfhHXjW18WlDQyun4kC..WNXEl7yxDUmMN9Rkovz3EfBwNd26BEXmanIIz_jO2DgC

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/affd272..a532699

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/5974ca0..cd15203

Rolling v8/third_party/instrumented_libraries: https://chromium.googlesource.com/chromium/src/third_party/instrumented_libraries/+log/084aee0..4ae2535

Rolling v8/third_party/zlib: https://chromium.googlesource.com/chromium/src/third_party/zlib/+log/3e6d345..5ce08a7

Rolling v8/tools/luci-go: git_revision:d7393d163ecb11c44626b3b221f86efdd2861565..git_revision:bbac8f199026d706b08e53ca46d1a9560ae580d2

Rolling v8/tools/luci-go: git_revision:d7393d163ecb11c44626b3b221f86efdd2861565..git_revision:bbac8f199026d706b08e53ca46d1a9560ae580d2

Rolling v8/tools/luci-go: git_revision:d7393d163ecb11c44626b3b221f86efdd2861565..git_revision:bbac8f199026d706b08e53ca46d1a9560ae580d2

TBR=v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I4c2ade9ac20eb15d20bd469b888d67a4c3a67430
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2898781Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#74576}

Change-Id: I81ff7fca841015ebc8cee66546ab40efb3065731
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2892842Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Andrey Kosyakov <caseq@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74575}

This option is used for --stress-snapshot when sharing the RO heap. The
RO heap is shared, so deserializing non-startup snapshots need to ensure
they use the same RO object cache mapping as the startup snapshot.

Cq-Include-Trybots: luci.v8.try:v8_linux64_gc_stress_custom_snapshot_dbg_ng
Bug: v8:11750
Change-Id: Ia2baa24d5b7d494ef5b7ff3c9cbcee846881182e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2897945Reviewed-by: Dan Elphick <delphick@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74574}

wasm-scope-info requires SIMD, since it prints the value of the SIMD
value in scope. We skip it using statusfile when SIMD is not supported.

Change-Id: Id64e130a1c497bae95ec5e794ad05816f8c908e7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2893568Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74573}

This allows us to eliminate some boilerplate.

Bug: v8:7790
Change-Id: Id3a14f27621435ea4e7cbf8daf68b71da62e3f1f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2875209
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74572}

Bug: v8:7748
Change-Id: I9a4dad42f433ce0adf928461cf0db589df3d69e9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2897087
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74571}

This is to make space for new instructions, such as br_on_non_null.

Change-Id: Id631478a1c0da2c20efe81aabe755d5fda841dba
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2897086Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74570}

See https://github.com/WebAssembly/branch-hinting for a description of
the proposal.

Change-Id: Ib6e980fc20aa750decabdeb9e281f502c9fe84ed
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2784696
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74569}

Mimics the kArchStoreWithWriteBarrier store in generated code by having
a relaxed store to the same address, with the same value. This is done
in order for TSAN to see these stores from generated code.

Since it is done only for kArchStoreWithWriteBarrier TSAN will see
tagged stores only.

Bug: v8:7790, v8:11600

Change-Id: I275dd46f5556b3a095c416adc03f2f0ac5bde41c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2848470Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74568}

This CL simplifies the approach to HeapNumbers in concurrent
compilation. We'll only create a HeapNumberRef for immutable
HeapNumbers -- this means that we don't need to validate the read
of the value with a compilation dependency check. Mutable
HeapNumbers are handled differently (the value is read for
constant folding, and protected with a constant field dependency).

This CL includes 2 reverts:
Revert "[compiler] Make HeapNumberRef background serialized"
Revert "[compiler] Fix endianness issue when reading HeapNumber"

Bug: v8:7790
Change-Id: I24e65583b787c214b917e96e789d711c2a7c9694
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2891576
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74567}

This CL adds support for regular expressions. To serialize a regular
expression, the pattern and flags are extracted and serialized as
strings.

Also, JSRegExp::StringFromFlags() is introduced to allow for
transforming back from JSRegExp::Flags to the corresponding flag string.
To verify that this implementation is on par with
RegExp.prototype.flags, unittests are introduced under
regexp/regexp-unittest.cc and RegExpBuiltinsAssembler::FlagsGetter()
is updated to include a slow path that calls JSRegExp::StringFromFlags()
through a runtime function.

Bug: v8:11525, v8:11706
Change-Id: I9cad4c464129ba1cbf64672130d8410730d7d679
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2878751
Commit-Queue: Vicky Kontoura <vkont@google.com>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74566}

Make sure we have no pending promises if correctness fuzzing is active.
Due to fast-paths we might not create all intermediate promises
that aren't spec visible. However, promise hooks might expose them
and cause different output which in turn breaks correctness fuzzing.

Drive-by-fix:
- Replace IsAnyPromiseHookEnabledOrDebugIsActiveOrHasAsyncEventDelegate
  with NeedsAnyPromiseHooks

Bug: v8:1207791
Change-Id: I5b956336c43348e029c3e283993d4140a8897439
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2886862Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74565}

Calling SharedFunctionInfoRef::GetBytecodeArray is expensive as it
needs to call HeapBroker::GetOrCreateData each time. Instead have
bytecode graph builder save the bytecode_array and use it instead.

BUG=v8:9684,v8:7790

Change-Id: I1e847a8e371142f0108fbfbb1e151edf1c55beb8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2892667Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74564}

Various WebAssembly APIs that don't have observable side-effects aren't
marked as such, leading to the inability of DevTools front-end to
generate eager evaluation previews in the Console, and also making them
unusable in conditional breakpoints and logpoints.

Bug: chromium:1164241
Change-Id: I8f0675d2ed5b362b34a6f6c756d372a61e9e8564
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2891571
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74563}

Added a CSA assertion to disallow page access when FLAG_enable_third_party_heap = true.

Also skipped two PageFromAddress callers in CSA that is not necessary when barriers are disabled.

Bug: v8:11641
Change-Id: Ib0e3ff7a7dbacb7c6e7a53a720b95e51cdf2e645
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2878757Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Wenyu Zhao <wenyu.zhao@anu.edu.au>
Cr-Commit-Position: refs/heads/master@{#74562}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/80d2921..00d8280

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/src/buildtools/+log/9b15350..b0912f9

Rolling v8/third_party/aemu-linux-x64: KMQBSqcXw7u61OKLUonbaZeROpW1KXX9tM-8Klzxus8C..JANUSSL6vlpZwl7eeXT1Jv3TTKfhHXjW18WlDQyun4kC

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/52e67e7..affd272

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/f5c054c..5974ca0

Rolling v8/third_party/zlib: https://chromium.googlesource.com/chromium/src/third_party/zlib/+log/c830e4e..3e6d345

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/06d525c..f6e0cbe

Rolling v8/tools/luci-go: git_revision:e03dc36a7374fdf2331886695fa8b13457e15b92..git_revision:d7393d163ecb11c44626b3b221f86efdd2861565

Rolling v8/tools/luci-go: git_revision:e03dc36a7374fdf2331886695fa8b13457e15b92..git_revision:d7393d163ecb11c44626b3b221f86efdd2861565

Rolling v8/tools/luci-go: git_revision:e03dc36a7374fdf2331886695fa8b13457e15b92..git_revision:d7393d163ecb11c44626b3b221f86efdd2861565

TBR=v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I9405aae219860c21833081ad67e006d7b1048b71
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2895357Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#74561}

This is a reland of 8b74fd45

Changes since revert:

- Reverted a61aa491 for not fixing the
  jitless toggling issue on Chromium Win64

- Fix jitless toggling on Win64 by checking FLAG_jitless in
  EmbeddedDataWithMaybeRemappedEmbeddedBuiltins

Original change's description:
> Reland^3 "[ptr-cage] Turn on shared pointer cage by default for arm64 and x64""
>
> This is a reland of 054ff044
>
> Change since revert:
>
> - Remove assignment to FLAG_enable_short_builtins in test since
>   it's write-once in CFI.
>
> Original change's description:
> > Reland^2 "[ptr-cage] Turn on shared pointer cage by default for arm64 and x64"
> >
> > This is a reland of 1f504c36
> >
> > Changes since revert:
> >
> > - Removed disabling of RO heap sharing when --stress-snapshot is passed;
> >   was fixed by f4a6c628
> > - Fixed crashing tests that caused revert separately in
> >   a61aa491
> >
> > Original change's description:
> > > > [ptr-cage] Turn on shared pointer cage by default for arm64 and x64
> > > >
> > > > Reviewed-on:
> > > https://chromium-review.googlesource.com/c/v8/v8/+/2873226
> > > > Reviewed-by: Igor Sheludko <ishell@chromium.org>
> > > > Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> > > > Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> > > > Cr-Commit-Position: refs/heads/master@{#74422}
> > >
> > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2878855
> > > Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> > > Reviewed-by: Adam Klein <adamk@chromium.org>
> > > Reviewed-by: Igor Sheludko <ishell@chromium.org>
> > > Reviewed-by: Dan Elphick <delphick@chromium.org>
> > > Cr-Commit-Position: refs/heads/master@{#74448}
> >
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2891460
> > Reviewed-by: Adam Klein <adamk@chromium.org>
> > Commit-Queue: Shu-yu Guo <syg@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#74546}
>
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2893567
> Reviewed-by: Shu-yu Guo <syg@chromium.org>
> Reviewed-by: Adam Klein <adamk@chromium.org>
> Commit-Queue: Shu-yu Guo <syg@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74548}

TBR=ishell@chromium.org

Bug: v8:11460
Change-Id: Ied925de5f886a906b1ca178365aee73155e679cb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2891697Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74560}

This reverts commit a61aa491.

Reason for revert: Did not fix the original issue with chromium
tests toggling jitless mode after V8 has already been initialized
on Win64.

Original change's description:
> [ptr-cage] Better support sharing CodeRange with re-embedded builtins
>
> If a shared CodeRange is already allocated when creating an Isolate in
> jitless mode, the CodeRange will be used. This is to better support the
> following use pattern:
>
> ```
> FLAG_jitless = false;
> v8::Isolate::New();
> FLAG_jitless = true;
> v8::Isolate::New();
> ```
>
> Note that the other direction of toggling jitless from true to false is
> unsupported and may have undefined behavior.
>
> Bug: v8:11460
> Change-Id: I1c451c53bc160be4122056d8b309323a94d4b8b6
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2890591
> Commit-Queue: Shu-yu Guo <syg@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74535}

TBR=ishell@chromium.org

Bug: v8:11460
Change-Id: I0acd7d0d444efbf6b9860bcc5e91034319b78601
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2893827Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#74559}

xxbrq includes a constant value of `31` as part the opcode. This CL
includes this constant within constants-ppc instead of adding
it while emitting code.


Change-Id: I897f5f86165c7b006a829dcb2ee2a0c9dc2ef1b3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2891935Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#74558}

This reverts commit 8b74fd45.

Reason for revert: Blocking the roll into Chromium, example failure on Windows 64 bot:

https://ci.chromium.org/p/chromium/builders/try/win10_chromium_x64_rel_ng/863189?

Original change's description:
> Reland^3 "[ptr-cage] Turn on shared pointer cage by default for arm64 and x64""
>
> This is a reland of 054ff044
>
> Change since revert:
>
> - Remove assignment to FLAG_enable_short_builtins in test since
>   it's write-once in CFI.
>
> Original change's description:
> > Reland^2 "[ptr-cage] Turn on shared pointer cage by default for arm64 and x64"
> >
> > This is a reland of 1f504c36
> >
> > Changes since revert:
> >
> > - Removed disabling of RO heap sharing when --stress-snapshot is passed;
> >   was fixed by f4a6c628
> > - Fixed crashing tests that caused revert separately in
> >   a61aa491
> >
> > Original change's description:
> > > > [ptr-cage] Turn on shared pointer cage by default for arm64 and x64
> > > >
> > > > Reviewed-on:
> > > https://chromium-review.googlesource.com/c/v8/v8/+/2873226
> > > > Reviewed-by: Igor Sheludko <ishell@chromium.org>
> > > > Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> > > > Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> > > > Cr-Commit-Position: refs/heads/master@{#74422}
> > >
> > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2878855
> > > Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> > > Reviewed-by: Adam Klein <adamk@chromium.org>
> > > Reviewed-by: Igor Sheludko <ishell@chromium.org>
> > > Reviewed-by: Dan Elphick <delphick@chromium.org>
> > > Cr-Commit-Position: refs/heads/master@{#74448}
> >
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2891460
> > Reviewed-by: Adam Klein <adamk@chromium.org>
> > Commit-Queue: Shu-yu Guo <syg@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#74546}
>
> TBR=adamk@chromium.org
>
> Bug: v8:11460
> Change-Id: Ib7526270d421a562cb00aec9a28b4fc2296e4a86
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2893567
> Reviewed-by: Shu-yu Guo <syg@chromium.org>
> Reviewed-by: Adam Klein <adamk@chromium.org>
> Commit-Queue: Shu-yu Guo <syg@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74548}

Bug: v8:11460
Change-Id: Ie1a6a5d7e7928f6b90571a33dc743ca5d1d082b4
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2893823
Auto-Submit: Bill Budge <bbudge@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#74557}

vnegw and vnegd are also added to the opcode list as well
as the disassembler and the simulator.

Change-Id: I852fbe4469b2dd3c3872aa846a0b680e35e1dba6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2892630Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#74556}

Port: d3d4a896
Bug: v8:11420
Change-Id: I995bb6f9e4f0d62d2e048fbae0d17747c301db4d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2894036
Commit-Queue: Brice Dobry <brice.dobry@futurewei.com>
Reviewed-by: Brice Dobry <brice.dobry@futurewei.com>
Cr-Commit-Position: refs/heads/master@{#74555}

OutputRegister does not always exist, so we add a TempRegister to store
the comparison result.

Change-Id: I47b2500c28be85a66cab1de669ed62401f878e1a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2885475
Auto-Submit: Liu yu <liuyu@loongson.cn>
Reviewed-by: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/master@{#74554}

Change-Id: I16872f90a10702c3dcc8e556a8bc17fd63a0f858
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2881511Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Wenyu Zhao <wenyu.zhao@anu.edu.au>
Cr-Commit-Position: refs/heads/master@{#74553}

Port: d3d4a896

Bug: v8:11420
Change-Id: I016981f83f347a1bafae9a72882b634a69b86c64
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2894002
Auto-Submit: Liu yu <liuyu@loongson.cn>
Reviewed-by: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/master@{#74552}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/4e27ee8..80d2921

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/src/buildtools/+log/e72cd45..9b15350

Rolling v8/third_party/aemu-linux-x64: pwjSs3IapHTvM0wB7z3723g8rjsQnCWikZJhQxtBetsC..KMQBSqcXw7u61OKLUonbaZeROpW1KXX9tM-8Klzxus8C

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/302ca09..52e67e7

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/b65bbfe..f5c054c

Rolling v8/third_party/icu: https://chromium.googlesource.com/chromium/deps/icu/+log/cd9f9a9..f022e29

Rolling v8/third_party/zlib: https://chromium.googlesource.com/chromium/src/third_party/zlib/+log/618ddec..c830e4e

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/53a9334..06d525c

Rolling v8/tools/luci-go: git_revision:37e5f238829f911f85b62d66670d2fbd88354ef1..git_revision:e03dc36a7374fdf2331886695fa8b13457e15b92

Rolling v8/tools/luci-go: git_revision:37e5f238829f911f85b62d66670d2fbd88354ef1..git_revision:e03dc36a7374fdf2331886695fa8b13457e15b92

Rolling v8/tools/luci-go: git_revision:37e5f238829f911f85b62d66670d2fbd88354ef1..git_revision:e03dc36a7374fdf2331886695fa8b13457e15b92

TBR=v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I0fc0fff630915f8fedea52785a54085a9cb7aafd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2892384Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#74551}

In debug mode, these will currently cause a DCHECK failure or a
segmentation fault.

See also: https://github.com/riscv/v8/issues/490

Change-Id: I2a4b8e0c9b0fb85393b41b1016b2caa2f013bcc4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2881505
Commit-Queue: Yahan Lu <yahan@iscas.ac.cn>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74550}

Bug: 
Change-Id: If5cb112f838e73bcec5e9971a12e1f88ab41e996
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2874399Reviewed-by: Brice Dobry <brice.dobry@futurewei.com>
Commit-Queue: Brice Dobry <brice.dobry@futurewei.com>
Cr-Commit-Position: refs/heads/master@{#74549}

This is a reland of 054ff044

Change since revert:

- Remove assignment to FLAG_enable_short_builtins in test since
  it's write-once in CFI.

Original change's description:
> Reland^2 "[ptr-cage] Turn on shared pointer cage by default for arm64 and x64"
>
> This is a reland of 1f504c36
>
> Changes since revert:
>
> - Removed disabling of RO heap sharing when --stress-snapshot is passed;
>   was fixed by f4a6c628
> - Fixed crashing tests that caused revert separately in
>   a61aa491
>
> Original change's description:
> > > [ptr-cage] Turn on shared pointer cage by default for arm64 and x64
> > >
> > > Reviewed-on:
> > https://chromium-review.googlesource.com/c/v8/v8/+/2873226
> > > Reviewed-by: Igor Sheludko <ishell@chromium.org>
> > > Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> > > Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> > > Cr-Commit-Position: refs/heads/master@{#74422}
> >
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2878855
> > Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> > Reviewed-by: Adam Klein <adamk@chromium.org>
> > Reviewed-by: Igor Sheludko <ishell@chromium.org>
> > Reviewed-by: Dan Elphick <delphick@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#74448}
>
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2891460
> Reviewed-by: Adam Klein <adamk@chromium.org>
> Commit-Queue: Shu-yu Guo <syg@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74546}

TBR=adamk@chromium.org

Bug: v8:11460
Change-Id: Ib7526270d421a562cb00aec9a28b4fc2296e4a86
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2893567Reviewed-by: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74548}

This reverts commit 054ff044.

Reason for revert: Breaks Arm64 build:

https://ci.chromium.org/p/v8/builders/ci/V8%20Android%20Arm64%20-%20debug%20builder/18683

Original change's description:
> Reland^2 "[ptr-cage] Turn on shared pointer cage by default for arm64 and x64"
>
> This is a reland of 1f504c36
>
> Changes since revert:
>
> - Removed disabling of RO heap sharing when --stress-snapshot is passed;
>   was fixed by f4a6c628
> - Fixed crashing tests that caused revert separately in
>   a61aa491
>
> Original change's description:
> > > [ptr-cage] Turn on shared pointer cage by default for arm64 and x64
> > >
> > > Reviewed-on:
> > https://chromium-review.googlesource.com/c/v8/v8/+/2873226
> > > Reviewed-by: Igor Sheludko <ishell@chromium.org>
> > > Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> > > Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> > > Cr-Commit-Position: refs/heads/master@{#74422}
> >
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2878855
> > Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> > Reviewed-by: Adam Klein <adamk@chromium.org>
> > Reviewed-by: Igor Sheludko <ishell@chromium.org>
> > Reviewed-by: Dan Elphick <delphick@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#74448}
>
> Bug: v8:11460
> Change-Id: I4e491574437f4c832e24b29815de6bdfd8975511
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2891460
> Reviewed-by: Adam Klein <adamk@chromium.org>
> Commit-Queue: Shu-yu Guo <syg@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74546}

Bug: v8:11460
Change-Id: I772afcd100d3d92b7e3f5f060c670a5686c9a338
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2892843
Auto-Submit: Bill Budge <bbudge@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#74547}

This is a reland of 1f504c36

Changes since revert:

- Removed disabling of RO heap sharing when --stress-snapshot is passed;
  was fixed by f4a6c628
- Fixed crashing tests that caused revert separately in
  a61aa491

Original change's description:
> > [ptr-cage] Turn on shared pointer cage by default for arm64 and x64
> >
> > Reviewed-on:
> https://chromium-review.googlesource.com/c/v8/v8/+/2873226
> > Reviewed-by: Igor Sheludko <ishell@chromium.org>
> > Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> > Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#74422}
>
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2878855
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Reviewed-by: Adam Klein <adamk@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Dan Elphick <delphick@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74448}

Bug: v8:11460
Change-Id: I4e491574437f4c832e24b29815de6bdfd8975511
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2891460Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74546}

This is a reland of 3356078a.

The fix is in PS2:
- fix the DCHECK to be triggered only if dst != src, the dcheck
  is meant to prevent rep from being overwritten, which happens only
  if dst != src
- fix instruction selector for f64x2.replace_lane, require SameAsFirst
  only for non-AVX, which makes dst == src, saving a move
- on x64 we also require all registers, since the macro-assembler
  helper only handles registers

Original change's description:
> [wasm-simd][x64][ia32] Factor f64x2.replace_lane into shared code
>
> This pblendw/movlhps combination has lower latency and requires less
> unop than pinsrq (1 v.s. 2).
>
> Bug: v8:11589
> Change-Id: I770b0c20a286774afefbac5ef0adffe463318f21
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2828871
> Reviewed-by: Bill Budge <bbudge@chromium.org>
> Commit-Queue: Zhi An Ng <zhin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74049}

Bug: v8:11589
Change-Id: I51cba0539d5241242dc4d7d971ede1940b9ac1fd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2842264
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74545}

Change-Id: I0c763d15f584f3b6d71f034412f736087824a2a6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2892605Reviewed-by: Milad Fa <mfarazma@redhat.com>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/master@{#74544}

Also handling kArchStackPointerGreaterThan in AssembleArchBoolean

Change-Id: I253c1a6cb924364eead3b9fe58c7cf7d6f0696af
Bug: v8:11737
Bug: v8:11747
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2876854Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Brice Dobry <brice.dobry@futurewei.com>
Commit-Queue: Brice Dobry <brice.dobry@futurewei.com>
Cr-Commit-Position: refs/heads/master@{#74543}

Change-Id: I8b7c63ce7438f7a7015ebd4a8d96a976f7d28704
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2892604Reviewed-by: Milad Fa <mfarazma@redhat.com>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/master@{#74542}

Change-Id: I6e72c56bb71d0d227b5556139dc687a78da6fb31
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2892257Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#74541}

This reverts commit 4f4b4f74.

Reason for revert: New unittest is failing on TSAN bot:

https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20TSAN%20-%20stress-incremental-marking/3210

Original change's description:
> cppgc-js: Add unittest for CollectCustomSpaceStatisticsAtLastGC
>
> Drive-by: fix delayed task implementation in cpp-heap.cc.
>
> Bug: chromium:1056170
> Change-Id: Ie92d909056532047b378ebfafeb98273997e60e9
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2883618
> Commit-Queue: Omer Katz <omerkatz@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74530}

Bug: chromium:1056170
Change-Id: I7e50f20178854081b6fd23aa6d31afc4b9e49850
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2891462
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74540}

This CL only affects non-production code. In non-production code, test
runners may invoke tasks (base::RunLoop()) with an interesting stack.
V8 assumes that it can clear certain data structures when running from
a non-nested task due to not having any interesting stack on top.
During testing this can lead to UAF on stack as data structures are
prematurely cleared.

With cppgc this failure can be fixed as the information on whether
test runners invoke tasks with a non-trivial stack is actually
present.

Example failure: https://logs.chromium.org/logs/chromium/buildbucket/cr-buildbucket.appspot.com/8847453411432681120/+/steps/webkit_unit_tests__with_patch__on_Ubuntu-18.04/0/logs/Flaky_failure:_WebSocketStreamTest.ConnectWithFailedHandshake__status_CRASH_SUCCESS_/0

Change-Id: Ib9f6fb2d8a1aa43d0b973afeb2d0a740c769e784
Bug: chromium:1056170
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2891574Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74539}

Replaces Payload* terminiology with Object* terminology.
HoH::ObjectSize = just the object, without the header.
HoH::AllocatedSize = both the object and the header.

Payload terminology is retained only for pages.

Bug: chromium:1056170
Change-Id: I568a324ae8728f098be642b024493c375ec873cb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2892079
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74538}

We would use a payload size of 0 and end up walking up the stack till
we crash.

Bug: chromium:1056170
Change-Id: I12a69ada24697faaf05e2f4ab210045d54cf34e5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2891657Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74537}