The destructor of the owner of a phantom handle must clear the phantom
handle first before calling any function that can trigger GC.

Bug: chromium:827806
Change-Id: I20141d0d710c486aec3d92e729d76a53069e16fd
Reviewed-on: https://chromium-review.googlesource.com/992093Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52325}

Summary of work done:
* Simplify complicated CompareAndBranch instructions
* Mark BC1EQZ and BC1NEZ as compact branches in simulator
* Remove unneeded nops for BC1EQZ and BC1NEZ
* Block trampolines for delay slot of BC1T and BC1F

Change-Id: I86f3a497e6e9ac73075bb51653c2d4c6ab8454b9
Reviewed-on: https://chromium-review.googlesource.com/986260
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Reviewed-by: Sreten Kovacevic <sreten.kovacevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#52324}

This reverts commit 12420537.

Reason for revert: MSAN complains
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/builds/20527

Original change's description:
> [heap] fix Sweeper::kNumberOfSweepingSpaces
> 
> When indexing into vectors of sweeping spaces, convert the
> AllocationSpace to an index (by subtracting FIRST_GROWABLE_PAGED_SPACE)
> to avoid wasted space at the start.
> 
> Change-Id: Ia23fe6dae42d5accea9f7fe7ec5c3b303ef857b4
> Reviewed-on: https://chromium-review.googlesource.com/978242
> Reviewed-by: Hannes Payer <hpayer@chromium.org>
> Commit-Queue: Dan Elphick <delphick@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52320}

TBR=hpayer@chromium.org,delphick@chromium.org

Change-Id: I9894dc10f122c9fab409e08b2a45389f1f51748f
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/992152Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52323}

Builtin continuation frames know their height now. This is prework
to allow UnwindAndFindHandler to reconstructor the stack pointer for
the ContinueToBuiltin trampoline.

Bug: v8:7584
Change-Id: If1361f5bbac130c284cd46c0d39cc81e2df613d3
Reviewed-on: https://chromium-review.googlesource.com/983633Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52322}

R=leszeks@chromium.org

Bug: v8:7591
Change-Id: Idcd2d586ab279dc070d2cfb2558298ebdd3ce33b
Reviewed-on: https://chromium-review.googlesource.com/991873
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52321}

When indexing into vectors of sweeping spaces, convert the
AllocationSpace to an index (by subtracting FIRST_GROWABLE_PAGED_SPACE)
to avoid wasted space at the start.

Change-Id: Ia23fe6dae42d5accea9f7fe7ec5c3b303ef857b4
Reviewed-on: https://chromium-review.googlesource.com/978242Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52320}

This reverts commit 0258a061.

Reason for revert: breaks perfbots, e.g. https://luci-milo.appspot.com/buildbot/internal.client.v8/v8_arm64_perf/21485

Original change's description:
> [test] Add JSTest benchmark for object literal spread
> 
> Bug: v8:7611
> Change-Id: Ia5467fd4da3b385568bcc3f3fdc1a8c56bd6340e
> Reviewed-on: https://chromium-review.googlesource.com/987321
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52313}

TBR=gsathya@chromium.org,bmeurer@chromium.org

Change-Id: I4a0e8da965b784739f821ff2c3bba742e70a4b7f
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7611
Reviewed-on: https://chromium-review.googlesource.com/992092Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52319}

This ensures that we have gatekeepers for API changes.

R=adamk@chromium.org

Change-Id: I7a78f9590dfc444a20044fe323b9470f4f9004a3
Reviewed-on: https://chromium-review.googlesource.com/986267
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52318}

Bug: chromium:794998
Change-Id: Ib607bc891625db686fe37cfe416c3abf4ddf9a2b
Reviewed-on: https://chromium-review.googlesource.com/983777Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52317}

When we know that the imported JavaScript function, and we cannot
generate a direct call because the parameter count does not match, then
we can call directly to the ArgumentsAdaptor instead of the Call
builtin.

R=bmeurer@chromium.org

Change-Id: I72882c2edf170d88135d12352852302d56cc54a5
Reviewed-on: https://chromium-review.googlesource.com/986095Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52316}

When peeking into descriptor arrays (for Function.prototype.bind
inlining), we need to check the number of descriptors rather than
the length of the DescriptorArray.

Bug: chromium:825045
Change-Id: I55dbe1544e5e4cb8e23d873961c71ed12294d89c
Reviewed-on: https://chromium-review.googlesource.com/991812Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52315}

This reverts commit 6031412e.

Reason for revert: Tanks quite a few benchmarks (crbug.com/827854).

Original change's description:
> [x64] Reuse scratch register for ExternalReference
> 
> This reduces CEntryStub code size by 64 bytes, and reduces CallApiCallbackStub
> by 27 bytes.
> 
> Change-Id: I46479077f61fdae6b260ca28c67df3509dee5c1a
> Reviewed-on: https://chromium-review.googlesource.com/963652
> Commit-Queue: Kanghua Yu <kanghua.yu@intel.com>
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52005}

TBR=bmeurer@chromium.org,kanghua.yu@intel.com
Bug: chromium:827854

# Not skipping CQ checks because original CL landed > 1 day ago.

Change-Id: Ief0905a7bdba86f7b9fd20888eecdfd58bc6ea7d
Reviewed-on: https://chromium-review.googlesource.com/991712Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52314}

Bug: v8:7611
Change-Id: Ia5467fd4da3b385568bcc3f3fdc1a8c56bd6340e
Reviewed-on: https://chromium-review.googlesource.com/987321Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52313}

TBR=sergiyb@chromium.org

Bug: chromium:773297
Change-Id: I51a9cff42adb477bc089a869741e34513426e5b6
Reviewed-on: https://chromium-review.googlesource.com/989715
Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org>
Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52312}

Remove a call to `icu::toUCharPtr()` that wasn't present in other
similar looking call sites either, just reinterpret_cast directly.

Fixes https://github.com/nodejs/node/issues/19656.

Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: If281ce0a39356aa8bd20efb24c3e4b52b06841a3
Reviewed-on: https://chromium-review.googlesource.com/987953Reviewed-by: Daniel Ehrenberg <littledan@chromium.org>
Commit-Queue: Ben Noordhuis <info@bnoordhuis.nl>
Cr-Commit-Position: refs/heads/master@{#52311}

This change makes full 8 GiB guard regions always enabled on 64-bit
platforms.

Additionally, since all Wasm memory allocation paths have some form of
guard regions, this removes and simplifies most of the logic around
whether to enable guard regions.

R=gdeepti@chromium.org

Change-Id: Idf3fbcc11ac70ea2ee7eb88c2173d6a1410395e1
Reviewed-on: https://chromium-review.googlesource.com/985142
Commit-Queue: Eric Holk <eholk@chromium.org>
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52310}

crtdbg.h provides the declarations for _CrtSetReportMode and the _CRT_*
constants. It should have moved in
https://chromium-review.googlesource.com/968244, but the MSVC C++
headers appear to include crtdbg.h transitively, so we only noticed this
on the libc++ Windows buildbot.

Tbr: mlippautz@chromium.org
Bug: chromium:801780
Change-Id: Ia07f6136e4b8d1f25014e00b0b9f662029ab5a2b
Reviewed-on: https://chromium-review.googlesource.com/981399
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52309}

Bug: v8:6600
Change-Id: Ieec3b7b9fcfd278c844c9591164e14247743e218
Reviewed-on: https://chromium-review.googlesource.com/987852Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#52308}

This is a reland of 16aecc5d

Intent to ship:
https://groups.google.com/d/msg/v8-users/ShhW0Xewph0/1-OT9q0_DQAJ

Originally reviewed at:
Reviewed-on: https://chromium-review.googlesource.com/981596

Bug: v8:6791
Change-Id: I772af807b9486081d7cd96b538bf5bc98d4dcffe
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng;luci.v8.try:v8_linux_blink_rel
Reviewed-on: https://chromium-review.googlesource.com/984857Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52307}

TBR=sergiyb@chromium.org

Bug: chromium:616879
No-Try: true
Change-Id: I55d89aa3ef4cd2a112fd6ff3b4e977d73117c747
Reviewed-on: https://chromium-review.googlesource.com/983414
Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org>
Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52306}

Because the GC is not aware of address space usage, this CL causes Wasm to
explicitly trigger a GC when its address space limit is reached in hopes of
being able to successfully allocate memory.

R=mlippautz@chromium.org
R=gdeepti@chromium.org

Change-Id: I2dcc560dd3d351dbfc4dda2f7c321c470a4d9fff
Reviewed-on: https://chromium-review.googlesource.com/985103Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Eric Holk <eholk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52305}

Port f0f22341

Original Commit Message:

    Add Rcpps and Rsqrtps macros.
    Rename SIMD_UNOP macros.

R=jing.bao@intel.com, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I269f553353827a2f36271cdc27c336438cb6488b
Reviewed-on: https://chromium-review.googlesource.com/986279Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#52304}

We cannot rely on base::OS::GetCurrentProcessId() as it is sandboxed.

BUG=chromium:823874

Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel
Change-Id: I6aaa7f7f7dacbc8aba43581f9d489e4cc47799ff
Reviewed-on: https://chromium-review.googlesource.com/985425Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
Commit-Queue: Alexei Filippov <alph@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52303}

R=titzer@chromium.org

Change-Id: I7c467adaff73ed0d3836edfeac435e5065d99892
Reviewed-on: https://chromium-review.googlesource.com/983774Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52302}

Register x25 is not reserved for anything else, so return it to the
Turbofan register allocator.

Change-Id: Ic905831683a825a1e1dd682552fd459dfc2323fe
Reviewed-on: https://chromium-review.googlesource.com/980976Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Martyn Capewell <martyn.capewell@arm.com>
Cr-Commit-Position: refs/heads/master@{#52301}

Optimize implementation of i32_set_cond using new macro-assembler
instruction LoadZeroOnCondition. This way, emitting branches is
avoided.

Bug: v8:6600
Change-Id: Icccb2f3714645851fac68a666ddb33db4a9d8062
Reviewed-on: https://chromium-review.googlesource.com/985976
Commit-Queue: Sreten Kovacevic <sreten.kovacevic@mips.com>
Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#52300}

R=leszeks@chromium.org, mythria@chromium.org

Bug: v8:7554
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I3eb29d67dfa64887fb52ac706d069e15dd2d0e85
Reviewed-on: https://chromium-review.googlesource.com/980944Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52299}

This CL prepares ground for adding CSA implementation of TransitionArray lookup.

Bug: v8:7310
Change-Id: Ie82e4db8f8a0cdb1dd7bbb759fd60ad55855fe72
Reviewed-on: https://chromium-review.googlesource.com/983920
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52298}

Properly print the new context types in HeapObjectShortPrint() so we see
what kind of context it is, and the number of context slots.

Bug: v8:7570, v8:7588
Change-Id: I43414996fd953f77e140e8750b2dc4923c9bce95
Reviewed-on: https://chromium-review.googlesource.com/986135Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52297}

For the wasm2js wrappers we have an optimization to call a JavaScript
function directly if the signature of the JavaScript function matches
the signature of the WebAssembly import. However, we are not supposed
to do this optimization if the imported function is a constructor,
because constructors can only be called with `new`. With this CL we
do not apply this optimization when the imported function is a
constructor.

R=titzer@chromium.org

Bug: chromium:824859
Change-Id: I1722367bd865d0b129eadf7d4849182410447179
Reviewed-on: https://chromium-review.googlesource.com/985974Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52296}

Original description:
Code in Isolate::Deinit may trigger a GC, e.g. wasm_engine()->TearDown.
However, the gin platform in Chrome does not allow to post tasks within
Isolate::Deinit. By initializing heap tear down at the beginning of
Isolate::Deinit, we can make that no tasks are posted anymore within
Isolate::Deinit.

R=ulan@chromium.org

Bug: chromium:826105
Change-Id: I28c4d40b3ce3bc58e42acec14e350e04379c0006
Reviewed-on: https://chromium-review.googlesource.com/984534Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52295}

Change-Id: I371804f47264344651bad7f328f114d1cc71cd24
Reviewed-on: https://chromium-review.googlesource.com/980539Reviewed-by: Daniel Clifford <danno@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52294}

This way we can teach the debugger to disable liveness analysis when
running with (potential) breakpoints, so that the developers always
have (read) access to all scoped variable values.

Bug: v8:7608, chromium:826613
Change-Id: I7e6cea105f111c99d2620546144201624dfe1d8b
Reviewed-on: https://chromium-review.googlesource.com/985838Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52293}

Rolling v8/base/trace_event/common: https://chromium.googlesource.com/chromium/src/base/trace_event/common/+log/8c1ce86..211b3ed

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/cc2d66c..e7b36e5

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/db4e76d..b1c9ad5

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: I71bffacf7c5032db4be0cfd7d2b3d894aafc28df
Reviewed-on: https://chromium-review.googlesource.com/985463
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52292}

Add Rcpps and Rsqrtps macros.
Rename SIMD_UNOP macros.

Change-Id: I7e9418a835f085cc0fdd31fc3815c17c8f413b67
Reviewed-on: https://chromium-review.googlesource.com/982575Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Jing Bao <jing.bao@intel.com>
Cr-Commit-Position: refs/heads/master@{#52291}

Just a simple cleanup CL. TryAllocateBackingStore function is only needed in
wasm-memory.cc, so this makes that stronger by putting it in an anonymous
namespace. Additionally, the whole function is moved to the top of the file.

No functional change.

R=gdeepti@chromium.org

Change-Id: I0c5ea07c1ab81f3083eb75f0a6177c503fc827b5
Reviewed-on: https://chromium-review.googlesource.com/985023Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Eric Holk <eholk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52290}

No-Try: true
Bug: chromium:824214
TBR: hpayer@chromium.org
Change-Id: I8095da413b5ca0ebba65b264b7310afd88d7a499
Reviewed-on: https://chromium-review.googlesource.com/984872
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52289}

R=clemensh@chromium.org

Bug: v8:7539

Change-Id: I1bd02ba84803055dd9e8b808c17622aa4fca42d4
Reviewed-on: https://chromium-review.googlesource.com/984520Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#52288}

R=joransiu@ca.ibm.com

Change-Id: I066b6d14694393cae43285a71bfc6aff91418505
Reviewed-on: https://chromium-review.googlesource.com/984593Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#52287}

This relands commit 496d0596.

Original change's description:
> [heap] Detect ineffective GCs near the heap limit.
>
> Currently V8 can enter CPU thrashing GC loop near the heap limit. In
> such cases it is better to trigger an out-of-memory failure earlier to
> avoid wasting CPU time and to avoid unresponsiveness.
>
> This patch adds a mechanism for tracking consecutive ineffective GCs.
> A GC is considered ineffective if the heap size after the GC is still
> close to the heap limit and if the average mutator utilization dropped
> below a fixed threshold.
>
> V8 execution is aborted after four consecutive ineffective GCs.
>
> Bug: chromium:824214

TBR: hpayer@chromium.org
Change-Id: Ib09d24d6280078ce6c33519309a2563c70fb68e1
Reviewed-on: https://chromium-review.googlesource.com/980555Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52286}