We add ref.func and ref.is_null to the fuzzed module.
ref.is_null returns i32, so it is added to i32 generator.
ref.func is added to GenerateOptRef.
GetRefType function is added to generate reftypes.

Bug: v8:11954
Change-Id: Ia1add950bed573a02b6bec1cba401273d401919e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3106925
Commit-Queue: Rakhim Khismet <khismet@google.com>
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76431}

Abstract reference types in the fuzzer have only generated trivial
values. This CL adds the capability for them to generate values of their
subtypes in addition.
Drive-by: Fix emission of multiple tables in wasm-fuzzer-common.

Bug: v8:11954
Change-Id: Id434109c9ae6c1e1b799414c90f18180b8895755
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3109672
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76430}

This aims to speed up stack scanning with a fast on-heap check. The
blooom-filter (at least with caged-heap enabled) is probably not needed
anymore.

Change-Id: I05536025c73df0cacdbbf6c474339dc71ecf33e5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2825590
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Auto-Submit: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76429}

This reverts commit d1b27019.

Reason for revert: Broke vtune build, tsan build and possibly others

Original change's description:
> [include] Split out v8.h
>
> This moves every single class/function out of include/v8.h into a
> separate header in include/, which v8.h then includes so that
> externally nothing appears to have changed.
>
> Every include of v8.h from inside v8 has been changed to a more
> fine-grained include.
>
> Previously inline functions defined at the bottom of v8.h would call
> private non-inline functions in the V8 class. Since that class is now
> in v8-initialization.h and is rarely included (as that would create
> dependency cycles), this is not possible and so those methods have been
> moved out of the V8 class into the namespace v8::api_internal.
>
> None of the previous files in include/ now #include v8.h, which means
> if embedders were relying on this transitive dependency then it will
> give compile failures.
>
> v8-inspector.h does depend on v8-scripts.h for the time being to ensure
> that Chrome continue to compile but that change will be reverted once
> those transitive #includes in chrome are changed to include it directly.
>
> Full design:
> https://docs.google.com/document/d/1rTD--I8hCAr-Rho1WTumZzFKaDpEp0IJ8ejZtk4nJdA/edit?usp=sharing
>
> Bug: v8:11965
> Change-Id: I53b84b29581632710edc80eb11f819c2097a2877
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3097448
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Reviewed-by: Camillo Bruni <cbruni@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Commit-Queue: Dan Elphick <delphick@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#76424}

Bug: v8:11965
Change-Id: Id57313ae992e720c8b19abc975cd69729e1344aa
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3113627
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Owners-Override: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76428}

This reverts commit 0179f6a6.

Reason for revert: reverting the CL this fixes

Original change's description:
> [bazel] Missing v8-initialization.h file
>
> No-Try: true
> Change-Id: I1ff26433f68ed9318ddc0f7d9a840df3699cdd4f
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3113625
> Auto-Submit: Victor Gomes <victorgomes@chromium.org>
> Reviewed-by: Dan Elphick <delphick@chromium.org>
> Commit-Queue: Dan Elphick <delphick@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#76425}

Change-Id: I8fe8d811badf478c2f8d6761e503e322cfd4e6fb
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3110609
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76427}

The fast_call_count getter in d8 was not properly initialised as
throwing when called as a constructor. As a result, it was possible
to pass a new object as its `this` and then attempt to "unwrap" it,
resulting in reading OOB in the new object. This CL also strenghtens
slow_call_count and reset_counts and adds a regression test.

Bug: chromium:1241464
Change-Id: I9b6e9a4e38a974dc111a53b911c73514c30de9df
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3110369Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76426}

No-Try: true
Change-Id: I1ff26433f68ed9318ddc0f7d9a840df3699cdd4f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3113625
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76425}

This moves every single class/function out of include/v8.h into a
separate header in include/, which v8.h then includes so that
externally nothing appears to have changed.

Every include of v8.h from inside v8 has been changed to a more
fine-grained include.

Previously inline functions defined at the bottom of v8.h would call
private non-inline functions in the V8 class. Since that class is now
in v8-initialization.h and is rarely included (as that would create
dependency cycles), this is not possible and so those methods have been
moved out of the V8 class into the namespace v8::api_internal.

None of the previous files in include/ now #include v8.h, which means
if embedders were relying on this transitive dependency then it will
give compile failures.

v8-inspector.h does depend on v8-scripts.h for the time being to ensure
that Chrome continue to compile but that change will be reverted once
those transitive #includes in chrome are changed to include it directly.

Full design:
https://docs.google.com/document/d/1rTD--I8hCAr-Rho1WTumZzFKaDpEp0IJ8ejZtk4nJdA/edit?usp=sharing

Bug: v8:11965
Change-Id: I53b84b29581632710edc80eb11f819c2097a2877
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3097448Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76424}

As a short-term mitigation for the abort() crash that happens
when the g_thread_in_wasm_code flag is set while we attempt to
free a Wasm code object as part of a GC cycle, clear the flag
in Runtime_AllocateInYoungGeneration. (The ...OldGeneration
counterpart is not affected because Wasm code does not request
pretenured allocations currently.)

Bug: chromium:1236668
Change-Id: I97ab9f67935de9aaeca0815e374bdfd8076acf6f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3110195Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76423}

Bug: v8:12130
Change-Id: I2cf3513fb09e5844ef827901cbbe73f70b2a3edd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3112986Reviewed-by: Ji Qiu <qiuji@iscas.ac.cn>
Commit-Queue: Ji Qiu <qiuji@iscas.ac.cn>
Auto-Submit: Yahan Lu <yahan@iscas.ac.cn>
Cr-Commit-Position: refs/heads/main@{#76422}

Bug: chromium:1237730
Change-Id: Ib604a5d3dc8931f195d6508048937ee735e18fd8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3107306
Auto-Submit: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76421}

This CL implements both the Register-Register and the
Register-Immediate variants needed by liftoff.

Change-Id: I148df8418097004710a17e0b216c2f18db808b8c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3105085Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#76420}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/d4924be..3d596a3

Rolling v8/buildtools/third_party/libc++abi/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi/+log/e4b161d..ffda034

Rolling v8/third_party/aemu-linux-x64: 6VzMt4Yj2cR2686nGtmYD_6idAkR2f0lTHjpGAYPr1oC..GG_dhOWH4FV08NLnsuMmrvJIzuPs-hEVC4Dt900CDY0C

TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I7df6641a8798cf335cc35eae25314727e3e2c6d5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3112527Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#76419}

Port commit 6a487504

Change-Id: Icfff8241e6e920970f0168ebfae535291c4d9e72
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3111275Reviewed-by: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/main@{#76418}

Port commit 6a487504

Change-Id: I6fd1a15f1f35fd3b8cd3cfb72d7c428d018273c8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3109087Reviewed-by: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/main@{#76417}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/536c882..d4924be

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/src/buildtools/+log/6f9b470..88e9a29

Rolling v8/buildtools/third_party/libc++abi/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi/+log/671803f..e4b161d

Rolling v8/buildtools/third_party/libunwind/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind/+log/83f8edb..5f26300

Rolling v8/third_party/aemu-linux-x64: JV2fBSeIQc_xaqKsVDvLIvDmvx2ejeL-Y75N37PloLMC..6VzMt4Yj2cR2686nGtmYD_6idAkR2f0lTHjpGAYPr1oC

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/77a7089..ebf22ea

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/c4e2b36..52b4510

Rolling v8/third_party/googletest/src: https://chromium.googlesource.com/external/github.com/google/googletest/+log/0134d73..2f80c2b

Rolling v8/third_party/jinja2: https://chromium.googlesource.com/chromium/src/third_party/jinja2/+log/6ac5f7e..6db8da1

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/f1ab49b..6002926

Rolling v8/tools/luci-go: git_revision:a5735121c6339dee9b1b3644535e230744daaac9..git_revision:24b519169c7848dbeae2dba04698c41666388a45

Rolling v8/tools/luci-go: git_revision:a5735121c6339dee9b1b3644535e230744daaac9..git_revision:24b519169c7848dbeae2dba04698c41666388a45

Rolling v8/tools/luci-go: git_revision:a5735121c6339dee9b1b3644535e230744daaac9..git_revision:24b519169c7848dbeae2dba04698c41666388a45

TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I3cb55842d72cf0e8bd892f0cce24ebd5c8465cbc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3111616Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#76416}

Consider reading the internal node pointer instead of the actual pointer
when trying to figure out whether a node needs to be destroyed. This
preserves the non-atomiticity of the actual pointer which highlights
races using TSAN while fixing destruction.

Bug: chromium:1239081
Change-Id: I1d1fa29d40d86e4b156269abc90142ee71a8d8f4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3110199
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76415}

This reverts commit 6ae18c2d.

Reason for revert: breaks a bunch of tests on Mac arm64 bots:

https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Mac%20-%20arm64%20-%20release/5754/overview
https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Mac%20-%20arm64%20-%20debug/2421/overview

Original change's description:
> [wasm] Move write scope out of NativeModule::AddCode
>
> {NativeModule::AddCode} is a central method that should usually be
> called in batches, where the caller holds a {CodeSpaceWriteScope} for a
> longer time (over several compilations).
> This CL moves us closer to that by removing the scope from that central
> method and instead putting it in callers where it becomes more visible.
> There are already TODOs to introduce caching or batching to avoid some
> switching, and one more TODO is added.
>
> Drive-by: Remove an unneeded {CodeSpaceMemoryModificationScope}.
>
> R=​jkummerow@chromium.org
>
> Bug: v8:11974
> Change-Id: Ia13c601abc766e5fca6ca053bf1fc4d647b53ed0
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3098186
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Clemens Backes <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#76344}

Bug: v8:11974
Change-Id: Ia6a6814f153f7602d5d691bc5c930601ff4622a7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3111268
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76414}

Bug: chromium:1066980
Change-Id: I4e149f5dd9ac2d3b8f51afd2c63451d509441e64
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3110652
Commit-Queue: Nico Weber <thakis@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Auto-Submit: Nico Weber <thakis@chromium.org>
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76413}

End of an era https://www.youtube.com/watch?v=jbf9ZYi8eac

Change-Id: I64eb201a9073df55564a3ba38ac5511974485c08
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3103316Reviewed-by: Dan Elphick <delphick@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Auto-Submit: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76412}

Avoids emitting scopes when not even running. This can be a problem for
metrics computation which may recursively invoke
EnsureSweepingCompleted() when starting marking even though the sweeper
is guaranteed to be not running at this point.

Bug: chromium:1211795
Change-Id: I8d7692f4e8c640f38d3c52df5c111fff4f06df9e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3109674
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Auto-Submit: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76411}

Bug: chromium:1066980
Change-Id: Ib7d38cb46f25b69431fa965eb6b951af3f24bc95
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3111005
Auto-Submit: Nico Weber <thakis@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76410}

Add infra-staging flag to test runner
which adds the no-fail flag. This will
be used to see the accuracy of numfuzz
builders when we ignore exit code 1.

Bug: v8:11826
Change-Id: I6684331efe9c801d02716d94cb16e8ba816d9c68
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3110196Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Almothana Athamneh <almuthanna@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76409}

Bug: v8:12013
Change-Id: Ied041acd5e8898eae0beca2d2b49b90846b3f047
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3110191
Commit-Queue: Almothana Athamneh <almuthanna@chromium.org>
Auto-Submit: Almothana Athamneh <almuthanna@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76408}

Port 6a487504

Original Commit Message:

    This is a reland of faf2208a

    Changes since revert:
    - Fix arm64 codegen for full pointer mode

    Original change's description:
    > [compiler] Support acq/rel accesses and atomic accesses on tagged
    >
    > This CL adds an AtomicMemoryOrder parameter to the various atomic load
    > and store operators. Currently only acquire release (kAcqRel) and
    > sequentially consistent (kSeqCst) orders are supported.
    >
    > Additionally, atomic loads and stores are extended to work with tagged
    > values.
    >
    > This CL is a pre-requisite for supporting atomic accesses in Torque,
    > which is in turn a pre-requisite for prototyping shared strings.
    >
    > Bug: v8:11995
    > Change-Id: Ic77d2640e2dc7e5581b1211a054c93210c219355
    > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3101765
    > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
    > Reviewed-by: Zhi An Ng <zhin@chromium.org>
    > Commit-Queue: Shu-yu Guo <syg@chromium.org>
    > Cr-Commit-Position: refs/heads/main@{#76393}

R=syg@chromium.org, joransiu@ca.ibm.com, junyan@redhat.com, midawson@redhat.com
BUG=
LOG=N

Change-Id: I859320f1e752a8e79a0855ecad8651c635092f46
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3108289Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/main@{#76407}

The heap snapshot view in the dev tools reports some incorrect retaining
paths involving weak references from relocation data in Code objects.
This change updates IndexedReferencesExtractor::VisitEmbeddedPointer to
better match the behavior in MarkingVisitorBase.

Drive-by cleanup: ObjectVisitor::VisitRelocInfo needn't be virtual
because there's only one implementation.

Bug: v8:12126
Change-Id: I669a7408e7a46e797b8c2b372235b4ea42ee22e1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3107214Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/main@{#76406}

No-Try: true
Change-Id: Ie9ccef9034d42c483c4d39aa949c85811fd65d9a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3109678Reviewed-by: Patrick Thier <pthier@chromium.org>
Commit-Queue: Patrick Thier <pthier@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76405}

Combining parts in a balanced-binary-tree like order allows us to
use fast multiplication algorithms.

Bug: v8:11515
Change-Id: I6829929671770f009f10f6f3b383501fede476ab
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3049079Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76404}

The skipped tests have been flaking on the last
ten runs on V8 NumFuzz - debug.

Bug: v8:11826
Change-Id: I925c8e581b34c1b08fb295856278e506b8d62f26
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3103305
Auto-Submit: Almothana Athamneh <almuthanna@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Liviu Rau <liviurau@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76403}

Change-Id: I5b3001cebcf97a239c259af7fc4ddc889c9a84a2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3108947
Commit-Queue: Ji Qiu <qiuji@iscas.ac.cn>
Reviewed-by: Ji Qiu <qiuji@iscas.ac.cn>
Cr-Commit-Position: refs/heads/main@{#76402}

Rolling v8/third_party/google_benchmark/src: https://chromium.googlesource.com/external/github.com/google/benchmark/+log/c4b06e5..8fd49d6

Fix a -Wunreachable-code-aggressive warning (#1214) (Nico Weber)
https://chromium.googlesource.com/external/github.com/google/benchmark/+/8fd49d6

TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com,mlippautz@chromium.org

Change-Id: I1442e530778245ed2252fbed092147dd496e61da
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3108868Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#76401}

Port 3107220: Reland "[compiler] Support acq/rel accesses and atomic accesses on tagged" | 3107220

Change-Id: I190f6b62458b0abe193ca7f5ea9d6912117439fe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3108945Reviewed-by: Ji Qiu <qiuji@iscas.ac.cn>
Commit-Queue: Ji Qiu <qiuji@iscas.ac.cn>
Auto-Submit: Yahan Lu <yahan@iscas.ac.cn>
Cr-Commit-Position: refs/heads/main@{#76400}

This is a reland of faf2208a

Changes since revert:
- Fix arm64 codegen for full pointer mode

Original change's description:
> [compiler] Support acq/rel accesses and atomic accesses on tagged
>
> This CL adds an AtomicMemoryOrder parameter to the various atomic load
> and store operators. Currently only acquire release (kAcqRel) and
> sequentially consistent (kSeqCst) orders are supported.
>
> Additionally, atomic loads and stores are extended to work with tagged
> values.
>
> This CL is a pre-requisite for supporting atomic accesses in Torque,
> which is in turn a pre-requisite for prototyping shared strings.
>
> Bug: v8:11995
> Change-Id: Ic77d2640e2dc7e5581b1211a054c93210c219355
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3101765
> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
> Reviewed-by: Zhi An Ng <zhin@chromium.org>
> Commit-Queue: Shu-yu Guo <syg@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#76393}

Bug: v8:11995
Change-Id: I23577486334fec6b08fb3a2f5be1f6e5e16db11b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3107220Reviewed-by: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76399}

Fixed: v8:12095
Bug: v8:12095
Change-Id: If2021397000958ccdd058b99ce8f4d6e8d4d2836
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3097106Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76398}

Whenever we are adding a new AddressRegion to the CodeMap, we first
remove all overlapping regions. The logic to check for overlapping
region is incomplete. For example, if all existing regions are less than
the region to be added, we incorrectly remove all regions, effectively
deleting all JITCodeEntry we have constructed.

We extract this overlapping check into a helper function, so that we can
unittest this without worrying about JITCodeEvent functionality, and also
without dealing with V8 internals (like Isolate and SFI).

The overlapping logic is rather hard to understand, has many special
cases, it will probably be much easier to just loop through all the
entries, rather than using lower_bound. Ideally, we can refactor this to
use some sort of sweep-line algorithm. Hopefully the unittests catch the
most obvious cases.

Bug: v8:11908
Change-Id: Id96975599ac59974185c3dbf64cdfceb17e98d18
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3105381
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76397}

Change-Id: I32fc41124c6c16efe1150d60e72dc2bba90782c7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3106745Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76396}

Change-Id: Ie96be7e4d1c37de92cbb6271fb0c8779ea9d4ae4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3106746Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76395}

This reverts commit faf2208a.

Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20-%20arm64%20-%20sim%20-%20pointer%20compression/10870/overview

Original change's description:
> [compiler] Support acq/rel accesses and atomic accesses on tagged
>
> This CL adds an AtomicMemoryOrder parameter to the various atomic load
> and store operators. Currently only acquire release (kAcqRel) and
> sequentially consistent (kSeqCst) orders are supported.
>
> Additionally, atomic loads and stores are extended to work with tagged
> values.
>
> This CL is a pre-requisite for supporting atomic accesses in Torque,
> which is in turn a pre-requisite for prototyping shared strings.
>
> Bug: v8:11995
> Change-Id: Ic77d2640e2dc7e5581b1211a054c93210c219355
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3101765
> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
> Reviewed-by: Zhi An Ng <zhin@chromium.org>
> Commit-Queue: Shu-yu Guo <syg@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#76393}

Bug: v8:11995
Change-Id: Id9936672f9e96c509b1cdf866de1ac5303996945
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3107229Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#76394}

This CL adds an AtomicMemoryOrder parameter to the various atomic load
and store operators. Currently only acquire release (kAcqRel) and
sequentially consistent (kSeqCst) orders are supported.

Additionally, atomic loads and stores are extended to work with tagged
values.

This CL is a pre-requisite for supporting atomic accesses in Torque,
which is in turn a pre-requisite for prototyping shared strings.

Bug: v8:11995
Change-Id: Ic77d2640e2dc7e5581b1211a054c93210c219355
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3101765Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76393}

- Introduce helper to push arguments onto the stack (Standalone this
change doesn't make a lot of sense, but is in preparation for including
the receiver in argc).
- Introduce helper to shift arguments already on the stack to make room
for new arguments (Varargs).
- arm64 is not included because a) there was already a helper similar
to ShiftArguments and b) PushArguments is not similar enough to make
sense for arm64 because of small differences (e.g. also pushing the
function) in conjunction with stack alignment.

Drive-by: Use masm DropArguments in Sparkplug EmitReturn

Bug: v8:11112
Change-Id: Id7a3a5f025abb19e2a52dae27b3b484fe87e9faf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3097275Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76392}