This includes a fix to issue 1156334.

BUG: chromium:1156334
Change-Id: I27a97436d7a1ed567077495846dc6260ca3f2340
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2580408Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Auto-Submit: Andrey Kosyakov <caseq@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71678}

Diamond patterns need to be chained to the current control node. This
was not done consistently in wasm code, particularly the parts
implementing asm-js specific instructions.

Additionally, the graph structure for BuildI32AsmjsDivS is improved.

Change-Id: I4a17e431b5795c197bf56dd034ff5e7d95dd6db0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2578982Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71677}

Seems after an OS upgrade the dimension Mac-11 doesn't work anymore as
swarming captures it only under Mac-11.0.

No-Try: true
Bug: chromium:1156547
Change-Id: If3f975c0aa6f8930634681c5cb05e3fdf58f322b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2579922
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71676}

R=manoskouk@chromium.org

Bug: v8:11074
Change-Id: I5a0d99d22b683aee7bd63d68335ef7f775cf0816
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2579921Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71675}

- Display the source code in the code-panel
- Add selection dropdown to code-panel
- Add more filter propertyNames to CodeLogEntry
- Rename list panel titles to "XXX List"
- Add +10, +100 buttons for LazyTables
- Add Color.darken

Change-Id: Ia41c41c1d6cc949dfe766397ba6b72edc29797aa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2578945Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Auto-Submit: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71674}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/115823d..68a1580

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/src/buildtools/+log/6302c11..86a7f72

Rolling v8/third_party/aemu-linux-x64: SdFzWCen9aCYiL4t1JtDSA-58NHJJaXuKuTxYN5wLfgC..FZmiNfUmb6lJR28DxZkS03xoY4oJh4177LjCbVwbpCMC

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/3b055d3..99b0e4a

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: Id938d3b2e20644da2ed03e1824cefd66eea89ffe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2581070Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#71673}

Bug: v8:11217
Change-Id: I82719eb2c4b35cc54fc1b4b6f01eca6a48afb152
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2576884Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71672}

Add new instruction vpaddl for signed and unsigned integers, adding
assembler, disassembler, simulator support, and also tests.

The signed and unsigned opcodes for vpaddl are separate enums, because
the helper EncodeNeonUnaryOp only takes a NeonSize (not NeonDataType). I
considered changing the signature, but none of the other instructions
use a NeonDataType, so it seems unnecessary.

Bug: v8:11086
Change-Id: I5e6694ae407779c1fd3604c5a40ca0a1b6ce061b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2578233Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71671}

Add a new option to disassembler NEON size encoded in instructions with
two registers, 'size2. Rename the current only to 'size3.

Clean up existing operations to use this new formatting option.

Bug: v8:11074
Change-Id: Ie309d93d24602439c3293c8bbfd6c2ecbc9fdfb7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2575786Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71670}

The GDB-stub for Wasm debugging (which builds with the flag
v8_enable_wasm_gdb_remote_debugging) doesn't build anymore after a few changes
in the interface of wasm::DebugInfo.
This CL fixes the build, and also adds a few small changes to the protocol.

Change-Id: I250a8c86fd83048434e68cbdc5cb8ae243577393
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2571341Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Philip Pfaffe <pfaffe@chromium.org>
Commit-Queue: Paolo Severini <paolosev@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#71669}

As an example, kEagerWithResumeDeoptExitSize is always expected to
emit a 6 byte instruction "brcl", however, if the branch offset
is small enough, brc (a 4 byte instruction) might get emitted.

We need a way to force the emission of brcl at times like above.

Change-Id: Ic42c1ad80098067df6a0049bdde20e90f12ef1b0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2578061Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#71668}

Currently, GetConsName incorrectly includes the null terminator as part
of the length used in the string's hash. Exclude this to be consistent
with GetCopy, GetName, etc. and permit coalescing.

Bug: v8:0
Change-Id: I1e8a4eb7055637f3ed178014725b44e84d7788b6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2578192Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Andrew Comminos <acomminos@fb.com>
Cr-Commit-Position: refs/heads/master@{#71667}

This is follow-up of 289d25c1
Improve loop using Subslice, improve common-case check.

Bug: v8:8996
Change-Id: I59ba14b87e1b034fd2d41c92a506e142550363ce
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2527608
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71666}

Prototype v128.{load,store}{8,16,32,64}_lane on Big Endian machines.

Lood/Stores need to be reversed manually on BE machines and as such
LoadLane and StoreLane opcodes cannot be done in a single instruction.
Therefore we divide them into separate "Load/Store" and "operation"
nodes.

Bug: v8:10975
Change-Id: If21c9663de41b872fe035d15526830f244605c48
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2577820Reviewed-by: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#71665}

Currently, all runtime C++ code generated for Torque macros all goes
into a single .cc file and corresponding header. This is simple, but
limits how we can use that generated code. For example, field accessors
are generally expected to be inlinable at compilation time (not relying
on LTO).

This change updates the Torque compiler to output runtime C++ code into
the same *-tq-inl.inc files that contain implementations of member
functions for generated classes. All Torque macros transitively called
from the top-level macros are included in the same file, to avoid any
need for these generated files to #include each other. These macros are
emitted within per-file namespaces to avoid multiple-definition build
failures.

Bug: v8:7793
Change-Id: Ic9ac3748c5020a05304773a66d7249efdc56b080
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2565067
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71664}

This is a reland of ab4d9717.
The original CL did a std::move before the final use of the NativeModule.
PS2 removes that.

TBR=petermarshall@chromium.org, thibaudm@chromium.org

Original change's description:
> [wasm] Pass the script ID to code logging
>
> We didn't pass a script ID with the code creation events for profiling.
> This made DevTools lose the connection to the wasm script, hence
> jumping from the profiler entry to the source did not work.
>
> This CL changes the timing of code logging a bit such that the script is
> always allocated before logging. In the queue of code to be logged we
> then also store the script ID, and finally set it on the {CodeEntry}
> object.
>
> R=thibaudm@chromium.org
>
> Bug: chromium:1125986
> Change-Id: I2248c1d520bc819436bbe732373f7a3446b64f48
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2575057
> Commit-Queue: Clemens Backes <clemensb@chromium.org>
> Reviewed-by: Peter Marshall <petermarshall@chromium.org>
> Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#71654}

Bug: chromium:1125986
Cq-Include-Trybots: luci.v8.try:v8_linux64_ubsan_rel_ng
Change-Id: I2a7c5fe04fff726836b1279e3d05b1702a4efb76
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2578980Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71663}

This is a reland of 064ee3c8

Issue 1: WasmEngine UAF when CompilationState is destroyed
asynchronously
Fix: Include https://chromium-review.googlesource.com/c/v8/v8/+/2565508
in this CL. Use OperationBarrier to keep WasmEngine alive.

Issue 2: In gin, JobTask lifetime is not extended beyond
JobHandle, thus making CancelAndDetach unusable.
This is fixed in chromium here:
https://chromium-review.googlesource.com/c/chromium/src/+/2566724

Original change's description:
> Reland "[wasm]: Use CancelAndDetach and barrier on BackgroundCompileJob."
>
> Reason for revert: Data race:
> https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20TSAN/34121
>
> It was assume that MockPlatform runs everything on 1 thread. However,
> MockPlatform::PostJob previously would schedule the job through
> TestPlatform, which eventually posts concurrent tasks, thus causing
> data race.
> Fix: Manually calling NewDefaultJobHandle and passing the MockPlatform
> ensures the jobs also run sequentially.
>
> Additional change:
> - CancelAndDetach is now called in ~CompilationStateImpl() to make sure
> it's called in sequence with ScheduleCompileJobForNewUnits
>
> Original CL description:
> To avoid keeping around a list of job handles, CancelAndDetach() is
> used in CancelCompilation. Dependency on WasmEngine is handled by a
> barrier that waits on all jobs to finish.
>
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2498659
> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Cr-Original-Commit-Position: refs/heads/master@{#71074}
> Change-Id: Ie9556f7f96f6fb9a61ada0e5cbd58d4fb4a0f571
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2559137
> Commit-Queue: Etienne Pierre-Doray <etiennep@chromium.org>
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#71459}

TBR=ulan@chromium.org

Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_rel_ng
Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_isolates_rel_ng
Change-Id: I6175092c97fea0d5f63a97af232e2d54cccea535
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2569360
Commit-Queue: Etienne Pierre-Doray <etiennep@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71662}

In AnalyzeLoopAssignment, tail calls were marked as invalidating the
memory cache, which in turn caused its reloading in generated code.
This is not correct since return calls end the current control branch.

Change-Id: Id3b5e60a810915ace6d9b0b13160177251adaa5e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2578981Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71661}

This reverts commit ab4d9717.

Reason for revert: UBSan issues: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20UBSan/14184/overview

Original change's description:
> [wasm] Pass the script ID to code logging
>
> We didn't pass a script ID with the code creation events for profiling.
> This made DevTools lose the connection to the wasm script, hence
> jumping from the profiler entry to the source did not work.
>
> This CL changes the timing of code logging a bit such that the script is
> always allocated before logging. In the queue of code to be logged we
> then also store the script ID, and finally set it on the {CodeEntry}
> object.
>
> R=​thibaudm@chromium.org
>
> Bug: chromium:1125986
> Change-Id: I2248c1d520bc819436bbe732373f7a3446b64f48
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2575057
> Commit-Queue: Clemens Backes <clemensb@chromium.org>
> Reviewed-by: Peter Marshall <petermarshall@chromium.org>
> Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#71654}

TBR=petermarshall@chromium.org,clemensb@chromium.org,thibaudm@chromium.org

Change-Id: I03c90c77b55e770797a6d66b1d778992a047e07a
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:1125986
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2575070Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71660}

Change-Id: Ief09e3ab31b8a49bc5e77d0235c20083615b32eb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2573479
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Lutz Vahl <vahl@chromium.org>
Commit-Queue: Lutz Vahl <vahl@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71659}

Adds support for generating code to migrate instances if a map
is a migration target, to dynamic check maps.

BUG=v8:10582

Change-Id: Id26d95491869fc68a5633398d230237eb88648d9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2575058Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71658}

This reverts commit c9c3ec4c.

Reason for revert: Speculative revert for https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/34616/overview (looks unrelated, but fails consistently since this CL)

Original change's description:
> [intl] Clean up intl_segmenter flag
>
> Intl.Segmenter shipped in m87 and launched.
>
> Bug: v8:11225
> Change-Id: I4213e261e1aea717c1281f19785a8c29ff1bbd8b
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2570461
> Commit-Queue: Frank Tang <ftang@chromium.org>
> Reviewed-by: Shu-yu Guo <syg@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#71653}

TBR=jkummerow@chromium.org,ftang@chromium.org,syg@chromium.org

Change-Id: Ic1d1b02abb9ae7faa41307eee694bb7e40d0fae2
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:11225
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2578979Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71657}

There is a verification phase in the graph verifier that is currently
disabled for WebAssembly. This CL is a first step to enable this
verification phase for WebAssembly.

CC=manoskouk@chromium.org
R=clemensb@chromium.org

Bug: v8:11236
Change-Id: I925153511f8f93e6d32d05008ddce800e61d5488
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2575062Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71656}

Bug: v8:10644
Change-Id: I83801396fe683173349d14a7590828ec86587eac
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2575122Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71655}

We didn't pass a script ID with the code creation events for profiling.
This made DevTools lose the connection to the wasm script, hence
jumping from the profiler entry to the source did not work.

This CL changes the timing of code logging a bit such that the script is
always allocated before logging. In the queue of code to be logged we
then also store the script ID, and finally set it on the {CodeEntry}
object.

R=thibaudm@chromium.org

Bug: chromium:1125986
Change-Id: I2248c1d520bc819436bbe732373f7a3446b64f48
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2575057
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71654}

Intl.Segmenter shipped in m87 and launched.

Bug: v8:11225
Change-Id: I4213e261e1aea717c1281f19785a8c29ff1bbd8b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2570461
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71653}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/b7fc8c9..115823d

Rolling v8/third_party/aemu-linux-x64: ZgEt2vZQcebeMBnTVKemE7gxtLtigVkD5iHfrp1QkDsC..SdFzWCen9aCYiL4t1JtDSA-58NHJJaXuKuTxYN5wLfgC

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/88efddc..4565794

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/e602c60..3b055d3

Rolling v8/third_party/instrumented_libraries: https://chromium.googlesource.com/chromium/src/third_party/instrumented_libraries/+log/6ba978c..4d38670

Rolling v8/third_party/jinja2: https://chromium.googlesource.com/chromium/src/third_party/jinja2/+log/a82a494..11b6b3e

Rolling v8/third_party/zlib: https://chromium.googlesource.com/chromium/src/third_party/zlib/+log/c29ee8c..2c183c9

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/9ec0bb3..36810de

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I3ae1851058c5fe420394dcf68db2e5a74e0d5955
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2578206Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#71652}

Bug: v8:10983
Change-Id: Id4b3a5909305c34cda0732b63716a2bf0324eac1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2576219Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71651}

In instruction selector for this opcode, when AVX is supported, we don't
require the second operand to be a register, so it can be an operand.

Bug: v8:1155497,v8:9198
Change-Id: I609deb69b826e686dddc237dcf2ab6129424e761
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2575787Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71650}

Although every Primitive is a Data, the Cast operations for the
subclasses of Primitive do not allow casting directly from Data to the
subclasses without first going through Value.  Because of this,
Primitives extracted from a V8::FixedArray require two casts to get to
the "real" type.

Thus, as a convenience to embedders, this change makes it possible to
cast directly from Data to all the subtypes of Primitive.

Also, this change makes the parameter names in the declarations match
those in the definitions, though there does not seem to be a universally
followed convention regarding these.

Bug: v8:10958
Change-Id: I18dc3fbb9a9bccb2cb3b75efd829af64d46d8eb9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2573816Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Dan Clark <daniec@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#71649}

ReduceToString performs heap access on the background thread.

Change-Id: Ic93ee21d6eeb96fe1dbd2b98043e6ccff0eefa64
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2577458
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71648}

Some wasm interpreter tests are failing since instructions generated
by gcc such as *multiply and and* (fmadds) create intermediate
results bigger than 8 bytes which doesn't match other architectures,
hence the resulting output differs.

Change-Id: I9c745c6be1b2b7a22085a230cc3f66ff756e0b62
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2577460Reviewed-by: Junliang Yan <junyan@redhat.com>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#71647}

This commit updates the gen-postmortem-metadata.py script to
incorporate changes in V8 8.4. This removes the need to float a
patch to the script in Node.js.

Change-Id: I69da40e792f22748b0eee2952b9009b2f03d13f3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2565275Reviewed-by: Joyee Cheung <joyee@igalia.com>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Joyee Cheung <joyee@igalia.com>
Cr-Commit-Position: refs/heads/master@{#71646}

Import wrappers were only logged if logging was enabled during
compilation. If the profiler is enabled later, and regular wasm code is
logged via {NativeModule::LogWasmCodes}, the import wrappers were
missing.
This CL fixes the long-standing TODO, and adds tests which triggered
that code path. Those tests were hanging before because the expected
functions did never appear in the profile.

Drive-by: If {WasmEngine::LogOutstandingCodesForIsolate} detects that
code logging is disabled by now, it should still clear the {code_to_log}
vector.

R=thibaudm@chromium.org

Bug: chromium:1125986, chromium:1141787
Change-Id: I2566ef369bb61a09488f2d932b6c10d92e4cb12f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2574696Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71645}

- Adds an AlignedSlotAllocator class and tests, to unify slot
  allocation. This attempts to use alignment holes for smaller
  values.
- Reworks Frame to use the new allocator for stack slots.
- Reworks LinkageAllocator to use the new allocator for stack
  slots and for ARMv7 FP register aliasing.
- Fixes the RegisterAllocator to align spill slots.
- Fixes InstructionSelector to align spill slots.

Bug: v8:9198

Change-Id: Ida148db428be89ef95de748ec5fc0e7b0358f523
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2512840
Commit-Queue: Bill Budge <bbudge@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71644}

No-Try: true
Bug: v8:11233
Change-Id: I391bbd22b4415e9a669795b62b4933fb4b3e9eef
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2575124Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71643}

For logging existing functions, currently walk the heap four times:
1) For getting the number of JS Code objects,
2) for getting the actual JS Code objects,
3) for getting the number of wasm code objects,
4) for getting the actual wasm code objects.

This CL refactors this to do only two heap walks (one for JS, one for
wasm). It also avoids the use of the brittle {ScopedVector} and uses a
{std::vector} instead.

R=thibaudm@chromium.org

Bug: chromium:1125986
Change-Id: I47e3c41ed65f4011ad8826f5e115db6459680807
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2571121
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71642}

Previously V8 would wrap the WebAssembly.Memory backing stores into
Uint8Arrays and report that as memories, but that's confusing to the
developer, since that's not what's really being used. The way that
DevTools presents the backing stores of memories, it's still perfectly
possible to get hold of an Uint8Array if that's what the developer is
looking for.

To make it possible to easily identify the WebAssembly.Memory objects
in the DevTools front-end (in particular for the memory inspector) we
add a 'webassemblymemory' subtype to the Chrome DevTools Protocol. We
also improve the description for the memories to include the number
of active pages.

Fixed: chromium:1155566
Screenshot: https://imgur.com/8enx57u.png
Change-Id: I63dbabe0e372e9ad6dcc8e6642cdb743147a620c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2574699Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71641}

Bug: v8:11074
Change-Id: Ic8514d33938a60ff5513463d4754fb7fc5f85491
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2569564Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71640}

Dependent code deopts were only printed with --trace-deopt-verbose
earlier. These just print one line and are helpful with --trace-deopt.
If we don't print these with --trace-deopt, it appears as if
we are optimizing without any deopts in between which is a bit
confusing.

Change-Id: I29b0f2ebbaac2a1ffc498e93c8433c986e429ef3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2573485Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71639}