This reverts commit 42cd9eb7.

Reason for revert: Clusterfuzz issues, e.g.
https://bugs.chromium.org/p/chromium/issues/detail?id=1176318

Original change's description:
> [compiler] Directly read PropertyCells
>
> Main changes:
>
> - Introduce a new broker data kind kBackgroundSerialized for objects
>   that can be serialized in the background (when direct reads are on).
>   (I'm planning to remove kPossiblyBackgroundSerialized in a followup,
>   in favor of a dynamic choice of kSerialized or kBackgroundSerialized).
> - Make PropertyCell use that new kind.
> - Introduce a bottleneck in runtime code for changes to PropertyCells
>   and make sure that a certain protocol is followed that allows
>   concurrent reads from the background thread.
> - Improve interface of PropertyCell in various ways.
>
> Bug: v8:7790
> Change-Id: If3d7926c3b894808811348b4b2bed153f5c06897
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2661462
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
> Commit-Queue: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#72586}

TBR=ulan@chromium.org,neis@chromium.org,verwaest@chromium.org,nicohartmann@chromium.org

Change-Id: Id04145760c49fa379bc5a3fc16eba664025a9180
Bug: v8:7790
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2685125Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72619}

TimeToSafepoint is the time needed for all background threads to enter
a safepoint after the GC was started on the main thread. This CL
improves that metric during concurrent compilation to bytecode by doing:

1) Park the LocalIsolate during
   InterpreterCompilationJob::ExecuteJobImpl. There are no concurrent
   heap accesses happening while generating bytecode for now. So instead
   of manually placing Safepoint() invocations in the code, simply park
   the local isolate.
2) Destroy the LocalIsolate before the ReleaseParser operation. I've
   seen this take around 2ms, which regressed TimeToSafepoint a lot.
3) Add explicit safepoints to concurrent allocations. This covers the
   rest of the code and from what I've seen so far this is good enough
   to keep TimeToSafepoint around a few microseconds.

I've still seen TimeToSafepoint events with 20-80 microseconds but those
were quite rare and always seemed to be related to Turbofan.

AsLocalIsolate() is necessary in generic code to convert both Isolate
and LocalIsolate to LocalIsolate.

Bug: v8:10315
Change-Id: Idaf9f04ffdf850d0ab0081ec372cc384a9fe7ef9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2663159Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72618}

This reverts commit 5cc7bfd0.

Reason for revert: Need to revert dependency.

Original change's description:
> [compiler] Clean up ObjectDataKind
>
> In particular: remove PossiblyBackgroundSerializedHeapObject in favor of
> either SerializedHeapObject or BackgroundSerializedHeapObject, depending
> on the (existing) argument to the ObjectRef constructor.
>
> Bug: v8:7790
> Change-Id: I0a67872c377107799233742cc7774bea62811d0f
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2681946
> Commit-Queue: Georg Neis <neis@chromium.org>
> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
> Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#72591}

TBR=neis@chromium.org,solanes@chromium.org,nicohartmann@chromium.org

Change-Id: I48a96504c29851587529d7d12cb15e569aec196b
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7790
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2685124Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72617}

Bug: v8:11424
Change-Id: Ic9c9dc2609ee85f046f6bc5794004ededd32bee5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2684931
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72616}

Extract i8x16.popcnt implementation into a macro-assembler function, and
reuse it in Liftoff.

We need an additional temporary XMMRegister whose lifetimes overlap with
dst and src, so make sure to pin those 2 when getting an unused
XMMRegister.

Bug: v8:11002
Change-Id: I13400b139add6f12316b3f398a796e6bf5a1ea7f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2676921
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72615}

This is a reland of 00babf07

No changes from original patch, previous CQ failures were likely
a Mac infra issue https://chromium-review.googlesource.com/c/2682521.

Original change's description:
> [wasm-simd][x64][liftoff] Implement i8x16.popcnt
>
> Extract i8x16.popcnt implementation into a macro-assembler function, and
> reuse it in Liftoff.
>
> Bug: v8:11002
> Change-Id: I86b2f5322c799d44f584cac28c70e0e393bf114f
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2676280
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
> Commit-Queue: Zhi An Ng <zhin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#72565}

Bug: v8:11002
Change-Id: Ic8bcbdb3444865805d8d2af3669ccb4a05c4426d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2682507Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72614}

This reverts commit 8b6fd147.

This adds --no-stress-flush-bytecode to the failing assertOptimized test as the flag changed the GC pattern and was deoptimizing code.

Original change's description:
> Revert "[regexp] Ship RegExp match indices"
>
> This reverts commit 72464122.
>
> Reason for revert:
> https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20gc%20stress/32046
>
> Original change's description:
> > [regexp] Ship RegExp match indices
> >
> > I2S:
> > https://groups.google.com/a/chromium.org/g/blink-dev/c/RR_dw_ZXtT0/m/xtgu5jjyAQAJ
> >
> > Bug: v8:9548
> > Change-Id: I8ccf2f4c38f9b9204ae47162303f21d2d44498e8
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2682508
> > Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> > Auto-Submit: Shu-yu Guo <syg@chromium.org>
> > Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#72571}
>
> TBR=jgruber@chromium.org,syg@chromium.org
>
> Change-Id: I1173389082928aa5c9895ca4fb360c7ab8ec073b
> No-Presubmit: true
> No-Tree-Checks: true
> No-Try: true
> Bug: v8:9548
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2681943
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#72576}

TBR=machenbach@chromium.org,jgruber@chromium.org,syg@chromium.org

# Not skipping CQ checks because this is a reland.

Bug: v8:9548
Change-Id: Ie18b16f347061602f35e3dea371c03d2ae136127
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2686098
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72613}

Bug: v8:11416
Change-Id: I8148e0191d0632cad6f8b659be4ba58ef4f11d6b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2686307Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72612}

This is a partial revert of https://crrev.com/c/2457669/.

This change is slightly longer (in code-generator-x64.cc) because we
also implement support when SSE4_2 is not supported (the reverted change
seems to assume SSE4_2, which is not always the case). This code
sequence is from https://github.com/WebAssembly/simd/pull/412.

Bug: v8:11415
Change-Id: I3eef415667b4142887cf1c449d27d19ba5bbd208
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2683219
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72611}

Port 68105996

Original Commit Message:

    WasmCompileLazy needs to save the content of vector
    parameter registers. If Simd is not enabled or the hardware
    does not support Simd operations then we need to saves the value of
    Double registers instead, therefore we need a way to retrieve the
    value of "CpuFeatures::SupportsWasmSimd128()" in builtins
    during runtime.

R=mfarazma@redhat.com, joransiu@ca.ibm.com, junyan@redhat.com, midawson@redhat.com
BUG=
LOG=N

Change-Id: I523f1353c61942acaa97c11637342b5be3d39b9d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2684980Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#72610}

Bug: chromium:1056170
Change-Id: I225f81235fe9d4f8fd26cc49446534e3f6c884ea
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2684834
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72609}

Port 257c303f

R=zhin@chromium.org, joransiu@ca.ibm.com, junyan@redhat.com, midawson@redhat.com
BUG=
LOG=N

Change-Id: I47fd3af2d1382ec12fcf64ca6eee72d3d41050bb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2685120Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#72608}

Implements https://github.com/tc39/ecma262/issues/2034

Currently the token sequence `for (async of` is ambiguous. It can be the
prefix for either `(async of => {};;);` or `for (async of foo);`. This
CL disallows the token sequence.

Note that `for await (async of` is still allowed, since there is no
C-style `for await (;;)`, and thus no ambiguity.

Bug: v8:11412
Change-Id: I3fede83a69420996baa2bc8b6c1cff000535d990
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2683221
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72607}

Bug: v8:11265
Change-Id: Ia51f2d177430e8659e745835fbdee57ad5ef5e07
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2683205Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72606}

- Removes kPadArguments boolean.
- Changes ShouldPadArguments to ArgumentPaddingSlots to reflect
  that on some architectures more than 1 padding slot may be needed.
- Adds AddArgumentPaddingSlots and ShouldPadArguments convenience
  functions.

Bug: v8:9198

Change-Id: Iba87518e071a75fb951b490d3f75a87ca715cc23
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2679109
Commit-Queue: Bill Budge <bbudge@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72605}

This reverts commit 21b3181a.

Reason for revert: Original CL is reverted.

Original change's description:
> PPC/s390: [wasm-simd][liftoff] Implement i8x16.popcnt
>
> Port 00babf07
>
> Original Commit Message:
>
>     Extract i8x16.popcnt implementation into a macro-assembler function, and
>     reuse it in Liftoff.
>
> R=​zhin@chromium.org, joransiu@ca.ibm.com, junyan@redhat.com, midawson@redhat.com
> BUG=
> LOG=N
>
> Change-Id: Id0f14597a97f90424aa450b2527ea71da1b2e8ce
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2679273
> Reviewed-by: Junliang Yan <junyan@redhat.com>
> Commit-Queue: Junliang Yan <junyan@redhat.com>
> Cr-Commit-Position: refs/heads/master@{#72601}

TBR=joransiu@ca.ibm.com,zhin@chromium.org,mfarazma@redhat.com,midawson@redhat.com,junyan@redhat.com

Change-Id: I54dd854e305d0fbbd475c0f756bc41acac74fa56
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2685060Reviewed-by: Milad Fa <mfarazma@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#72604}

Bug: v8:11347,v8:11348,chromium:1174498
Change-Id: I9afaacefcab55a6d7eb48f6e9d1848b714f64eb6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2666147Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72603}

pmovsxdq, pmovzxdq, and pcmpeqq requires SSE4.1.

Bug: v8:11215,v8:10972
Change-Id: I77e17378f819ce44ccc09a42f1d5778d7f6cf0e2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2683222Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72602}

Port 00babf07

Original Commit Message:

    Extract i8x16.popcnt implementation into a macro-assembler function, and
    reuse it in Liftoff.

R=zhin@chromium.org, joransiu@ca.ibm.com, junyan@redhat.com, midawson@redhat.com
BUG=
LOG=N

Change-Id: Id0f14597a97f90424aa450b2527ea71da1b2e8ce
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2679273Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/master@{#72601}

Port 3b6eb335

Original Commit Message:

    Prototype these 6 instructions on arm:

    - f64x2.convert_low_i32x4_s
    - f64x2.convert_low_i32x4_u
    - i32x4.trunc_sat_f64x2_s_zero
    - i32x4.trunc_sat_f64x2_u_zero
    - f32x4.demote_f64x2_zero
    - f64x2.promote_low_f32x4

    For all these instructions we rely on having Q registers that map to S
    registers, which means we can only use q0 to q7. We fix the src/dst
    to q0 arbitrarily.

R=zhin@chromium.org, joransiu@ca.ibm.com, junyan@redhat.com, midawson@redhat.com
BUG=
LOG=N

Bug: v8:11265
Change-Id: Ibef0b05fe1066cd79ddcda12787441b09cc8ede2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2684360Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#72600}

Change-Id: Ia314fc4a4e659b127597d85718dae7ddc01113c4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2684634
Commit-Queue: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Reviewed-by: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#72599}

This very large changeset adds support for RISC-V.

Bug: v8:10991
Change-Id: Ic997c94cc12bba6881bc208e66526f423dd0679c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2571344
Commit-Queue: Brice Dobry <brice.dobry@futurewei.com>
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72598}

v8_generate_external_defines_header has been enabled for a couple of
weeks now with no problems, so this removes the hybrid state where
V8_GN_HEADER was defined on the command line along with the other
defines.

Bug: v8:11292, v8:11341
Change-Id: Ie78f00afe5d1cbca751101a7beb61a18c7d86d04
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2681947
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Auto-Submit: Dan Elphick <delphick@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72597}

This CL adds support for generating acquire/release accessors on class
fields. Adds first use of this new feature (@acquireRead and
@releaseWrite) on FunctionTemplateInfo::rare_data.

Bug: v8:7790, v8:11122
Change-Id: I98f533807ab784d8667fd43564fe84686d27830c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2679684Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Seth Brenith <seth.brenith@microsoft.com>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72596}

This fixes a build problem in gcc, where the constexpr function
SwissNameDictionary::SizeFor uses the non-constxpr function
SwissNameDictionary::IsValidCapacity in a DCHECK.

Bug: v8:11388
Change-Id: Iaeb2b80bb72da3a9c895aa33977c160533019c35
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2684514Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Frank Emrich <emrich@google.com>
Cr-Commit-Position: refs/heads/master@{#72595}

Bug: v8:7748
Change-Id: Id84459c496f7e57b36c3acd13a91d39b7e9fb15f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2676630Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72594}

The is_awaiting bit on async generators distinguishes waiting on an
await. When the async generator resumes from an await, the is_awaiting
bit is cleared.

It is possible through overriding Promise#constructor that `await`
throws *after* setting is_awaiting. There is an implicit try-catch
around the body of the async generator such that, usually, caught
exceptions would clear the is_awaiting bit. However, the exception
thrown from a monkeypatched Promise#constructor can be caught by script,
and thus never clear the is_awaiting bit.

This CL sets the is_awaiting bit *after* `await` completes, with the
exception of the return resumption. It is not possible to have the
exception thrown by the await in the return resumption be caught by
script.

Bug: chromium:1171667
Change-Id: I0b615617a5c949f03350ab0f06c42920d43b5488
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2659508Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72593}

- No noticeable changes in runtime performance according to js-perf-test/RegExp/{base_search.js, base_match.js} benchmarks
- Slight builtin code sizes reduction:

BEFORE
======
TFJ Builtin, StringPrototypeSearch, 1592
TFJ Builtin, StringPrototypeMatch, 1592

AFTER
=====
TFJ Builtin, StringPrototypeSearch, 1432
TFJ Builtin, StringPrototypeMatch, 1432

Bug: v8:8996
Change-Id: Ifeadac1c924a36003a41be3b805438522f8188be
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2670247Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Peter Wong <peter.wm.wong@gmail.com>
Cr-Commit-Position: refs/heads/master@{#72592}

In particular: remove PossiblyBackgroundSerializedHeapObject in favor of
either SerializedHeapObject or BackgroundSerializedHeapObject, depending
on the (existing) argument to the ObjectRef constructor.

Bug: v8:7790
Change-Id: I0a67872c377107799233742cc7774bea62811d0f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2681946
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72591}

Turboprop doesn't use optimizations based on field constness to reduce
the number of deoptimizations. While this is safe for loads, for stores
if a different value is stored to a const field we should update the
constness of the field. This is needed so we can safely deopt any other
code that is relying on the constness of the field. Currently, turboprop
doesn't do this. So for now treat stores to constant fields similar to
TurboFan. In future, we may consider adding code to update the field
constness if necessary to reduce the number of deoptimizations.


Bug: chromium:1172797, v8:9684
Change-Id: I1d660457cb5d647e1283a495040a7e452fe1ac7e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2673401
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72590}

The only opcode which can pop the last control block is "end".
There is already validation in place to check that no code is following
the last "end". Thus all checks for a non-empty control stack in other
opcodes are redundant and can be replaced by DCHECKs.

Drive-by: Avoid the use of {PushControl} for pushing the very first
block, to avoid another check for an empty control stack there.

R=thibaudm@chromium.org

Change-Id: I8f04b225a61f832bca2dd7b706e31d1faa173767
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2678162Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72589}

- Fixes a problem when constructing Wasm CallDescriptors, where the
  allocation tries to treat parameters and returns as if they are in the
  same frame. This doesn't work when slots may be aligned in their
  frame. Instead, allocate parameters and returns separately and offset
  return slots by the number of parameter slots.
- Adds argument slot padding in the CallDescriptor lowering case, to
  prepare for when 32 bit targets align stack frames and require
  padding.
- Adds a regression test.

Bug: chromium:1174500
Change-Id: I60d96a94b171a0d27ff61cbab35623976b0c6da8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2683024
Commit-Queue: Bill Budge <bbudge@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72588}

Bug: v8:7790
Change-Id: Iabfbb36c18935b04ee4c67129accd3a9b4729b3a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2681942
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72587}

Main changes:

- Introduce a new broker data kind kBackgroundSerialized for objects
  that can be serialized in the background (when direct reads are on).
  (I'm planning to remove kPossiblyBackgroundSerialized in a followup,
  in favor of a dynamic choice of kSerialized or kBackgroundSerialized).
- Make PropertyCell use that new kind.
- Introduce a bottleneck in runtime code for changes to PropertyCells
  and make sure that a certain protocol is followed that allows
  concurrent reads from the background thread.
- Improve interface of PropertyCell in various ways.

Bug: v8:7790
Change-Id: If3d7926c3b894808811348b4b2bed153f5c06897
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2661462Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72586}

Those dynamic allocations are responsible for 5-10% of execution time in
wasm code publishing, which again is the biggest contributor to
deserialization time. The allocations are used for patching the jump
table. This CL avoids dynamic memory allocation by having some
thread-local space that is re-used for allocations of
ExternalAssemblerBufferImpl. Since those objects are small, memory usage
is not a concern here.

R=jkummerow@chromium.org

Bug: v8:11164
Cq-Include-Trybots: luci.v8.try:v8_linux64_asan_rel_ng
Cq-Include-Trybots: luci.v8.try:v8_linux64_msan_rel_ng
Cq-Include-Trybots: luci.v8.try:v8_linux64_ubsan_rel_ng
Change-Id: I44aad86fa821a1ccb59b539da861a346f62a9813
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2667859
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72585}

WasmCompileLazy needs to save the content of vector
parameter registers. If Simd is not enabled or the hardware
does not support Simd operations then we need to saves the value of
Double registers instead, therefore we need a way to retrieve the
value of "CpuFeatures::SupportsWasmSimd128()" in builtins
during runtime.

Bug: v8:11377
Change-Id: I74a5f870d7077166548472adb25c3fb06d0ebdb9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2679682Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Junliang Yan <junyan@redhat.com>
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#72584}

This reverts commit da785659.

Reason for revert: Investigating regressions https://chromeperf.appspot.com/group_report?rev=72572

Original change's description:
> [compiler] Don't serialize JSTypedArray fields
>
> This CL removes serialization of JSTypedArray fields when direct heap
> reads are enabled. Invariants we rely on:
>
> - Of the underlying interesting fields,
>   - base_pointer and external_pointer are set either during
>     initialization, or in a one-time on-to-off-heap transition in
>     GetBuffer.
>   - length and buffer are immutable after initialization.
> - is_on_heap and DataPtr derive from base_pointer and
>   external_pointer s.t. is_on_heap == (base_pointer != 0) and
>   DataPtr == external_pointer in the off-heap case.
>
> In this CL we add one new invariant:
>
> - For all base_pointer and external_pointer mutations after
>   initialization, base_pointer is guaranteed to be release-stored
>   after external_pointer has been written.
>
> With these invariants, concurrent access to off-heap typed arrays is
> trivial as long as is_on_heap (= base_pointer) is read before other
> relevant fields.
>
> Note that JSTypedArray remains a kSerializedHeapObject due to the
> serialized superclass JSObject.
>
> Drive-by: Remove unused Torque operators and empty TODOs.
>
> Bug: v8:7790
> Change-Id: I3c4327318f94e4e6083d4e87476069aad2649386
> Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_isolates_rel_ng
> Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_rel_ng
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2679689
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#72572}

TBR=neis@chromium.org,jgruber@chromium.org

Change-Id: I5a7e6bacb7b7a3e3510c778837679e6822f26339
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7790
Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_isolates_rel_ng
Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2681948Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72583}

This CL is part of a series that adds the C++ implementation of
SwissNameDictionary, a deterministic property backing store based on
Swiss Tables.

This CL contains most of the boilerplate code for introducing a new
instance type.

Bug: v8:11388
Change-Id: Id263b8138a8ce4b465fb28d968223d2e1aaf05a4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2672030Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Frank Emrich <emrich@google.com>
Cr-Commit-Position: refs/heads/master@{#72582}

The interpreter frame is only used for testing now (see linked issue).
This CL removes some remnants in messages.{h,cc}.

R=bmeurer@chromium.org

Bug: v8:10389
Change-Id: I369057ed02dbb68ba40ef9b4aa9a84799d3db528
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2681944
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Auto-Submit: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72581}

Bug: v8:11092
Change-Id: I62fe079a67a4643d2e42cbdeabf26b5c7d8bc148
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2677813Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Paolo Severini <paolosev@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#72580}