Change-Id: I6dd7a99d464940304cfced8ab301e23e7b658762
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2764782Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#73446}

R=clemensb@chromium.org

Bug: v8:11453
Change-Id: I9775032093ac1a0883339cb32bb30b7710f08491
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2763877
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73445}

In wasm-compiler, nodes that reference the Isolate and Instance should
depend on whether the current frame JS or Wasm. This was implemented
with mutable fields caching nodes in WasmGraphBuilder and its
subclasses, but was not done consistently.
This CL removes all mutability and replaces it with an additional field
isolate_ in WasmGraphBuilder, which is only set in the constructor of
the child class WasmWrapperGraphBuilder.

Additional changes:
- Remove three almost-unused utilities from WasmGraphAssembler.
- Reduce duplicate BuildImportCall with int index argument to the one
  with Node* index argument (the additional operations should be
  optimized away).

Bug: v8:11510
Change-Id: I2bb44a617210916edf671c238402727e04bdc38f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2739976Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73444}

R=clemensb@chromium.org

Bug: v8:11453
Change-Id: I8a29f1359b9f77401bba1f6abb8d11221b742176
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2763876
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73443}

This CL implements the above in a concurrent setting without relying
on serialization (except existing serialization to read a consistent
JSObject state, which should be addressed in future work).

There are three main cases in which GetOwnConstantElement can succeed:

- Frozen elements are always constant. The backing store is immutable
after initialization and can be accessed through relaxed reads.
- String wrapper elements are always constant. The JSPrimitiveWrapper
is immutable after initialization, and internalized Strings are
protected by a mutex (other string kinds are currently not handled).
- Dictionary elements may be constant. Since this case is not
particularly important for the optimization, we leave it unimplemented
for now.

Bug: v8:7790
Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_no_cm_rel_ng
Change-Id: If2fbced50218ebd3930da8157cd2ae5eb83a8e02
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2717308Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73442}

(See bug for repro.)

Bug: v8:11571
Change-Id: I7cf7ddad1c031c476d29edf5a3922c64079c186b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2764462Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73441}

Add a test for a module without a start function; in that case, we want
to break when first calling into the module (via an exported function).

R=bmeurer@chromium.org

Bug: chromium:1151211
Change-Id: Id14978b5feff4dcd64cff828951f2a00b73c9736
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2763880Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73440}

R=clemensb@chromium.org

Bug: v8:11453
Change-Id: I6e73f68f842e9f5de95bed1233bfcc08ab600b43
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2763873Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73439}

macOS’s `readlink` doesn’t support the `-f` flag. By using `realpath`
we get the same functionality with added support for macOS.

Finally, this patch adds `v8` and `v8-debug` to the completion
command. These are the binary names used by jsvu [1].

[1]: https://github.com/GoogleChromeLabs/jsvu

Bug: v8:11567
Change-Id: I1ec47752e50bce4bfb97a7ce23571d0a6e55dbc1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2762147
Commit-Queue: Mathias Bynens <mathias@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73438}

Bug: chromium:1188212
Change-Id: I2c01544e5ff114d4fbdb853a344eb2b6250ee7ab
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2763881Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73437}

Bonus: this contains small regression tests for the issues fixed in
https://chromium-review.googlesource.com/c/v8/v8/+/2739586.

Fixed: chromium:1186603
Change-Id: I6eca2ef41936555e6fe81555805a659b30023952
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2761201
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73436}

Because why not.

No-Try: true
Bug: v8:11567
Change-Id: I763d9d0c6704f3f8c5e8336e2157336e159648fe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2762139
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73435}

Processing StateValues into operands is one of the most costly
parts of instruction selection. As it happens, StateValues are
shared by many nodes, and so we are unecessarily reprocessing
the same StateValues multiple times. This CL introduces caching
for the processed StateValues enabling very fast emitting of
operands for subsiquent instructions with the same StateValue.
The hitrate for the cache is higher than 90% on most optimizations.

BUG=v8:9684

Change-Id: I7edcfa1b0d7add16e509f0e2abeda0a8873f5a95
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2756535
Auto-Submit: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73434}

We had two similar methods (HasOnlyStablePrototypesWithFastElements and
HasOnlyStablePrototypesWithFastElementsHelper) which seemed to have been
defined to be used in different places, but they were used in only one
place each. We can specialize those methods based on their uses and not
worry about the other cases.

Bug: v8:7790
Change-Id: I2341ce4849d421afd960cb199908f9c98511999e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2759523Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73433}

Most of Map's bit_field (as in not 2 or 3) accessors are not set after
construction e.g. is_callable. They are also not used as a
synchronization point. From the compiler's point of view, they can be
set as non-atomic. There are two accessors (`prototype_slot` and
`non_instance_prototype`) that have to be atomic for concurrent marker
reasons (relaxed is fine for them).

Bug: v8:7790, chromium:1150811
Change-Id: Ic3c81a59e7895ee9c35a128bb10656040b19dd42
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2752154Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73432}

Allocate the TryInfo in a unique_ptr to ensure that its destructor is
called when the corresponding control block is popped from the control
stack.
In particular, the cache state allocates memory on the heap which is
otherwise never freed.

R=clemensb@chromium.org

Bug: chromium:1185127
Change-Id: I3aee5573f99ef94c13d0649413a4e647a32bc555
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2739649
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73431}

Release-official builds strip error messages from CHECK messages.
This can make it difficult to distinguish a CHECK crash location in
crash reports. As such, instead of using V8_FatalNoContext, import the
IMMEDIATE_CRASH macro from chromium and use that instead, which should
cause a crash directly in the instruction stream so that the top
stackframe on the crash report directly identifies the CHECK location
that failed.

More details here:
https://docs.google.com/document/d/1tyMwzxUNH8BctM_urSQIYdcbwmzP4kTnwEjnFamBpKY

Change-Id: I5b8175f19571834f790060d641db08d0b9c2c17b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2756223Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73430}

We try and match literal load instructions in order to print a
relocation info comment. However, we could be doing it while we're
decoding a constant pool. This would cause a DCHECK to fire on Arm64
with full pointers.

Change-Id: I82a523dc5c033f86f41467db75e43419ab87d5ca
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2756532Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Commit-Queue: Pierre Langlois <pierre.langlois@arm.com>
Cr-Commit-Position: refs/heads/master@{#73429}

Change-Id: Iec90b4821f41838eb4c2bae26035af4e30082ef9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2762140Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Frank Emrich <emrich@google.com>
Cr-Commit-Position: refs/heads/master@{#73428}

The register allocator sometimes fails if a parameter node appears
twice. This seems to be an issue in the register allocator rather than
a global assumption of Turbofan. This CL ensures duplication does not
happen in wasm code until the issue is resolved.

Changes:
- Cache parameter nodes in wasm-compiler.
- Use Dead() over Parameter() as placeholder in lowering stages.

Change-Id: I7afb5de45dd169819309fea3d3c1a7cfe68af62c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2756529
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73427}

Poisoning unmarked objects serves two purposes:
- Prohibits finalizer from accessing other unmarked objects;
- Unpoisioning also clears potential poisoning of the embedder which
  is necessary as the sweeper and compactor modify the payload of
  objects;

Bug: chromium:1056170
Change-Id: I4346a0ab736603b3d6170b41b0e7255db1452897
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2762137Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73426}

Using RW to update code perturbs SMC snooping on some CPUs.
This reland fixes Apple Silicon and jitless by forcing the flag off.

Change-Id: Ie2cc2e4fac333cad24a129e59cbcb6b13590d6d8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2759515
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Auto-Submit: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73425}

While testing the perf for v8-etw, I noticed that the runtime flag
didn't completely guard from event emission. This change fixes that.

Bug: v8:11043
Change-Id: Iee919e6030214e18173c93e4426d6437aed08235
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2757894Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Sara Tang <sartang@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#73424}

This updates tools/bash-completion.sh to consider flags defined
in src/wasm/wasm-feature-flags.h.

No-Try: true
Change-Id: I0556d237608c88a87d65f739c856f94e35e2123e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2761398
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73423}

This will make accidental includes much easier to see and fix. Without
this, you might get compiler or linker errors instead.

R=jkummerow@chromium.org

Bug: v8:11238
Cq-Include-Trybots: luci.v8.try:v8_linux64_no_wasm_compile_rel
Change-Id: I235d779f9c1ed3af5d736f1554ded427935ddc9b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2756531
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73422}

When the builder was moved to the main console it should have gotten
a higher priority for tests as otherwise it's affected of bot
shortage as in the bug below.

No-Try: true
Bug: v8:11566
Change-Id: Ide63f3659a8791e5ef4b48fc62504bc06bd09453
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2762149
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73421}

This removes all wasm-related flags in no-wasm builds.
We could have made them read-only, but fully removing them actually
forces us to consider the no-wasm case at every use site, which often
hints at further cleanups.

R=jkummerow@chromium.org

Bug: v8:11238
Change-Id: Ic140031a2732975b2a46116a58e26fe49f1f7c8c
Cq-Include-Trybots: luci.v8.try:v8_linux64_no_wasm_compile_rel
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2759518
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73420}

Port: 3e689a7d

Bug: v8:11453
Change-Id: I5671fe0505f0dfd924aa9b5242b3277ed03f2337
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2763632
Auto-Submit: Liu yu <liuyu@loongson.cn>
Reviewed-by: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/master@{#73419}

This removes the TYPE_WASM script type, and all fields on Script that
are only needed for WebAssembly.

R=jgruber@chromium.org

Bug: v8:11238
Change-Id: I233bfd3dec9b389bc74d926670310fd175c0c6d8
Cq-Include-Trybots: luci.v8.try:v8_linux64_no_wasm_compile_rel
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2757690Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73418}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/5f2e66e..5081eef

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/6e87bdd..6d5a4e5

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/159efca..593a6b5

TBR=v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: Ic44d5c48396e5e2bdfe7183434eb4defaf78d805
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2762676Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#73417}

Note that top-level await is already on-by-default in blink. This flips
the flag in V8 only for other embedders.

Bug: v8:9344
Change-Id: Ic860b22316718b353a0493799fdf95200a71acc1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2746843
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Auto-Submit: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73416}

palignr has a false dependency, so use punpckhbw. Plus optimize for AVX,
which can have 1 less instruction.

The logic for i16x8.extmul_high_u is slightly complicated (SSE case)
to handle register aliasing. This allows us to have the most flexible
register allocation, and be able to optimize the most

Bug: v8:11468
Change-Id: I221b2d7a79009edb6c4060c136fc35ee7aff08fa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2757224Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73415}

I want to extract the Canonicalize shuffle out of the arch-specific
instruction selector, since all archs have to do that anyway. Adding
these tests to make sure the matching still works.

Bug: v8:11542
Change-Id: Ic7ce0e0a027ce858a30f79a0f9ef2495bcaab4c7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2750289Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73414}

S128Load and S128Store are not used, we create a node with Load/Store
opcode and store the appropriate LoadType/StoreType indicating this is a
128-bit type.

Bug: v8:11384
Change-Id: Ida4a36ab893637525cb827b659753ac90fcca743
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2760539Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73413}

Change-Id: I00ec1cd82160d7e987b7d66dfefd7297f665f05f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2760958
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Reviewed-by: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/master@{#73412}

Bug: v8:11454
Change-Id: I44ed59d5ca7d998ff1affd8acb30862b532a8b3b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2759519
Auto-Submit: Almothana Athamneh <almuthanna@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73411}

asm validation and translation to wasm is disabled in no-wasm builds,
hence remove respective detection and marking of scopes and functions.

R=verwaest@chromium.org

Bug: v8:11238
Change-Id: I2ac8a84024fa37a0c5896a0f85ea4beea4d93137
Cq-Include-Trybots: luci.v8.try:v8_linux64_no_wasm_compile_rel
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2757689Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73410}

"FinishCall" is also unnecessary after a tail call, move it inside the
condition too.

R=clemensb@chromium.org

Bug: chromium:1187484
Change-Id: I258dd736565546277deb33e52a4619d6aaa2fe25
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2759512Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73409}

Change-Id: I5608c6123433b1378d92c534e8f38dba68ac3d15
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2760778Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#73408}

Add a module-wide cache to cache both TurboFan code and Liftoff debug
code, such that we can quickly tier up or down a module without
repeated recompilation.

R=thibaudm@chromium.org

Bug: v8:11556
Change-Id: Iec56e67b53e5a40c11ca24dae0728cb569a7c68f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2757688
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73407}