Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/d77db9e..ca471fc

Rolling v8/third_party/aemu-linux-x64: UncMpcoIeFj9FKkqbpkwnPCh8YmqHZcucJu-mi7jF1MC..LUFkW5GTwXItfKWgJt7kkk1hEf35ZueIbx73KwUN5K0C

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I60c55187182f5e19dd677838779757795e82df73
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2420451Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#70015}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/153ad0b..d77db9e

Rolling v8/third_party/aemu-linux-x64: QxDL1Bk85zKmALn9xHGhro_uZAytSTHjJ--QwZLaT7oC..UncMpcoIeFj9FKkqbpkwnPCh8YmqHZcucJu-mi7jF1MC

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/d949c91..244d770

Rolling v8/third_party/jinja2: https://chromium.googlesource.com/chromium/src/third_party/jinja2/+log/61cfe2a..a82a494

Rolling v8/tools/luci-go: git_revision:b022173f8069cf8001d4cf2a87ce7c5f0eae220f..git_revision:83c3df996b224edf5061840744395707a0e513e7

Rolling v8/tools/luci-go: git_revision:b022173f8069cf8001d4cf2a87ce7c5f0eae220f..git_revision:83c3df996b224edf5061840744395707a0e513e7

Rolling v8/tools/luci-go: git_revision:b022173f8069cf8001d4cf2a87ce7c5f0eae220f..git_revision:83c3df996b224edf5061840744395707a0e513e7

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I3305d8fa9f2a741f1f6fdd14b9754f4f42b76bc9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2419992Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#70014}

The DCHECK is only guaranteed to hold after checking that is_logging()
still returns true.

Bug: v8:10315
Change-Id: Ia43657faffa4c7eda70c95a446bee1389d08e6fd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2418713Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70013}

TBR=tebbi@chromium.org

Bug: v8:10577
Change-Id: I3367c31afb9f38f9151d3c5787a7838da4db327a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2418717Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70012}

This reverts commit c0564971.

Reason for revert: Speculative revert, ASAN is failing consistently:
https://ci.chromium.org/p/v8/builders/ci/V8%20Win64%20ASAN/15103

Original change's description:
> [parser] Use SmallVector(1) for DeclarationParsingResult::declarations
> 
> Typically we'll parse a single declaration when parsing variable declarations.
> Using on-stack storage rather than std::vector that requires malloc is much
> more efficient.
> 
> Change-Id: Id99515bb4ce7ea2dae46498f8f9f9d49c33c7353
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2418393
> Commit-Queue: Toon Verwaest <verwaest@chromium.org>
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69995}

TBR=leszeks@chromium.org,verwaest@chromium.org

Change-Id: I6e46c058f16c965e905f20b8df473a8fb22cc6cc
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2419037Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70011}

This reverts commit cfe9544a.

Reason for revert: Some spec tests fail:
https://ci.chromium.org/p/v8/builders/ci/V8%20Arm%20-%20debug/15933

Original change's description:
> [wasm-simd][scalar-lowering] Enable some spec tests
> 
> These tests can now be enabled as we implemented more scalar lowering
> support.
> 
> Bug: v8:10507
> Change-Id: Ida5f896300e074db079ec24720302729b0582d9d
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2411774
> Reviewed-by: Bill Budge <bbudge@chromium.org>
> Commit-Queue: Zhi An Ng <zhin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70006}

TBR=bbudge@chromium.org,zhin@chromium.org

Change-Id: Idb2da40178860f045ffab9ab5b2c8b1f2ebafcf6
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10507
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2419036Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70010}

This reverts commit 66e4c99c.

Reason for revert: Causes TSAN data races:
https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20TSAN%20-%20isolates/11350

Original change's description:
> [d8] Avoid recursive unhandled rejected Promise processing
> 
> Bug: chromium:1126309
> Change-Id: I9d9d33cd151ed8af5ee8af09b8957eae9df2dcb1
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2410059
> Commit-Queue: Toon Verwaest <verwaest@chromium.org>
> Auto-Submit: Camillo Bruni <cbruni@chromium.org>
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69986}

TBR=cbruni@chromium.org,verwaest@chromium.org

Change-Id: I39e6e40ade8d0fd8d3260d41513e68b4763753fe
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:1126309
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2419034Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70009}

Cast to int32_t after checking the range.

Bug: v8:10921

Cq-Include-Trybots: luci.v8.try:v8_linux64_ubsan_rel_ng,v8_linux64_asan_rel_ng,v8_linux64_tsan_isolates_rel_ng,v8_linux64_msan_rel_ng,v8_linux64_tsan_rel_ng,v8_mac64_asan_rel_ng,v8_win64_asan_rel_ng,v8_linux64_gcc_compile_dbg,v8_linux_gcc_compile_rel,v8_linux_gcc_rel_ng,v8_linux64_gc_stress_custom_snapshot_dbg_ng,v8_linux_arm64_gc_stress_dbg_ng,v8_linux_gc_stress_dbg_ng,v8_mac64_gc_stress_dbg_ng;luci.chromium.try:linux_chromium_ubsan_rel_ng

Change-Id: I9c3631a2f3aa34bc9c87a6f40a2888b38832978c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2414622
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70008}

Bug: v8:10904
Bug: chromium:1129706
Change-Id: I11a06ed3afbc9d11ad0956392758c22484a9ea1f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2418995Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70007}

These tests can now be enabled as we implemented more scalar lowering
support.

Bug: v8:10507
Change-Id: Ida5f896300e074db079ec24720302729b0582d9d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2411774Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70006}

vmin should return the default NaN if any input is a NaN (regardless of
the default NaN mode), so turn the default NaN mode, canonicalize, then
reset it.

Bug: v8:10835
Change-Id: Ia83c9fbcbc2070029f35bbd07cbb4abf857b594d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2416399Reviewed-by: Bill Budge <bbudge@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70005}

Implement f32x4 and f64x2 nearest, trunc, ceil, and floor for arm and
arm64. arm implementation will check for ARMv8 support, and bail out to
runtime call if not supported.

Bug: v8:10906
Change-Id: Ia473f63de3717d02d4cea2fc888befb3681e20aa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2415769Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70004}

This will allow minimorphic ICs the best chance of succeeding as they
only check the first FLAG_max_minimorphic_map_checks maps in the
feedback vector.

Bug: v8:10582
Change-Id: I1c78dcc8b6f7072b2563fdc8bf69b349a99c4bb5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2400340
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70003}

Change-Id: Ibd414806c5f8688486fec169d523876d0ef74c8f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2415047Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70002}

Changes:
- Rename IsSignatureEqual -> MatchesSignature for consistency
- Add WasmInstanceObject field to WasmTableObject.
- Improve some error messages related to tables in
  function-body-decoder-impl.h.
- Introduce WasmTable::IsValidTableType. Use it wherever appropriate.
- Overload equality operators in HeapType to work with
  HeapType::Representation.
- Rename DynamicTypeCheckRef -> TypecheckJSObject.
- Handle WasmCapiFunctions in TypecheckJSObject.
- Use TypecheckJSObject in WasmTableObject::IsValidElement.
- A few more minor improvements.

Bug: v8:9495
Change-Id: I2867dd3486d7c31717ac26b87a50e15cf2b898be
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2416491
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70001}

This is a reland of 2000aea5
Changes compared to last reland:
- Add rule in variants.py for --enable_experimental_regexp_engine.
- Make sure --abort-on-contradictory-flags works as well as --fuzzing
  to disable the checking for fuzzers, including for d8 flags.

Original change's description:
> Reland^4 "[flags] warn about contradictory flags"
>
> This is a reland of 0ba115e6
> Changes compared to last reland:
> - Fix Python code trying to write to expected_outcomes, which is now a
>   computed property.
> - Fix remaining place in d8.cc that ignored the --fuzzing flag.
> - Expect flag contradictions for --cache in code_serializer variant.
>
> Original change's description:
> > Reland^3 "[flags] warn about contradictory flags"
> >
> > Changes:
> > - Also allow second parameter influenced by --cache to be reassigned.
> > - Fix --stress-opt to only --always-opt in the last iteration as before.
> >
> > Original change's description:
> > > Reland^2 "[flags] warn about contradictory flags"
> > >
> > > This is a reland of d8f8a7e2
> > > Change compared to last reland:
> > > - Do not check for d8 flag contradictions in the presence of --fuzzing
> > > - Allow identical re-declaration of --cache=*
> > >
> > > Original change's description:
> > > > Reland "[flags] warn about contradictory flags"
> > > >
> > > > This is a reland of b8f91666
> > > > Difference to previous CL: Additional functionality to specify
> > > > incompatible flags based on GN variables and extra-flags, used
> > > > to fix the issues that came up on the waterfall.
> > > >
> > > > This also changes the rules regarding repeated flags: While
> > > > explicitly repeated flags are allowed for boolean values as long
> > > > as they are identical, repeated flags or explicit flags in the
> > > > presence of an active implication are disallowed for non-boolean
> > > > flags. The latter simplifies specifying conflict rules in
> > > > variants.py. Otherwise a rule like
> > > >
> > > > INCOMPATIBLE_FLAGS_PER_EXTRA_FLAG = {
> > > >   "--gc-interval=*": ["--gc-interval=*"],
> > > > }
> > > >
> > > > wouldn't work because specifying the same GC interval twice
> > > > wouldn't actually count as a conflict. This was an issue with
> > > > test/mjsunit/wasm/gc-buffer.js, which specifies
> > > > --gc-interval=500 exactly like the extra flag by the stress bot.
> > > >
> > > > Also, this now expands contradictory flags checking to d8 flags
> > > > for consistency.
> > > >
> > > > Original change's description:
> > > > > [flags] warn about contradictory flags
> > > > >
> > > > > Design Doc: https://docs.google.com/document/d/1lkvu8crkK7Ei39qjkPCFijpNyxWXsOktG9GB-7K34jM/
> > > > >
> > > > > Bug: v8:10577
> > > > > Change-Id: Ib9cfdffa401c48c895bf31caed5ee03545beddab
> > > > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154792
> > > > > Reviewed-by: Clemens Backes <clemensb@chromium.org>
> > > > > Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> > > > > Reviewed-by: Georg Neis <neis@chromium.org>
> > > > > Reviewed-by: Tamer Tas <tmrts@chromium.org>
> > > > > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > > > > Cr-Commit-Position: refs/heads/master@{#68168}
> > > >
> > > > Bug: v8:10577
> > > > Change-Id: I268e590ee18a535b13dee14eeb15ddd0a9ee8341
> > > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2235115
> > > > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > > > Reviewed-by: Tamer Tas <tmrts@chromium.org>
> > > > Reviewed-by: Clemens Backes <clemensb@chromium.org>
> > > > Reviewed-by: Georg Neis <neis@chromium.org>
> > > > Cr-Commit-Position: refs/heads/master@{#68989}
> > >
> > > Bug: v8:10577
> > > Change-Id: I31d2794d4f9ff630f3444210100c64d67d881276
> > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2339464
> > > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > > Reviewed-by: Clemens Backes <clemensb@chromium.org>
> > > Cr-Commit-Position: refs/heads/master@{#69339}
> >
> > Bug: v8:10577
> > Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_rel_ng
> > Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_isolates_rel_ng
> > Change-Id: I4a69dc57a102782cb453144323e3752ac8278624
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2352770
> > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> > Reviewed-by: Clemens Backes <clemensb@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#69433}
>
> Change-Id: Ib6d2aeb495210f581ac671221c265df58e8e5e70
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2398640
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Reviewed-by: Tamer Tas <tmrts@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69954}

Bug: v8:10577
TBR: clemensb@chromium.org, tmrts@chromium.org
Change-Id: Iab2d32cdcc2648934fc52255ccf3ae3ec9ca4d9b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2416386Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70000}

This reverts commit 8b60d8fc.

Reason for revert: Flaky on windows: https://ci.chromium.org/p/v8/builders/ci/V8%20Win32%20-%20debug/27302

Original change's description:
> Reland "[cpu-profiler] Log OSR code when starting the profiler"
> 
> This is a reland of f6965281
> 
> Updated the test:
> 1. Set profiling interval to 100us to get 10x the samples
> 2. Guarantee we spend at least 1ms per iteration, instead of only
> bailing out if we spend more than 1ms. This gives us enough samples on
> release mode.
> 3. Increase the time spent profiling optimized code by 50% to make sure
> we have a big enough difference.
> 
> With 1000 iterations I didn't see any flakes locally so this looks solid
> now.
> 
> Original change's description:
> > [cpu-profiler] Log OSR code when starting the profiler
> >
> > OSR code doesn't hang off any JSFunction or SFI, so we missed it when
> > starting up the profiler. This meant we didn't properly attribute
> > ticks to SFI code. The ticks ended up going to the caller instead.
> >
> > There is a weak cache of OSR code per native context, so iterate that
> > on profiler startup and log all the code objects.
> >
> > Change-Id: I2e9738b86a488b37f36ac89803561607dc76f745
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2414216
> > Commit-Queue: Peter Marshall <petermarshall@chromium.org>
> > Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> > Reviewed-by: Mythri Alle <mythria@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#69964}
> 
> Change-Id: Ib506e88b546008e462967259763bbf985b74b462
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2418092
> Commit-Queue: Peter Marshall <petermarshall@chromium.org>
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Reviewed-by: Mythri Alle <mythria@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69990}

TBR=mythria@chromium.org,petermarshall@chromium.org,dinfuehr@chromium.org

Change-Id: Ie3272c4fd297ca6f10a47c3fe8826e226a9f0545
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2418714Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69999}

Ensures that there is no concurrent allocation happening.

Bug: v8:10315
Change-Id: Ief40cbde9d859e3a2eea66d6e4437d7f0e3840e8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2418951Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69998}

Bug: v8:10875
Change-Id: I9e7e688b3a490d680157d824183d6b8899116838
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2418394
Commit-Queue: Almothana Athamneh <almuthanna@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69997}

GCs should reset memory pressure back to none on GC. Especially with
background threads calling MemoryPressureNotification to start a
collection.

Bug: v8:10315
Change-Id: I4dbda71e8434eb7949c0f9b978662b32910133cc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2418400Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69996}

Typically we'll parse a single declaration when parsing variable declarations.
Using on-stack storage rather than std::vector that requires malloc is much
more efficient.

Change-Id: Id99515bb4ce7ea2dae46498f8f9f9d49c33c7353
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2418393
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69995}

Keep TSAN happy by locking the string table NumberOfElements read (only
on heap counters and in the startup serializer), which can be modified
by background threads that add elements.

Bug: v8:10928
Change-Id: I411af5f9642b0cafce291344d26351ff18d2301e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2418392
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69994}

This reverts commit af5f437c.

Reason for revert: Seems to break TSAN - https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20TSAN/33286?

Original change's description:
> [heap] Fix tracking of code pages for V8 stack unwinder
> 
> When a compaction space allocates a new code page, that pages needs to
> be added to the Isolate::code_pages_ array used for stack unwinding.
> Since the array is owned by the main thread, compaction thread cannot
> directly modify it. Because of that code pages are added upon merging
> of the compaction space to the main spage in MergeLocalSpace.
> 
> The bug was that all code pages coming from the compaction space
> were added to the code_pages_ array. However, some of the pages are
> not newly allocated but merely borrowed from the main space.
> 
> This CL introduces a new page flag for marking pages that are borrowed
> during compaction and skips them in MergeLocalSpace.
> 
> Bug: v8:10900
> Change-Id: I786dc5747bd7c785ae58dfd8b841c00774efb15e
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2416500
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69992}

TBR=ulan@chromium.org,jkummerow@chromium.org,dinfuehr@chromium.org

Change-Id: I13f8b64014750af95423166152dc9bee8cec12d0
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10900
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2418395Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69993}

When a compaction space allocates a new code page, that pages needs to
be added to the Isolate::code_pages_ array used for stack unwinding.
Since the array is owned by the main thread, compaction thread cannot
directly modify it. Because of that code pages are added upon merging
of the compaction space to the main spage in MergeLocalSpace.

The bug was that all code pages coming from the compaction space
were added to the code_pages_ array. However, some of the pages are
not newly allocated but merely borrowed from the main space.

This CL introduces a new page flag for marking pages that are borrowed
during compaction and skips them in MergeLocalSpace.

Bug: v8:10900
Change-Id: I786dc5747bd7c785ae58dfd8b841c00774efb15e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2416500Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69992}

Instead of iterating over the pair of map and handlers twice -- once
to extract them into a vector, second to process them from the vector
-- combine the two passes into one.

Bug: v8:10582
Change-Id: I4c238b494789ae270798f33302b94b1ec02c7fc8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2400338Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69991}

This is a reland of f6965281

Updated the test:
1. Set profiling interval to 100us to get 10x the samples
2. Guarantee we spend at least 1ms per iteration, instead of only
bailing out if we spend more than 1ms. This gives us enough samples on
release mode.
3. Increase the time spent profiling optimized code by 50% to make sure
we have a big enough difference.

With 1000 iterations I didn't see any flakes locally so this looks solid
now.

Original change's description:
> [cpu-profiler] Log OSR code when starting the profiler
>
> OSR code doesn't hang off any JSFunction or SFI, so we missed it when
> starting up the profiler. This meant we didn't properly attribute
> ticks to SFI code. The ticks ended up going to the caller instead.
>
> There is a weak cache of OSR code per native context, so iterate that
> on profiler startup and log all the code objects.
>
> Change-Id: I2e9738b86a488b37f36ac89803561607dc76f745
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2414216
> Commit-Queue: Peter Marshall <petermarshall@chromium.org>
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Reviewed-by: Mythri Alle <mythria@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69964}

Change-Id: Ib506e88b546008e462967259763bbf985b74b462
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2418092
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69990}

Tests aren't compatible with concurrent allocation on background threads.

Bug: v8:10315
Change-Id: I376e98858fa1aacf1689e6791985774299def319
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2418391Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69989}

This reverts commit 1aa9ab73.

The reverted CL chain had an issue where ThinStrings could accidentally
end up in compilation artifacts, causing issues down the line with ICs
that expected direct internalized strings.

The reason for this bug was that forward references to internalized
strings were resolved before PostProcessNewObject. When this happened,
the internalized string A would be written to the field where it was
previously deferred, then PostProcessNewObject would change string A to
string A', and update string A to a ThinString.  This means any _future_
back references to A would see the ThinString and follow it to receive
A', but any _past_ forward references would keep pointing to the
ThinString A.

This reland fixes this by preventing InternalizedString deferral, so
that all references to InternalizedStrings are back references. It also
adds some additional verification to the heap verifier that constant
pools and object boilerplate descriptors aren't allowed to hold thin
strings.

This patch also fixes an additional bug in the original CL, where weak
forward refs weren't being serialized with a weak prefix.

Original change's description:
> Revert recent de/serializer related changes
>
> They are suspected to be causing Canary crashes, confirmed through
> local reverts and repro attempts.
>
> This reverts:
> - "Reland "[serializer] Change deferring to use forward refs""
>   commit 76d684cc.
> - "Reland "[serializer] Remove new space""
>   commit 81231c23.
> - "[serializer] Clean-up and de-macro ReadDataCase"
>   commit c06d24b9.
> - "[serializer] DCHECK deserializer allocations are initialized"
>   commit fbc1f32d.
>
> Bug: chromium:1128872
> Change-Id: Id2bb3b8fac526fdf9ffb033222ae08cd423f8238
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2414220
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Reviewed-by: Adam Klein <adamk@chromium.org>
> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69955}

Tbr: jgruber@chromium.org,dinfuehr@chromium.org
Bug: chromium:1075999
Bug: chromium:1127610
Bug: chromium:1128848
Bug: chromium:1128872
Bug: chromium:1128957
Change-Id: I8b7bbabf77eb8cb942a28316afbfaa5f9a0aa4cb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2418101
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69988}

The new helper function allows us to write tests for log parsing
without the need of first generating a log file.
This makes it easier guard against errors when the log format changes.

- add d8.log.getAndStop helper
- add basic log test
- fix test that regresses due to changed gc timing

Bug: v8:10668
Change-Id: Ie57171fa98fe90428b89c26289d55fcbf2a70615
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2403245Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Auto-Submit: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69987}

Bug: chromium:1126309
Change-Id: I9d9d33cd151ed8af5ee8af09b8957eae9df2dcb1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2410059
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Auto-Submit: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69986}

Fix merging of detachedness state.

Drive-by: Split lookup and merging of nodes.

Bug: chromium:1110816
Change-Id: I27dba7a6f22c75e5aae130d8cec01ccf755fad79
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2416492
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69985}

The builder was renamed here:
https://chromium-review.googlesource.com/c/v8/v8/+/2418093

No-Try: true
Change-Id: I0b437cb854d56c903609109a21827b34b6dd4a94
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2418094
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69984}

... to "V8 Linux64 TSAN - stress-incremental-marking" since it runs
with --stress-incremental-marking (and concurrent marking is on by
default anyways).

No-Try: true
Change-Id: I4660151cde2fb9e873cc046c1baf6578ab835eb7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2416385
Commit-Queue: Georg Neis <neis@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69983}

This enables defining abstract type subtypes of classes
with constexpr version, which in turn is useful to model
custom C++ subclasses.

Bug: v8:7793
Change-Id: I07dcb62121afdddfbe2c78ecc870afcb11800c19
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2412180
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69982}

Changes:
- Extend IsJSCompatibleSignature to include typed functions.
- Generalize WasmIsValidFuncRefValue to WasmIsValidRefValue, utilize
  DynamicTypeCheckRef. Use it in FromJS.
- Extend DynamicTypeCheckRef to eqRef type and WasmJSFunction
  references.
- Update call-ref.js test.

Change-Id: I71166ab8c1e716c21e79776c561e77b443add1da
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2412527Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69981}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/b5fefa9..153ad0b

Rolling v8/third_party/aemu-linux-x64: cw5KjATCqXEo2ji2ep1Vx88VOe8DdIMAsfq3dV86XzYC..QxDL1Bk85zKmALn9xHGhro_uZAytSTHjJ--QwZLaT7oC

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/d03abd8..0de9874

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/a787cd5..d949c91

Rolling v8/third_party/icu: https://chromium.googlesource.com/chromium/deps/icu/+log/d7eebbf..79326ef

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/06a2576..92b3622

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I8d2b7ca89e949a3ed77a7ed6fb88df8068ebe4e5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2416142Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#69980}

Port 7f654693
https://chromium-review.googlesource.com/c/v8/v8/+/2411691

Change-Id: I8b06288b003d99d1ee76415aee3fafd5cd963ae7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2415852
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69979}

To let the user do special handling on the main thread e.g. Scavenging
uses different tracing categories for background/foreground threads.

Change-Id: I6c9187fd6201b5b81cd83727727fda49fcf7ff68
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2405797Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Etienne Pierre-Doray <etiennep@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69978}

ceilf and truncf do not preserve the sign bit when its input
is passed by value and the output is rounded to 0:

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97086

Change-Id: I10b963e3193f1754f31f3bfc415b8a82d4ae011c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2416240Reviewed-by: Junliang Yan <junyan@redhat.com>
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#69977}

In many cases, the event we are waiting for already happened. In that
case, entering the {ExecuteCompilationUnits} function creates
significant overhead.

This CL fixes this by just checking whether the event we are waiting for
already happened, and returning early in that case. This should restore
the original performance before https://crrev.com/c/2351671.

R=thibaudm@chromium.org

Bug: v8:10922
Change-Id: I5229808162a3b348bbbb067bd10065894c8a655c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2414028Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69976}