We optimized swizzle with constant mask, but failed to actually swizzle
using the masks...

Bug: v8:10992
Change-Id: If655fdad1e17e92b62e8a2eaabbf1f8d82e4d5e4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2822951Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73943}

This is similar in spirit to https://crrev.com/c/2808621, which is to
ensure that no matter what combination of --[no-]enable-{extension} flag
is passed, we end up with a set of supported extensions that make sense.

The 2 rules are:

- If a newer extension is supported (SSE4_2), older extensions are
supported (SSE4_1, SSSE3, SSE3),
- If an older extension is not supported (SSE4_1), new extensions are
not supported (SSE4_2, AVX)

Tests have been added to both ia32 and x64 to check that we follow these
above 2 rules.

We change the ProbeImpl to have a reconciliation step to ensure that we
stick to the 2 rules.

E.g. if --enable-avx --no-enable-sse4-2, we will first set AVX to
supported, then in the second step, fix-up AVX to unsupported. In this
sense, the --no version of the flags take priority. This more accurately
follows the intention of the flags.

Bug: chromium:1195579
Change-Id: I0390f24de9d203fe6bbd4cc02a23771a1f052618
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2818570
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73942}

Added a comparison to throw a TypeError when the "enumerable"
field of the new descriptor doesn't match the one of the old descriptor.

Bug: v8:10782
Change-Id: I2f1acf215e597b85be5d29e22c006cbd79afcb47
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2818067
Commit-Queue: Luis Fernando Pardo Sixtos <lpardosixtos@microsoft.com>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73941}

Bug: chromium:728583
Change-Id: I0d88b7516d053f2024a43bed84843ee47e06cd42
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2823697Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Jochen Eisinger <jochen@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73940}

This reverts commit 6ec52d90.

Reason for revert: Caused failure on Chromium android-asan bot. More info in crbug.com/1198565.

Original change's description:
> [wasm] Enable wasm threads by default in V8
>
> Finer grained control of platforms that support threads are
> enforced by chromium.
>
> Bug: chromium:1167733
> Change-Id: Ic34a4950aebf6ba394053b79df97b703af333636
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2810190
> Reviewed-by: Lutz Vahl <vahl@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#73919}

Bug: chromium:1167733
Change-Id: I8a7740c70c227dea42de5a54bb1cfa07fc139098
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2821704
Auto-Submit: Victor Vianna <victorvianna@google.com>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#73939}

Change-Id: I5b5024fdcf4806b6e91112448db3c334f9ede48b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2821957
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73938}

- Add %BaselineOsr to manually trigger OSR to Baseline.
- Add flags to %GetOptimizationStatus to check if the topmost frame is
an Interpreter/Baseline frame.
- Add mjsunit test.

Bug: v8:11420
Change-Id: Id80421ad97ee719a67ef299cc700da9c44f23bae
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2814567
Auto-Submit: Patrick Thier <pthier@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73937}

Change-Id: I35c08f9d64210f0ddbedd2c394f59bc3cb5180fe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2821635
Commit-Queue: Junliang Yan <junyan@redhat.com>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73936}

From the concurrent compiler's perspective, we can perform those
read/writes non-atomically and have wider TSAN coverage. The concurrent
marker, however, needs them to be atomic.

Bug: v8:7790
Change-Id: I96897f4f6237c90da018ec89be838aae894c24bc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2817538
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73935}

Port: 5e0b94c4

Bug: v8:11624
Change-Id: I0b462dceaf4b155bf662e4fb9204a237c252b4ec
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2822273
Auto-Submit: Liu yu <liuyu@loongson.cn>
Reviewed-by: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/master@{#73934}

R=thibaudm@chromium.org, jgruber@chromium.org

Bug: v8:10740
Change-Id: Iceb20f00f6f8505885856400a0c0228708ff3979
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2807610
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73933}

When looking for intersections between the current range and inactive
range, we can stop the search as soon as the inactive range's next start
is past the current range's end position. We know that subsequent
inactive ranges cannot intersect either, because they are ordered by
their next start.

R=sigurds@chromium.org

Bug: chromium:986862
Change-Id: I249a781be281abc7b438f31848f5d6cb3a25303f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2821434Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73932}

Original CL: https://chromium-review.googlesource.com/c/v8/v8/+/2807157

Bug: v8:11043
Change-Id: I49d29323bf3ae6ede7e48e63645f4ee0a750c83e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2818573Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Sara Tang <sartang@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#73931}

The method was scheduled for removal in M92, as finaly part of the
fn.displayName support removal.

Fixed: chromium:1177685
Doc: https://bit.ly/devtools-function-displayName-removal
Change-Id: I243dd6c9849a6f39e76dd003300b639bfd8df604
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2821954
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73930}

Bug: v8:11263
Change-Id: I320a75b8819353ab7af5bf7608329e6f0a7a66ca
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2821544Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73929}

The CanAllocateArray used to be executed during JSCreateLowering,
leading to bailouts when large arrays are passed as arguments to
an async function or a bound function. This meant that
JSCreateAsyncFunctionObject or JSCreateBoundFunction will reach
JSGenericLowering, where they are not lowered. This CL moves
the checks earlier in the pipeline during JSNativeContextSpecialization
and JSCallReducer respectively, so that those operators are not
created at all in such cases and we bail out to the runtime instead.

Bug: v8:11564
Change-Id: I232ce7d9378730ae0cc8690e52fde840a484e069
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2807609
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73928}

Multivalue has been shipped for a while now, so it is time to remove
its experimental feature flag.

Additional change: Set kV8MaxWasmFunctionReturns to the old
kV8MaxWasmFunctionMultiReturns value.

Change-Id: I5c4d33b036e64a7221de17f0e97119bb0a036838
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2817790Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73927}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/563f147..79006be

Rolling v8/third_party/aemu-linux-x64: _EJXYI9PIL6jmQi9nGYfsMiQZf2CFqi_hE7uUCqpScAC..dXMWT4elldlEXvj4YHtc9u0W4YEfTP-KZbIKpA75-7MC

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/ab687ea..8680ff0

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/006bc90..7168936

Rolling v8/tools/luci-go: git_revision:f784260b204b2d93c7bd6d1a619f09c6822e5926..git_revision:cbabdf2ff62e64e99bfdf57ab5625d3da3eb5db9

Rolling v8/tools/luci-go: git_revision:f784260b204b2d93c7bd6d1a619f09c6822e5926..git_revision:cbabdf2ff62e64e99bfdf57ab5625d3da3eb5db9

Rolling v8/tools/luci-go: git_revision:f784260b204b2d93c7bd6d1a619f09c6822e5926..git_revision:cbabdf2ff62e64e99bfdf57ab5625d3da3eb5db9

TBR=v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I73becb94dcd7fba838472e99d0bb9202146b221f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2822914Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#73926}

   Clean todo comment in constant-riscv64.h about PCRelativeJumpRange.

Change-Id: I9067134e96e4801fbd1f976d0e5d033085d5f133
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2817975Reviewed-by: Brice Dobry <brice.dobry@futurewei.com>
Commit-Queue: Yahan Lu <yahan@iscas.ac.cn>
Cr-Commit-Position: refs/heads/master@{#73925}

With a shared cage, there's no easy way to recover an Isolate from a
heap pointer. Symbol::Description relies on RO symbols' description slot
being uncompressed so a Handle could point to it. This isn't possible
with a shared cage without going through TLS to get an Isolate for
Handle construction, so deprecate the method in favor of one that takes
an Isolate directly.

Bug: v8:11460
Change-Id: I69b2b7d77f4c00d0f58954cd80e22cba5ff222e3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2802860
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73924}

Port 5e0b94c4

Original Commit Message:

    This CL adds features to pack/unpack map words.

    Currently V8 cannot store extra metadata in object headers -- because V8
    objects do not have a proper header, but only a map pointer at the start
    of the object. To store per-object metadata like marking data, a side
    table is required as the per-object metadata storage.

    This CL enables V8 to use higher unused bits in a 64-bit map word as
    per-object metadata storage. Map pointer stores come with an extra step
    to encode the metadata into the pointer (we call it "map packing").
    Map pointer loads will also remove the metadata bits as well (we call it
    "map packing").

    Since the map word is no longer a valid pointer after packing, we also
    change the tag of the packed map word to make it looks like a Smi. This
    helps various GC and barrier code to correctly skip them instead of
    blindly dereferencing this invalid pointer.

    A ninja flag `v8_enable_map_packing` is provided to turn this
    map-packing feature on and off. It is disabled by default.

    * Only works on x64 platform, with `v8_enable_pointer_compression`
      set to `false`

R=wenyu.zhao@anu.edu.au, joransiu@ca.ibm.com, junyan@redhat.com, midawson@redhat.com
BUG=
LOG=N

Change-Id: I4a13093e7b20bb38990d947c697008a920cfe715
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2821649Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#73923}

Bug: v8:11635
Change-Id: I71c5542a503ca4b94fc3c8746e96fb0bc4e6c1f8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2822628
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Auto-Submit: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73922}

Change-Id: Icb0d165c97e4a08d4111dd1ad0e1402f4a28746f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2821634Reviewed-by: Milad Fa <mfarazma@redhat.com>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/master@{#73921}

It's used when setting up the context snapshot for blink, so we want to
be sure that it doesn't execute script.

Bug: chromium:728583
Change-Id: I46507e18d178e6473dd10348a9f253016a9178b7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2807615Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Jochen Eisinger <jochen@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73920}

Finer grained control of platforms that support threads are
enforced by chromium.

Bug: chromium:1167733
Change-Id: Ic34a4950aebf6ba394053b79df97b703af333636
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2810190Reviewed-by: Lutz Vahl <vahl@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73919}

R=ahaas@chromium.org

Bug: chromium:1197408
Change-Id: I9a9ede5cf141cd7d19b67438465bcba35e2b87f6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2821543Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73918}

The existing code assumes that the number of inputs is fixed to 4.
However, the fuzzer says that at least 5 inputs are also possible.
This CL makes the number of inputs more flexible.

CC=sam.parker@arm.com

Bug: chromium:1197393
Change-Id: I487ac96570b96f04b4d0a47065e7b383ba39016f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2821435Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73917}

The pointer compression cage is the virtual memory reservation
that all compressed pointers fall within. This CL splits pointer
compression into two modes: a per-Isolate cage and a shared cage
among multiple Isolates.

When multiple Isolates are sharing a cage, they can decompress
each others' pointers and share the same virtual memory range.

Bug: v8:11460
Change-Id: I7b89b7413b8e7ca6b8b6faafd083dc387542a8b4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2783674Reviewed-by: Dan Elphick <delphick@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73916}

This CL adds features to pack/unpack map words.

Currently V8 cannot store extra metadata in object headers -- because V8
objects do not have a proper header, but only a map pointer at the start
of the object. To store per-object metadata like marking data, a side
table is required as the per-object metadata storage.

This CL enables V8 to use higher unused bits in a 64-bit map word as
per-object metadata storage. Map pointer stores come with an extra step
to encode the metadata into the pointer (we call it "map packing").
Map pointer loads will also remove the metadata bits as well (we call it
"map packing").

Since the map word is no longer a valid pointer after packing, we also
change the tag of the packed map word to make it looks like a Smi. This
helps various GC and barrier code to correctly skip them instead of
blindly dereferencing this invalid pointer.

A ninja flag `v8_enable_map_packing` is provided to turn this
map-packing feature on and off. It is disabled by default.

* Only works on x64 platform, with `v8_enable_pointer_compression`
  set to `false`

Bug: v8:11624
Change-Id: Ia2bdf79553945e5fc0b0874c87803d2cc733e073
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2247561Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73915}

Change-Id: Ic7ed7938527dcf32d856a965da86a33cd713b83d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2821630Reviewed-by: Milad Fa <mfarazma@redhat.com>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/master@{#73914}

BUG=chromium:1180335

Change-Id: Ic6e4d18595b1003a036d247e8b11b03fcdae9b01
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2821538
Auto-Submit: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73913}

Refs: https://bugs.chromium.org/p/v8/issues/detail?id=11628
Change-Id: Ia651b14acd6fc3293abddbe5e49277d8dadb19ba
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2814563Reviewed-by: Brice Dobry <brice.dobry@futurewei.com>
Commit-Queue: Brice Dobry <brice.dobry@futurewei.com>
Cr-Commit-Position: refs/heads/master@{#73912}

We have to have special rules for bit_fields since we multiple accesors
touch the same field. I used:
 * If the accessor is set at map initalization time only and:
   * only the main thread accesses it: non-atomic write/read
   * bg accesses it too: non-atomic write, relaxed read (read has to be
     relaxed due to the whole bit_field being modified concurrently via
     other bit_field3 accessors)
 * If the accessor is set after map initialization:
   * but it is not necessary for synchronization: relaxed write/read
   * If the accessor is needed for synchronization: release/acquire

As a note, Map::NumberOfOwnDescriptors are the bits accessed by the
concurrent marker. For concurrent marker reasons it can be relaxed, but
we would like it to be release/acquire for the compiler since that's
where we synchronize Maps with adding descriptors to the descriptor
array.

Bug: v8:7790, chromium:1150811
Change-Id: I0ba7d2f8cb81d65a487970b4ea0bfa2a4cb3a975
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2773286Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73911}

Make runtime-call-stats a compile-time flag. Disabling RCS saves roughly
1MB binary size on 64bit systems and yields minor performance
improvements.

Bug: v8:11299
Change-Id: Ia1db75e330a665db5251b685c164b96857e38d2d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2799766Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73910}

We have to respect the TypeCheckKind.

Bug: chromium:1195777
Change-Id: If1eed719fef79b7c61d99c29ba869ddd7985c413
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2817791
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73909}

    Skip wasm/simd test for riscv64
    Add buitin info when call a builtin.
    Port 064ca18c

Change-Id: I1150de98a95231abf9d5def9e95ad38a8a42bbb3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2814128Reviewed-by: Brice Dobry <brice.dobry@futurewei.com>
Commit-Queue: Brice Dobry <brice.dobry@futurewei.com>
Cr-Commit-Position: refs/heads/master@{#73908}

Change-Id: Ia49c840d5e87554dd28222ba96dcba860a21d051
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2821648Reviewed-by: Milad Fa <mfarazma@redhat.com>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/master@{#73907}

If a loop is removed in dead code elimination, we may have a dead node
in the control chain. This wasn't expected, and endless recursion could
result.

Bug: chromium:1196185
Change-Id: Id6d69d0eaed11b0c6158b5643d3433b11611af59
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2817792Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73906}

This CL makes more assumptions in the fast-api-call mjsunit test
explicit and specifies --deopt-every-n-times=0 for it, as it relies
on particular optimization/deoptimization sequences. It also fixes an
inconsistency between the fast/slow path results.

Bug: v8:11620
Change-Id: I385949a04534cd1658236878875efa6622936bc5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2817607Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73905}

In Isolate::UnwindAndFindHandler(), the thread-in-wasm flag was set
before the destructor of some objects in that function got executed,
e.g. the destructor of {WasmCodeRefScope}. On Windows-asan, these
destructors could throw exceptions (asan on Windows uses exceptions for
its memory access tracking), which get handled initially by the wasm
trap handler, and would thereby invalidate the thread-in-wasm flag.

With this CL a new scope gets introduced which makes sure that setting
the thread-in-wasm flag is the last thing that happens in
Isolate::UnwindAndFindHandler().


Bug: chromium:1195595
Change-Id: If9f5f486c55b3bc2718a1d5aee3e3bd290d0ff35
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2817598
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73904}