This CL adds an access check for the arguments to all calls to
{console} like {console.log}. This is needed since the DevTools
protocol notificiation event does not contain the context in which
the {console.log} call occurred. Only the context of the argument.
When DevTools then reads properties for the preview of the argument,
it uses arguments context, instead of the calling context, potentially
leaking objects/exceptions into the calling context.

Bug: chromium:987502, chromium:986393
Change-Id: I6f7682f7bee94a28ac61994bad259bd003511c39
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1741664
Commit-Queue: Simon Zünd <szuend@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63122}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/8400a89..c991845

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/1b12368..a01c121

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/aa2db56..a110bf6

Rolling v8/third_party/googletest/src: https://chromium.googlesource.com/external/github.com/google/googletest/+log/a45c24a..90a443f

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: I12467c5b037ee1b6c757bc2f321d2af301928e1c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1742747Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#63121}

Each LHS expression that contains an optional chain of some form is
wrapped in an OptionalChain node. This root node allows us to use a
single jump location for every individual item in the chain,
improving the performance and simplifying the implementation.

Bug: v8:9553
Change-Id: I678563928b2dbfd6200bff55801919d4fd816962
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1723359
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63120}

In instruction selector we were tagging as Compressed or Tagged Any when
we could have been more specific. Also, we were marking as Word32 or Word64
when we should have been using CompressedSigned or TaggedSigned, respectively.

Drive-by cleanup: Rename MarkAsReference to MarkAsTagged.

Bug: v8:7703
Change-Id: I4df7a17e25cfa51a1e11eac0af40be21efb50990
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1739367Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63119}

The previous ordering caused a SCOPED event to end after its parent
event, which isn't really supported in the trace format.

Change-Id: I2ddaa12596604499366854231506c889d910f951
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1741926Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Eric Seckler <eseckler@chromium.org>
Auto-Submit: Eric Seckler <eseckler@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63118}

TBR=santa

Change-Id: I05cdd74eea6f2b02158d6d9854f35a08b455edd4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1741656Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63117}

Previous differences in eager and lazy parsing meant that it was possible
that feedback vectors could be different for the same function depending on
how it was compiled. These issues have now been fixed, so remove the workaround
and add an explicit CHECK that the feedback vectors are the same.

BUG=chromium:984344,v8:9511

Change-Id: I0edfa350b1a2f236db1ee2f86bc46690da926af1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1741650
Auto-Submit: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63116}

This reverts commit 79b00555.

Reason for revert: needs more discussion

Original change's description:
> [torque] introduce JSAny type for user-accessible JavaScript values
> 
> This CL introduces a JSAny type for user-exposed JavaScript values and
> a few new types to define it. Especially, it splits Symbol into
> PrivateSymbol (not exposed) and PublicSymbol (JavaScript exposed
> symbols).
> 
> The change is mostly mechanical, but a few things are interesting:
> - PropertyKey and JSPrimitive were designed to coincide with the spec
>   notions of IsPropertyKey() and primitive value, respectively.
> - Since Name is an open type, we define AnyName to be the known
>   subtypes of Name. This is not too elegant, but by using AnyName
>   instead of Name, typeswitch can properly conclude something if a
>   subtype of Name is excluded.
> 
> Small drive-by changes, which were necessary:
> - Allow subtyping on label parameters.
> - Fix the formatting of typeswitch, it was broken with union types
>   in case types.
> 
> Bug: v8:7793
> Change-Id: I14b10507f8cf316ad85e048fe8d53d1df5e0bb13
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1735322
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#63114}

TBR=neis@chromium.org,jgruber@chromium.org,tebbi@chromium.org

Change-Id: Ifde7881d74afe407628f40047997339d54cb2424
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7793
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1741652Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63115}

This CL introduces a JSAny type for user-exposed JavaScript values and
a few new types to define it. Especially, it splits Symbol into
PrivateSymbol (not exposed) and PublicSymbol (JavaScript exposed
symbols).

The change is mostly mechanical, but a few things are interesting:
- PropertyKey and JSPrimitive were designed to coincide with the spec
  notions of IsPropertyKey() and primitive value, respectively.
- Since Name is an open type, we define AnyName to be the known
  subtypes of Name. This is not too elegant, but by using AnyName
  instead of Name, typeswitch can properly conclude something if a
  subtype of Name is excluded.

Small drive-by changes, which were necessary:
- Allow subtyping on label parameters.
- Fix the formatting of typeswitch, it was broken with union types
  in case types.

Bug: v8:7793
Change-Id: I14b10507f8cf316ad85e048fe8d53d1df5e0bb13
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1735322
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63114}

This patch stores the home objects in private methods that
access super properties.

Bug: v8:8330
Change-Id: I2507fda0bd70183f02d162ec50a5be76c248f0ff
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1724900Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Joyee Cheung <joyee@igalia.com>
Cr-Commit-Position: refs/heads/master@{#63113}

Currently, the private name symbols are displayed in the block
scopes in DevTools, though these are just implementation details
of private fields. This patch hides them from the block scope
by marking variables with names starting with `#` as synthetic.

The private fields are still going to show up in the previews
of objects, only the key symbols themselves are going to be hidden.

Bug: v8:8773, chromium:982267
Change-Id: I059472d05c26a1f035ab92718a1b7e5ecafa8dc4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1741846Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Joyee Cheung <joyee@igalia.com>
Cr-Commit-Position: refs/heads/master@{#63112}

This CL changes {descriptionForError} to not immediately return when a {stack}
is not found, but instead try to lookup and append the {message} as well.

The existing logic to build a description in a specific way when the class
of the exception does not match, is retained for backwards compatibility.

Bug: chromium:954017
Change-Id: I9fa1d2807e2877bd988f82b4b57cf329bcd9f61b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1738862
Commit-Queue: Simon Zünd <szuend@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63111}

Calling a multi-return WASM function from JS creates an array filled
with the returned values.

See: https://github.com/WebAssembly/multi-value

R=ahaas@chromium.org

Bug: v8:9492
Change-Id: I3151212b6784782c8f89908befab9d26b32e5a8b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1739372
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63110}

We didn't track transitions from non-smi elements kind in builtins but we
did track them in the runtime. We should track these transitions in
builtins as well. Not tracking them uniformly causes deopts in unexpected
places which are hard to reason about.


Bug: chromium:987522
Change-Id: I09403c7365d4d2474bca3ab601887abec19aef27
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1736748Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63109}

Also roll 0705a10: Comments

Change-Id: I9802283fa68093839286779503b6073122cbc8d7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1739369Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63108}

Change-Id: I035d276004b21f167ede2ecd9bc59759f135bbd9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1741647Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63107}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/38ae7d2..8400a89

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/698405a..1b12368

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/36756e4..aa2db56

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/cd2137f..3605577

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: I08bb4364173d6a8765d07a7b6e9665f188306c9e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1740967Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#63106}

Change-Id: I0607978da6c346c5f8807b0c9a33e0245cd503e5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1738470Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63105}

The current V8HugeMaxOldGenerationSize feature increases the JS heap size for
systems with larger than 16 GB physical memory. This cl adds support for 16 GB
configuration.

Because a small portion of memory is reserved by hardware, the physical memory
calculation here is rounded up to GB so the actual installed memory is checked.

Bug:chromium:958974

Change-Id: Idaf2e03a43ba6c3c40bb771296d06b87032c2725
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1734038
Commit-Queue: Maggie Chen <magchen@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63104}

The HandleScope lets objects allocated within the slow loop be collected
prior to loop termination.

Drive-by: Use the appropriate kMaxElementCount constant.
Drive-by: Switch to less-or-equal comparison against it.

Bug: chromium:948810
Change-Id: I2449408b87e7e82dead5ee76d8c92129fa3243fc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1736749
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63103}

Use Perfetto's Start/StopBlocking() helpers instead of bespoke
synchronization with semaphores.

Cq-Include-Trybots: luci.v8.try:v8_linux64_perfetto_dbg_ng
Bug: v8:8339
Change-Id: If8266d5fa5e3ff6403b9b2e539ec985bc67fcc90
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1728623
Commit-Queue: Sami Kyöstilä <skyostil@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Auto-Submit: Sami Kyöstilä <skyostil@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63102}

Ongoing cleanup to use the same term everywhere.

Bug: chromium:913887
Change-Id: Ifc4d4de0c2dfd9f1150e61d64cf7f91cf923aa24
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1738865Reviewed-by: Simon Zünd <szuend@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63101}

This reverts commit 11524453.

Reason for revert: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20TSAN/27728

Original change's description:
> [wasm] Test concurrent code emission
> 
> This extends the jump table stress test. Currently, we generate
> different thunks (on the main thread) and then concurrently update the
> jump table to jump to one of these thunks.
> With this CL, we also generate the thunks concurrently. So this also
> tests whether there is proper synchronization between code generation
> and executing it in another thread.
> 
> R=​ahaas@chromium.org, mstarzinger@chromium.org
> 
> Bug: v8:9477
> Change-Id: I3598329e37482ebd27a13acc752581c714226184
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1735319
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#63097}

TBR=mstarzinger@chromium.org,ahaas@chromium.org,clemensh@chromium.org

Change-Id: I1c95cb43aa23340913de9cfad9988d0c583cc266
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:9477
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1739368Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63100}

This cl makes IsLockFree return true for 8 bytes on x64 platforms.
The standard is unfortunately a bit vague on what exactly 'lock free' means.
As a result, we err on the side of caution. We can revisit this, but first
we need the specification to nail down exactly what 'lock free' in this
context.

Bug: v8:8100
Change-Id: I0a6099c6cb95a5581f3e71d0267857b88b4a2f0a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1735592
Commit-Queue: Joshua Litt <joshualitt@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63099}

Bug: v8:7793
Change-Id: I5f5461e4e3d31c6d3c2c1fba4ce48a4eb5db5d8e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1725625
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63098}

This extends the jump table stress test. Currently, we generate
different thunks (on the main thread) and then concurrently update the
jump table to jump to one of these thunks.
With this CL, we also generate the thunks concurrently. So this also
tests whether there is proper synchronization between code generation
and executing it in another thread.

R=ahaas@chromium.org, mstarzinger@chromium.org

Bug: v8:9477
Change-Id: I3598329e37482ebd27a13acc752581c714226184
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1735319Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63097}

There were some accesses that could be specialized to Pointer
instead of Any.

Also updated the WriteBarrierKind to match. Any -> full barrier,
Pointer -> Pointer barrier, Signed -> no barrier.

There were some accesses that were not used, and therefore got deleted.

Bug: v8:9396
Change-Id: Ie249e6571080fa6e24d9022344775de679966144
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1733070Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63096}

This CL removes the SEPERATOR from the FOREACH_WASM_FEATURE_FLAG macro,
which was ugly, and fortunately also unnecessary.

R=jkummerow@chromium.org

Bug: v8:9396
Change-Id: I455589331f84a011a231d6897d03e8ab0b492b45
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1738847Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63095}

NOTRY=true

Bug: v8:7783
Change-Id: I90226a16744388149993380399f1c6ee577b7c11
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1738861Reviewed-by: Tamer Tas <tmrts@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63094}

NOTRY=true
TBR=tmrts@chromium.org

Change-Id: Id7148a5579d99928116a416bbd149d9ed7135fc8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1738858Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63093}

The is_public name is misleading now that we have private
symbols. It's only used to know if the symbol is stored in the global
symbol registry.

This patch renames it to a more suitable name.

Change-Id: I78f31cb5438416d07b78a9038c3526c9dfb96c6e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1738849Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63092}

This CL fixes an upcoming clang compiler warning (-Wparentheses).

BuildAsciiCharFlags uses ternary operator '?' together with bitwise
or '|'. Bitwise or '|' binds stronger than '?', so BuildAsciiCharsFlags
is basically: return check1(c) ? E1
                  : (0 | check2(c)) ? E2
                       : (0 | check3(c)) ? E3
                           : 0;
This CL fixes this.

Change-Id: I794ef4aa19786e61b23d1f2b35eff486cf6d569a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1738850Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Simon Zünd <szuend@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63091}

Sorting the pages by least free bytes should reduce fragmentation:
since map space is never compacted, it makes sense to first fill
pages that are the most full already rather than to start with the
most empty pages (which is what was more or less going on until this
CL).

Bug: v8:9329
Change-Id: I2157e3b4706c53da80220da5e4a26c00ee4c592f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1735325Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Darius Mercadier <dmercadier@google.com>
Cr-Commit-Position: refs/heads/master@{#63090}

This is a reland of a3218aa7.
Unmodified reland, thus TBR.

Original change's description:
> [wasm] Add support to allocate in a specific code region
>
> For multiple code spaces with multiple jump tables, we need to allocate
> the space for the jump tables within specific regions (the new code
> spaces) so they are within reachable distance.
> This CL adds support for that, and uses it for the first jump table.
>
> R=mstarzinger@chromium.org
>
> Bug: v8:9477
> Change-Id: Ibdf05c9500c2dfdb2c5f5f920b4422339aaab810
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1733069
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#63074}

TBR=mstarzinger@chromium.org

Bug: v8:9477
Change-Id: Ic110705fa13edeb103c06ad579a61cba78b6890c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1738848Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63089}

This is a reland of 779bdef3

Original change's description:
> [wasm] Prepare for multiple jump tables
> 
> This CL prepares {NativeModule} and {WasmCodeAllocator} for multiple
> code spaces with separate jump tables. {WasmCodeAllocator} calls back
> to the {NativeModule} for each code space it allocates, and
> {NativeModule} stores data (especially the jump table) for each code
> space.
> A jump table is currently only created for the first code space added,
> so nothing changes there yet.
> 
> R=mstarzinger@chromium.org
> 
> Bug: v8:9477
> Change-Id: I3ddeb8e251648b07ba8b7b4638abafe2364b47ff
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1730996
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#63069}

Bug: v8:9477
Change-Id: I9e25d59029cb6ce4869cf53a868afc59bc20b72f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1735324Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63088}

Instead of inserting "deletion" entries into the store buffer, keep
a list of invalidated objects to filter out invalid old-to-new slots.

The first CL https://crrev.com/c/1704109 got reverted because both the sweeper and the main task were modifying the invalidated slots data structure concurrently. This CL changes this, such that the sweeper only modifies the invalidated slots during the final atomic pause when the main thread is not running. The sweeper does not need to clean this data structure after the pause, since the "update pointers" phase already removed all invalidated slots.

Bug: v8:9454
Change-Id: Iffb5bf96de2c89eee1ee1231a3414a0f2a155cbc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1733081Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63087}

Sorting is done in order to make compaction more efficient: by
sweeping pages with the most free bytes first, we make it more likely
that when evacuating a page, already swept pages will have enough free
bytes to hold the objects to move (and therefore, we won't need to
wait for more pages to be swept in order to move those objects).
Since maps don't move, there is no need to sort the pages from
MAP_SPACE before sweeping them.

Bug: v8:9093
Bug: v8:9329
Change-Id: I63964364d3cd0b64faf8570e87b5f75de6443902
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1736746
Commit-Queue: Darius Mercadier <dmercadier@google.com>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63086}

When serializing frame states into translations (later used by
deopts), we pass certain values, depending on the frame kind, to be
serialized as the frame height.

This CL moves the calculation of this height value into the
FrameStateDescriptor. In a follow-up, we may want to simplify the way
these height values are passed and processed by deopts.

The motivation behind this is to simplify calculation of unoptimized
stack frame sizes during compilation.

Bug: v8:9534
Change-Id: I20d2b57a42cea0c238b9c887dba0280f6aad76de
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1728609
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63085}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/d57f70e..38ae7d2

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/93ee550..698405a

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/921f6a1..36756e4

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: Ic6b12a6c3bfbbd27895110a29de92788360eaf3a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1737928Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Reviewed-by: Tamer Tas <tmrts@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63084}

Update the TracingCpuProfiler test to work properly with perfetto.

Roll perfetto to get fixes for bugs encountered with starting/stopping
tracing rapidly, which happens in the test for the tracing profiler.

Add a check that the DataSource::Register call was successful to flush
out any errors there (although they are fixed by the perfetto roll).

Emit a fake trace event when stopping tracing in order to avoid
losing the final trace event that the user provided. Remove the ad-hoc
fake final trace events that the cctests for perfetto added.

Add a test StartAndStopRepeated which flushes out the issues fixed by
the perfetto roll.

TBR=yangguo@chromium.org

Cq-Include-Trybots: luci.v8.try:v8_linux64_perfetto_dbg_ng
Bug: v8:8339
Change-Id: I042d7385486bf42c86f1631406974693868a477f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1731006
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63083}