Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/4fd0dec..b031112

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: Ic9a9082919cc7de8c816c33dcc62d219440a342c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2567562Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#71542}

This CL extends the existing optimization markers:

- "~" for interpreted code
- "-" for native context independent code (new)
- "+" for turboprop code (new)
- "*" for turbofan code

Bug: v8:10644
Change-Id: If8940a8c3f32c6f347f61a901be101078df66331
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2567693
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71541}

Bug: v8:10644
Change-Id: I8c81e1f9d6f1f766af07905928ea7b437771e1ef
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2567201Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71540}

This is a reland of 535fd785.
This CL was not the culprit, thus landing unmodified.

Original change's description:
> [wasm] Make DecodeLocals return the number of decoded locals
>
> Currently, when the new locals are not appended to the existing ones,
> there is no way to know how many new locals were defined. This CL
> addresses this issue.
>
> Drive-by: Fix the pc passed to DecodeLocals in OpcodeLength.
> Change-Id: Id9de561a6380b52dcce398301727aa12196c0677
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2567695
> Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#71526}

TBR=manoskouk@chromium.org

Change-Id: I1b2fbe9f6d0a19da9d73202de9f488870e79cd30
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2567704Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71539}

This is a reland of 4ad08c82

The reland organizes the different error types in separate functions
for separate call stacks. Error simulation is also guarded by
a minimum file size to prevent Clusterfuzz from getting stuck with
its bad-build check.

Original change's description:
> Enable simulating errors to test fuzzer reliability
>
> This adds a d8 flag --simulate-errors, which on shutdown will cause
> certain errors. This enables testing the reliability of sanitizers.
>
> This will cause a fatal error, a dcheck (if available) or a
> violation that can be detected with one of the following sanitizers:
> ASAN, UBSAN, MSAN, CFI.
>
> The same flag used in differential fuzzing will cause an error
> subsumed with the error state "fake_difference".
>
> Bug: chromium:1152412
> Change-Id: I4b36c6fe716797004d634263617d22ca67b05600
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2554999
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#71430}

Bug: chromium:1152412
Change-Id: I604258b4c1ebd215c26b1de6b2822663f857bf64
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2565125
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71538}

The wasm fuzzer corpus is pretty outdated. The script that was used to
generate it did not work any more.
This CL updates the script, and runs it. This generates a fuzzer corpus
of 42011 wasm modules, compared to 15290 before. The new modules will
contain new features like SIMD and multi-value, which will be
interesting fuzzer inputs.

R=ahaas@chromium.org

Change-Id: Ic3df26930cb8c1c6e8d521597ceb06cc338c02ed
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2565512Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71537}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/23fe346..4fd0dec

Rolling v8/third_party/aemu-linux-x64: uQdbvtcP840HCVMjrZtUTrYeUgSD_J2rxG1WcyDUbvMC..jfuzh1KU9b_qTmPrfQ2v7GW8FB2tUz0uUUjeyB_2LdQC

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/1af7968..6d2a0fe

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: Ie69bc3b89d25bbe914fd1359077902b16ecc0565
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2567493Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#71536}

Await is a unary operator and should be disallowed on the LHS of
exponentiation like all other unary operators.

Bug: v8:11213
Change-Id: I9c51e33cb37660627748cd926ec222ac0ac246de
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2566442Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71535}

So far the main thread can have two different kinds of local handles,
regular main thread handles and local handles in its LocalIsolate. This
is both confusing and error-prone.

This CL retargets local handles creation for the LocalIsolate on the
main thread to always create regular main thread handles instead.

Bug: v8:10315
Change-Id: I4df509a0fc1bd630ba956b5eaacacbe706ddb4ef
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2527062Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71534}

Add support for array and struct definitions and the rest of gc-related
opcodes.

Drive-by: Remove obsolete kWasmAnyFunctionTypeForm, replace it with
kWasmFuncRef.

Bug: v8:7748
Change-Id: I9512ff22d661fead5ad86767871632ae94346465
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2567691Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71533}

- Uses linkage location information, to keep in sync with how
  LinkageAllocator and Frame work to assign stack slots.

Bug: v8:9198

Change-Id: I299038e4cff706355263f00603ba32515449fefe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2556259Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71532}

This reverts commit 535fd785.

Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux%20-%20gc%20stress/31193/blamelist

Original change's description:
> [wasm] Make DecodeLocals return the number of decoded locals
>
> Currently, when the new locals are not appended to the existing ones,
> there is no way to know how many new locals were defined. This CL
> addresses this issue.
>
> Drive-by: Fix the pc passed to DecodeLocals in OpcodeLength.
> Change-Id: Id9de561a6380b52dcce398301727aa12196c0677
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2567695
> Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#71526}

TBR=clemensb@chromium.org,manoskouk@chromium.org

Change-Id: Ie2bbb1b14e5326bce62bb42fa528528b662d3528
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2567199Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71531}

Instead of processing batches with a fixed number of functions, process
batches with approximately the same number of bytes. This prevents
disproportionately large batches to block the pipeline.

R=ahaas@chromium.org

Bug: v8:11164
Change-Id: I7fe57abac13c5fb749a002e339c5a9b2dab607be
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2567699Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71530}

Null checks were not optimized out for non-nullable arrays for array.len.
This CL brings array.len in line with the rest of the gc operations.

Bug: v8:7748
Change-Id: I8d4d5f159ed220f6e64cb812079e15d6e92de68b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2567690Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71529}

Avoid data race when enabling flag with concurrent thread that reads
that flag as well.

Bug: v8:10315
Change-Id: I9eecc48e21b1070e8db444021264eec2784f5102
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2567697
Auto-Submit: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71528}

The DCHECK on number_of_elements was making TSAN unhappy. Given that
making this field atomic would be a performance penalty, and that the
DCHECK isn't expected to catch any errors in practice (other DCHECKs
check the same invariant), we can just drop it.

Bug: v8:11183
Change-Id: Ic1b5697b233c4c45c3951816531f888459c3e69f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2567698
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71527}

Currently, when the new locals are not appended to the existing ones,
there is no way to know how many new locals were defined. This CL
addresses this issue.

Drive-by: Fix the pc passed to DecodeLocals in OpcodeLength.
Change-Id: Id9de561a6380b52dcce398301727aa12196c0677
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2567695
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71526}

Bug: chromium:1061857
Change-Id: I81ec92979b2e64f77385df79c084b98485c266ff
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2563265Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71525}

Adds publicly callable version of write barrier for TracedReferenceBase.

Bug: chromium:1056170
Change-Id: Ie45b4ebbe91d9f0e8f76b521dcbfd931232adcf6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2565248Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71524}

This reverts commit be52501d.

Reason for revert: Multiple TSan issues: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20TSAN/34457/overview (and others)

Original change's description:
> [heap] Add epoch to GC tracing events
>
> This CL adds the TRACE_GC_EPOCH macro, which adds the epoch as attribute
> to the trace event. Use TRACE_GC_EPOCH for top-level events, nested
> events can get the information from its parent.
>
> V8's GC needs an epoch for young and full collections, since scavenges
> also occur during incremental marking. The epoch is also process-wide,
> so different isolates do not reuse the same id.
>
> Change-Id: I8889bccce51e008374b4796445a50062bd87a45d
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2565247
> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#71521}

TBR=ulan@chromium.org,dinfuehr@chromium.org

Change-Id: I8219595f0751de84cbea7e047ef21aa95da32f07
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2567696Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71523}

When one comparison run crashes, we cap the outputs to compare to the
shorter one. If one of those, however, contains ignored lines, the
comparison get's skewed.

This makes the main source of ignored lines more robust (the line
printed for unknown flags), by not printing it in the first place in
the context of differential fuzzing.

Bug: chromium:1153871
Change-Id: If2e534959779be14a686be5e43630cbf66e215a0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2567692
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71522}

This CL adds the TRACE_GC_EPOCH macro, which adds the epoch as attribute
to the trace event. Use TRACE_GC_EPOCH for top-level events, nested
events can get the information from its parent.

V8's GC needs an epoch for young and full collections, since scavenges
also occur during incremental marking. The epoch is also process-wide,
so different isolates do not reuse the same id.

Change-Id: I8889bccce51e008374b4796445a50062bd87a45d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2565247
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71521}

Bug: v8:11074
Change-Id: I0b819aba03d720780142bcc937e2f148d39f9be9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2567537
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71520}

This reverts commit 064ee3c8.

Reason for revert: Causing blink_web_tests to fail on builder "WebKit Linux MSAN"
https://bugs.chromium.org/p/chromium/issues/detail?id=1153968

Original change's description:
> Reland "[wasm]: Use CancelAndDetach and barrier on BackgroundCompileJob."
>
> Reason for revert: Data race:
> https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20TSAN/34121
>
> It was assume that MockPlatform runs everything on 1 thread. However,
> MockPlatform::PostJob previously would schedule the job through
> TestPlatform, which eventually posts concurrent tasks, thus causing
> data race.
> Fix: Manually calling NewDefaultJobHandle and passing the MockPlatform
> ensures the jobs also run sequentially.
>
> Additional change:
> - CancelAndDetach is now called in ~CompilationStateImpl() to make sure
> it's called in sequence with ScheduleCompileJobForNewUnits
>
> Original CL description:
> To avoid keeping around a list of job handles, CancelAndDetach() is
> used in CancelCompilation. Dependency on WasmEngine is handled by a
> barrier that waits on all jobs to finish.
>
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2498659
> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Cr-Original-Commit-Position: refs/heads/master@{#71074}
> Change-Id: Ie9556f7f96f6fb9a61ada0e5cbd58d4fb4a0f571
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2559137
> Commit-Queue: Etienne Pierre-Doray <etiennep@chromium.org>
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#71459}

TBR=ulan@chromium.org,jkummerow@chromium.org,ahaas@chromium.org,clemensb@chromium.org,etiennep@chromium.org
Bug: chromium:1153968, v8:11209, v8:11210, v8:11212

# Not skipping CQ checks because original CL landed > 1 day ago.

Change-Id: I2c8406bea81ee7cf6c5726c2fec50fffdce09611
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2566446Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71519}

Change-Id: Iee3a65c6df143a41b45b610a10a19ec28ad5c268
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2565513Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71518}

Bug: v8:11074
Change-Id: I80b7c54e44f2fc0cdc4d9786b58aaa92de519b04
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2567536Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71517}

This CL applies kSetOverflowToMin in TruncateFloat32ToInt32,
TruncateFloat32ToUint32, and TruncateFloat64ToInt64, allowing
EffectControlLinearizer to request truncating to INT32_MIN
or INT64_MIN in case of overflow.

Port: d4b29d75

Bug: v8:11121

Change-Id: I1ef794e89641d0be6e9be9bdb99fd7737f465821
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2537417Reviewed-by: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Auto-Submit: Liu yu <liuyu@loongson.cn>
Cr-Commit-Position: refs/heads/master@{#71516}

The auto-generated inspector fuzzer corpus seed files will overwrite the
'utils' class by a proxy which provides non-existing functions.
See https://crrev.com/c/2563552.

R=szuend@chromium.org

Bug: chromium:1142437
Change-Id: If1e86617c4244f1b12fe007b5059b5a5f57454d5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2565127Reviewed-by: Simon Zünd <szuend@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71515}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/4a4f94b..23fe346

Rolling v8/third_party/aemu-linux-x64: xSLGBy9YVgE3OzSwrnR3yqDwyZerQuy2QBEFfV1Lc2IC..uQdbvtcP840HCVMjrZtUTrYeUgSD_J2rxG1WcyDUbvMC

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/7598272..5537c03

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/dc7b108..1af7968

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/20f5376..8636efe

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I911a8d05cb6e8f207706f3c21d2fa9ebf15a55d1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2567490Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#71514}

Port: 9d9e8b41

Bug: v8:10997

Change-Id: I147e88d44c65d225ea9f8f27d937fe4b75ff05c4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2560538
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Reviewed-by: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Auto-Submit: Liu yu <liuyu@loongson.cn>
Cr-Commit-Position: refs/heads/master@{#71513}

This reverts commit a69b7ef2.

Reason for revert: Broke msvc https://ci.chromium.org/p/v8/builders/ci/V8%20Win64%20-%20msvc/15975?

Original change's description:
> [wasm-simd][ia32] Prototype store lane
>
> Prototype v128.store{8,16,32,64}_lane on IA32.
>
> Drive by fix for wrong disassembly of movlps.
>
> Also added more test cases for StoreLane, test for more alignment and offset.
>
> Bug: v8:10975
> Change-Id: I0e16f1b5be824b6fc818d02d0fd84ebc0dff4174
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2557068
> Commit-Queue: Zhi An Ng <zhin@chromium.org>
> Reviewed-by: Bill Budge <bbudge@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#71511}

TBR=bbudge@chromium.org,zhin@chromium.org

Change-Id: Ic9386ea1254c1e0d9b42e92723b1a951fafe3a8b
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10975
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2567315Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71512}

Prototype v128.store{8,16,32,64}_lane on IA32.

Drive by fix for wrong disassembly of movlps.

Also added more test cases for StoreLane, test for more alignment and offset.

Bug: v8:10975
Change-Id: I0e16f1b5be824b6fc818d02d0fd84ebc0dff4174
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2557068
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71511}

We forgot to check if a load's input node (index) has any replacement.
This led to weird cases like I32x4ExtractLane persisting even after
scalar lowering is done, which is incorrect.

This manifested in a crash, where we try to call pextrd with a general
register operand.

With this, we can run all currently checked in performance tests without
crashing.

Bug: chromium:1124885
Change-Id: Ide36ef94ab5f63446c725b9c2eb64be01e7fa6ab
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2562817Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71510}

Bug: v8:11074
Change-Id: Iae76972afb7d1933b8eb57cf634053bb518eeb4b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2565080Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71509}

Bug: v8:10997
Change-Id: I432b1a06b6210ef5916fa07781c0bba677a7d51a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2565244Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#71508}

Change-Id: I5a42e582bec48a0f10f4914295e0c9a267e37b57
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2565518Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71507}

This change completes the necessary API changes for import assertions
discussed in
https://docs.google.com/document/d/1yuXgNHSbTAPubT1Mg0JXp5uTrfirkvO1g5cHHCe-LmY.

The old ResolveCallback is deprecated and replaced with a
ResolveModuleCallback that includes import assertions.  Until
ResolveCallback is removed, InstantiateModule and associated functions
are modified to accept both types of callback, using the new one if it
was supplied and the old one otherwise.  An alternative that I chose not
to go with would be to just duplicate InstantiateModule and associated
functions for both callback types.

SyntheticModule::PrepareInstantiate's callback parameter was unused so I
removed it.

Bug: v8:10958
Change-Id: I8e9fbaf9c2853b076b13da02473fbbe039b9db57
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2551919Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Dan Clark <daniec@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#71506}

Bug: v8:10644
Change-Id: I24229cbbf6a3ffea0fd4c3b96ef6eaf1e780b6e9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2565136
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71505}

Instead of using argc directly, all CSA builtins should use
CodeStubArguments::GetLength().

Bug: v8:11112
Change-Id: Ib62d9d9240e8d42b6b7daed5bdf63f7ab0943fd9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2563879
Commit-Queue: Patrick Thier <pthier@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71504}

The streaming decoder computed the code section start from the passed
"offset". That offset is computed from the module offset *after* the
number of functions has been read. Hence 1 is subtracted, with the
comment:
// The offset passed to {ProcessCodeSectionHeader} is an error offset and
// not the start offset of a buffer. Therefore we need the -1 here.

That subtraction of 1 worked when the number of functions was encoded in
a 1-byte LEB, otherwise it was off.

This CL fixes the immediate issue of passing the right code offset. The
usage of the previously existing offset also seems wrong, and I will try
to clean that up in a follow-up CL.

R=ahaas@chromium.org
CC=szuend@chromium.org

Bug: chromium:1150303
Change-Id: I64bb2ececeb4749b7ba2096cd148ccb4079eca4f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2562383
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71503}