Change-Id: Ic4266909eef21398377372a18b004e2ba37567e1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3810192Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82194}

Bug: v8:13116
Change-Id: I76b5e7dfa5e99107fc54722b794bd07ada91152c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3810231Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Almothana Athamneh <almuthanna@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82193}

Revert "[infra] Enable sandbox for x64 and arm64 builders and add a set of builders with Sandbox off"

This reverts commit 161d7f92.

Reason for revert: 
https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Clusterfuzz%20Linux64%20-%20release%20builder/29779/overview

Original change's description:
> [infra] Enable sandbox for x64 and arm64 builders and add a set of builders with Sandbox off
>
> Bug: v8:13058
> Change-Id: Ie3d4f87080fd1076edff1ee75cb03ee8ea4db505
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3788096
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Commit-Queue: Almothana Athamneh <almuthanna@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#82191}

Bug: v8:13058
Change-Id: I68a4097074150f2cf7cca9c776054dca19597fcc
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3810611
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#82192}

Bug: v8:13058
Change-Id: Ie3d4f87080fd1076edff1ee75cb03ee8ea4db505
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3788096Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Almothana Athamneh <almuthanna@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82191}

This is a reland of commit 4bab7a8e

The reland changes the way how we install the async stack tagging API
on the console object. Instead of using `v8::Object::Set`, we use
`createDataProperty` which is sufficient. With `Set`, arbitrary
JS could run via accessors, which might not be allowed depending on
when the API is installed.

Original change's description:
> [inspector] Enable async stack tagging API by default
>
> R=bmeurer@chromium.org
>
> Fixed: chromium:1334585
> Change-Id: Id79a60bac1731ea9c60654ff15c8e23f958c6e57
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3799431
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Commit-Queue: Simon Zünd <szuend@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#82161}

Change-Id: I9b8c8e643705f8f043acac5af14307f2dbdb5a68
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3809692Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82190}

Change-Id: I67b6594d7ec5226d54f09954210fe4f6ec4d47b8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3810172Reviewed-by: Mathias Bynens <mathias@chromium.org>
Commit-Queue: Mathias Bynens <mathias@chromium.org>
Auto-Submit: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82189}

v8::TracedReference is supposed to be used from objects allocated on
CppHeap. Such objects can be in construction during garbage
collection, meaning that they are unable to invoke
Trace(v8::TraceReference) as they have not been properly set up.

It is thus necessary to use conservative tracing to find
v8::TracedReference (backed by TracedNode in GlobalHandle) in
in-construction objects.

Change-Id: I5b4ac6e7805ff7ded33f63a405db65ea08d809ad
Bug: v8:13141, chromium:1322114
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3806439
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82188}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/b1d3dce..0ad6539

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/b11b8b4..ba74bc7

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I5bdd2fa04c54f6c0bcad868651d5d424e6aea1b2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3808973
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#82187}

Port 4e329f8c
Also fix 64-bit addressed stores on riscv64

Bug: v8:12852
Bug: v8:10949
Change-Id: Ibc0d4efe04da5b4ca3c3e6c2997655b8d3795004
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3806593
Commit-Queue: Yahan Lu <yahan@iscas.ac.cn>
Auto-Submit: ji qiu <qiuji@iscas.ac.cn>
Reviewed-by: Yahan Lu <yahan@iscas.ac.cn>
Cr-Commit-Position: refs/heads/main@{#82186}

1. fix year value between 100 and 9999 should use 4 digit padding without '+' prefix to sync with the latest spec in
mjsunit/temporal/plain-date-time-to-json

2. Change the the toPlainDateTime to accept object with partial time fields to sync with current spect in
test/mjsunit/temporal/plain-date-to-plain-date-time.js

3. Change the test to accept input parameter type to Number instead of BigInt for Instant fromEpochSeconds and from EpochMilliseconds in
test/mjsunit/temporal/instant-from-epoch-milliseconds.js and
test/mjsunit/temporal/instant-from-epoch-seconds.js
Throw TypeError if the type is BigInt.

4. Change the return type of Instant epochSeconds and epochMilliseconds from BigInt to Number to sync with the spec in
test/mjsunit/temporal/instant-constructor.js

Spec text
https://tc39.es/proposal-temporal/#sec-temporal-padisoyear
https://tc39.es/proposal-temporal/#sec-temporal-totemporaltimerecord
https://tc39.es/proposal-temporal/#sec-temporal.instant.fromepochmilliseconds
https://tc39.es/proposal-temporal/#sec-temporal.instant.fromepochseconds
https://tc39.es/proposal-temporal/#sec-get-temporal.zoneddatetime.prototype.epochmilliseconds
https://tc39.es/proposal-temporal/#sec-get-temporal.zoneddatetime.prototype.epochseconds

Bug: v8:11544
Change-Id: Icd290905b65fdabbedece27e59c785635c212ec2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3807122Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82185}

Correct the wrong parameter passing in the 3rd  PrepareTemporalFields
calls

Spec text:
https://tc39.es/proposal-temporal/#sec-temporal.plaindate.prototype.with
https://tc39.es/proposal-temporal/#sec-temporal.plainyearmonth.prototype.with
https://tc39.es/proposal-temporal/#sec-temporal.plainmonthday.prototype.with

Bug: v8:11544
Change-Id: I8acd7059cedf6924eee36ed5cb7892b636c8c72a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3807905Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82184}

Implement the WebAssembly.Function-based API.
With the old API, wrapping an import and export with JS Promise
Integration looked like:

  WebAssembly.returnPromiseOnSuspend(<wasm_export>);
  WebAssembly.suspendOnReturnedPromise(
    new WebAssembly.Function(<sig>, <js_import>));

With the new API:

  new WebAssembly.Function(<sig>, <wasm_export>, {promising: 'first'})
  new WebAssembly.Function(<sig>, <js_import>, {suspending: 'first'})

For details, see
https://github.com/WebAssembly/js-promise-integration/pull/8/files

R=ahaas@chromium.org

Bug: v8:12191
Change-Id: Iaefaac5304a038fc39283db165b637af7e48b009
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3804669Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82183}

This reverts commit 4bab7a8e.

Reason for revert: Breaks chromium integration, blocking the roll: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Blink%20Linux%20Debug/15697/overview

Original change's description:
> [inspector] Enable async stack tagging API by default
>
> R=​bmeurer@chromium.org
>
> Fixed: chromium:1334585
> Change-Id: Id79a60bac1731ea9c60654ff15c8e23f958c6e57
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3799431
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Commit-Queue: Simon Zünd <szuend@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#82161}

Change-Id: I1918c5c14d17d724b7836e04eb4a64d034c2af9b
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3804697
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Auto-Submit: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82182}

With streaming compilation we delay the generation of errors until after
all bytes are received, so that potentially better error messages get
generated. With this CL we also delay the generation of errors in the
combination of lazy compilation and streaming compilation.

In particular, this CL does the following:
* It avoids the creation of a `DecodeFail` task in
`FinishAsyncCompileJobWithError`, which would create an error immediately before a potential name section arrived.
* It calls `CompilationStateImpl::SetError()` so that an error is
created once the stream finishes.
* It removes the return value of `ProcessFunctionBody` so that wire
bytes continue to be received even after a validation error.
* It adds an early exit to `ProcessFunctionBody` if
`CompilationStateImpl::failed()` is true, so that we don't continue
validation after the first detected error.

R=clemensb@chromium.org

Bug: v8:12852
Change-Id: Ie8c6be243a257ef62cbb29fea6b8e0c205060680
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3802691Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82181}

R=clemensb@chromium.org

Bug: v8:12852
Change-Id: I3fbae50b164cca4ad1c0fefb856070ae2e472ff5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3805059Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82180}

The String might be in the shared heap which is not collected during
client GCs.

Bug: v8:11708
Change-Id: I0958c46996a2aeba3a046263350617e8d177deca
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3805883Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82179}

If DefaultJobState::Join is called before any worker tasks were spawned
(e.g. right after Platform::CreateJob), it should spawn the required
number of worker tasks (mimicing what Platform::PostJob followed by Join
would do, but with less context switches).
This fixes regressions we got from switching from Platform::PostJob to
Platform::CreateJob.

R=mlippautz@chromium.org
CC=etiennep@chromium.org

Bug: chromium:1348512
Change-Id: Ic7984d12a28fc67f4b2f51ddc2ba5a406e43c127
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3804600Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82178}

Bug: v8:7700
Change-Id: Ifc1008dce56e8f7e628a0ee0012f13403c40170b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3804668
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82177}

This reverts commit 5592bad9.

Reason for revert:
https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/45109/overview

Original change's description:
> [d8] Dump stack trace on d8 tests timeouts on posix systems
>
> - Add a SIGTERM handler in d8 that dupms the stack trace
> - Send SIGTERM before SIGKILL in the test runner
>
> Bug: v8:13115
> Change-Id: I75285f33caabab61ff6ae83c1fbc6faf45cf595a
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3791906
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#82173}

Bug: v8:13115
Change-Id: I29f72d67036f76f93043f06841e4236864623bbe
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3805885Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Owners-Override: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82176}

Bug: v8:7700
Change-Id: I4d74ca2d063869978226586c81fc45e0fd45dffa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3804665
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82175}

Bug: v8:7700
Change-Id: Ifad20bcccea2b87cb2119dcbaa5f16bf2dba2f60
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3804666Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82174}

- Add a SIGTERM handler in d8 that dupms the stack trace
- Send SIGTERM before SIGKILL in the test runner

Bug: v8:13115
Change-Id: I75285f33caabab61ff6ae83c1fbc6faf45cf595a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3791906Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82173}

Async compilation with lazy compilation generated an error message that
did not include the function name. With this CL the function name now
gets included.

R=clemensb@chromium.org

Bug: v8:12852
Change-Id: Ia8aed83a2114a2c9da1367045404b20fa8554c8a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3804863
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82172}

The serialized module contains information for each function whether the
serialized code for the function exists, and whether the function has
been executed before serialization. The latter information is used to
decide if the function should get compiled eagerly after deserialization
(in case the function has been executed before serialization), or if the
function should get compiled lazily because it will probably not be
executed anytime soon.

So far this code only worked for eager compilation. When lazy compilation
was enabled, all functions would get compiled lazily after
deserialization. With this CL the behavior described above is extended to
lazy compilation.

R=clemensb@chromium.org

Bug: v8:12926
Change-Id: Ifd6f400396222105feffa472c2e8787e1358220e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3807583Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82171}

Weak containers are re-traced during conservative stack scanning to
strongify their contents. This runs in parallel with concurrent
marking that could find new weak containers.

The CL fixes two issues:
- The concurrent marker could find a weak container and mark it but
  would only add it to the set of weak containers afterwards. We need to
  reverse this (using a lock) to make sure that the main thread sees the
  marked weak container.
- The DCHECK for containment needs to be concurrency aware.

Bug: chromium:1349298
Change-Id: I1ec31db62647f7f1c19e9cc60976e09946551333
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3807593Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82170}

... with inlined allocation.

Bug: v8:7700
Change-Id: I523bc6ed843e87611f83ed39821c389c32ea787e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3804663Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82169}

This reverts commit ccde4205.

Reason for revert: Investigating performance regressions

Original change's description:
> [TurboFan] Support BigIntMultiply
>
> Bug: v8:9407
> Change-Id: Iab0a4ca8dd5d83444d1addd6043a5c8e3a8577a7
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3773773
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#82140}

Bug: v8:9407
Change-Id: I21de9fd43df2e043b4019d2bad560329ef0971b4
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3807584
Owners-Override: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#82168}

Use marking already made several assumptions about node numbering
running just before it (in particular, that loop Phis can't be marked
when visited, but only when the loop back edge is visited). This wasn't
too bad initially, but now we have to bend over backwards to extract the
node id at loop headers for lifetime extension.

So, merge the numbering into the use marking.

Bug: v8:7700
Change-Id: I2f2e8feec8d0e25e302e92988109d88621879cd5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3797830Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82167}

The is_unmerged_loop predicate was using the "unmerged_loop_marker"
predecessor sentinel value to decide whether the merge state is an
unmerged loop header or not. However, the predecessor values were
otherwise uninitialized. This means that with some amount of bad luck,
you could get an uninitialized predecessor which happened to hold the
unmerged loop marker (it's more likely than a 1 in 2^32 chance, because
it could be left over from a previous compilation's zone).

Since we anyway now store whether a merge state is a loop header for
other reasons, we can replace the sentinel logic with predecessor count
based logic for this predicate.

Bug: v8:7700, v8:13109
Change-Id: Ibabe23feefc2bb909cf2480113300cb4757114d3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3807591
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82166}

This is a reland of commit a1392fa1

The original change was reverted due to v8:13135, which was fixed
separately.

Original change's description:
> Enable background merging when --stress-background-compile
>
> This change adds new functions to BackgroundCompileTask which closely
> match those in BackgroundDeserializeTask. These functions allow a caller
> to manage background merging of newly compiled content into an existing
> Script from the Isolate compilation cache. These functions are not yet
> exposed via the API; instead, StressBackgroundCompileThread uses them to
> increase test coverage of the merging logic.
>
> Bug: v8:12808
> Change-Id: I4d2f429164223785169fe447ce2bdd8beaee00d4
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3793959
> Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#82121}

Bug: v8:12808
Change-Id: I530c6e87bbad11e178ef4abfdc25fa98530f0224
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3806590Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/main@{#82165}

... with addresses unexpected by V8.

Bug: v8:12425
Change-Id: I602ea79e84242a4a163bdbd6b22fb16e76eda1a2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3807585Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82164}

This reverts commit 491de34b.

Reason for revert: Lose co-authors information

Original change's description:
> [riscv32] Add RISCV32 backend
>
> This very large changeset adds support for RISCV32.
>
> Bug: v8:13025
> Change-Id: Ieacc857131e6620f0fcfd7daa88a0f8d77056aa9
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3736732
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Commit-Queue: Yahan Lu <yahan@iscas.ac.cn>
> Reviewed-by: ji qiu <qiuji@iscas.ac.cn>
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Reviewed-by: Hannes Payer <hpayer@chromium.org>
> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#82053}

Bug: v8:13025
Change-Id: I6abea32c8ea43b080a938782dc643c97a123f1d8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3803994Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Owners-Override: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: ji qiu <qiuji@iscas.ac.cn>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Yahan Lu <yahan@iscas.ac.cn>
Cr-Commit-Position: refs/heads/main@{#82163}

Some tests assume that liftoff code is available immediately after
compilation. Add the `--no-wasm-lazy-compilation` flag to these tests
so that they work even after shipping lazy compilation.

R=clemensb@chromium.org

Bug: v8:12926
Change-Id: I839610221390822b90b25e1bef3ae727fa33d1ca
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3804862Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82162}

R=bmeurer@chromium.org

Fixed: chromium:1334585
Change-Id: Id79a60bac1731ea9c60654ff15c8e23f958c6e57
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3799431Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82161}

Bug: v8:7700
Change-Id: Id4294fdfad414b34606a1f15e97dbd5485b8e23a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3804868
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82160}

We create a constructor for CallBuiltin that accepts a feedback vector.
It assumes that the builtin expects a slot and the vector respectively
at the end.

Bug: v8:7700
Change-Id: I20f9b4ff172dca7779abd31a042b3bdc734df350
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3804250
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82159}

These bytecodes simply call a builtin.

Bug: v8:7700
Change-Id: I2616ea5571741a7f79b27bc6ddbd95cfb3254e97
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3805063
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82158}

Except CopyDataPropertiesWithExcludedPropertiesOnStack.

Bug: v8:7700
Change-Id: Ie7e070002071291da2d9279c601a78b22113fc9b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3804864Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82157}

Turbofan optimizes TruncateInt64ToInt32 by trying to merge it into
its input. This can avoid generating a movl instruction. However, when
the input is BitcastTaggedToWordForTagAndSmiBits, it fails to apply
this optimization and this results in a redundant move:

  Turbofan IR:
  149: Load[kRepTaggedSigned|kTypeInt32](...)
  150: BitcastTaggedToWordForTagAndSmiBits(149)
  151: TruncateInt64ToInt32(150)
  152: Word32And(151, 558)

  Assembly:
  103  movl r11,[r8+0x1f]
  107  movl r11,r11
  10a  andl r11,0x4

This CL fixes this and avoids the redundant movl instruction.

Change-Id: Id59d1ce1e3b139344f750e903726dd9f338cfdba
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3787681Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Hao A Xu <hao.a.xu@intel.com>
Cr-Commit-Position: refs/heads/main@{#82156}

Currently, WebSnapshotDeserializer::CreateScopeInfo creates the
ScopeInfo first, and then creates its local names hashtable if
necessary. If GC occurs when creating the local names hashtable, the
object verifier correctly complains that the ScopeInfo doesn't have all
needed fields. The solution (consistent with ScopeInfo::Create) is to
create the local names hashtable first. That way, no GC can happen in
the interval after the ScopeInfo is allocated but before it has valid
fields.

Bug: v8:13135
Change-Id: Ifd6eb10e54a4151f7edb592bc19afa3263d41788
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3803674Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82155}