This reverts commit 55c2566c.

Reason for revert: msan failures: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/45213/overview

Original change's description:
> Reland "[d8] Dump stack trace on d8 tests timeouts on posix systems"
>
> This is a reland of commit 5592bad9
>
> Disable timeout signal handler with --fuzzing
>
> Original change's description:
> > [d8] Dump stack trace on d8 tests timeouts on posix systems
> >
> > - Add a SIGTERM handler in d8 that dupms the stack trace
> > - Send SIGTERM before SIGKILL in the test runner
> >
> > Bug: v8:13115
> > Change-Id: I75285f33caabab61ff6ae83c1fbc6faf45cf595a
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3791906
> > Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> > Reviewed-by: Igor Sheludko <ishell@chromium.org>
> > Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> > Cr-Commit-Position: refs/heads/main@{#82173}
>
> Bug: v8:13115
> Change-Id: I8ddbf2a5e601737c2326384d832902b38c371f81
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3816670
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#82296}

Bug: v8:13115
Change-Id: Iea5a808f1ba3b06f53568e6b4af6c973a5ba5e1b
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3819646
Owners-Override: Tobias Tebbi <tebbi@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Auto-Submit: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#82302}

Bug: chromium:1350916

Change-Id: I161dc57506e87b997508b07a0b4f4a206439cb02
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3816651
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82301}

This reverts commit b67385d2.

Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20TSAN%20-%20no-concurrent-marking/10251/overview

Original change's description:
> [wasm] Enable lazy compilation on --future
>
> This should increase test coverage of lazy compilation.
>
> R=​clemensb@chromium.org
>
> Bug: v8:12852
> Change-Id: I205f4b642576add07db5851126370becdad52fb8
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3784597
> Commit-Queue: Andreas Haas <ahaas@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#82291}

Bug: v8:12852
Change-Id: I7cb5a60aa5cf093c12371877b98c72ad754c5ed3
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3819622
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Auto-Submit: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82300}

In order to support a larger heap cage (8GB, 16GB), the cage offset
will take up more than 32 bits. As a consequence, for 8GB cages, the
least significant bit of the cage offset will overlap with the most
significant bit of the tagged offset. To avoid this, allocations need
to be aligned to 8 bytes to free up one bit from the offset.
All changes are deactivated behind the build flag
`v8_enable_pointer_compression_8gb`.

Bug: v8:13070
Change-Id: Ibb0bd0177f3e88dcd24fc0ee7526335df0faa987
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3791052Reviewed-by: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Teo Dutu <teodutu@google.com>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82299}

The GC might promote an in-place internalizable string from new space
directly into the shared heap. This means that the GC might need to
create OLD_TO_SHARED slots when updating OLD_TO_NEW slots.

This CL implements this both for minor and full GCs.

Bug: v8:11708
Change-Id: I6102b9024d1dd5dd602d654b006ea5897ab5baa6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3804604
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82298}

Change-Id: I00acbcac8bbd86b502ef5d921bfcc9b2fa0f3860
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3816672
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82297}

This is a reland of commit 5592bad9

Disable timeout signal handler with --fuzzing

Original change's description:
> [d8] Dump stack trace on d8 tests timeouts on posix systems
>
> - Add a SIGTERM handler in d8 that dupms the stack trace
> - Send SIGTERM before SIGKILL in the test runner
>
> Bug: v8:13115
> Change-Id: I75285f33caabab61ff6ae83c1fbc6faf45cf595a
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3791906
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#82173}

Bug: v8:13115
Change-Id: I8ddbf2a5e601737c2326384d832902b38c371f81
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3816670Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82296}

Splitting off cosmetics and unrelated test refactorings from a larger
CL reworking traced global handles.

Bug: v8:13141
Change-Id: I675cdbd4898346ab55b0db65d53e992f2eb95744
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3816671
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82295}

StepOrigin is enough to infer the right completion action: Either
finalization by task (for StepOrigin::kTask) or stack guard
(for StepOrigin::kV8).

Only tests with StepOrigin::kV8 were violating this but they also just
pass when enabling the stack guard.

Bug: v8:12775
Change-Id: I5df50198d8e3612ee97142f84bd497820a5cec78
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3816664Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82294}

.. since these functions will also be used by Maglev codegen.

Bug: v8:7700
Change-Id: I6fdf830976369aa0dc70ca54be2165a1186eab06
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3816666Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82293}

This reverts commit b1020a43.

Reason for revert: Causes timeout for `condition-workers`: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux%20-%20debug/40516/overview

Original change's description:
> Reland "[shared-struct] Add Atomics.Condition"
>
> This is a reland of commit e2066ff6
>
> Changes since revert:
> - Rebased against c9918524, which
>   uses the external pointer table for the WaiterQueueNode stored
>   in the state field when compressing pointers. This relaxes
>   the alignment requirement of the state field to be 4-bytes when
>   compressing pointers.
> - Moved the state field into the JSSynchronizationPrimitive base
>   class, since alignment and padding can now be made simpler.
>
> Original change's description:
> > [shared-struct] Add Atomics.Condition
> >
> > Bug: v8:12547
> > Change-Id: Id439aef9cab3348171a23378cdd47ede5f4d7288
> > Cq-Include-Trybots: luci.v8.try:v8_linux_arm64_rel_ng,v8_linux64_tsan_rel_ng
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3630350
> > Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> > Reviewed-by: Adam Klein <adamk@chromium.org>
> > Commit-Queue: Shu-yu Guo <syg@chromium.org>
> > Cr-Commit-Position: refs/heads/main@{#81734}
>
> Bug: v8:12547
> Change-Id: I638304c3d5722c64bd04708ed4cf84863cdebb81
> Cq-Include-Trybots: luci.v8.try:v8_linux_arm64_rel_ng,v8_linux64_tsan_rel_ng
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3763787
> Reviewed-by: Adam Klein <adamk@chromium.org>
> Commit-Queue: Shu-yu Guo <syg@chromium.org>
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#82278}

Bug: v8:12547
Change-Id: I27c2aeb131f1b68c2240323189db88d552aa92f9
Cq-Include-Trybots: luci.v8.try:v8_linux_arm64_rel_ng,v8_linux64_tsan_rel_ng
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3817187
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Auto-Submit: Tobias Tebbi <tebbi@chromium.org>
Owners-Override: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#82292}

This should increase test coverage of lazy compilation.

R=clemensb@chromium.org

Bug: v8:12852
Change-Id: I205f4b642576add07db5851126370becdad52fb8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3784597
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82291}

Mark objects as grey when pushing to worklist and mark as black when
objects are visited.

Bug: v8:12612
Change-Id: I5ad28c4481052f41588f43dc39dd44f132a27dfb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3810467
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82290}

JSArrayBuffer::Setup may trigger GC during PostProcessNewJSReceiver.
This is Ok if we drop the raw_obj parameter and instead always reference
the object through a Handle.

Bug: v8:13121
Change-Id: I70361b16a48599ff83094d11008f6288a1402c7f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3810342
Auto-Submit: Samuel Groß <saelo@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82289}

Rolling v8/buildtools/linux64: git_revision:9ef321772ecc161937db69acb346397e0ccc484d..git_revision:3d773bba0927e67eae8fdaee5e28b0f6203d3bee

Rolling v8/buildtools/third_party/libc++/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxx/+log/6c8f712..75bbec9

Rolling v8/buildtools/third_party/libunwind/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind/+log/012c343..c38cbd4

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/84a7988..4755386

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/2cd4823..647cfe6

Rolling v8/third_party/fuchsia-sdk/sdk: version:9.20220728.1.1..version:9.20220808.1.1

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/src/buildtools/+log/56cc5bc..1453422

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I497e392a7c7690f422550d966d553b1ffa8a8c76
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3816766
Owners-Override: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82288}

builtin

Port commit 1067c6ac

Change-Id: Ibbe4aa66f988a55ed4201d87019ac9f31bbfa9cc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3819043Reviewed-by: Philip Pfaffe <pfaffe@chromium.org>
Auto-Submit: Yahan Lu <yahan@iscas.ac.cn>
Reviewed-by: ji qiu <qiuji@iscas.ac.cn>
Commit-Queue: Philip Pfaffe <pfaffe@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82287}

Bug: v8:7748
Change-Id: I511d5016ae5106a1e4aa148038b3ab2f43da1a6d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3810177
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82286}

This reverts commit 82a876b0.

Bug: v8:13086, v8:12619
Change-Id: Idcc42f36b642fefb3ed706214e7385cccc89effc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3779687
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82285}

Avoid terminating from another thread in some thread termination
unit tests.

Change-Id: I0f66e49f1f4e7e3d6ec4c614c2cc1afc9fdb0a22
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3816663
Commit-Queue: Qifan Pan <panq@google.com>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82284}

TF optimizations are still missing, but otherwise the feature is code
complete; further bugs at this point will be unexpected.

Bug: v8:11111
Change-Id: I21f85f29a3753d21baa0f4f76daa6e69ff46097b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3810466Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82283}

... when setting the prototype of TypedArray constructor.

Setting the __proto__ of TypedArray constructor could change TypedArray's
@@species, thus we need to invalidate the @@species protector.

Bug: v8:13110
Change-Id: Ib3b2c88d1136965c221492ff81a26ae69533b356
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3813063
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82282}

Change-Id: I4671a704fc76063a64ed90c337770ec17fe8e393
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3815778
Commit-Queue: Yahan Lu <yahan@iscas.ac.cn>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Auto-Submit: Yahan Lu <yahan@iscas.ac.cn>
Cr-Commit-Position: refs/heads/main@{#82281}

Since those are accessed from background threads during marking, they
should generally be loaded and stored using atomic operations. Further,
when an external pointer slot is initialized, the handle should be
stored using release semantics to prevent reordering of the store into
the pointer table after the store of the handle to the object.

Bug: v8:10391, v8:13156
Change-Id: I5c33b4e791482f84e2770cd047a11f5762a0aa65
Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3812035Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Samuel Groß <saelo@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82280}

Change-Id: I406d211bdac02501b1bfefdf6ebb63b97bb02e44
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3815774Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Yahan Lu <yahan@iscas.ac.cn>
Reviewed-by: ji qiu <qiuji@iscas.ac.cn>
Auto-Submit: Yahan Lu <yahan@iscas.ac.cn>
Cr-Commit-Position: refs/heads/main@{#82279}

This is a reland of commit e2066ff6

Changes since revert:
- Rebased against c9918524, which
  uses the external pointer table for the WaiterQueueNode stored
  in the state field when compressing pointers. This relaxes
  the alignment requirement of the state field to be 4-bytes when
  compressing pointers.
- Moved the state field into the JSSynchronizationPrimitive base
  class, since alignment and padding can now be made simpler.

Original change's description:
> [shared-struct] Add Atomics.Condition
>
> Bug: v8:12547
> Change-Id: Id439aef9cab3348171a23378cdd47ede5f4d7288
> Cq-Include-Trybots: luci.v8.try:v8_linux_arm64_rel_ng,v8_linux64_tsan_rel_ng
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3630350
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Reviewed-by: Adam Klein <adamk@chromium.org>
> Commit-Queue: Shu-yu Guo <syg@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#81734}

Bug: v8:12547
Change-Id: I638304c3d5722c64bd04708ed4cf84863cdebb81
Cq-Include-Trybots: luci.v8.try:v8_linux_arm64_rel_ng,v8_linux64_tsan_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3763787Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82278}

Use a single SBFX instruction for Word64Sar(ChangeInt32ToInt64(x), imm)
when possible.

Using PGO, this improves Speedometer2 by 0.4% on a Cortex-A55 machine,
and 0.27% on a Neoverse-N1 machine.

Change-Id: I6fea5e473f0f0869f8f6cebd9a4e61bb2fc6e9ef
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3807586Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Rodolph Perfetta <rodolph.perfetta@arm.com>
Reviewed-by: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82277}

noextern is the abstract null type for the extern type.

Bug: v8:7748
Change-Id: I03ac0daf3051f479e096f3d05f4fa7cbf03968f1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3810191Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82276}

We now have different mechanisms for black allocation, for regular
sized objects we will set all mark bits for the LAB. For large
objects we will set the mark bit when initializing that large page.

So when we reach this method, the object is already marked black.

Bug: v8:11708
Change-Id: Ie0f82f78eefe06a25103264098cc59a3ee46d20c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3817742
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82275}

nofunc is the abstract null type, the equivalent of none but for the
function type hierarchy.
none and nofunc (and later on noextern) all can only represent a null
value, however their nulls are distinct (as there isn't any subtype
relationship between them).

Bug: v8:7748
Change-Id: Ic5ae502cc21a581ca2e0f5abc46139435d950af9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3805884Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82274}

This might or might not give clang-tidy a hint that the reported case
(see issue) cannot happen. It might also generate slightly better code
by giving hints to the compiler.
Note that V8_ASSUME is actually a DCHECK in DEBUG builds, so we do not
loose any checks here.

Some DCHECKs were removed because they are redundant
(RegisterBase::code() assumes to be only called on valid registers).

R=jkummerow@chromium.org

Bug: chromium:1349619
Change-Id: I467e7917a87ec86dd692f0edeed6bb72e0393cc4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3804667
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82273}

We should verify the consistency of the objects we produced after deserializing successfully.

Bug: v8:11525
Change-Id: Ieec1aa7112ab6eda0c61a1a9ab78e86ad8352942
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3813061
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82272}

The test-gc cctest loads the WasmCode from the NativeModule and then
executes it. With lazy compilation, the WasmCode object first has to get
generated before it can get loaded.

R=jkummerow@chromium.org

Bug: v8:12852
Change-Id: I83a8a2433ac5d11690c82f07e4ae01ddc979821c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3809811
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82271}

Keep page flags which are used in the write barrier together in order
to help reduce code size and reduce register usage.

Bug: v8:11708
Change-Id: I42efa1eeb431dea338d65aef0318cba479f2f431
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3811158Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82270}

Bug: v8:7700
Change-Id: Ib27a3a818189acb5c1a1f39543762b3f0fcd9d69
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3815485Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Cr-Commit-Position: refs/heads/main@{#82269}

...in Runtime_StringToArray.

When a string is sliced from an externalized two-byte string that has
only one-byte chars, String::IsFlat() and
should not call ToOneByteVector() on it and instead we should use

String: :IsOneByteRepresentation() can both be true, while
FlatContent: :IsOneByte() returns false. In this case we
String: :Get() to get the individual characters.
Bug: chromium:1350270
Change-Id: I735408602072279f09b32e1997c97b2900942bdd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3813070Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Joyee Cheung <joyee@igalia.com>
Cr-Commit-Position: refs/heads/main@{#82268}

This change removes the subtyping between funcref and anyref.
Currently, nullref (ref null none) is still a subtype of funcref and externref.
This has to be adapted in a follow-up change introducing nullexternref
(ref null noextern) and nullfuncref (ref null nofunc).

Bug: v8:7748
Change-Id: I77a1b3fef387faf710f7bf7bf9d4655fb600ffdc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3804253Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82267}

Add a --deopt-to-baseline flag, on by default, which allows returning to
sparkplug code when deoptimizing.

However when we turn this off, no longer deoptimizing to baseline code
means we can omit marking most bytecodes as valid jump targets. Leaving
just OSR and exception handling entry points.

This reduces the baseline code size by ~18% on Arm64.

Bug: v8:13082
Change-Id: I5b5a6679465807d7fe812cb977464167efffa7ab
Cq-Include-Trybots: luci.v8.try:v8_linux_arm64_cfi_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3785006Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Pierre Langlois <pierre.langlois@arm.com>
Cr-Commit-Position: refs/heads/main@{#82266}

In https://crrev.com/c/3811502 metrics for lazy compilation were
introduced that get recorded 5 seconds and 20 seconds after
instantiation. With this CL we record these metrics also 60 seconds and
120 seconds after instantiation.

R=clemensb@chromium.org

Bug: v8:12852
Change-Id: If95a3453f6a8510b567d291158d4119b022c1c9b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3810248
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82265}

This reverts commit 5965c90b.

Reason for revert: breaks tree

Original change's description:
> Move some string allocation functions from Factory to FactoryBase
>
> In a subsequent CL, I'll need to do String allocations in Turbofan (in
> the background), where only a LocalFactory is available. By moving
> those string allocation functions to FactoryBase, they will also be
> available in the LocalFactory.
>
> Change-Id: I066bbd4b5016645de183633ef237986e0ae50f5d
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3811581
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Commit-Queue: Darius Mercadier <dmercadier@chromium.org>
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#82262}

Change-Id: I27b4dd06286562ec67e5e6e681e6bcebbff08980
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3816662
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Owners-Override: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82264}

... - a code range size agnostic version of InterpreterEntryTrampoline
builtin. The new builtin is fully compatible with the default version
and used as a template for creating interpreter entry trampoline
Code objects when --interpreted-frames-native-stack is enabled.

This CL introduces a new assembler option "position_independent_code"
which affects the way builtin calls are generated.
This mode is enabled only for InterpreterEntryTrampolineForProfiling.

Motivation:

* InterpreterEntryTrampoline uses RelocInfo::CODE_TARGET for calling
  other builtins which requires the code range to be small enough to
  allow PC-relative jumps/calls between Code objects. This is the
  reason why --interpreted-frames-native-stack was not supported on
  arm and might not work on arm64 because the code range is bigger
  than the max PC-relative distance for call/jump instructions.
  The new builtin calls other builtins via builtins entry table which
  makes the code fully relocatable and usable for any code range size.

* RelocInfo::CODE_TARGET requires a target code to be materialized
  as a Code object which contradicts the Code-less builtins goal.

* The --interpreted-frames-native-stack is rarely used in the wild but
  we have to pay the price of deserializing InterpreterEntryTrampoline
  builtin as a Code object which consumes address space in the code
  range and thus limits the number of V8 isolates that can be created
  because of code range exhaustion. Now the pointer compression cage
  becomes the limiting factor instead of the code range.

* We can remove complicated logic of Factory::CopyCode() and respective
  support on GC side.

Bug: v8:11880, v8:8713, v8:12592
Change-Id: Ib72e28c03496c43db42f6fe46622def12e102f31
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3811287Reviewed-by: Jakob Linke <jgruber@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82263}