In the WebAssembly.Global constructor we continued to execute even after
the JavaScript code in the descriptor.mutable getter threw an exception.
This caused a problem when the descriptor.value getter was executed even
though there was a scheduled exception.

R=jkummerow@chromium.org

Bug: chromium:1033948
Change-Id: Idac554175fe45ec677447b793db069eb6de543b7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1993283Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65669}

This change updates CachedTemplateObjectMap, BreakPointInfo, and
BreakPoint to inherit directly from Struct rather than Tuple2 or Tuple3.
It also removes Tuple3 because nothing else used Tuple3. By avoiding
tuple types, we get various benefits that Torque can provide:
- stricter debug verifier functions
- accessors, cast functions, and printers are generated
- BreakPoint and BreakPointInfo have different instance types, so you
  can tell them apart at runtime or in a debugger

Change-Id: I9367bc08c6dea55d659fd610f9f6105fd61c907a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1988793Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#65668}

Upstream PR: https://chromium-review.googlesource.com/c/deps/inspector_protocol/+/1990896

New rev: dee0c0c65cc2df6284e75ae9fca083dc604c9fca

Change-Id: I1a09d46ee572249bb2c3f4cbdfbc499b7e4f4aa9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1991803Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
Commit-Queue: Johannes Henkel <johannes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65667}

This is a cleanup to remove unneeded flags after these changes (in
https://crrev.com/c/1988548):
* --future does not imply --wasm-tier-up any more, and
* --wasm-tier-up does not imply --liftoff any more.

Instead, now
* --wasm-tier-up is enabled by default,
* --wasm-tier-up has no effect if --liftoff is not set, and
* --future implies --liftoff.

R=ahaas@chromium.org

Bug: chromium:1040061
Change-Id: I5d04ee1f1d84ddcd0654df0e0a4c6298f80aee9e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1993280Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65666}

Fix for a bug introduced in
https://chromium-review.googlesource.com/c/v8/v8/+/1977863

Change-Id: I4dbf259899005bb3b317bc5e8222d19c16abede4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1993284Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65665}

This is a loop over an address range; the loop condition was
incorrectly implemented as a signed comparison.

Bug: chromium:876210
Change-Id: If7276d8ba50f46600f2dfc31268fd02cbb173f15
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1985997Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65664}

This changes the marking worklist draining for the main thread
marker and the concurrent marker to use the following algorithm in
per-context mode:
1) Pop an object from the marking worklist.
2) Try to infer the native context that owns the objects.
   This is done using a new NativeContextInferrer class.
3) If the inference is successful, then change the active marking
   worklist to the worklist of the inferred native context.
4) Otherwise, keep the current active marking worklist.
5) Visit the object. Newly discovered objects will be pushed
   onto the active marking worklist.
6) Account the object size for the native context corresponding
   to the active marking worklist.
   This is done using a new NativeContextStats class.

The main property of the algorithm is that each object for which
we couldn't infer the native context is either attributed to
the native context retaining it or is not attributed to any native
context.

Bug: chromium:973627

Change-Id: Ide4ab992275d115279f971d89ace657f4c05e176
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1981491
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65663}

If --no-liftoff is passed, we should never compile with Liftoff,
independent of the --wasm-tier-up flag.
The current logic hard-coded Liftoff as baseline tier and TurboFan as
top tier for the tiering case.

Drive-by: Remove unused {default_tier_} field from
          {CompilationUnitBuilder}.

R=ahaas@chromium.org

Bug: chromium:1040061
Change-Id: I65bc5e4aad85396e3b952b41cfe1150f6cd29890
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1992439Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65662}

This tnodifies:
TaggedToNumeric
TaggedToNumericWithFeedback
ThrowIfNotInstanceType (also made void since its return value was never
used).
IsSharedFunctionInfo
ComputeUnseededHash (and moves it to builtins-collections-gen.cc)
ComputeSeededHash
TrapAllocationMemento
BranchIfAccessorPair
GotoIfNumberGreaterThanOrEqual
CodeStubArguments::PopAndReturn

Also removes CodeStubArguments::GetArguments which was never called.

Bug: v8:10021
Change-Id: Iaa434f933f0d37ff999ba41601e982b62cfab048
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1989828
Auto-Submit: Dan Elphick <delphick@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65661}

Inspector will no longer report per-function wasm scripts or
provide wasm disassembly. Locations in wasm are now consistently
reported through the inspector API as lineNumber=0
columnNumber=byte offset in module.

Bug: chromium:1013527, chromium:1003022
Change-Id: Ide85bbaa85ad75f29248ff82a3e7f3e40688d377
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1991481
Commit-Queue: Eric Leese <leese@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65660}

When FLAG_noconcurrent_recompilation is turned on we always run on main
thread. So it is safe to derefernce handles when printing the turbofan
graph. We should only add a DCHECK when dereferencing read-only heap
objects when optimizing concurrently.

Bug: chromium:1040444,chromium:1040403
Change-Id: I6bde966690458b1d122611b02e713c581c87f534
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1992433Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65659}

Adds an paged space object iterator for OffThreadSpace, and removes
the Heap pointer from the iterator so that it can be used off-thread.

Bug: chromium:1011762
Change-Id: I025edf144f393e61d89cce2485c0ff1fe8c80c56
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1991488
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65658}

When parsing an arrowhead, it's possible for temporary variables to be
created with a different index depending on whether the parsing is lazy
or eager. This then results in bytecode mismatches as the index is used
to determine which register to use.

To make the ordering stable, this changes variable allocation in arrow
functions to always allocate the non-temporaries first and then the
temporaries.

Bug: chromium:1020162
Change-Id: Ia47c4c2916d63f12d20d663e4e3842bfd68f6d8e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1977865
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65657}

Matched:
  Load\(MachineType::(.*)\(\),
To:
  Load<$1T>(
for cases that were possible in CSA. Example:
Load(MachineType::Int32(), counter_address);
To:
Load<Int32T>(counter_address);

There are some cases that change a bit (e.g "Pointer" to "RawPtrT").

As a drive-by eliminate redundant UncheckedCasts.

Bug: v8:10021
Change-Id: I1135d5986ca7d1cd10ccdceb6c9b4c0aefedb685
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1977863Reviewed-by: Dan Elphick <delphick@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Auto-Submit: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65656}

This currently runs into UNIMPLEMENTED. Since the fuzzer starts hitting
this, make the error message a bit nicer to spot this more easily.

R=ahaas@chromium.org

Bug: chromium:1035233
Change-Id: I63caac37e9b767fba9d6e4b71cb54a8a77b87ab9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1991493Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65655}

Bug: v8:9891
Change-Id: I320b5de731f1d3c03eb1b85de412e1f67196b049
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1985187Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65654}

Change-Id: I7583d4c3f798babb1b8cd23da8abbebf23f53331
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1992604
Auto-Submit: Joshua Litt <joshualitt@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65653}

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/a209c4d..5217563

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/3a797af..0d462e9

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: Ia179ff131f15eb0fc848e152994f07a4a9596c4c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1992920Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#65652}

This reverts commit d6556fbd.

Reason for revert: ugh, accidentally submitted this

Original change's description:
> Reland "Reland "[promises] Port Promise.race to Torque.""
> 
> This reverts commit 2225d242.
> 
> Reason for revert: clusterfuzz fixed
> 
> Original change's description:
> > Revert "Reland "[promises] Port Promise.race to Torque.""
> > 
> > This reverts commit 766aeb99.
> > 
> > Reason for revert: clusterfuzz
> > Bug: chromium:1040238
> > 
> > Original change's description:
> > > Reland "[promises] Port Promise.race to Torque."
> > >
> > > Fixes clusterfuzz bug.
> > >
> > > This is a reland of 15ec4a09
> > >
> > > Original change's description:
> > > > [promises] Port Promise.race to Torque.
> > > >
> > > > Bug: v8:9838
> > > > Change-Id: Iee3bcaa3a7149309c01d16be67d189ccc56bd0e8
> > > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1965919
> > > > Commit-Queue: Joshua Litt <joshualitt@chromium.org>
> > > > Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> > > > Cr-Commit-Position: refs/heads/master@{#65562}
> > >
> > > Bug: v8:9838
> > > Change-Id: Id295a12023195511289d92517936733ab22cdf4b
> > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1988542
> > > Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> > > Commit-Queue: Joshua Litt <joshualitt@chromium.org>
> > > Cr-Commit-Position: refs/heads/master@{#65613}
> > 
> > TBR=jgruber@chromium.org,tebbi@chromium.org,joshualitt@chromium.org
> > 
> > 
> > Bug: v8:9838
> > Change-Id: I1d14eae04ee228806f69b489ab2d86e87fec1ae5
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1991808
> > Reviewed-by: Joshua Litt <joshualitt@chromium.org>
> > Auto-Submit: Joshua Litt <joshualitt@chromium.org>
> > Commit-Queue: Joshua Litt <joshualitt@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#65649}
> 
> TBR=jgruber@chromium.org,tebbi@chromium.org,joshualitt@chromium.org
> 
> Change-Id: I9dda79c99070478443db1a2d8190bd27b4e990d3
> No-Presubmit: true
> No-Tree-Checks: true
> No-Try: true
> Bug: chromium:1040238, v8:9838
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1992605
> Reviewed-by: Joshua Litt <joshualitt@chromium.org>
> Commit-Queue: Joshua Litt <joshualitt@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#65650}

TBR=jgruber@chromium.org,tebbi@chromium.org,joshualitt@chromium.org

Change-Id: I8cf8909e4e4d9ec59fd80eaa6804a8421b0626a6
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:1040238, v8:9838
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1992606Reviewed-by: Joshua Litt <joshualitt@chromium.org>
Commit-Queue: Joshua Litt <joshualitt@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65651}

This reverts commit 2225d242.

Reason for revert: clusterfuzz fixed

Original change's description:
> Revert "Reland "[promises] Port Promise.race to Torque.""
> 
> This reverts commit 766aeb99.
> 
> Reason for revert: clusterfuzz
> Bug: chromium:1040238
> 
> Original change's description:
> > Reland "[promises] Port Promise.race to Torque."
> >
> > Fixes clusterfuzz bug.
> >
> > This is a reland of 15ec4a09
> >
> > Original change's description:
> > > [promises] Port Promise.race to Torque.
> > >
> > > Bug: v8:9838
> > > Change-Id: Iee3bcaa3a7149309c01d16be67d189ccc56bd0e8
> > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1965919
> > > Commit-Queue: Joshua Litt <joshualitt@chromium.org>
> > > Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> > > Cr-Commit-Position: refs/heads/master@{#65562}
> >
> > Bug: v8:9838
> > Change-Id: Id295a12023195511289d92517936733ab22cdf4b
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1988542
> > Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> > Commit-Queue: Joshua Litt <joshualitt@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#65613}
> 
> TBR=jgruber@chromium.org,tebbi@chromium.org,joshualitt@chromium.org
> 
> 
> Bug: v8:9838
> Change-Id: I1d14eae04ee228806f69b489ab2d86e87fec1ae5
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1991808
> Reviewed-by: Joshua Litt <joshualitt@chromium.org>
> Auto-Submit: Joshua Litt <joshualitt@chromium.org>
> Commit-Queue: Joshua Litt <joshualitt@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#65649}

TBR=jgruber@chromium.org,tebbi@chromium.org,joshualitt@chromium.org

Change-Id: I9dda79c99070478443db1a2d8190bd27b4e990d3
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:1040238, v8:9838
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1992605Reviewed-by: Joshua Litt <joshualitt@chromium.org>
Commit-Queue: Joshua Litt <joshualitt@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65650}

This reverts commit 766aeb99.

Reason for revert: clusterfuzz
Bug: chromium:1040238

Original change's description:
> Reland "[promises] Port Promise.race to Torque."
>
> Fixes clusterfuzz bug.
>
> This is a reland of 15ec4a09
>
> Original change's description:
> > [promises] Port Promise.race to Torque.
> >
> > Bug: v8:9838
> > Change-Id: Iee3bcaa3a7149309c01d16be67d189ccc56bd0e8
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1965919
> > Commit-Queue: Joshua Litt <joshualitt@chromium.org>
> > Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#65562}
>
> Bug: v8:9838
> Change-Id: Id295a12023195511289d92517936733ab22cdf4b
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1988542
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Commit-Queue: Joshua Litt <joshualitt@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#65613}

TBR=jgruber@chromium.org,tebbi@chromium.org,joshualitt@chromium.org


Bug: v8:9838
Change-Id: I1d14eae04ee228806f69b489ab2d86e87fec1ae5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1991808Reviewed-by: Joshua Litt <joshualitt@chromium.org>
Auto-Submit: Joshua Litt <joshualitt@chromium.org>
Commit-Queue: Joshua Litt <joshualitt@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65649}

E.g. see
https://chromium.googlesource.com/deps/inspector_protocol/+log

Change-Id: I0b38d2813bbe99be2bcce12390369e57125e728d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1991804Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
Commit-Queue: Johannes Henkel <johannes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65648}

We were missing some possible load compressions due to not having these
bitcasts as cases.

Bug: v8:7703
Change-Id: I866196c4fd09d313d3a461cb7f8f80bc92278e13
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1989830Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65647}

These are already enabled by default on Chrome, but disabled on
platforms without site isolation. Moving to staging to get some
fuzzer coverage.

Bug: v8:10065
Change-Id: I11309926109441083ca39406dfbcc9108e6dd6fc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1972406Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65646}

Upstream PR: https://chromium-review.googlesource.com/c/deps/inspector_protocol/+/1989575
Remove support for emitting cbor into an std::string.

New Revision: b29d8a5d2bb56b3e555bb27a0e035a9d571c5f28

Change-Id: I6bf63822c4c6551db30f5902d1f27f6933b209a5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1989973
Auto-Submit: Johannes Henkel <johannes@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65645}

Change-Id: Ib4b2821f2941cdc131f9c75b89a3baced7554f8d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1991802Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#65644}

Bug: v8:9561
Change-Id: I2259e72829c0ad688284dcecef8aaf418ad53022
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1980503Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65643}

For I16x8Splat and I8x16Splat, the arguments takes I32, which can hold a
value larger than what should be splatted. We add tests to check that
the splatted values is the truncated I32 value (top bits masked off).

See https://github.com/WebAssembly/simd/pull/151 for the updated to
proposal text.

Change-Id: Ib32770872e70c7cde2028130d2b44b416594610e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1986200Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65642}

Bug: v8:9838
Change-Id: If2cbae09eb0628cd4d29bb1768d1ef7d1659e683
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1990128
Commit-Queue: Joshua Litt <joshualitt@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65641}

So far creating scripts always grew the script_list without ever
reusing cleared slots or shrinking. While this is probably not a
problem with script_list in practice, this is still a memory leak.

Fix this leak by using WeakArrayList::Append instead of AddToEnd.
Append adds to the end of the array, but potentially compacts and
shrinks the list as well. Other WeakArrayLists can use this method as
well, as long as they are not using indices into this array.

Bug: v8:10031
Change-Id: If743c4cc3f8d67ab735522f0ded038b2fb43e437
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1967385
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65640}

Clean up isolate inference and non-allocating/allocating parts of
SharedFunctionInfo::InitFromFunctionLiteral, so that it can more easily
be refactored for off-thread allocation in the future. Also, make
SharedFunctionInfo::SetScript a member function, to acknowledge that it
is non-allocating.

Bug: chromium:1011762
Change-Id: I26624fceb642dfdf257ec3d96aab31ea90e48870
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1991482
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65639}

This reverts commit 7a0ae73b.

Reason for revert: Not useful after all, no tests, we can reland if we
do end up needing it.

Original change's description:
> [ast] Add a Flatten method for AstConsString
> 
> This allows off-thread flattening.
> 
> Bug: chromium:1011762
> Change-Id: If83f7bbcbf74165987a4c157184f5b92dc554971
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1924437
> Commit-Queue: Leszek Swirski <leszeks@chromium.org>
> Commit-Queue: Toon Verwaest <verwaest@chromium.org>
> Auto-Submit: Leszek Swirski <leszeks@chromium.org>
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#65075}

TBR=leszeks@chromium.org,verwaest@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: chromium:1011762
Change-Id: Ia72e5abdc9b6149a337565576806427dcd1d11c2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1991484Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65638}

Port cb4ff11d

R=zhin@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I830f055201e8fe873b3e7721d4c117715f620f14
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1991321Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#65637}

Add jkummerow, thibaudm, zhin; drop titzer.
Also make src/wasm/OWNERS the source of truth and let test-specific
OWNERS files refer to that.

No-Try: true
Change-Id: I9862ae452970e20b7842269721ad6a7953f275fc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1989827
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65636}

For finching Liftoff on mobile, we want to support Liftoff-only,
TurboFan-only, and Liftoff with tier-up to TurboFan. Hence, chrome needs
to be able to set the liftoff flag separately from the tier-up flag, and
there should not be an implication, since that implication would be
applied before all flags have been set to their final state.
See https://crrev.com/c/1988360 for the chromium-side change.

Note that this CL does not change any defaults.
After this change, Liftoff can be disabled by passing '--no-liftoff',
independent of the tier-up flag (this would be a TurboFan-only
configuration).
A Liftoff-only version would specify --liftoff and --no-wasm-tier-up.
The default on Desktop (--liftoff and --wasm-tier-up) compiles with
Liftoff first, and tiers up to TurboFan.

R=ahaas@chromium.org

Bug: chromium:1040061
Change-Id: I0291ec20f5a29f3a9e23c25c93907d1d8ffabd51
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1988548Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65635}

The only one remaining was the one in CSA. Once that was removed, we can
simplify the pipeline.

In order to remove it, we have to update the machine graph verifer so
that Word32Equal can accept Tagged values as well.

Bug: v8:7703
Change-Id: Ia3c4d872babc2005be1b402b4614a6039c59dbf3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1987254
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65634}

It has been deprecated in v7.9, but needed to be changed
again for v8.0 by providing a default implementation. This
allowed embedders to remove all overrides. We can now
remove the definitions in v8.1.

R=ulan@chromium.org
CC=​​ahaas@chromium.org

Bug: v8:9810
Change-Id: I9d303bf8a01d863bce3522abccdd3ded5e551818
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1868620Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65633}

The optimized code for String.charCodeAt(BigInt.asUintN(64, 10n)) did
not throw a TypeError due to how lowering of CheckBounds triggers
RepresentationChanger.

Bug: chromium:1038573
Change-Id: Ie0f9ca95de5af5fd3701841ab169e11ccc77216c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1986003
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65632}

Reland after disabling flaky test-cpu-profiler tests

Reland the cl with fixes to TSAN failures.

This reverts commit 03c9de73.

Original change's description:
> Revert "[TurboFan] Don't serialize read-only heap objects"
>
> This reverts commit 9f18e55f.
>
> Reason for revert: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20TSAN/29660
>
> Original change's description:
> > [TurboFan] Don't serialize read-only heap objects
> >
> > Read-only heap objects are immutable and immovable. It is safe to access
> > these objects directly from the heap. Not having to serialize them
> > reduces the time we spend on main thread especially for TurboProp.
> >
> > Bug: v8:9684
> > Change-Id: Ibabb7076af50c9007d2a8ed57fe257406958fb6a
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1955596
> > Reviewed-by: Michael Stanton <mvstanton@chromium.org>
> > Reviewed-by: Maya Lekova <mslekova@chromium.org>
> > Commit-Queue: Mythri Alle <mythria@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#65490}
>
> TBR=mvstanton@chromium.org,neis@chromium.org,mythria@chromium.org,mslekova@chromium.org
>
> Change-Id: If2d8649cdc083f7d064684352501320a96a1ba2c
> No-Presubmit: true
> No-Tree-Checks: true
> No-Try: true
> Bug: v8:9684
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1973732
> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#65492}

TBR=mvstanton@chromium.org,neis@chromium.org,mythria@chromium.org,mslekova@chromium.org,nicohartmann@chromium.org


Bug: v8:9684
Change-Id: I71fb438b9387f7fef8b36629bb947335065474f0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1980573Reviewed-by: Mythri Alle <mythria@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#65584}
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1981163Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65631}

Put the nesting limit of the serializer back to 25.

Bug: chromium:1034768
Change-Id: I7ea827d27241ea930bae40142069bab1962e4133
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1981156
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65630}