This limit is wasm-internal, and does not need to be exposed via
src/common/globals.h.
This CL moves it into the {WasmCodeAllocator}.

Drive-by: Minor simplification in jump table stress test.

R=ecmziegler@chromium.org

Change-Id: Iff8c4657697ae98123d840a022c5b21c4948fcdf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2375189Reviewed-by: Emanuel Ziegler <ecmziegler@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69558}

While LocalHeap allow to dereference handles on background threads, this
is only possible when FLAG_local_heaps is enabled.

Bug: v8:10315
Change-Id: Ia27582cda7e4b4faf4d2c76959de418415e1ae68
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2372147
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69557}

This CL is the start to implement reference types support in Liftoff.
As a first step this CL implements the ref.null instruction, and allows
reference types as return values. This allows register allocation to be
extended to support reference types, and also adds an easy way to get a
reference type value for tests. Additionally with ref.null we don't have
to worry about garbage collection because 'null' is an immovable object
and therefore does not have to be scanned by the GC.

R=thibaudm@chromium.org

Bug: v8:7581
Change-Id: I5785dcf522c0d9881e1386f2d8b5d8560a16225c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2352784
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69556}

NCI code deopts differently than TF code.

Tbr: mythria@chromium.org
Bug: v8:8888
Change-Id: Ica1352ed5aba648c95a8a26fd6c2dd703b0f335c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2375186Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69555}

We already make sure hints are 16K aligned on the Mac. On linux, it's
possible to run with 64K pages enabled so we also need to align the
hint there.

Bug: v8:10808
Change-Id: I4ae7a56828135f6aa2980f164f25e2eb932b3cc0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2369176Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Pierre Langlois <pierre.langlois@arm.com>
Cr-Commit-Position: refs/heads/master@{#69554}

- JobHandle::IsCompleted()
- JobDelegate::GetTaskId()
- worker_count passed as argument to GetMaxConcurrency().
  Jobs implementation must call the new GetMaxConcurrency(), but Jobs
  users aren't migrated yet.

Bug: chromium:1114823
Change-Id: I0f4295ccaf9eba866dd771f30e2e49aa3eae9551
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2352484
Commit-Queue: Etienne Pierre-Doray <etiennep@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69553}

Also we can do ParameterToIntPtr since this was the last use.

Bug: v8:9708, v8:6949
Change-Id: I61747205d9d747c80bd13cd98bc51d8f97946130
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2374546Reviewed-by: Dan Elphick <delphick@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69552}

Change-Id: Iee7d2d0d2abbb5e18640d0601203dfb58e5ec474
Bug: v8:10201, v8:10825
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2374527
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69551}

The cctests need to simulate full pages, however the calculation of the
remainging available space is wrong causing an assertion when we change
the V8 page size to 512K:

    $ cctest test-array-buffer-tracker/ArrayBuffer_PagePromotion

    #
    # Fatal error in ../../test/cctest/heap/heap-utils.cc, line 94
    # Check failed: padding_size <= overall_free_memory || overall_free_memory == 0.

The reason is:

  - On startup, we register a scavenger observer on the new space. The
    observer is set to trigger when the new space capacity is at 80% by
    default.

  - On linux, the initial capacity of the new space is 512K, so the
    scavenger observer will be placed at 80% of 512K, which will either
    be in the second page of the space if the page size is 256K, or in
    the first page if the page size is 512K.

  - When placing the observer, if the observer hits the first page, we
    lower the allocation limit (see `ComputeLimit()`). This makes sure
    the observer isn't skipped by allocations inlined in generated code.

However, when we simulate filling the current page, we compute the space
left in the current page by comparing the top with the `page_high()`
rather than `limit()`. This was done so the tests would also work when
inlined allocations are disabled. If we don't look at the `limit()`, we
don't take the observer into account and fill more space than is
available, triggering the assertion.

This can also be reproduced by reducing the % at which the scavenger is
triggered so that it hits the first page instead of the second when the
page size is 256K, for example passing --scavenge-task-trigger=10.

Bug v8:10808, v8:9906

Change-Id: Iad50bb68995de5ee017dcbe069d1fb229c9f5985
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2372545
Commit-Queue: Pierre Langlois <pierre.langlois@arm.com>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69550}

With WebAssembly streaming compilation it is possible that FinishStream
indirectly calls AbortStream. This had the effect that while
FinishStream fulfilled the promise, AbortStream disposed the promise
by removing the compile job from the wasm engine and thereby deallocated
AsyncCompileJob and all the state that belongs to it. Without that
state, FinishStream could not finish fulfilling the promise correctly.

With this CL the streaming decoder remembers that the stream has
already been finished. When the stream has been finished, all calls to
Abort get ignored.

The regression test for this issue requires the Chrome embedding, see
https://crrev.com/c/2368359

R=clemensb@chromium.org

Bug: chromium:1117258
Change-Id: Ifc28a1ee38c228b051c4d7d85b305fe2a721fa1f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2367858
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69549}

This bumps the engine-wide limit for generated machine code from 1GB to
2GB. This will allow compiling (and debugging) bigger modules, as they
occur particularly in the debugging use case because the module will be
unoptimized then.

The limit per allocated code space is left at 1024MB (1GB), so a module
will need to allocate two separate code spaces to make use of the full
2GB code space.

R=ecmziegler@chromium.org

Bug: chromium:1117033, chromium:1114093, chromium:1107649, chromium:1111266
Change-Id: Iab95b3130cbacc21ba078bf0d4ee2d6cd121d675
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2372604Reviewed-by: Emanuel Ziegler <ecmziegler@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69548}

This reverts commit f16d3abf.

Reason for revert: register_count() is read from the heap on the
background thread. This is only safe when FLAG_local_heaps is enabled
(set to true) but this isn't the case on tip-of-tree.

Original change's description:
> [compiler] Access the heap for BytecodeArray int/Register members
>
> We can create a new macro to skip the xxxData classes and read directly
> from the heap.
>
> Bug: v8:7790
> Change-Id: I8de9ba0aee78c74d4c3113eb6bc4870a314de552
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2362687
> Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69471}

TBR=neis@chromium.org,solanes@chromium.org

Bug: v8:7790
Change-Id: I35bdd44721ce1e9d2f46df7cf5d1f413e22d9acf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2372602Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69547}

Bug: v8:9237
Change-Id: Iaa1e3485eaecdd5af654177f207a990a2e63396b
No-Try: True
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2374545Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69546}

Action items:
* Replace alls css @import with link tags.
* Format all sources in system-analyzer/*.

Bug: v8:10644

Change-Id: I6354cf7b0ed2aca8cdab4888cf9d504a1d963b50
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2367869
Commit-Queue: Zeynep Cankara <zcankara@google.com>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69545}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/b656b39..7946304

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/e6244cc..a54f10f

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/4909610..e95b5d6

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/9784c4f..d9986ad

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: Ib4c2f5df542ec7aa228c80cf330f6a17ec7ee7e7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2373478Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#69544}

This is a reland of 8358094d

Original change's description:
> [atomics] Missing detach check in Atomics.store on MIPS
> 
> There was a missing detach check in the runtime implementation of
> Atomics.store on BigInt TypedArrays. This runtime function is only used
> on MIPS.
> 
> Bug: v8:10687
> Change-Id: I77946d2ab0abf70c583af514ddaba0d384a21309
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2369663
> Auto-Submit: Shu-yu Guo <syg@chromium.org>
> Commit-Queue: Ben Smith <binji@chromium.org>
> Reviewed-by: Ben Smith <binji@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69525}

Bug: v8:10687
Change-Id: If75e2100712786fc9b39782e24b1457031060169
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2369974Reviewed-by: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Ben Smith <binji@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69543}

Bug: v8:10201
Change-Id: Ia0c89a02840b2b29afe41f8eedd423c4d635c61f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2319646Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69542}

Also remove ParameterMode since it is not needed.

Bug: v8:9708, v8:6949
Change-Id: If82cd5ffb89502e3feed7f5af613182df668080e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2370639Reviewed-by: Dan Elphick <delphick@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69541}

Also remove unused macros from the list.

Bug: v8:9708, v8:6949
Change-Id: Ib90ce7c2c4996b3f8892106a89884d7e83610ca6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2370637Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69540}

Bug: v8:9708, v8:6949
Change-Id: If2b95333b5821b91296169714359f095bf8b9bd6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2370636Reviewed-by: Dan Elphick <delphick@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69539}

Bug: v8:9237
No-Try: True
Change-Id: Ic1bba1e0f5584350217c3971dfcc769c86beb1fd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2366694
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69538}

This CL highlights the items with clickable functionality.
It is implemented based on the received feedback from the
V8 Mobile Team.

Bug: v8:10644

Change-Id: I0489327681d485eedde59594d36083efdc216575
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2370626Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Zeynep Cankara <zcankara@google.com>
Cr-Commit-Position: refs/heads/master@{#69537}

The new one was created in
https://chromium-review.googlesource.com/c/v8/v8/+/1969900, and the old
API was deprecated in
https://chromium-review.googlesource.com/c/v8/v8/+/2110015, so now we
can remove it.

Bug: v8:8116
Change-Id: Ia839279609b412c36f1f17368acef23fe07e7c61
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2369174Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69536}

This cleanup CL adds a timeline property to ic-panel and directly
assigns the logEvents to selectedLogEvents upon data load.

Bug: v8:10644

Change-Id: Ic1707ea237abbf57417c0b14e24fc0bf797d9679
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2370627Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Zeynep Cankara <zcankara@google.com>
Cr-Commit-Position: refs/heads/master@{#69535}

Marking on allocation assumes a non-empty stack. Thus marking on
allocation will not finalize even if it runs out of work (we prefer
to finalize in a non-nestable task with no stack).
Instead it will schedule another marking task and delegates
finalization to the next marking task.

Bug: chromium:1056170
Change-Id: I457090fe0a235707bb9973e330ff24fb25ac66c0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2366764Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69534}

Change-Id: I1df5bbb5f974e09967a7e904556dd109235ecace
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2366780Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69533}

Reverse JS arguments hasn't been implemented on mips

Change-Id: Ie6adb1c55de06838cb530966b1b54fb4b542350f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2371477Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/master@{#69532}

Prior to this CL, one had to artificially insert a
basic-block-terminating node after Unreachable. The common pattern was

 Unreachable();
 Goto(&some_label);  // Never reached but generates useless code.

This CL improves usability by automatically merging Unreachable nodes
to the end node, and terminating current effect/control. The updated
pattern is just

 Unreachable();

or in cases where Turboprop must maintain a schedule:

 Unreachable(&some_label);

Bug: v8:8888
Change-Id: I26a0b11b5e67252a6dc3584ae09ed06370f1eacc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2362690
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69531}

Starboard is the platform abstraction for Cobalt.
This CL introduces all Cobalt changes in src/base/platform.

The review was conducted mostly on:
https://chromium-review.googlesource.com/c/v8/v8/+/2247918

See b/156155426 for background

Tbr: mlippautz@chromium.org
Change-Id: I6cd092304ba6485acd38e82aa2dc4505d7dfb0aa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2346090
Commit-Queue: John Xu <johnx@google.com>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69530}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/c97da98..b656b39

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I9d81d498321fe94d55f2b0eec45c10ef1cdc7f0c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2370823Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#69529}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/134058c..c97da98

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: Ic02d3f8415af6afc1cdfe372d04f8cbef0113a55
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2370822Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#69528}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/d2b7ca1..134058c

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/src/buildtools/+log/b00ad0a..ff93f3e

Rolling v8/buildtools/linux64: git_revision:e327ffdc503815916db2543ec000226a8df45163..git_revision:6f13aaac55a977e1948910942675c69f2b4f7a94

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/7f34313..e6244cc

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/87a7605..4909610

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/a4bb1c6..9784c4f

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I5979068c4c7066b845adc8576281de66a36fdc6d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2370070Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#69527}

This reverts commit 8358094d.

Reason for revert: Closed the tree on arm pointer compression:
https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20-%20arm64%20-%20sim%20-%20pointer%20compression/6256?


Original change's description:
> [atomics] Missing detach check in Atomics.store on MIPS
> 
> There was a missing detach check in the runtime implementation of
> Atomics.store on BigInt TypedArrays. This runtime function is only used
> on MIPS.
> 
> Bug: v8:10687
> Change-Id: I77946d2ab0abf70c583af514ddaba0d384a21309
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2369663
> Auto-Submit: Shu-yu Guo <syg@chromium.org>
> Commit-Queue: Ben Smith <binji@chromium.org>
> Reviewed-by: Ben Smith <binji@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69525}

TBR=binji@chromium.org,syg@chromium.org

Change-Id: I955cdbf5d83674b8acb5b67bbe8754f3d39261aa
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10687
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2369973Reviewed-by: Francis McCabe <fgm@chromium.org>
Commit-Queue: Francis McCabe <fgm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69526}

There was a missing detach check in the runtime implementation of
Atomics.store on BigInt TypedArrays. This runtime function is only used
on MIPS.

Bug: v8:10687
Change-Id: I77946d2ab0abf70c583af514ddaba0d384a21309
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2369663
Auto-Submit: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Ben Smith <binji@chromium.org>
Reviewed-by: Ben Smith <binji@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69525}

Bug: v8:10819
Change-Id: I91cf658d9fdcbaf58d6b2e5734c59d7248b8393e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2369461Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69524}

If the input to a Switch happens to be something that we already know to
be zero-extended, then we don't need to emit a movl to zero-extend it.
This is a tiny optimization, but speeds up the Mono interpreter by 3%
because it's heavily dependent on switch dispatch speed.

Bug: v8:10606
Change-Id: I67ab6b6aeb93df4e420ea2afef41a2234d7da979
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2368195Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#69523}

Also removes bmeurer@ from interpreter/OWNERS.

BUG=v8:10806

Change-Id: I97cb77350271f773600e92d4ce787080388eb14c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2369179
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Auto-Submit: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69522}

With in-place representation changes we can transition from a double
field to a Tagged field without changing the map. So it is not always
safe to assume the loaded value would be a HeapNumber. TurboFan takes a
dependency on the field representation to ensure the code is deoptimized
on any changes. With dynamic map checks, it is not possible to take such
a dependency. Hence check the loaded value is a HeapNumber and
deoptimize otherwise.

Bug: chromium:1112155,v8:10582
Change-Id: I910ac1c0781ac8842fdbf272f9173b55b02923ba
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2354810
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69521}

Bug: v8:9708, v8:6949
Change-Id: I2a60a3970adf3020b42ee1b1264ca3c11f9f88c6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2362955Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69520}

The array can be FixedArrayBase, PropertyArray or HeapObject. That
HeapObject has to be either a FixedArray or a PropertyArray since we
have an assert for it. However, due to how the code is structured it
is not so simple to remove HeapObject from the Union.

Drive-by: deleted unused version of BuildFastArrayForEach.

Bug: v8:9708, v8:6949
Change-Id: I980f759dad9c76f0c765622cbdda37e33709f53f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2362954Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69519}