This instruction is a non-standard V8-only experiment for now,
hidden behind the --experimental-wasm-gc-experiments flag.
The motivation is to provide a way to set up non-canonicalized
RTT hierarchies, to enable expressing the type system of Java-like
languages in terms of WasmGC constructs.

Bug: v8:7748
Change-Id: Idf1c18e9944c983f40f1e01b2032ee5fdc2fd81b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2930478Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74920}

Since we always call the out-of-line Prologue, we can preload the
accumulator in there with undefined instead of having to emit an
undefined load in every Sparkplug code header.

Change-Id: Ie0385316b0ee8bf96cd0069cda0496d05a4fb1eb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2933144Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74919}

This reverts commit 59eff3bf.

Reason for revert: Breaks UBSan - https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20UBSan/16697/overview

Original change's description:
> [bigint] Karatsuba multiplication
>
> The Karatsuba algorithm is used for BigInts with 34 or more internal
> digits, and thanks to better asymptotic complexity provides greater
> speedups the bigger the inputs.
>
> Bug: v8:11515
> Change-Id: I5ab0e318173ea4a02ced3f156d3c17e0259c5036
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2782283
> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74916}

Bug: v8:11515
Change-Id: Ifd3d651a26441ba36a23724c6eb1a9915f6e41a8
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2933496
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#74918}

Different platforms have different limits for growing memory, thus the
correctness fuzzer should crash instead of failing to grow. This will
make the fuzzer ignore the test case.

Instead of using the minimum of {wasm::max_mem_pages()} and the declared
maximum as the limit for growing, we can just use the declared limit.
{wasm::max_mem_pages()} will already be checked in the called methods.
All we need is a check for the --correctness-fuzzer-suppressions flag if
growing actually fails (either because of the platform-specific limit,
or because of an actual OOM).

Drive-by: unify the duplicated call to
{BackingStore::GrowWasmMemoryInPlace}.

R=ahaas@chromium.org

Bug: chromium:1213320
Change-Id: I7f219e1f93824225946d8a2136f15874c091e234
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2931815Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74917}

The Karatsuba algorithm is used for BigInts with 34 or more internal
digits, and thanks to better asymptotic complexity provides greater
speedups the bigger the inputs.

Bug: v8:11515
Change-Id: I5ab0e318173ea4a02ced3f156d3c17e0259c5036
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2782283
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74916}

This reverts commit b0c70710.

Reason for revert: Lots of compile errors.

Original change's description:
> [heap] Remove unused LocalSpace class
>
> LocalSpace was introduced for off-heap spaces with concurrent bytecode
> compilation finalization. However, finalization ended up using
> LocalHeap for concurrent allocations. LocalSpace is therefore unused
> and can be removed.
>
> This CL removes LocalSpace and renames all mentions of local space to
> compaction space. Compaction space was the only local space left.
>
> Change-Id: I12a8a2724f777a77ddb9957fe2d8e89febfebbaf
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2930169
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74914}

Change-Id: I3a654da0ddb556c1fb8767f8401ecd3b46786bea
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2933140
Auto-Submit: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#74915}

LocalSpace was introduced for off-heap spaces with concurrent bytecode
compilation finalization. However, finalization ended up using
LocalHeap for concurrent allocations. LocalSpace is therefore unused
and can be removed.

This CL removes LocalSpace and renames all mentions of local space to
compaction space. Compaction space was the only local space left.

Change-Id: I12a8a2724f777a77ddb9957fe2d8e89febfebbaf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2930169Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74914}

Instead of compiling a function with baseline immediately when the
interrupt budget is hit, we compile functions in batches to save some
memory protection flips on code pages.

This CL introduces batch compilation behind --baseline-batch-compilation
(enabled on future) and adds a flag
--baseline-batch-compilation-threshold to control the size of batches.

Bug: v8:11790

Change-Id: I3efc360424a14e4b07c6570e48860509ae59e591
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2891656Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74913}

- Maintain the correct stack in unreachable code for all type casts.
- Compute the correct type for the pushed stack value for ref.cast.
- Check if current_code_reachable_and_ok_ instead of checking the
  popped values' types against bottom.
- Add unit tests.

Bug: v8:7748
Change-Id: I02c26f526060f40884c4ff1e541315f71d8ad90a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2928191Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74912}

After https://crrev.com/c/2910080 we can define the histogram as a
proper boolean histogram with minimum 0, maximum 1, and 2 buckets.
This will map to a chromium histogram with maximum 2, and 3 buckets, but
that conversion will happen on chromium's side.

R=jkummerow@chromium.org

Bug: chromium:1207318
Cq-Include-Trybots: luci.v8.try:v8_linux_blink_rel
Change-Id: I176cf2467949591bcc3aa5ad0635cb8b12f20e9e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2930479Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74911}

os.system seems to be flaky on certain bots. Disabling this until we
have a proper fix.

Change-Id: I075542772ba8eb968c96942923f76b87a2f18d47
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2931809Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Auto-Submit: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74910}

This interface allows associating meta information to
exceptions. This meta information can be used by debugging
tools, like DevTools, to learn about e.g. a network request
or a DevTools issue that is associated with the exception.
To do so the inspector client (i.e. embedder) has to provide
the data.

Bug: chromium:1213393
Change-Id: Ia86221f4f04b21024d592bafb2f74886ead8a6a8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2928496
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Philip Pfaffe <pfaffe@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74909}

... it's too slow otherwise.

Change-Id: I5809912521cf91ca4fcdd1a0590c430e2282719c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2931803
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74908}

Failure link:
https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/37294/overview

Started crashing after CL:
https://chromium-review.googlesource.com/c/v8/v8/+/2929382

Bug: v8:11842
No-Try: true
Change-Id: I68613a9cede8f2f90a46725e34cde87cb6e46d81
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2931806Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74907}

Similar to https://crrev.com/c/2912786, this fixes a high number of
page permission switches (incuring mprotect syscall and lock contention
overhead) by pulling a {NativeModuleModificationScope} outside of a
loop (and across a function boundary).

R=clemensb@chromium.org
CC=​​​jkummerow@chromium.org

Cq-Include-Trybots: luci.v8.try:v8_linux64_fyi_rel_ng
Bug: v8:11663, chromium:932033
Change-Id: I2ec47f3eeeb2ab9624d2eaea9b4e776738871c97
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2928504Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Daniel Lehmann <dlehmann@google.com>
Cr-Commit-Position: refs/heads/master@{#74906}

Not using constexpr might throw this error during compilation:

```
error: call to non-'constexpr' function 'std::__1::array<_Tp, ...
```

Bug: v8:11420
Change-Id: I308e76b9d9683ae37088ef8e1a5d72cd1e05de78
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2930362Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74905}

This fixes a bug introduced in crrev.com/c/2717308. For JSArray
holders, we must observe JSArray::length for bounds checks (in
addition to elements.length).

JSArray::length cannot reliably be read from the background thread;
thus we do a best-effort read there, and verify the result during
finalization through a new ArrayIndexIsInBoundsDependency.

Bug: v8:7790,chromium:1209444
Change-Id: I189df9f58043411ada62f32fe741d4729874d357
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2928509
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74904}

This reverts commit 59d58d72.

Reason for revert: This CL breaks --predictable

Original change's description:
> [csa] Remove InnerAllocate and replace with non-folded allocations
>
> This CL removes all uses of InnerAllocate (except memento allocations)
> and replace with non-folded allocations. The change is based on the
> fact that 1. Those InnerAllocates are not guarded by --allocation-folding
> flag. 2. Hopefully the MemoryOptimizer can handle the folding and no
> performance regression will happen.
>
> Two special versions of InnerAllocate is still kept:
> * One for memento allocations (renamed to InnerAllocateMemento).
> * One for AllocateUninitializedJSArrayWithElements (renamed to InnerAllocateElements).
>
> Change-Id: Ie77da6b2fba31b048241f7b7d927065305a01c27
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2873767
> Commit-Queue: Wenyu Zhao <wenyu.zhao@anu.edu.au>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74899}

Change-Id: If6a1836634670eff3342f6df1d2a5b76afbdc0ac
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2932796
Auto-Submit: Wenyu Zhao <wenyu.zhao@anu.edu.au>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#74903}

This is a reland of ed7e4554:
- fixing platform names for tickprocessor
- UnixCppEntriesProvider => LinuxCppEntriesProvider
- MacCppEntriesProvider => MacOSCppEntriesProvider

Original change's description:
> [mjsunit][tools][d8] Full roundtrip tickprocessor test
>
> - Add os.d8Path property
> - Add os.name property
> - Change tickprocssor test to use command line arguments for testing
>   various configurations
> - Change tickprocessor test to create a temporary v8.log and read it
>   back in on linux only
> - Rearrange code in tickprocessor.mjs to allow instantiating the
>   CppEntriesProvider directly
> - Drop complete symbol-list for tickprocessor-test-large.log for better
>   code searching in V8
>
> Change-Id: Ib56dd0a1ba5377282c84c4de6f17e2fd69ee8123
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2929120
> Reviewed-by: Patrick Thier <pthier@chromium.org>
> Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74892}

Change-Id: I5e121ba11f407af50108a2712d27c32867a22eb0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2929382Reviewed-by: Patrick Thier <pthier@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74902}

... as these jobs may have references to the array backing store and
expect them to stay valid.


Bug: chromium:1211215
Change-Id: Ia48519e993306223afab8d11a94d6d8fc150a11d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2928502Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74901}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/0f7c842..315c86c

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/src/buildtools/+log/fba2905..cd7b8c0

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/12d96cd..053e386

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/0694fa6..cd3696c

Rolling v8/third_party/zlib: https://chromium.googlesource.com/chromium/src/third_party/zlib/+log/d0e636e..00ade15

TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: Ib3c4dd056e3b4a831d6244d501230ec938a633f5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2931896Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#74900}

This CL removes all uses of InnerAllocate (except memento allocations)
and replace with non-folded allocations. The change is based on the
fact that 1. Those InnerAllocates are not guarded by --allocation-folding
flag. 2. Hopefully the MemoryOptimizer can handle the folding and no
performance regression will happen.

Two special versions of InnerAllocate is still kept:
* One for memento allocations (renamed to InnerAllocateMemento).
* One for AllocateUninitializedJSArrayWithElements (renamed to InnerAllocateElements).

Change-Id: Ie77da6b2fba31b048241f7b7d927065305a01c27
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2873767
Commit-Queue: Wenyu Zhao <wenyu.zhao@anu.edu.au>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74899}

These tests are too slow and we get enough coverage by running in
other configurations.

Change-Id: Ib07136b01ae1e5c57589ca97114c283258a958f6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2929385
Auto-Submit: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74898}

Cleanup StoreU64 and StoreU64WithUpdate

Change-Id: Ifaf6fd84b57b145bcbf4f2c060603adb9a08c368
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2930481Reviewed-by: Milad Fa <mfarazma@redhat.com>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/master@{#74897}

CompactionSpaces are only used during GC, so there is no need to
lock pending_allocation_mutex_ for them. Locking for GC allocations
actually caused multiple regressions.

Bug: chromium:1214765
Change-Id: I6db4ed96deced41dc52f04b2917ec944b4ccc674
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2928189Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74896}

Change-Id: I98b23187829126c670d26f7685e28ebdd8e2e95d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2929379
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Auto-Submit: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74895}

This reverts commit ed7e4554.

Reason for revert: new test fails on Mac: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Mac64/40407/overview

Original change's description:
> [mjsunit][tools][d8] Full roundtrip tickprocessor test
>
> - Add os.d8Path property
> - Add os.name property
> - Change tickprocssor test to use command line arguments for testing
>   various configurations
> - Change tickprocessor test to create a temporary v8.log and read it
>   back in on linux only
> - Rearrange code in tickprocessor.mjs to allow instantiating the
>   CppEntriesProvider directly
> - Drop complete symbol-list for tickprocessor-test-large.log for better
>   code searching in V8
>
> Change-Id: Ib56dd0a1ba5377282c84c4de6f17e2fd69ee8123
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2929120
> Reviewed-by: Patrick Thier <pthier@chromium.org>
> Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74892}

Change-Id: I7d7506b370f96365552a21fa767b1c5c608ebb1c
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2929380
Auto-Submit: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#74894}

This reverts commit 360c7afc.

Reason for revert: TSAN https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20TSAN%20-%20stress-incremental-marking/3437/overview

Original change's description:
> [weakrefs] Clear unregister token-related fields when clearing weak cells
>
> Bug: chromium:1213770
> Change-Id: Ic063e79bfa8f3dabdd29d1cc9ed74c7af44d0c31
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2923294
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Commit-Queue: Shu-yu Guo <syg@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74890}

Bug: chromium:1213770
Change-Id: I9655db1a20d983c187779199e9009f6aeb5b46df
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2930553
Auto-Submit: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#74893}

- Add os.d8Path property
- Add os.name property
- Change tickprocssor test to use command line arguments for testing
  various configurations
- Change tickprocessor test to create a temporary v8.log and read it
  back in on linux only
- Rearrange code in tickprocessor.mjs to allow instantiating the
  CppEntriesProvider directly
- Drop complete symbol-list for tickprocessor-test-large.log for better
  code searching in V8

Change-Id: Ib56dd0a1ba5377282c84c4de6f17e2fd69ee8123
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2929120Reviewed-by: Patrick Thier <pthier@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74892}

These tests require Simd enabled which causes failures
on machines without the support.

They are already skipped on Mips: https://crrev.com/c/2841887

Change-Id: I4b9a9bb3cb208a0e9aa12dc135393bc515ad766e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2927210Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#74891}

Bug: chromium:1213770
Change-Id: Ic063e79bfa8f3dabdd29d1cc9ed74c7af44d0c31
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2923294Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74890}

GCC build fails trying to use a non constexpr function from a
constexpr function.

../chromium-92.0.4503.0/v8/src/wasm/baseline/liftoff-register.h: In member function 'constexpr v8::internal::DoubleRegister v8::internal::wasm::LiftoffRegister::fp() const':
../chromium-92.0.4503.0/v8/src/wasm/baseline/liftoff-register.h:286:71: error: call to non-'constexpr' function 'static v8::internal::VRegister v8::internal::VRegister::from_code(int)'
  286 |     return DoubleRegister::from_code(code_ - kAfterMaxLiftoffGpRegCode);
      |                                                                       ^
In file included from ../chromium-92.0.4503.0/v8/src/codegen/register-arch.h:16,
                 from ../chromium-92.0.4503.0/v8/src/deoptimizer/translation-array.h:8,
                 from ../chromium-92.0.4503.0/v8/src/objects/code.h:10,
                 from ../chromium-92.0.4503.0/v8/src/codegen/reloc-info.h:10,
                 from ../chromium-92.0.4503.0/v8/src/codegen/assembler.h:47,
                 from ../chromium-92.0.4503.0/v8/src/codegen/assembler-arch.h:8,
                 from ../chromium-92.0.4503.0/v8/src/codegen/turbo-assembler.h:12,
                 from ../chromium-92.0.4503.0/v8/src/codegen/macro-assembler.h:8,
                 from ../chromium-92.0.4503.0/v8/src/wasm/baseline/liftoff-assembler.h:13,
                 from ../chromium-92.0.4503.0/v8/src/wasm/baseline/liftoff-assembler.cc:5:
../chromium-92.0.4503.0/v8/src/codegen/arm64/register-arm64.h:416:20: note: 'static v8::internal::VRegister v8::internal::VRegister::from_code(int)' declared here
  416 |   static VRegister from_code(int code) {
      |                    ^~~~~~~~~

Bug: chromium:819294
Change-Id: Ia19ea90f3f666702d32c90e147af17dcda7e08a6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2929805Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: José Dapena Paz <jdapena@igalia.com>
Cr-Commit-Position: refs/heads/master@{#74889}

Port: c69b0c80

Change-Id: I5fafcb67ab35d489eab02755304a52730411ef72
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2930361Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#74888}

Cleanup LoadU64 and LoadU64WithUpdate

Change-Id: If98c6949aeaa9c2b9bca47958cb72d80d70e7309
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2930360
Commit-Queue: Junliang Yan <junyan@redhat.com>
Reviewed-by: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#74887}

Port 2b77ca20

Original Commit Message:

    The upper 32 bits of the 64 bit offset register are not guaranteed to be
    cleared, so a zero-extension is needed. We already do the zero-extension
    in the case of explicit bounds checking, but this should also be done if
    the trap handler is enabled.

R=thibaudm@chromium.org, joransiu@ca.ibm.com, junyan@redhat.com, midawson@redhat.com
BUG=
LOG=N

Change-Id: Ife3ae4f93b85fe1b2c76fe4b98fa408b5b51ed71
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2929661Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#74886}

This CL adds all relevant cctests as mjsunit tests as well.

Bug: v8:11525, v8:11706
Change-Id: I2d05e21adc6f665613249b67f24695c82e2ea455
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2930157
Commit-Queue: Vicky Kontoura <vkont@google.com>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74885}

Change-Id: Iddb3e161535fb3639e5883443d07520fdfe06c4e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2930166
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74884}

- Add d8.file.read() and d8.file.execute() helpers
- Change tools and tests to use new d8.file helper
- Unify error throwing in v8::Shell::ReadFile

Change-Id: I5ef4cb27f217508a367106f01e872a4059d5e399
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2928505
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74883}

The split between "Complete" methods and "Validate" methods is subtle
and undocumented. The "Complete" methods are only used in places where
we know that the function is valid anyway: Printing wasm code and
getting stack effects of an instruction (for the interpreter). Both are
also not performance critical.
Hence this CL merges the "Complete" methods in the respective "Validate"
methods and just call the latter instead of the former.

R=jkummerow@chromium.org

Bug: v8:11831
Change-Id: Id9591c73587262c30b8c56770b090f2b0d2d45b0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2922118Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74882}

The upper 32 bits of the 64 bit offset register are not guaranteed to be
cleared, so a zero-extension is needed. We already do the zero-extension
in the case of explicit bounds checking, but this should also be done if
the trap handler is enabled.

R=clemensb@chromium.org
CC=jkummerow@chromium.org

Bug: v8:11809
Change-Id: I21e2535c701041d11fa06c176fa683d82db0a3f1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2917612
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74881}