Bug: v8:10644
Change-Id: I24229cbbf6a3ffea0fd4c3b96ef6eaf1e780b6e9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2565136
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71505}

Instead of using argc directly, all CSA builtins should use
CodeStubArguments::GetLength().

Bug: v8:11112
Change-Id: Ib62d9d9240e8d42b6b7daed5bdf63f7ab0943fd9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2563879
Commit-Queue: Patrick Thier <pthier@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71504}

The streaming decoder computed the code section start from the passed
"offset". That offset is computed from the module offset *after* the
number of functions has been read. Hence 1 is subtracted, with the
comment:
// The offset passed to {ProcessCodeSectionHeader} is an error offset and
// not the start offset of a buffer. Therefore we need the -1 here.

That subtraction of 1 worked when the number of functions was encoded in
a 1-byte LEB, otherwise it was off.

This CL fixes the immediate issue of passing the right code offset. The
usage of the previously existing offset also seems wrong, and I will try
to clean that up in a follow-up CL.

R=ahaas@chromium.org
CC=szuend@chromium.org

Bug: chromium:1150303
Change-Id: I64bb2ececeb4749b7ba2096cd148ccb4079eca4f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2562383
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71503}

Use 1-byte store to overwrite a uint8_t.

Fixed: chromium:1149115
Change-Id: I52018c2062ca8b89e5b4436ea84f97ce1d7d50e7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2563881
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71502}

Since one of the latest Clang rolls, ASan builds on MacOS appear
to be using bigger stack frames, so reduce the maximum recursion
depth a bit in that configuration.

Fixed: v8:11176
Change-Id: I00942194a6c4d8046ec6abd24219912ebd153e57
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2563465
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71501}

ScopeInfo objects generally start with three fields: flags, parameter
count, and local variable count. But a single read-only ScopeInfo
instance has none of those fields. This is the empty ScopeInfo, which is
used for contexts that don't correspond to any scope (the native context
and contexts for builtin functions). Since there is only ever a single
instance of the empty ScopeInfo, the memory savings of omitting these
fields is trivial, and we can simplify logic somewhat by including them.
Rather than checking for length to be zero, this change introduces a new
flag indicating that a ScopeInfo instance is the empty one.

On its own, this change doesn't provide a whole lot of value. However,
it sets us up for two further improvements, which are consistent with
the goals outlined in [1]:

1. We should fully describe ScopeInfo fields in Torque. Getting rid of
the requirement to check for emptiness would substantially simplify the
indexed field expressions.

2. ScopeInfo shouldn't inherit from FixedArray, and shouldn't begin with
a `length` field when the length can be computed from the other fields.
This would save a small amount of heap memory and avoid any possibility
of a mismatch between the two ways of computing the length.

[1] https://docs.google.com/document/d/1tiGK7_lubxPHnInI2vscUwMHfadn8gIEa1apmI8HxR4/edit#heading=h.n63k76b3zfwa

Bug: v8:8952
Change-Id: I018127698a5d91fb2a91684bc3aec2e27ee27c41
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2561598Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#71500}

The script update-object-macros-undef.py provided the new undefs.

Change-Id: I9c9aea3fbf3501301f8fa5acdc460e6069f56b9f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2565134Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71499}

While working on C++ debug evaluate, we found that several builtins and
intrinsics aren't marked as side effect free, although they are clearly
side effect free, and that breaks the C++ side effect free evaluation.

- %DefineClass() and %TypedArray%.of(), and
- various WebAssembly getters ("buffer", "exports" and "length") as
  well as the C++ functions for the debug proxy.

Also-By: pfaffe@chromium.org
Bug: chromium:1137514
Change-Id: Iebd333dc2014f1ad218908f64c9199c157dc08b5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2565135Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71498}

- Timeline.selection is now a Timeline as well
- Allow remove the current timeline-track selection by double-clicking
  outside-the selection
- Update the timeline-track stats based on the current selection
- Simplify DOM element creation methods
- Add separate SelectionHandler class for timeline-track

Bug: v8:10644
Change-Id: I4f15d6ab4f5ec6b7330e22769472ca3074b00edd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2565130
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71497}

This is a compile fix: the constants were defined
as uint32_t/uint64_t while being declared as float/double.

Changed type in the definition to match declaration and
used bit_cast to make sure the bit pattern is as expected.

Bug: chromium:1151843
Change-Id: I129af71cd9a3dc97f01d2b58f14953345be84382
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2551111Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71496}

This is the 3rd step in a series of CLs to move the SharedFunctionInfo
class to kNeverSerialized and make it concurrently accessible from
the background thread. This CL:
* Adds synchronization to PrepareFunctionForDebugExecution
* Adds tests that mess with SharedFunctionInfo while it is accessed
  by another thread.

Bug: v8:7790
Change-Id: I2200fc7b6e977cda4e1003cb83d6ff49b1f1e337
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2523318Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71495}

Safepoints encode which slots in a stack frame store references when a
function is called. Safepoints for normal function calls in Liftoff were
already implemented before. With this CL, a safepoint for the runtime
call in a stack check is emitted.

R=thibaudm@chromium.org, clemensb@chromium.org

Bug: v8:7581
Change-Id: Iacb8b15559502adb7622935edb0cfa7ca03d634e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2563266
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71494}

Bug: v8:10644
Change-Id: I299e95f5a8505205a4942a5a5b04cde36f1e5320
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2565355Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71493}

This is a reland of 4719dae1.
The "V8 Linux64 TSAN - stress-incremental-marking" bot adds the
--stress-incremental-marking flag for all variants, hence the SKIP in
the status file was not triggered. We just explicitly disable the
--stress-incremental-marking flag for the two new tests. This works for
the "stress_incremental_marking" variant as well as the specific bot.

Original change's description:
> [wasm][inspector][test] Add more tests for code offsets
>
> The code offsets are sometimes wrong when compiled with streaming
> compilation. Thus add more tests for synchronous, asynchronous, and
> streaming compilation. The reported code offsets should all match. This
> will be fixed in a follow-up CL.
>
> In order to make asynchronous WebAssembly compilation finish, the
> inspector-test executable needs to pump the message loop before waiting
> for new tasks to come in, just as other executables like d8.
> This is added in this CL, but because of another bug this is skipped in
> the stress-incremental-marking variant. Hence the new tests are also
> skipped there.
>
> R=szuend@chromium.org
> CC=ahaas@chromium.org
>
> Bug: chromium:1150303, v8:10748
> Change-Id: Ie1d63c8d6795e61627d838b7fa7b21e6728befc0
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2562382
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Commit-Queue: Clemens Backes <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#71483}

Bug: chromium:1150303
Bug: v8:10748
Change-Id: I9adb9fc0250fab5c43dc85b695f4d338a9c7183c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2565128Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71492}

Bug: v8:10644
Change-Id: I8aaaf7337a92ef4962848a550ad1b80a65e3bc23
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2565350Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71491}

Bug: v8:10644
Change-Id: I98a557782cabadec3a85ca04cd3fc6c391e239d7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2565352Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71490}

This is to mitigate the performance regression introduced in the linked
bug.

Changes:
- Postpone (this->failed()) checks into CALL_INTERFACE_IF_REACHABLE.
- Remove the check for invalid stack after typechecking a branch. This
  shouldn't impact correctness, since the program is invalid and
  decoding should stop after this instruction.

Bug: chromium:1153530
Change-Id: Ie856e5b365c32ead8e6bbfa23e3007c0836741ef
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2565118Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71489}

When a function returns multiple result, we check the only the first
result. We correctly get the first return value from the interpreter
results, but did not handle the compiled code correctly, which returns a
JSArray.

Bug: chromium:1153406
Change-Id: I32198cea131cab18094fac3e66a44e976907773d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2562816Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71488}

It is safe to do the store even when the map is already unstable.

Change-Id: I4f4ca8eeb7eceb13ea5bc36868583d02e1213755
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2534813
Auto-Submit: Georg Neis <neis@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71487}

Bug: v8:10644
Change-Id: I934795e6ef8c42c3bc801c84dfb5f9770acd46fa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2565057Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71486}

Bug: chromium:1054771
Change-Id: I5120ce65f6a83728048398db0bf4705ae67b826f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2565124Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71485}

This reverts commit 4719dae1.

Reason for revert: Timeouts with --stress-incremental-marking: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20TSAN%20-%20stress-incremental-marking/1093

Original change's description:
> [wasm][inspector][test] Add more tests for code offsets
>
> The code offsets are sometimes wrong when compiled with streaming
> compilation. Thus add more tests for synchronous, asynchronous, and
> streaming compilation. The reported code offsets should all match. This
> will be fixed in a follow-up CL.
>
> In order to make asynchronous WebAssembly compilation finish, the
> inspector-test executable needs to pump the message loop before waiting
> for new tasks to come in, just as other executables like d8.
> This is added in this CL, but because of another bug this is skipped in
> the stress-incremental-marking variant. Hence the new tests are also
> skipped there.
>
> R=​szuend@chromium.org
> CC=​ahaas@chromium.org
>
> Bug: chromium:1150303, v8:10748
> Change-Id: Ie1d63c8d6795e61627d838b7fa7b21e6728befc0
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2562382
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Commit-Queue: Clemens Backes <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#71483}

TBR=ahaas@chromium.org,clemensb@chromium.org,szuend@chromium.org

Change-Id: Ia4361183bfafeca3cc7d71ffe12d0ec2b0722b49
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:1150303
Bug: v8:10748
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2565126Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71484}

The code offsets are sometimes wrong when compiled with streaming
compilation. Thus add more tests for synchronous, asynchronous, and
streaming compilation. The reported code offsets should all match. This
will be fixed in a follow-up CL.

In order to make asynchronous WebAssembly compilation finish, the
inspector-test executable needs to pump the message loop before waiting
for new tasks to come in, just as other executables like d8.
This is added in this CL, but because of another bug this is skipped in
the stress-incremental-marking variant. Hence the new tests are also
skipped there.

R=szuend@chromium.org
CC=ahaas@chromium.org

Bug: chromium:1150303, v8:10748
Change-Id: Ie1d63c8d6795e61627d838b7fa7b21e6728befc0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2562382Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71483}

Attach SourcePositionInfo objects to existing code entries if we find
code-source-info log entries. This improves fixes finding scripts for
anonymous functions.

Bug: v8:10644
Change-Id: I6fc1e029b17107cacce89dc74a67d4d448d9a979
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2562672
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71482}

With this change, there are const and mutable version of slices, in
analogy to const and mutable references, which we already have.
A const slice as a readonly view into memory, it doesn't mean that
nobody else has a writable view on it.

An array field in a Torque class produces const slices if it is declared
as const.

Due to limitations in the Torque type system, mutable slices are not
a subtype of const slices of the same type.

Bug: v8:7793
Change-Id: I1ba96e1ee82bf03b5fdc824488981f2a6b5eae8a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2560195Reviewed-by: Seth Brenith <seth.brenith@microsoft.com>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71481}

Update scope names to match the new scope naming scheme we settled on.
This CL also:
1) Adds high-level scopes for atomic mark/sweep/compact and incremental
   mark/sweep.
2) Remove scopes that will now become redundant (i.e. SweepAndCompact,
   UnifiedMarkingStep, etc.)

The new scopes are no longer aligned with the existing telemetry code
(gc_metric.html) in blink.

Bug: chromium:1056170
Change-Id: I510269e24172f411b2a98c0a0a250a6e9fe58841
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2563882
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71480}

Drive-by-fix:
- better handle tooltip text

Bug: v8:10644
Change-Id: Ibe20a1e0a0ebd298855afcbdc6f28e6fa4d1e64e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2563660
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71479}

Bug: v8:10644
Change-Id: I14bbe3afcef09b0d2a785c61d603974c3c393d72
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2565121Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71478}

- Fix transition view selection and opening of subtrees
- Fix transition colors by storing an index on the uniqueType map
  in the timeline
- Do not reset the current list in the transition view when
  clicking on a map
- Support changing source positions in the source panel
- Highlight the current source position with a pulsing marker
- Fix kColors usage in timeline-track

Bug: v8:10644
Change-Id: I5130f18d9076cb37f9c3c8d585c9e47038ca411b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2562386Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71477}

Bug: v8:11074
Change-Id: I7af4fb1fd93e1b369fdca5b9e726dcafa43b0afb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2565081Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71476}

This reverts commit 4ad08c82.

Reason for revert: Need to retry with bugs in separate stack
frames.

Original change's description:
> Enable simulating errors to test fuzzer reliability
>
> This adds a d8 flag --simulate-errors, which on shutdown will cause
> certain errors. This enables testing the reliability of sanitizers.
>
> This will cause a fatal error, a dcheck (if available) or a
> violation that can be detected with one of the following sanitizers:
> ASAN, UBSAN, MSAN, CFI.
>
> The same flag used in differential fuzzing will cause an error
> subsumed with the error state "fake_difference".
>
> Bug: chromium:1152412
> Change-Id: I4b36c6fe716797004d634263617d22ca67b05600
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2554999
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#71430}

TBR=machenbach@chromium.org,clemensb@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: chromium:1152412
Change-Id: If20cdef372b0e7e92e7080687f446539a587a815
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2565120Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71475}

The flags were added because scalar lowering was not implemented for the
instructions in the test. Now that scalar lowering is complete, we can
remove these flags.

Fixed: v8:11137
Change-Id: Ic7bdedbfe558fafebe98917fe4e6a7922203ba91
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2565078Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71474}

ConcurrentMarkingState and MarkingStateBase are already defined in the

This change fixes compilation with MSVC.

v8: :internal namespace.
Change-Id: Ib8a1370a0a27a90e385fd69e61036e263e1489e6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2562671Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Michaël Zasso <mic.besace@gmail.com>
Cr-Commit-Position: refs/heads/master@{#71473}

Bug: v8:10997
Change-Id: I77e3fceec342698e25c8653b6a3dabe0ddbdc045
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2557057
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71472}

Bug: v8:11074
Change-Id: Iccb5daa414f4a0be0820f4c19416c11374ffc17e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2558266Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71471}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/425e151..4a4f94b

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: Ia928e09f768dc7b14580070621150b02d0740af6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2564593Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#71470}

Bug: v8:11074
Change-Id: I4158b4ad72350cde27bda76db2d9d646b793f684
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2558265Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71469}

Bug: v8:11074
Change-Id: I478f4390523ddf7cfb87dd22cef5ed331be5c875
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2558267Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71468}

This is a reland of 21e47944

The fix is in the encoding of vmov. Bit 23 (the U bit) should be 0,
whether the NeonDataType is NeonS32 or NeonU32. Also added a DCHECK
in the simulator to assert this.

Original change's description:
> [wasm-simd][arm] Prototype i64x2.bitmask
>
> Cleanup to simulator to remove repetitive logic to get instruction
> fields.
>
> Bug: v8:10997
> Change-Id: I01f0b99f85788b41e4cab505fc94362d637c396f
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2554256
> Commit-Queue: Zhi An Ng <zhin@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Reviewed-by: Bill Budge <bbudge@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#71391}

Bug: v8:10997
Change-Id: I93b5d2168a50446d4a3b487ad83d6af8ea9ba8ab
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2558262
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71467}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/fc6f0ec..425e151

Rolling v8/third_party/aemu-linux-x64: nv1qScP1jMWHbtAnUPBMcQOVcG6n7KxhpPYWWa21rA8C..xSLGBy9YVgE3OzSwrnR3yqDwyZerQuy2QBEFfV1Lc2IC

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/5726acb..20f5376

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I67d4a0e805ed6ee7ee63b135fb1340ecdded730c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2564204Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#71466}