Bug: v8:12244,v8:12245
Change-Id: Ic677503ceeb5903e94cc60d7c95f0ec990fba691
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3183163
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77113}

The intent of the RISC-V ISA is that 32-bit C values are stored sign extended in registers, even for unsigned types.
So we skip cctest case RunLoadStoreZeroExtend64/RunUnalignedLoadStoreZeroExtend64 due to sign extend uint32

Change-Id: Icfe727916b1c04aad5681902ec4782cc98906964
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3184560Reviewed-by: Ji Qiu <qiuji@iscas.ac.cn>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Ji Qiu <qiuji@iscas.ac.cn>
Cr-Commit-Position: refs/heads/main@{#77112}

Several of the cctest/test-bytecode-generator/* tests used to rely
on the __COUNTER__ C++ compiler macro, which could cause spurious
test failures due to mismatched expectations when usages of that
macro were added or removed elsewhere in the code. This patch switches
to a custom, controllable static counter variable instead, to make
the tests' behaviors self-contained.

Bug: v8:12244
Change-Id: I4d875b6095e4ee4ef91933ab8c60c89054d1894a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3186836Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77111}

Port commit a0ace8a8

On mips64 and loong64, sign-extend the 32-bit value.

Change-Id: I058e3fcba94c25ad36ab1d751dea6bfc0558471a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3189854Reviewed-by: Liu yu <liuyu@loongson.cn>
Commit-Queue: Liu yu <liuyu@loongson.cn>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/main@{#77110}

No-Try: true
Bug: v8:12261
Change-Id: Ib51f8b694156228d2a3217b3cf171d15390af87d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3190092
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77109}

Port e301d71f
 [compiler] Teach InstructionScheduler about protected memory accesses

Port a0ace8a8
 [wasm] Interpret table.grow result as 32 bit

Port [regexp] Fix UAF in RegExpMacroAssembler

Change-Id: Ieac5e4deae9c6bbf844788d927f5201b906495f6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3189213
Commit-Queue: Ji Qiu <qiuji@iscas.ac.cn>
Reviewed-by: Ji Qiu <qiuji@iscas.ac.cn>
Cr-Commit-Position: refs/heads/main@{#77108}

Bug: chromium:1252747
Change-Id: I2eb0f71049836ca5a761928e3c8adf7034f5fdb2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3186437Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77107}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/6476f40..a76920d

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/src/buildtools/+log/9d33a71..a9bc3e2

Rolling v8/buildtools/linux64: git_revision:de86ec4176235871a7cb335756987e41246dae4a..git_revision:0153d369bbccc908f4da4993b1ba82728055926a

Rolling v8/buildtools/third_party/libc++abi/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi/+log/c883cb1..50e90b8

Rolling v8/buildtools/third_party/libunwind/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind/+log/a7e4ce0..a002c72

Rolling v8/third_party/abseil-cpp: https://chromium.googlesource.com/chromium/src/third_party/abseil-cpp/+log/a46a633..8aecb68

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/444aba8..2146b04

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/f35d350..ce514ad

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/efd7c81..2e80143

TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: Ifcb08d19030149f8f920d334f4b0072c286d80bd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3189492Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#77106}

Port 3162604 3173681
Bug: v8:11382

Change-Id: Iea5910dfe1f091cb0d202f1abe894562f5c6c63f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3184561Reviewed-by: Ji Qiu <qiuji@iscas.ac.cn>
Commit-Queue: Ji Qiu <qiuji@iscas.ac.cn>
Cr-Commit-Position: refs/heads/main@{#77105}

These tests test allocation failure and time out on TSAN.

Bug: v8:11852
Change-Id: I81e0af3ab8130c05488c6a117dd1c6ef12aba33b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3188071
Auto-Submit: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77104}

After the parameter processing, the arraybuffer may have been detached.
TypedArray copyWithin/fill should throw in that condition. TypedArray
includes should return false if the search element is not undefined.

Change-Id: If507d0efa1dafbe3dcefcd368e5ea27406bb3df8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3144315Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77103}

Bug: v8:7790
Change-Id: Ibf6e842c2bec780a9a52643494def8efbab92466
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3185920
Auto-Submit: Georg Neis <neis@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77102}

Bug: v8:12244,v8:12245
Change-Id: Ib0db9d9431e42399d3031b5d7f315ddf3cd9993d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3182441
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77101}

This reverts commit ec4a3124.

Reason for revert: https://bugs.chromium.org/p/chromium/issues/detail?id=1253374#c2

Original change's description:
> heap: Resolve -Wshadow warning in allocation-observer.cc
>
> Bug: v8:12244, v8:12245
> Change-Id: Id6b9e0a3986fb04c1a949b26ecf20da652ddd097
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3181537
> Auto-Submit: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#77045}

Bug: v8:12244, v8:12245
Change-Id: I506055fa7b959ac9adffa77ebc58234ec5b03371
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3186834Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77100}

Prepare the Torque compiler to generate Kythe artifacts to be consumed
by CodeSearch.

Drive-by changes.
* Extend SourcePosition by an offset in the input string, as this is
  required by the Kythe graph.
* Correctly set missing identifier positions in Declarations.

Bug: v8:12261
Change-Id: Ida0a4a562c99f58ab924ddde36f3146f3d3fd415
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3181102
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/main@{#77099}

Bug: v8:12244
Change-Id: I57a54b43c1821b57ef45de38c4d7782534f74d2d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3183521Reviewed-by: Simon Zünd <szuend@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77098}

Don't really have a good name for this inner TryCatch.

Bug: v8:12244
Change-Id: I4c1353bcd98e78e49d0354e285249302a8ee0dd8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3183522Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77097}

Bug: v8:12244
Change-Id: Ia441c2056a8a4edf44aa6fd5a1bb86726d599af9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3182927Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77096}

Bug: v8:12240
Change-Id: I9bf62d8c99b1f945139e274652d667c1a361e2a4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3180371Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77095}

Bug: v8:12244
Change-Id: Ia99fac6e7001bb6bce12256d3fcce28e45222f7d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3182229Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77094}

- Print extension and type
- Clarify elements printing

Change-Id: Ie5d5fb60e20bb2f5bfee4e438a4dec52b3b27d13
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3186435
Auto-Submit: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77093}

R=thibaudm@chromium.org

Bug: v8:12244
Change-Id: I9012ec21f4dbf2c644b0cb3964e545bfb2b2112c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3182442Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77092}

No-Try: true
Bug: v8:11880
Change-Id: I8d15b1974e965a31b822308879d78461bf1a141f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3186442
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77091}

Port commit bba7c09a
  [regexp] Allow reentrant irregexp execution

Port commit 4bbfc4b7
  [regexp] Remove the `stack` parameter from regexp matchers

Port commit c1700c56
  [regexp] Fix UAF in RegExpMacroAssembler

Bug: v8:11382
Change-Id: Ie2e95d7b19ecbd740e8d8a4130c725416abc114a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3185562Reviewed-by: Liu yu <liuyu@loongson.cn>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/main@{#77090}

Activate argument count consistency (receiver is always included in
JS argument count) for arm and arm64.

Bug: v8:11112
Change-Id: I4b019721422a0a4653d59e81cde2f7d57708e625
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3186436
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Patrick Thier <pthier@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77089}

... an ObjectVisitor subclass that takes care of caching values of
both the main pointer compression cage base and code cage base
(when the external code space is enabled).

Drive-by: this CL also changes signature of
RelocInfo::target_object_no_host(...) to accept PtrComprCageBase
instead of Isolate*.

Bug: v8:11880
Change-Id: I3fbb382e0a0170e28542bc495d8fecfd24da8a07
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3182231
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77088}

Bug: chromium:1252634, chromium:1056170
Change-Id: Ifdecca29dbff4ed3d6ee2acd547a20add482d59f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3183167Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77087}

R=clemensb@chromium.org

Bug: v8:12244
Change-Id: I988ebec99cb791b21c46acf6de961627406d70ef
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3182443Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77086}

Bug: v8:12244,v8:12245
Change-Id: I718eea6eb065b2775186322b888f805423d6be1e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3183161
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77085}

1. Now there is no serializer/deserializer-specific buffer size limit.
2. Update AUTHORS

Ref: https://github.com/nodejs/node/issues/40059

Change-Id: Iad4c6d8f68a91ef21d3c404fb7945949e69ad9e2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3170411Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77084}

Bug: v8:12244, v8:12245
Change-Id: I5745daaa18dba962b45a05d1064face610d05e2b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3185460Reviewed-by: Patrick Thier <pthier@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77083}

.. by turning `masm_` into a unique_ptr s.t. it's freed after the
NoRootArrayScope which references it.

Fixed: chromium:1252620
Change-Id: I24580c5a96d76a973b2b083e7a76b95f93bb6068
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3185459
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Patrick Thier <pthier@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77082}

Bug: v8:12244,v8:12245
Change-Id: Ic09dcc473b9e853490a54b63f08e91e8f7b2d69c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3183164
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77081}

Bug: v8:12244,v8:12245
Change-Id: I0bcc6dcc148138a6c3b2c87fd8819a9e809e5668
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3182230
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77080}

When cloning objects using spread and update properties (e.g.
obj = {...o, x: 0}), we wrongly used the setter for the update argument
if one was set.
This CL changes the behaviour such that all arguments following the
spread are treated as dynamic arguments.

Bug: chromium:1251366
Change-Id: I76a6d02606dca0faa0a256f465834d85d3df4f6f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3178969
Commit-Queue: Patrick Thier <pthier@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77079}

Bug: v8:12244,v8:12245
Change-Id: Ida2dc91b10f708ded9cb71d140bf26673b1442bc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3183166
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77078}

Bug: v8:11111
Change-Id: I10409756af4ba1a04c1bca21cbdab375003a7f42
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3177225
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77077}

GCTracer::Scope and GCTracer::Event shadow GarbageCollector's
MARK_COMPACTOR, etc.

Bug: v8:12244, v8:12245
Change-Id: Ibe60fb03ba35c9a9e057cadc7b8f557d9db9437f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3182226
Auto-Submit: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77076}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/a169c19..6476f40

TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I7f9fa264560e7a5128358e1b0218cb6763f9c12c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3184927Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#77075}

Port commit e301d71f

Change-Id: I58bb66e86629b60bcb75b3cec3e293d75acc5f5c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3184290
Auto-Submit: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Reviewed-by: Liu yu <liuyu@loongson.cn>
Commit-Queue: Liu yu <liuyu@loongson.cn>
Cr-Commit-Position: refs/heads/main@{#77074}