R=mstarzinger@chromium.org

Change-Id: I5b062da2b4717f7247ea61d1118f0466c7b0474c
Reviewed-on: https://chromium-review.googlesource.com/1097322Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53674}

As specified in https://tc39.github.io/ecma262/#sec-atomics-wait, the
critical section must occur before the load and comparison.

This slightly changes the `AtomicsWaitCallback` API, but in a
direction that arguably makes it more consistent.

As a drive-by fix, reset `node->waiting_` in case there
was an exception from the first callback.

Refs: https://chromium-review.googlesource.com/c/v8/v8/+/1095814
Bug: v8:7836
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I577cdf76cedfe39bc61f783203b543c7c68fc238
Reviewed-on: https://chromium-review.googlesource.com/1096236Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Ben Smith <binji@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53673}

This CL inserts NOP instructions a little bit earlier into empty
blocks; this ensures that instructions keep their initial position.

Bug: v8:7327
Change-Id: Idee5269f4fd7fc15c44bda83a2be74e8cff62df8
Reviewed-on: https://chromium-review.googlesource.com/1097078
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53672}

This is a necessary cleanup before porting Array[No,Single,N]ArgumentsConstructor
builtins to CSA.

Bug: v8:5269, v8:7703
Change-Id: I40a2dd83faab1f8c3c180d461ef62fa4d8578f5e
Reviewed-on: https://chromium-review.googlesource.com/1097079
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53671}

Bug: v8:7754
Change-Id: I11845f84c5e837d3d7323c4a932c36af08b61a8e
Reviewed-on: https://chromium-review.googlesource.com/1096940Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53670}

This reverts commit a229e121.

Reason for revert: Breaks a layout test:
https://ci.chromium.org/buildbot/client.v8.fyi/V8-Blink%20Linux%2064/24021
fast/js/constructor-length.html

See also:
https://github.com/v8/v8/wiki/Blink-layout-tests

Original change's description:
> [builtins] set DataView.length to 1
> 
> Refs: https://github.com/tc39/ecma262/pull/1131
> Test: test262/built-ins/DataView/length
> Bug: v8:7816
> Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
> Change-Id: I66a06734bd32cd2043a8d04728b2185f6093bd69
> Reviewed-on: https://chromium-review.googlesource.com/1094980
> Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
> Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#53649}

TBR=gsathya@chromium.org,joyee@igalia.com

Change-Id: Iaa602a40bd09dec6884f5f56b1f010b59c19b32a
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7816
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/1097275Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53669}

These tests are also affected by duplicate builtin copies (on- and
off-heap).

TBR=yangguo@chromium.org

Bug: v8:6666, v8:7718
Change-Id: I8adfe8b8b63fb5f539cdff5e709e9358a47dfc7e
Reviewed-on: https://chromium-review.googlesource.com/1097088Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53668}

This makes sure debug code in WasmCode traps immediately instead of
embedding a call to the Abort builtin, which would be Isolate specific.

R=clemensh@chromium.org
BUG=v8:7424

Change-Id: I08799d41b5e8d21b9f7af97d65f80a1594d9a613
Reviewed-on: https://chromium-review.googlesource.com/1095113
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53667}

Indirections for external references are now handled completely in
macro assemblers, which can produce more efficient code.

Bug: v8:6666
Change-Id: I158f2e2517e2d97a1006cec6e3b4ac3a7ef3fab6
Reviewed-on: https://chromium-review.googlesource.com/1095307
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53666}

This limits the call targets of {WasmCode} to only reference a limited
set of builtins via the {RelocInfo::CODE_TARGET} relocation mode. By now
most calls have been made independent of the Isolate.

R=clemensh@chromium.org
BUG=v8:7424

Change-Id: If4c643a7104e2ff0536ceb0f0de7fd30a923d854
Reviewed-on: https://chromium-review.googlesource.com/1092576Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53665}

In the process:
  - Add strict ordering of Types so that name mangling is consistent
    and build time. Previously, the UnionType stored the union's
    types in a std::set<const Type*>, which did not have a consistent
    ordering of the types in the set.
  - Add a int31 type to enable consistency and correctness of
    handling of 'constexpr int31' values on the C++ side.
  - By removing the "implicit" keyword for operators, there is now
    one less difference between operators and calls, another
    incremental step in unifying operators and calls.
  - Enable external (i.e. C++-defined) generic specializations
  - Add CSA support for checking double ElementsKinds, including
    tests.
  - Clean up some constexpr/non-constexpr handling of ElementsKinds.

Bug: v8:7793
Change-Id: I27699aba70b98ebf5466e5b62b045d7b1dad62c8
Reviewed-on: https://chromium-review.googlesource.com/1091155
Commit-Queue: Daniel Clifford <danno@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53664}

Bug: chromium:851877
Change-Id: Ib3b4ec7086ecf2115e42a30fab10be1ae6b67593
Reviewed-on: https://chromium-review.googlesource.com/1096943Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@google.com>
Cr-Commit-Position: refs/heads/master@{#53663}

Introduce debug-only non-isolate versions of oddball checks so that
we can check for oddballs in DCHECKs without requiring an isolate.

Bug: v8:7786
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I97ee22fb99b23dbfa5d2d0bc7c6b22392d16d694
Reviewed-on: https://chromium-review.googlesource.com/1094875Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53662}

External references located within the isolate can be loaded as a
fixed offset from the root register. This avoids one load from memory
over the default indirect method (which reads from the external
reference table).

Bug: v8:6666
Change-Id: I569308c03f1a8c3feb1be7ceb072178b5be17b25
Reviewed-on: https://chromium-review.googlesource.com/1092739
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53661}

This CL re-enables a mjsunit test for some simulator configurations
after Array.p.sort pivot selection improvements have landed.

R=jgruber@chromium.org

Bug: v8:7795
Change-Id: I03599c34e34a0bafd5f276b03aa4f059a8078026
Reviewed-on: https://chromium-review.googlesource.com/1096764Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Simon Zünd <szuend@google.com>
Cr-Commit-Position: refs/heads/master@{#53660}

This moves all accesses from Typer to the broker. This is policed by
DisallowHandleDereferenceScope in Typer::Visitor::Reduce.

Bug: v8:7790
Change-Id: Ic37d029261b3302eedb902a3b2249834a5dd0512
Reviewed-on: https://chromium-review.googlesource.com/1095305
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53659}

Change-Id: I5aa052371ac21857606465c4781a1f9fcad28c5c
Reviewed-on: https://chromium-review.googlesource.com/1096755Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@google.com>
Cr-Commit-Position: refs/heads/master@{#53658}

Code generation for stack checks and protected loads produces duplicate
loads of the stack pointer and memory base address. Without gvn these
turn into actual move operations and sign conversions. Even worse, as
turbofan seems to hoist the stack pointer loads to early blocks, I saw
a high register pressure and many spills.

While there is some compile time cost for gvn, I expect it to be rather
low. On the positive side, I see about a 5% performance inprovement for
some benchmarks. If compilation time turns out to be an issue, we can
still revert.

Change-Id: I13be2ace5b27c51c32430d0cb14fbbe8f31fbf6f
Reviewed-on: https://chromium-review.googlesource.com/1095335Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Stephan Herhut <herhut@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53657}

Loading a root generates a kRootRegister-relative load on all
architectures but ia32 (where we currently don't have a root
register).

This is preferable to loading an external reference, which will
usually embed an absolute pointer into the generated code, or add an
indirection when within an embedded builtin.

Bug: v8:6666
Change-Id: I1a93b1325b375bfcf3547977760e1d9ada1d0ee4
Reviewed-on: https://chromium-review.googlesource.com/1095260
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53656}

Change-Id: If46c25c098565bcb43f5475783591190f6d80b56
Reviewed-on: https://chromium-review.googlesource.com/1096040Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@google.com>
Cr-Commit-Position: refs/heads/master@{#53655}

Add explicit lowered type.
Distinguish operations for low/high.
Shl + Shr is equal to Mask.
Enable WASM_SIMD_COMPILED_AND_LOWERED_TEST for unpacking.

Change-Id: I0492318deb7c0ea0f4b30975ab107eedd446314a
Reviewed-on: https://chromium-review.googlesource.com/1079989Reviewed-by: Aseem Garg <aseemgarg@chromium.org>
Commit-Queue: Jing Bao <jing.bao@intel.com>
Cr-Commit-Position: refs/heads/master@{#53654}

R=gsathya@chromium.org, littledan@chromium.org

Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: Ib3806f2b8d6f8adf61fe0dc8c327c461e1d20304
Reviewed-on: https://chromium-review.googlesource.com/1095558
Commit-Queue: Brian Stell <bstell@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53653}

This patch ports over the spec defined operation `GetOption` from
JavaScript to C++:
https://tc39.github.io/ecma402/#sec-getoption

The JS implementation will be deleted once all it's
users are migrated.

Refactors LocaleConstructor to use this method which fixes some test262
tests. The test262 test status file is updated to reflect this.

Bug: v8:5751, v8:7684
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: Ief5eae9b69dcea50062825163ca7658ed20bd0cf
Reviewed-on: https://chromium-review.googlesource.com/1094201
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53652}

See: https://trac.webkit.org/changeset/232253/webkit

This is a defensive fix insofar as we were not observing any
issues, hence there is no regression test either.

Bug: v8:6791, v8:3770
Change-Id: Icdabe6a26aca9a5913fba278ae1fd0a79857dfd9
Reviewed-on: https://chromium-review.googlesource.com/1077660Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53651}

Port 699a91f2

Original Commit Message:

    This class can contain members and functions common across all
    platforms.

R=jgruber@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: Id085de265e915d0cc3d7851153df53529545743b
Reviewed-on: https://chromium-review.googlesource.com/1095735Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#53650}

Refs: https://github.com/tc39/ecma262/pull/1131
Test: test262/built-ins/DataView/length
Bug: v8:7816
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: I66a06734bd32cd2043a8d04728b2185f6093bd69
Reviewed-on: https://chromium-review.googlesource.com/1094980Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53649}

- Shuffle canonicalization improved to reverse operands to match
  more architectural shuffles.
- Handles shuffles where the order of operands is reversed.
- Adds tests for non-canonical shuffles, and for swizzles.
- Improves TryMatchConcat method.
- Substantially rewrites shuffles on ia32 to better handle swizzles
  and fix bugs on reversed shuffles where source registers are
  overwritten.
- Adds Palignr macro-assembler instructions for ia32.

Bug: v8:6020
Change-Id: I8e43a1e7650057c66690af1504b67509a1437d75
Reviewed-on: https://chromium-review.googlesource.com/1070934
Commit-Queue: Bill Budge <bbudge@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Martyn Capewell <martyn.capewell@arm.com>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53648}

Change-Id: I7f2d0ba0e544267a9f97838e2904d8dfeecd9a99
Reviewed-on: https://chromium-review.googlesource.com/1095615Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53647}

Bug: chromium:844008
Change-Id: If248ca90213c5cb3dfb0e3936a9ac824ed3c3119
Reviewed-on: https://chromium-review.googlesource.com/1095276Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@google.com>
Cr-Commit-Position: refs/heads/master@{#53646}

The current implementation allocates a new {NativeModule} if trap
handlers are disabled. Afterwards, all export wrappers need to be
patched to call to the code objects in this new native module (this
patching is done in {CodeSpecialization}).
With the jump table, we want to get rid of this patching, hence we need
to reuse the same jump table, hence we cannot allocate a new
{NativeModule}. Instead, we should update the existing one with the new
code.

R=mstarzinger@chromium.org
CC=eholk@chromium.org

Bug: v8:7143, v8:7758
Change-Id: If2f395d462752b9084ed1e5f0a81f71d400ccfca
Reviewed-on: https://chromium-review.googlesource.com/1095262Reviewed-by: Eric Holk <eholk@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53645}

This switches Liftoff code to use WebAssembly runtime stubs instead of
builtin calls for handling traps, similar to what we use in TurboFan
generated code as well.

R=clemensh@chromium.org
BUG=v8:7424

Change-Id: If2554067b3e294220306c67861bb1fb14db7b492
Reviewed-on: https://chromium-review.googlesource.com/1087275
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53644}

Now that V8 uses EphemeronHashTable as backing store for
JSWeakCollections one pass over the heap is enough. In the old
implementation a second pass was necessary to find the owner
of the FixedArray to determine if its entries are strong or weak
references.

Bug: chromium:844008
Change-Id: I04bdf7d480c9be301831698571be5b226d20ac20
Reviewed-on: https://chromium-review.googlesource.com/1090910Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Alexei Filippov <alph@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@google.com>
Cr-Commit-Position: refs/heads/master@{#53643}

Fix afd6351d

After `[csa][builtins] Port CompileLazy* to CSA` landed,
there is an implicit expectation that the address of the JS code
is stored in the target register. Due to optimizations on MIPSR6,
this address was not properly loaded.

We fix this by loading target address explicitly before performing
the jump.

TEST=mjsunit/json2,mjsunit/packed-elements

Change-Id: Ida9cb062910415bf15aa40dd20a17fc42fdba719
Reviewed-on: https://chromium-review.googlesource.com/1095155Reviewed-by: Sreten Kovacevic <sreten.kovacevic@mips.com>
Commit-Queue: Sreten Kovacevic <sreten.kovacevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#53642}

Mark JSWeakCollections and EphemeronHashTables concurrently to
the application to reduce pause times.

Bug: chromium:844008
Change-Id: I0a8fe592e651b368c5c12846d02d55bbf4058ff2
Reviewed-on: https://chromium-review.googlesource.com/1095035Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@google.com>
Cr-Commit-Position: refs/heads/master@{#53641}

This adds a new gn arg v8_custom_deps to add a dependency that's dynamically
added under v8/custom_deps. E.g. for depending on a target in
v8/custom_deps/test_root/BUILD.gn set
v8_custom_deps = "custom_deps/test_root:target_name".

Bug: chromium:846711
Change-Id: If03d48dba07cb36dc1b981602e5dc267deec086b
Reviewed-on: https://chromium-review.googlesource.com/1095218Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53640}

R=sigurds@chromium.org

Change-Id: I544b804fd7ccb90e64a945e0da9e43b01b5afdf3
Reviewed-on: https://chromium-review.googlesource.com/1095294Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53639}

The graph_zone_ field in PipelineData was initialized to nullptr
instead of the correct zone when running the wasm compilation pipeline.
Now it is set to the actual zone of the graph that is being compiled.

Bug: chromium:844591
Change-Id: I8d9a688a292471a45dedcd01b03244baed60e378
Reviewed-on: https://chromium-review.googlesource.com/1095254Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Stephan Herhut <herhut@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53638}

Bug: v8:7327
Change-Id: Id354b039977a82af8b2c6bba416cf5a1f804ca71
Reviewed-on: https://chromium-review.googlesource.com/1095257
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53637}

This CL allows selection/highlighting of wasm source when a graph node
is clicked.

Bug: v8:7327
Change-Id: I4a3347a83c8a38804feabffefaefd761596005c3
Reviewed-on: https://chromium-review.googlesource.com/1092712
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53636}

This new scope allows to avoid emitting calls to {Builtin::kAbort} in
debug code when requested, but still trap when the debug code fails. It
can be used to keep generated code independent of builtins.

R=jgruber@chromium.org

Change-Id: I77864a1a10ec5b52bccfd76981ab5f4ff33bc727
Reviewed-on: https://chromium-review.googlesource.com/1095179
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53635}