Bug: v8:11384
Change-Id: I5efbcd661242b8c8e23225f921b9170db66d98dd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2740486Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73283}

Add more items in the Locals pane representing the JS function name,
source file name, and character offset within the source file, so
that the user doesn’t need to dig through the shared_function_info to
find them.

Change-Id: I5d42b3c9542885a72e81613503d1d5abf51870b5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2712310
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Reviewed-by: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#73282}

When objects are recorded for conservative handling and the GC is
finalized conservatively, with a different stack, we rely on
MarkNotFullyConstructedObjects(). In this method, the objects are
initially marked, only to be forwarded to handlers that try to mark
them again.

Bug: chromium:1056170
Change-Id: I942e7b0ec88aae08e3fe06b7cb3ff4a86dc42f36
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2744074
Auto-Submit: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73281}

... where TF doesn't see that the property is deleted and re-added.

Bug: chromium:1161847
Change-Id: I599a25fa8d29154b5bfede45f6655a1eac44a0f7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2739592
Auto-Submit: Georg Neis <neis@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73280}

- Adds some missing types, to appease the fuzzers.

Bug: chromium:1185464
Change-Id: I08c4ebe5f4ae0d036da9819b805aeac93be384fe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2742017
Commit-Queue: Bill Budge <bbudge@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73279}

This change relands the last part of https://crrev.com/c/2601880 .

ScopeInfo has a vestigial 'length' field from when it used to be a
FixedArray. This change removes that field, which saves some memory.

More specifically:

- Make ScopeInfo inherit from HeapObject, not FixedArrayBase which
  supplied the 'length' field.
- Change FactoryBase::NewScopeInfo to allocate the updated object shape.
  It maintains the existing behavior of filling the newly-allocated
  object with undefined, even though that's not a valid ScopeInfo and
  further initialization is required.
- Change a few length computations to use HeapObject::kHeaderSize rather
  than FixedArray::kHeaderSize.
- Remove an unnecessary heap verifier function.

Change-Id: I9b3980157568fdb0402fa31660949966b401fd31
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2733037Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#73278}

Resize() may be used to adjust additional trailing bytes of an object.
It is up to the embedder to ensure correctness in case of shrinking.

Bug: chromium:1056170
Change-Id: I954df6c7440b77275cd62e4b802e8f5d39c06f9d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2739652
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73277}

Bug: v8:11384
Change-Id: I230548625908512753e5d05dcf4f19c593d9cb19
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2739449Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73276}

Change-Id: Ice30aa43344e7bd010a03c49efa9b6389193e98f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2742627Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#73275}

- arm64 aligns the frame, which guarantees an even
  number of return slots. Change RoundUp call to DCHECK.

Bug: v8:9198
Change-Id: I9a6949b93d14109f83f09800ffe75ebba6387b04
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2740481Reviewed-by: Bill Budge <bbudge@chromium.org>
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73274}

Port c2a1d633

Drive-by: port code-generator-s390.cc changes
Change-Id: I2090cf136d62cc9db1f17d158b88a1e58cc430d9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2740341Reviewed-by: Milad Fa <mfarazma@redhat.com>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/master@{#73273}

Rather than doing a set lookup for each bytecode offset during
iteration, rely on the fact that bytecode offsets are monotonically
increasing, and store the handler offsets in a sorted array with a
"next offset" cursor that the iteration can increment when a handler
is found.

Bug: v8:11420
Change-Id: I50e40043540d37e6c6ecb3e39a9a92c28b65e3d1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2742621
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73272}

Bug: chromium:1185753
Change-Id: Ic59de63d3db745356b2b3dddca0064185e5ad57b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2739593
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73271}

Change-Id: Ie555be4ee5c44dcd6a1b4f5a6716b7ce38213191
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2742620Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73270}

Port c2a1d633

Change-Id: I2062ce41260b3e55fdcfff7e47de3aab5132d391
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2739247Reviewed-by: Milad Fa <mfarazma@redhat.com>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/master@{#73269}

This CL enables full csa optimization for wasm code. To take advantage
of csa load elimination, it switches from Load/Store to LoadFromObject/
StoreToObject operators in the wasm compiler (where possible).

Bug: v8:11510
Change-Id: Ibecd8ba81e89a76553b12ad2671ecad520e9e066
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2727407Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73268}

Reduce the granularity to 4 bytes:
- Saves some memory on 32bit configurations
- Allows uniformly reasoning about HoH::ObjectSize() with
  RoundUp<kAllocationGranularity>(sizeof(T))

Change-Id: Ic87aa25839d9b8a99916c07d64e5e49864a6cb53
Bug: chromium:1056170
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2739628Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73267}

As of https://chromium-review.googlesource.com/c/v8/v8/+/2452689 ,
ObjectCacheIndexMap uses IdentityMap which deals with GC gracefully.

Change-Id: I6d43ee2c1e330556b0ab7e4a6c313d5b37086343
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2742615Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73266}

Change-Id: Idece4925aa0ffa99bc34db39d20b24a41d59f84f
Bug: v8:11421
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2715064Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73265}

This CL adds missing locks to the PersistentRegions for
(Weak)CrossThreadPersistents.
To make sure no locks are missed in the future, this CL also splits
PersistentRegion and introduces CrossThreadPersistentRegion that checks
whether a lock is taken whenever it is accessed.

Bug: chromium:1056170
Change-Id: Iaaef4a28af0f02bcb896706e9abf1ee5ad2ee1e1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2737299
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73264}

Before dropping a value we should validate that there is indeed a value
on the stack.

R=jkummerow@chromium.org

Bug: chromium:1184964
Change-Id: Iec3ac061df2545717749e664b10c383765d67c9d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2739588Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73263}

Add an explicit FreeUnreferencedObject() call that can be used to
reclaim objects that are guaranteed to not be referenced anymore
by the embedder. It is up to the embedder to ensure correctness.

Change-Id: I7f2d86d9639e8b805f79a8fd0a346903f63171e5
Bug: chromium:1056170
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2737301
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73262}

This removes all includes of src/wasm from src/deoptimizer, by #if'ing
out wasm-related parts. This will allow to later exclude the whole
src/wasm directory from compilation.

Drive-by: Inline DecodeWasmReturnKind and EncodeWasmReturnKind to avoid
more #ifs.

R=jgruber@chromium.org

Bug: v8:11238
Change-Id: Ia49ed26fc217b3e80756a363dcd397d9060f6835
Cq-Include-Trybots: luci.v8.try:v8_linux64_no_wasm_compile_rel
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2739653Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73261}

Instead of checking for the null TNode, we can use base::Optional.

Bug: v8:6949
Change-Id: I550b2fdb507c61ea6128a0631351b22a8542d4d3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2737296
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73260}

Bug: chromium:1185463, v8:9233
Change-Id: I87ad8e1ddbbf106ae5221264b53d53aded2c4c51
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2739633Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73259}

This fixes a null pointer access in FindSharedFunctionInfo that
was introduced when adding a guard to top level function
compilation.

Bug: chromium:1185540
Change-Id: I24b9752637aba0e660bd8f20be83522e1009b69f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2742194
Commit-Queue: Kim-Anh Tran <kimanh@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73258}

This CL is part of a series that makes SwissNameDictionary available
as a new property backing store. Previously, the flag
v8_dict_mode_prototypes allows selecting between NameDictionary and
OrderedNameDictionary as the backing store used for all dictionary
mode objects. This series of CLs changes this such that enabling the
flag causes SwissNameDictionary being used instead of
OrderedNameDictionary. The behavior for when the flag is not set
remains unchanged (= use NameDictionary).

This particular CL just collects many small changes, including some
CSA changes where runtime calls are necessary.

Bug: v8:11388
Change-Id: I38fd18098fc641a5d92a986da251a6b3ac09411a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2739642
Commit-Queue: Frank Emrich <emrich@google.com>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73257}

We sometimes have a need to check for termination requests
while we're in the middle of non-GC-safe computations, so
we can't do a full "HandleInterrupts" (which could do GC).
This CL adds a separate function to check for termination
requests (but no other interrupt reasons) in such cases.

Bug: v8:9877, v8:11515
Change-Id: I431dba193a07ba63003794639e5d3630470d6ee7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2739587
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73256}

std::stod() on Solaris does not currently handle hex strings.
This commit provides a workaround based on strtol() until proper
stod() support is available.

This was encountered while updating Node.js to V8 8.8. For more
details see the following comment:

https://github.com/nodejs/node/pull/36139#issuecomment-740131942

Change-Id: I16ed80a817f6d9105e7153b10824b1fee8520432
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2692746Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73255}

Remove the include from js-array-buffer-inl.h, because the wasm engine
is not used in that file. Add missing includes in other files that
relied on the recursive include.

R=jkummerow@chromium.org

Bug: v8:11238
Cq-Include-Trybots: luci.v8.try:v8_linux64_no_wasm_compile_rel
Change-Id: I8b7f11ce92858cbc0ccf26925159486ed39573fa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2739650Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73254}

Follow-up to 1b5c7e15 / r73193.
ClusterFuzz is going to be _so_ happy about this...

Fixed: chromium:1184928, chromium:1184966, chromium:1184991
Fixed: chromium:1185045, chromium:1185126, chromium:1185322
Fixed: chromium:1185443
Change-Id: I0adc50b4a0fc2d62eb8034c23102c61163b73f74
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2739586
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73253}

Bug: v8:11491
Change-Id: I603bc9ab6c4e925bc210a8cf420e2d7c6bcfb186
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2712782
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73252}

If a method happens on the main thread and only on the main thread
(i.e. it will never be run on the background), it is safer to use
non-atomic accessors as TSAN will give warnings if we use them
improperly.

As a drive-by, pass the isolate as a parameter where it was readily
available as it saves us from getting the isolate from the object later
on.

Bug: v8:7790
Change-Id: Id9bdd69254edc60b0331a32fccf1479a95b7d286
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2732669Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73251}

The recent change crrev.com/c/2712755 got a bounds check wrong,
causing an invalid use of the lookup iterator.

Bug: v8:1185072
Change-Id: I3138d266cb4b2482dcb5078fb025bbfc43dd2940
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2742196
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73250}

The range checks in InputAt and ReplaceInput are relatively expensive
given the high frequency of these calls and the bitfield decoding
required for InputCount. Make these DCHECKs instead of CHECKS

BUG=v8:9684

Change-Id: Ibee0f9b06b4581f3bc1176d1fe57de33cdd73cdc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2735274Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73249}

The typo was introduced in https://crrev.com/c/2712964.

R=bmeurer@chromium.org
CC=leese@chromium.org

No-Try: true
Change-Id: I773e13919d939c8c55c42393e335956deb5eb36d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2739651
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Auto-Submit: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73248}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/6950b7c..baef8bb

Rolling v8/buildtools/third_party/libunwind/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind/+log/8869f42..cc80b4a

TBR=v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I8b0663f26ef8b2805813b46973bddf500fb9cb6d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2741780Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#73247}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/426f691..6950b7c

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/src/buildtools/+log/523462a..27d20f0

Rolling v8/buildtools/third_party/libc++abi/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi/+log/47a0930..c93be42

Rolling v8/third_party/aemu-linux-x64: bA9tqm_KjeEA4nnfJ882IxW2o2pJSsODi2wo4fvcXz4C..UNqI4KV2QmdCbFaMAYUJ340CZT7YjUKiV11WNfMPFF8C

Rolling v8/third_party/icu: https://chromium.googlesource.com/chromium/deps/icu/+log/e05b663..e6379c8

TBR=v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: Ib9d330c20f57e23eac75d41231fb132774714967
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2741001Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#73246}

Port ed60adb5

R=machenbach@chromium.org, joransiu@ca.ibm.com, junyan@redhat.com, midawson@redhat.com
BUG=
LOG=N

Bug: v8:11134
Change-Id: I02d0899df33633c15a5911b055a7e34961d8982f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2739647Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#73245}

Port: c2a1d633

Bug: v8:9198
Change-Id: I5b448fec800b0db2860f415dd3ddcfe98728b501
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2738791
Auto-Submit: Liu yu <liuyu@loongson.cn>
Reviewed-by: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/master@{#73244}