Design Doc: https://docs.google.com/document/d/1cPGfiihn76yj2iAomKcspPFyLLcnk3WkCiqceBQPQyk/edit#
https://chromestatus.com/feature/5407573287108608

Bug: v8:7051
Change-Id: I880ca0b67f745283037226ce816a74d02128bfc9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2874950Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74393}

We have a scratch available, so we can use it instead of asking for a
temporary register from the register allocator. We can also relax the
unique register requirement, since we are careful not to overwrite src0
or src1 in the codegen.

Bug: chromium:1204071
Change-Id: Ia7775167e323b3bca80f63304687cdbd425af0e5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2873227Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74392}

Change-Id: I5fcf6ca7974d2af9ab59b1d82dc6996322794f73
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2874446
Auto-Submit: Georg Neis <neis@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74391}

Change-Id: I0f732a3e7e970c02925c0ba4e93273a27605dec3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2875206Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74390}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/85859d6..c5571d5

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/d4ee032..1ae270e

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/6b022d1..3da9171

Rolling v8/third_party/google_benchmark/src: https://chromium.googlesource.com/external/github.com/google/benchmark/+log/33c133a..d0c227c

TBR=v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: Ifa5ee873b9133ceb50147d80cd40f3d271cd2680
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2874931Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#74389}

This compilation error might happen without the header:
error: 'unique_ptr' in namespace 'std' does not name a template type

Change-Id: I103ce0496eff5dda85557410b4e7863c1c65aad0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2873446Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#74388}

- Take HeapHandle& parameter to allow a use case of free() on an already
  dead object during sweeping.
- Change free() from T* to T& which forces an object and allows the
  caller to place the nullptr check before retrieving a heap handle.

Bug: chromium:1056170
Change-Id: I80689d27d3abe410d177cd8c86b31ff2fe579a77
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2874461
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74387}

This field has been used with atomically relaxed semantics due to a race
with layout_descriptor [1]. Even though layout_descriptor doens't exist
anymore, this race is still present presumably because the transition to
a new map happens on StoreIC. We can set it as atomic for non-cm and
atomic relaxed for cm like we did with the other Map's fields.

Note that originally, this field was relaxed so we are reverting it
back to what it was for concurrent marking.

[1]: https://chromium-review.googlesource.com/c/v8/v8/+/555210/

Bug: v8:7790, v8:11696
Change-Id: I5d8c18bedb84b4bd5dc771e87310bc14409cfed8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2874454Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74386}

... in favour of an optional return type for MapRef::prototype().
This also eliminates one kind of use of ShouldHaveBeenSerialized(),
which I want to get rid of entirely.

Bug: v8:7790
Change-Id: I031f067d644570e5c8aaeaf94c5ff69ff0515a99
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2874456
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74385}

Bug: v8:7748
Change-Id: I039fa3cc1c236027d8e44cd5d9f2d713099911fc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2874452Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74384}

Effect control linearization already does splitting on most constant nodes it
introduces, and we don't get much benifit otherwise for what is a fairly

BUG=v8:9684

Change-Id: I74301058d157cc163762722576f9301088f8e72a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2874460Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74383}

As per WebAssembly Web API[1], the engine should only consider names
from the name section to synthesize function names in the context of
call stacks. We previously also added support to harvest the exports
table here in an attempt to improve the DevTools debugging experience,
but that needs a separate fix specifically for the inspector (which
should also take into account the imports to harvest names).

[1]: https://webassembly.github.io/spec/web-api/index.html#conventions

Fixed: chromium:1164305
Change-Id: I4bde5c8398a5164f1d8ac9060ad3743ed494c41e
Bug: chromium:1159307, chromium:1164241, chromium:1071432
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2874464
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74382}

The IC_BUILTIN and IC_BUILTIN_PARAM macro prevent code navigation and
they only avoid very simple, non-performance critical code.

Change-Id: Ic9d10a9c53a1890149d86b43a6989afae7f1d6f4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2871464Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74381}

Bug: chromium:1205004
Change-Id: Ib97dbc06ac62d7d1392d610651ccd15daf12bb89
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2872825
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Liviu Rau <liviurau@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74380}

This reverts commit 305aa12f.

Reason for revert: Breaks MSVC compilation: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Win64%20-%20msvc/17718/overview

Original change's description:
> cppgc: Save xmm registers on the stack
>
> Microsoft x86_64 ABI considers XMM6-XMM15 as non-volatile
> (callee-saved), which means that the compiler can store pointers in them.
> We need to make sure they are pushed onto the stack inside the stack
> scanning trampolines.
>
> Bug: v8:11710
> Change-Id: Ida804fe49d3d3b6f179ec276903a42ec8d3d86be
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2865745
> Commit-Queue: Anton Bikineev <bikineev@chromium.org>
> Auto-Submit: Anton Bikineev <bikineev@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74376}

Bug: v8:11710
Change-Id: I9593e55b5c935619a6707f3c00f9ac295475b30d
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2874462
Auto-Submit: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#74379}

This change makes it possible to enable SharedArrayBuffer per Context,
controlling whether it should be enabled or not with a callback. The
previous implementation of the reverse origin trial for
SharedArrayBuffer was broken, since the feature could only be enabled
globally per process, and only if the feature flag is set early enough
in the v8 initialization. This does not play well with how origin
trials work.

The implementation is similar to the callbacks that already exist for
the origin trials for WebAssembly simd and exceptions.

SharedArrayBuffer is still controlled by the flag
harmony_sharedarraybuffer. If that flag is disabled, then
SharedArrayBuffer is disabled unconditionally. On top of that, this CL
introduces a new flag for enabling SharedArrayBuffer per context. If
that flag is set, a callback is used to determine whether
SharedArrayBuffer should be enabled.


Note that this only controls whether the SharedArrayBuffer constructor
should be exposed on the global object or not. It is always possible
to construct a SharedArrayBuffer using

  new WebAssembly.Memory({
    shared:true, initial:0, maximum:0 }).buffer.constructor;


There are few things which I do not like of this approach, but I did
not have better ideas:

1. The complex logic of dobule flag + callback. However, this seemed
the best way to me to not break embedders which rely on that flag
being enabled by default.

2. The fact that what actually matters is just whether the callback
returns `true` once. It would be good to check that the callback gives
a consistent return value, or to provide a better API that cannot be
missunderstood.


Bug: chromium:923807,chromium:1071424,chromium:1138860
Change-Id: Ibe3776fad4d3bff5dda9066967e4b20328014266
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2867473Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Antonio Sartori <antoniosartori@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74378}

This CL adds a new %VerifyType compiler intrinsic that can be used
by tests and fuzzers to generate a runtime type check of the given
input value. Internally, %VerifyType is lowered to %AssertType
which is why checks are currently limited to range types.

tests to be const-correct.

Drive-by: Add a few consts to NodeProperties accessors to allow
Bug: v8:11724
Change-Id: I06842062d0e8278a5ba011d5a09947fe05b6e85e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2859959
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74377}

Microsoft x86_64 ABI considers XMM6-XMM15 as non-volatile
(callee-saved), which means that the compiler can store pointers in them.
We need to make sure they are pushed onto the stack inside the stack
scanning trampolines.

Bug: v8:11710
Change-Id: Ida804fe49d3d3b6f179ec276903a42ec8d3d86be
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2865745
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Auto-Submit: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74376}

We potentially emitted the same gap move multiple times to satisfy slot
constraint of live ranges defined by a constant. Avoid this by keeping
track of already spilled ranges for a given instruction.

This is not expected to cause any regression because this case is rare.
If it does, a better approach to save allocations would be to re-use the
same vector by storing it somewhere that survives the function calls,
e.g. in the ConstraintBuilder.

Drive-by: Remove unused functions.

R=sigurds@chromium.org
CC=nicohartmann@chromium.org

Bug: chromium:1204748
Change-Id: I75a838a8b27775ecdeddb4c60cf72c56d5f1c2a4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2871462Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74375}

Main changes:
- Allow global.get in elements segments with expressions-as-elements.
- Allow element segments with types other than funcref.

Detailed changes:
- Move WasmInitExpr to its own file. Add stream opearator << support.
- Simplify type of PrintCollection.
- Make WasmElemSegment use an array of WasmInitExpr's over the previous
  ad-hoc implementation. Move null_index to WasmModuleBuilder.
- Refactor consume_element_segment_header. Make it return a
  WasmElemSegment.
- Refactor consume_element_expr. Make it return a WasmInitExpr.
- Refactor DecodeElementSection. Make it invoke
  consume_element_segment_header, then populate its element array.
- Update module-instantiate.cc to handle global.get elements.
- Fix bug in wasm-objects.cc where the wrong type index was passed into
  module()->has_signature()
- Adapt and add tests.

Change-Id: I5abfbe424dbb750ee2dca59f91c451ffcb79f95f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2857959
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74374}

Simplifies the traversal of nodes in Scheduler::PrepareUses to
avoid having to carefully order stack traversal for pre/post
ordering visits. Instead simply pre visit when pushing a node
onto the stack, then post visit the node when popping it from
the stack and then visiting it's inputs. This keeps the same
invariants required, but reduces visit overhead.

In addition, move checking for CoupledControlEdges out of
Increment/DecrementUnscheduledUseCounts such that the
coupled control edge calculation only needs to be done once
per node, rather than once for every input of the node. Also
remove unecessary recursion from these functions.

All told, these optimizations reduce the PrepareUses overhead
by 40-50%.

BUG=v8:9684

Change-Id: I934523a732892a1f66d7e77f8d04e200169080f1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2863602
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74373}

This is the final part of a CL series that establishes
MakeRef/TryMakeRef as the bottleneck for Ref construction. We do this by
converting direct constructor uses to (Try)MakeRef calls, and then
marking the ctor as protected.

Bug: v8:7790
Change-Id: I41bfa226d48cbdfee53b434ec52004eb6507e67a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2874166
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74372}

This is part of a CL series that establishes MakeRef/TryMakeRef as
the bottleneck for Ref construction. We do this by converting direct
constructor uses to (Try)MakeRef calls, and then marking the ctor
as protected.

Bug: v8:7790
Change-Id: I26faa6bc1934662c81ae127dee64bddffa428de9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2874165Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74371}

WasmModules were not removed from the global type judgement cache when
they were deleted. This created problems if another module got allocated
in the same location as a previously deleted module, by creating false
positive cache hits. This CL fixes this issue by removing WasmModule
from the cache as part of its destructor.

Bug: v8:11700
Change-Id: I4948e361dd681040807f35d759b647d1bce585dc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2859863
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74370}

These should all be forward/backward compatible with Python 2/Python 3.

[tools] Tweak statusfile.py for Python 3

.iteritems() does not exist in Python 3, only .items().

(While .iteritems() was meant to be an optimization over .items()
in Python 2, .items() should work fine, and it is forward/backward
compatible.)


[tools] Fix another Python 3 issue in mb.py

sys.platform used to return e.g. 'linux2', which is 'linux' plus
whatever the first digit of `uname -r` was when Python was built.
As of Python 3.3, it always returns just 'linux' for Linux OSes.
Use `sys.platform.startswith('linux')` for forward/backward
compatibility.


[tools] Make base_runner.py Python 3 compatible

dict.keys() returns a dict_keys in Python 3, whereas it
used to return a simple array. list() is forward/backward
compatible with identical results on Python 2/3 (returns array).

(Tested on Linux x64, trying to recreate NodeJS's CI workflow.)


[tools] Make tools/dev/v8gen.py work with Python 3

dict.keys() returns a dict_keys in Python 3, whereas it
used to return a simple array. list() is forward/backward
compatible with identical results on Python 2/3 (returns array).

Comparing a None-type value numerically used to result in the
None-type value always being considered "less than" the thing
it is compared to. As of Python 3, numerically comparing against
None or None-typed values results in an error. Check if a value
is truthy before numerically comparing it, for forward/backward
compatibility.

print() used to transparently decode byte strings in Python 2.
In Python 3, they must be explicitly decoded first.

(Tested on Linux 64-bit, trying to recreate NodeJS's CI workflow.)

Bug: v8:9871
Change-Id: I059bf98577a67649bbe7ec49848989d468da96b0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2867270Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74369}

Element segments and tables in tests used an ad-hoc mechanism to
describe the different types of initializer expressions, e.g. an number
which could denote either the value of a constant or the index of a
global. This CL tidies up and generalizes the test infrastructure by
directly using WasmInitExpr in those cases.

Additional changes:
- Introduce WasmElemSegment class.
- Remove obsolete --experimental-wasm-bulk-memory flag from tests.
- Rename WasmInitExpr.type -> kind.
- Remove dependency of wasm-module-builder from mjsunit.js (except in
  assertTraps).

Change-Id: I716254a04ceea9ceb8ac6b848e12e1637f618f0d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2857638
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74368}

This is part of a CL series that establishes MakeRef/TryMakeRef as
the bottleneck for Ref construction. We do this by converting direct
constructor uses to (Try)MakeRef calls, and then marking the ctor
as protected.

Bug: v8:7790
Change-Id: I36c07f69378f3a630462c216ef5da284cfd3972f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2871449
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74367}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/b057259..85859d6

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/785c56f..d4ee032

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/0292793..6b022d1

Rolling v8/third_party/google_benchmark/src: https://chromium.googlesource.com/external/github.com/google/benchmark/+log/ba9a763..33c133a

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/84ada2d..dbcffda

TBR=v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: Id4968f10cd978198caa4dc523aef60a9a6a81092
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2873071Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#74366}

Bug: v8:11460
Change-Id: I97a21d158ad057334cc7fe5f53edc5c6c23d1355
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2861711
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74365}

Pointer cage reserved another register and inadvertently broke
speculation poisoning by aliasing kSpeculationPoisonRegister with
kInterpreterBytecodeArrayRegister (r12).

This CL changes kInterpreterBytecodeArrayRegister to r11. Note that this
changes it from being callee-save to caller-save, which required code
reshuffling in a baseline builtin.

Bug: v8:11726
Change-Id: Ic2a1bd6b3a2cb4c480c84375dd3274f2efedc81f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2869985
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74364}

We don't have memory alignment yet, so using memory operands will cause
segv if we try to access the unaligned operands (on non-AVX systems).

The fix here is kept simple (the logic can be cleaned up a bit and
optimized to not use unique registers), in order to keep the cherry-pick
and back-merge as small and safe as possible.

Bug: chromium:1204071
Change-Id: Ieda23dcc097a06c6db20b952d7061708c3be0d24
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2869986Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74363}

Bug: v8:11688
Change-Id: I35cf5d11d1a9af68be29c8e00224667ddbf07e7a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2864388Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74362}

Bug: v8:11722
Change-Id: I34569071d74f0fe68b30cf3a596ea944440f1fec
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2864703Reviewed-by: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74361}

cpplint rules change over time, and we change the exact rules we enable
for v8. This CL removes NOLINT annotations which are not needed
according to the currently enabled rules.

R=leszeks@chromium.org

Bug: v8:11717
Change-Id: I7b54d7c75ef474749e22599a4bf16d9d309f4436
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2859950
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74360}

Use a function pointer rather than lambda when loading unwinding
functions on Windows.

Bug: v8:7301
Change-Id: I00e9c895d9ffdce6ba485eaf4401a749faa5e825
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2867489Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#74359}

Bug: v8:11727
Change-Id: Id78995e250e16f43687db1c7ce97a59c635b5424
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2871459
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74358}

Maps set on the JSFunction were done so in a non-atomic way, which meant
that we were failing to have a synchronization point and the read/writes
could be reordered.

This started happening after a previous CL[1] moved some methods from
relaxed to non-atomic, which triggered TSAN (see v8:11696).

[1]: https://chromium-review.googlesource.com/c/v8/v8/+/2843359

Bug: v8:7790, v8:11696
Change-Id: I8472ff8b63d391376ee2f1dcf0a8b4fd7cecfcd1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2851893Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74357}

Drive-by-fix:
- Show tooltips in list-panel entries
- Use fixed kChunkWidth in timeline-track

Bug: v8:10644
Change-Id: I738f613c9a35726b9ab4a6c51f784638eade9335
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2867467
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74356}

WebAssembly.Function and functions of the C-API do not have a function
index. Their index is kAnonymousFuncIndex = -1. Therefore it is
necessary to change the return type of WasmCode::index() from uint to
int.

The changes in WasmFrame::Print produces output like the following:

[9]: CWasmEntryFrame [pc: 0x9d200084091]
[10]: Anonymous wasm wrapper [pc: 0x101c5975c972]
[11]: WASM [wasm://wasm/f4bee83a], function #1 ('fibonacci_wasm'), pc=0x101c5975c5dc (+0x7c), pos=123 (+32)

R=jkummerow@chromium.org

Bug: v8:11713
Change-Id: I1012e92713d64d24ed2a92729dd3c2e4a013b9c0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2871455Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74355}

cpplint rules change over time, and we change the exact rules we enable
for v8. This CL removes NOLINT annotations which are not needed
according to the currently enabled rules.

R=mslekova@chromium.org

Bug: v8:11717
Change-Id: Ic986c01ac151cee9fc6f7d950d0c4c139ebac6d8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2859852Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74354}