Rename opcodes based on the renaming in the proposal,
https://github.com/WebAssembly/simd/pull/322.

Bug: v8:10946
Change-Id: If267d6f8fb1b9deeff64cd9abcd7e4cd64a540a5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2422357
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70077}

This is a reland of 21bb43cc

The build failures seems to be an infra flake.

Original change's description:
> [log][d8] Only use d8.log.getAndStop on temporary log file
>
> We run tests in parallel which can cause multiple tests to write to
> the shared v8.log file. This obviously breaks the simple assertions in
> mjsunit/tools/log.js.
>
> - Use temporary files for log testing with --logfile='+'
>
> - Change the symbol from '&' to '+' for using temporary files for
>   logging with --logfile
>
> - Enable skipped log tests again.
>
> Bug: v8:10937, chromium:1129854, chromium:1130196
> Change-Id: I607dc9a9ecc352e58525cdd21c1c93efebf0f09f
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2421826
> Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Reviewed-by: Victor Gomes <victorgomes@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70071}

Bug: v8:10937
Bug: chromium:1129854
Bug: chromium:1130196
Change-Id: I2ccf7528f35057ef668aa211142e0f1073fc1fc3
Tbr: verwaest@chromium.org, victorgomes@chromium.org
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2424257Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70076}

This reverts commit 54b141ef.

Reason for revert: closed tree due to: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20noi18n%20-%20debug/33838?

Original change's description:
> [wasm][ukm] Add tests for Wasm events (reland)
> 
> Ensure that events are triggered when a module is decoded, compiled,
> instantiated and tiered-up.
> 
> This is a reland of I9dc87957fc03023c5ab1c4f49e865957c8324e1a.
> 
> R=​clemensb@chromium.org
> 
> Bug: chromium:1092417
> Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_rel_ng
> Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_isolates_rel_ng
> Change-Id: Ib5883a338c3756c6f3488fbdd7b6861ecc2ba218
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2367866
> Reviewed-by: Adam Klein <adamk@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Commit-Queue: Emanuel Ziegler <ecmziegler@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70074}

TBR=adamk@chromium.org,clemensb@chromium.org,ecmziegler@chromium.org

Change-Id: I859c69bacfca9c790ed274140bb9e8d23de26729
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:1092417
Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_rel_ng
Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_isolates_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2425104Reviewed-by: Francis McCabe <fgm@chromium.org>
Commit-Queue: Francis McCabe <fgm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70075}

Ensure that events are triggered when a module is decoded, compiled,
instantiated and tiered-up.

This is a reland of I9dc87957fc03023c5ab1c4f49e865957c8324e1a.

R=clemensb@chromium.org

Bug: chromium:1092417
Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_rel_ng
Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_isolates_rel_ng
Change-Id: Ib5883a338c3756c6f3488fbdd7b6861ecc2ba218
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2367866Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Emanuel Ziegler <ecmziegler@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70074}

Bug: chromium:1130489
Change-Id: I506f2ea418bf3bde9468126534df9d78337e5f82
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2422086Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70073}

This reverts commit 21bb43cc.

Reason for revert: See broken build: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20-%20builder/49882

Original change's description:
> [log][d8] Only use d8.log.getAndStop on temporary log file
> 
> We run tests in parallel which can cause multiple tests to write to
> the shared v8.log file. This obviously breaks the simple assertions in
> mjsunit/tools/log.js.
> 
> - Use temporary files for log testing with --logfile='+'
> 
> - Change the symbol from '&' to '+' for using temporary files for
>   logging with --logfile
> 
> - Enable skipped log tests again.
> 
> Bug: v8:10937, chromium:1129854, chromium:1130196
> Change-Id: I607dc9a9ecc352e58525cdd21c1c93efebf0f09f
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2421826
> Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Reviewed-by: Victor Gomes <victorgomes@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70071}

TBR=cbruni@chromium.org,verwaest@chromium.org,victorgomes@chromium.org

Change-Id: I5de61792c283139b2a898334e28e1f7b2d7c08f8
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10937
Bug: chromium:1129854
Bug: chromium:1130196
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2424625Reviewed-by: Francis McCabe <fgm@chromium.org>
Commit-Queue: Francis McCabe <fgm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70072}

We run tests in parallel which can cause multiple tests to write to
the shared v8.log file. This obviously breaks the simple assertions in
mjsunit/tools/log.js.

- Use temporary files for log testing with --logfile='+'

- Change the symbol from '&' to '+' for using temporary files for
  logging with --logfile

- Enable skipped log tests again.

Bug: v8:10937, chromium:1129854, chromium:1130196
Change-Id: I607dc9a9ecc352e58525cdd21c1c93efebf0f09f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2421826
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70071}

This CL extends fast-path transformations of JavaScript parameters
when calling an exported WebAssembly function from JavaScript
to support types kF32 and kF64.

Bug: v8:10943
Change-Id: I730a04c426614460777cad7c6552533868cd902e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2424263Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Vicky Kontoura <vkont@google.com>
Cr-Commit-Position: refs/heads/master@{#70070}

Load and zero extend is still in prototype phase [0], implementing for ARM64 in
order to get more benchmark results.

[0] https://github.com/WebAssembly/simd/pull/237

Bug: v8:10713
Change-Id: I7d632324e4bdb0934ab024911201a06b19a1a83d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2416407
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70069}

No-Try: true
Bug: chromium:1126457
Change-Id: I3c293afb191a269c5b25d43d68f5f92d93afb410
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2424270
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70068}

No-Try: true
Bug: chromium:1126467
Change-Id: Ib8c6bea1397ef27ae9ccff3891194ec5999c4cb7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2424269
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70067}

Change-Id: I0a3ac5e56504c7c99f94a29f30c3827e99718b7d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2423615Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#70066}

This reverts commit 64caf2b0.

Reason for revert: Seems to be causing a failure:
https://ci.chromium.org/p/v8/builders/ci/V8%20Linux/38809?

Original change's description:
> [torque] refactor: use -tq only in filenames derived from .tq files
> 
> This is to establish a naming rule for Torque-generated files:
> - If the file is called foo/bar-tq..., then it is derived from a
>   file foo/bar.tq
> - Otherwise it doesn't belong to a specific .tq file.
> 
> So far, we attached -tq to all Torque-generated file names, where it
> sometimes corresponded to a .tq file name and sometimes not.
> It is not necessary to add -tq to file names to indicate that they are
> Torque-generated, since they are already in a directory called
> torque-generated, and we always refer to them as
> "torque-generated/filename", so there is no confusion even though some
> files now have the same name as a corresponding hand-written file, for
> example factory.cc.
> 
> TBR: hpayer@chromium.org
> Bug: v8:7793
> Change-Id: Ie172babad1fc7422fd1059c48f5dafaa53e50c8b
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2414218
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70060}

TBR=jgruber@chromium.org,tebbi@chromium.org

Change-Id: I6960fe540861947536c6ddfc0f4887ea80899fae
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7793
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2424486Reviewed-by: Francis McCabe <fgm@chromium.org>
Commit-Queue: Francis McCabe <fgm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70065}

Using associative property of addition: (x + A) + B => x + (A + B).
Note: A and B need to have the same sign and we need to check that
(x + A) isn't used anywhere else.

20% perf improvement of the following function.

function f(n) {
  var c = 0;
  for (var i = 0; i < n; i++) {
    c = c + 2 + 3;
  }
  return c;
}
for n = 10_000_000.

Before: 7.31s.
After: 6.05s.

Bug: v8:10305
Change-Id: If45d1cad6128a9a25cb9f43a4828ae28d594a84b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2365221
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70064}

We are hitting some limits in number of opcodes on ARM64. Try to reduce
it by merging AnyTrue opcodes (from 4 to 1) since the codegen is
identical.

Bug: v8:10930
Change-Id: Ib0bcedbd24d122a4da1ffcb29c1e4b5656fa6ac2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2422087Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70063}

The detach CHECK is currently crashing on a non-TypedArray and non-Array
input source to TypedArray#set that detaches the destination TypedArray
in its length getter.

Bug: v8:10885
Change-Id: I80bcb4ffb4e4122afbff5c412623c008dc9509df
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2419655Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70062}

Strange things happen if we add too many opcodes such that we exceed the
number of bits ArchOpcodeField has, and in some arch (ARM64), we are
only one away from requiring 10 bits (at 0x1ff) now.

Bug: v8:10930
Change-Id: I8dc6b7e0822291f2403db4e4e1dfaf90b9416a8c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2422843
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70061}

This is to establish a naming rule for Torque-generated files:
- If the file is called foo/bar-tq..., then it is derived from a
  file foo/bar.tq
- Otherwise it doesn't belong to a specific .tq file.

So far, we attached -tq to all Torque-generated file names, where it
sometimes corresponded to a .tq file name and sometimes not.
It is not necessary to add -tq to file names to indicate that they are
Torque-generated, since they are already in a directory called
torque-generated, and we always refer to them as
"torque-generated/filename", so there is no confusion even though some
files now have the same name as a corresponding hand-written file, for
example factory.cc.

TBR: hpayer@chromium.org
Bug: v8:7793
Change-Id: Ie172babad1fc7422fd1059c48f5dafaa53e50c8b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2414218
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70060}

It is not allowed to invoke ResetPendingObject() in
MarkCompactCollector::StartMarking(). This method is invoked when
starting incremental marking, at this point the object might not be
initialized.

Bug: v8:10315
Change-Id: I7659855d78fbb28536f57b26e8a7d33c1ba4092e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2424267Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70059}

Avoid race with concurrent allocation thread by updating the flag
conditionally.

Bug: v8:10315
Change-Id: I63df8ab5a6a506e9337281c9fef7555b9deaaee6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2424264Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70058}

Also remove yangguo@ at his behest.

Change-Id: Ief4176663ab01ff7b1d75aa8d6907c96ab519310
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2421822Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70057}

The tests are flaky because of missing safepoint information for stack
checks. Adding the safepoint information there is not trivial though,
so I disable these tests for now to keep at least the bots green.
An alternative would be to revert the CLs that add safepoints in the
first place. However, I would prefer to avoid the overhead that would
be caused by it. The implementation is completely hidden behind a flag,
so it does not have impact on production code.

R=clemensb@chromium.org

Bug: v8:10929
Change-Id: I38c0e3c3806de2cc39ba26bc3b47c2ea8d1cf81a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2423705Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70056}

Bug: v8:10577

Change-Id: I28aaec30b73def5034294f71bb6bda466172b4ac
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2400978
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Tamer Tas <tmrts@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70055}

Otherwise concurrent allocation might start incremental marking, which
would then mark the global handle.

Bug: v8:10315
Change-Id: Ibc681b001847a7c52e9fd8a0420e42a0d0ecfbda
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2424004Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70054}

Change-Id: I257cd745966cbd9ee87eb725b3f80fbf5bf40ca3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2423743Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70053}

This flag has no uses in any tests, and it's hard to image a use case
for debugging or similar.

R=ahaas@chromium.org

Bug: v8:10933
Change-Id: I2e96187e4410805824d213e9a9df152b54dd3fb2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2421825Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70052}

No-Try: true
Bug: chromium:1126457
Change-Id: Iea2f8f37b172fb130c13b0f1d397eb5789c82893
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2423720
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70051}

This CL improves the condition that checks all parameters received
from JavaScript when calling an exported WebAssembly function
to determine whether they can be transformed without calls to
built-in functions. The condition is now updated to stop checking
if one parameter that cannot be transformed quickly
is encountered.

Bug: v8:10943
Change-Id: If199aa8d2ffcef86f973c23d9663f8091dfced8d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2423713Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Vicky Kontoura <vkont@google.com>
Cr-Commit-Position: refs/heads/master@{#70050}

This reverts commit 4a2b2b2e.

Reason for revert: Speculative revert due to https://ci.chromium.org/p/chromium/builders/try/linux-rel/495075?

Original change's description:
> [Heap]: Marking use Jobs.
> 
> StopRequest is removed in favor of:
> COMPLETE_TASKS_FOR_TESTING -> JoinForTesting()
> PREEMPT_TASKS -> Pause()
> COMPLETE_ONGOING_TASKS now has the same behavior as PREEMPT_TASKS
> - we should avoid waiting on the main thread as much as possible.
> 
> Change-Id: Icceeb4f0c0fda2ed234b2f26fe308b11410fcfb7
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2376166
> Commit-Queue: Etienne Pierre-Doray <etiennep@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70037}

TBR=ulan@chromium.org,etiennep@chromium.org

Change-Id: I63f24bffa0f56c6ffa1d1977fc4fb8a76b6f3ba2
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2423722Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70049}

Tests fails sometimes with concurrent allocation.

Bug: v8:10315
Change-Id: Ic055a3573f6daacc435670efcf2e310f4c746451
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2423714Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70048}

Choose the page size based on V8_HOST_ARCH_ARM64 (i.e. we're building
an arm64 binary) instead of V8_TARGET_ARCH_ARM64 (i.e. V8's compilers
are emitting arm64 instructions, which is the case in simulator builds
as well).
Drive-by:
- use V8_TARGET_OS_MACOSX instead of __APPLE__
- drop implementation difference between AllocatePageSize and
  CommitPageSize on POSIX (they must return the same value anyway)

This continues and obsoletes the work at
https://chromium-review.googlesource.com/c/v8/v8/+/2314102 .

Bug: chromium:1107945, chromium:1128932
Change-Id: Iaaa509dd496ff581ddda4d957bc3d35d806cf81e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2421817
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70047}

It's inherently timing-dependent, leading to false positives.

Bug: chromium:1127612, v8:10239

Change-Id: Ibf6f3cb07f520a404daf8e860a0c2e5f2319529e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2423707
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70046}

The actual fix is in LoadIC::ComputeHandler (checking
lookup_start_object == holder instead of receiver == holder) + the
LookupIterator changes for preserving lookup_start_object.

The rest is renaming / refactoring.

Bug: v8:9237, chromium:1127653
Change-Id: Ieef46fb46ababa79623951c48639429c5b552d2d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2414039
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70045}

StressConcurrentAllocatorTask now checks whether tear down was started
for the isolate to avoid allocation failures.

As a drive-by change remove the unused method
ConcurrentAllocator::PerformCollectionAndAllocateAgain.

Bug: v8:10315
Change-Id: Iba329ebbd782e9f8f11e9b8ec644bf28ab9c80ab
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2423703Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70044}

Bug: v8:10875
Change-Id: Idde7011b82a292c83758e5a181442960e55a8592
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2421824
Auto-Submit: Almothana Athamneh <almuthanna@chromium.org>
Reviewed-by: Liviu Rau <liviurau@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Liviu Rau <liviurau@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70043}

Added scopes to diallow/allow GCs from happening using a DCHECK. It is
stricter than DisallowHeapAllocation, since this also doesn't allow
safepoints.

As soon as Turbofan is ready, we can replace all usages of
DisallowHeapAllocation with DisallowGarbageCollection.

Bug: v8:10315
Change-Id: I12c144ec099d9af57d692ff343adbe7aec46c0c7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2362960Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70042}

Building and running tests with v8_enabled_concurrent_marking=false
currently produces two failures:
1) Segmentation fault on attempt to mark a read-only object.
   This is fixed by changing MarkBit::Set to be a no-op if the object
   is already marked (which is the case for the readonly space).
2) Missing write-barrier due to bogus condition in the bailout.
   The barrier can be skipped only if the host object is not marked yet.

This also disables two concurrent allocation tests that rely on
concurrent marking write-barrier.

Bug: v8:10875

Change-Id: Ib3a238fc34c8f20c697470e0bd4ac427fb4bdc0e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2421816Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70041}

See b/169093796 for details

Change-Id: Icdb6fac9d3063cc0dedd68e318805b88f4c06bc6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2421982
Auto-Submit: John Xu <johnx@google.com>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70040}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/4070870..e78873c

Rolling v8/third_party/aemu-linux-x64: LUFkW5GTwXItfKWgJt7kkk1hEf35ZueIbx73KwUN5K0C..zVhDYckO5pABaht9PlF8y1S_JicWTnMzwymJyNabQj4C

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/244d770..cc29098

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/92b3622..7c1d1f3

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: Ief975fc418bf135578e441c849e41f1635897980
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2422777Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#70039}

Instantiating a module that contains a function (exported) with a v128
in its signature is fine, but then later calling it will trap.

So v128 values are technically not callable from JS, but we can give it
a default argument of 0, and will later trap anyway. This is useful when
fuzzers generate functions with v128 in the signature of the main
function that we then later try to call.

Bug: chromium:1129068
Change-Id: I93f239a0355b8059e25b8bd5f1274d151d71ee11
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2419657
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70038}