Bug: v8:7700
Change-Id: I3547c06a6f90ea1243b76a9967574d6c2afd0af9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3813712
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82253}

Bug: v8:7700
Change-Id: Iaff0bf8d3ed1510bd9d8605932905bee9341e33f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3815483
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82252}

We could throw proxy revoked error before calling
Array.IsArray to make error message clearer.

Bug: v8:13037
Change-Id: I85055d24c833acd25791ef7a8a394955805ff3f1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3813065Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Cr-Commit-Position: refs/heads/main@{#82251}

Bug: v8:7700
Change-Id: Iad4b8c8187dc99e811a90f66b05d0cd9e2713ec9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3815484Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Cr-Commit-Position: refs/heads/main@{#82250}

Bug: v8:7700
Change-Id: Ifa3c78017abf8f596a7d3c96877ca035d6126c90
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3815481
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82249}

This CL adds three metrics for lazy compilation: the number of functions
compiled lazily, the total time spent on compiling functions lazily,
and the maximum time spent on compiling a single function. All three
metrics get recorded twice, once 5 seconds after instantiation, and once
20 seconds after instantiation.

R=clemensb@chromium.org

Bug: v8:12852
Change-Id: Ib9e5e12921fb1ec7aefd53af604cbb389bee79b9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3811502Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82248}

This CL enables Myers algorithm introduced with
https://crrev.com/c/3804860.

Note that Myers finds slightly different diffs in some cases compared
to the current approach so this CL has to rebaseline one test.

R=kimanh@chromium.org

Bug: chromium:1205288
Change-Id: Ife4708a9edf543db938024a5e14c34a589d6a22a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3810244Reviewed-by: Kim-Anh Tran <kimanh@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82247}

Wasm counters were accidentally changed to use NestedTimedHistograms in
https://crrev.com/c/3080566.
Revert that, and fix a comment in the NESTED_TIMED_HISTOGRAM_LIST macro
list.

R=cbruni@chromium.org

Change-Id: Ib28fbf50781026fe28c22af6108c88c3634d92c0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3811584
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82246}

Bug: v8:7700
Change-Id: Ib3f799f37110ea6ba56417d868a25794abbfa08b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3813071
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82245}

This reverts commit 6ca3adb9.

Reason for revert: Build failed with V8_MAP_PACKING

Original change's description:
> [ptr-compr][x64][compiler] Support load map in compressed form
>
> ...to allow pointer decompression at use-site.
>
> Bug: v8:13056, v8:7703
> Change-Id: If369286814c76340a945cc2a9fd863888a813080
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3811737
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Commit-Queue: Hao A Xu <hao.a.xu@intel.com>
> Cr-Commit-Position: refs/heads/main@{#82242}

Bug: v8:13056, v8:7703
Change-Id: I01b6ea880c656b66392cb8eb47f7c80d8c0e4936
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3815777
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82244}

This CL adds a new diffing implementation based on Myers algorithm
to live editing. We straight-up implement the algorithm presented in
"Myers, E.W. An O(ND) difference algorithm and its variations (1986)"
particularly the "Linear space refinement" presented in section 4b.

Note that the CL does not enable the new algorithm straight-away.
We'll land a separate CL for easier revertability.

Myers algorithm is a great improvement over the current dynamic
programming approach. Local benchmarking with a 130kB script
has shown drastic improvements both for time and space:

    Live editing script (Old line count 10236 vs New 10240)
    Dynamic Programming: 65701.931 ms
    Myers:               11.735 ms

Bug: chromium:1205288
Change-Id: I136f176f4a0d3c9a5dcd7a157c72c49c475bea19
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3804860Reviewed-by: Kim-Anh Tran <kimanh@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82243}

...to allow pointer decompression at use-site.

Bug: v8:13056, v8:7703
Change-Id: If369286814c76340a945cc2a9fd863888a813080
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3811737Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Hao A Xu <hao.a.xu@intel.com>
Cr-Commit-Position: refs/heads/main@{#82242}

Change-Id: I5d6636591912694cd0d0897f62c7ab56f0107b99
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3813425
Auto-Submit: Yahan Lu <yahan@iscas.ac.cn>
Commit-Queue: ji qiu <qiuji@iscas.ac.cn>
Reviewed-by: ji qiu <qiuji@iscas.ac.cn>
Cr-Commit-Position: refs/heads/main@{#82241}

Some wasm interpreter tests are failing since instructions generated
by gcc such as *multiply and and* (fmadds) create intermediate
results bigger than 8 bytes which doesn't match other architectures,
hence the resulting output differs.

Port commit 13314a20

co-authors: Jun Yuan Tan <junyuan.tan@starfivetech.com>

Change-Id: I18c0b659f30df84bb30daa176368a7e81b51063e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3811139
Commit-Queue: Yahan Lu <yahan@iscas.ac.cn>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82240}

Bug: v8:11092
Change-Id: Ic0f30c35dfc4acda286c157722eb794a0aa4a360
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3814072
Commit-Queue: Paolo Severini <paolosev@microsoft.com>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82239}

This CL refactors WasmContinuationObject to have a direct
ExternalPointer to the jmpbuf structure instead of using a Foreign.
This in turn makes it possible to use a unique pointer tag for that
external pointer when the sandbox is enabled.

Bug: v8:10391, v8:12949
Change-Id: I25528bd8aaffb32dd617440d3ccb77d319894a38
Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3805061Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Samuel Groß <saelo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82238}

This bit may not get cleared automatically and could show
results from older executed instructions.

Change-Id: I5976f9a6c5bf87b1a63ef0f35493b222729e20f6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3812037Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#82237}

The compiler is free to spill intermediate results of
compression|decompression on stack. With our scheme, the only
intermediate result can be a truncated but non-shifted pointer.

Bug: chromium:1325007
Change-Id: Ibec1f80b9d214d1c1e7cb8368c094fc262237642
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3793615Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82236}

Bug: chromium:1216437,chromium:1219630,chromium:1309225
Bug: chromium:1311641,chromium:1314616
Change-Id: I1575edbdd7fe91ed970ffe2f3437fd7c514e1ebd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3794525Reviewed-by: Samuel Groß <saelo@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Brendon Tiszka <tiszka@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82235}

Bug: v8:7700
Change-Id: I0bf8f8e216bd4d73dea4dde0e80b0d7157ccab6a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3811282Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82234}

This reverts commit 30ee0690.

Reason for revert: breaks something on windows: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Win64/47755/overview

Original change's description:
> Reland "[TurboFan] Support BigIntMultiply"
>
> This is a reland of commit ccde4205
>
> Added a test case for terminating optimized bigint multiply and attached frame_state to the runtime call to provide deopt information to determine the throw location
>
> Original change's description:
> > [TurboFan] Support BigIntMultiply
> >
> > Bug: v8:9407
> > Change-Id: Iab0a4ca8dd5d83444d1addd6043a5c8e3a8577a7
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3773773
> > Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> > Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
> > Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
> > Cr-Commit-Position: refs/heads/main@{#82140}
>
> Bug: v8:9407
> Change-Id: Ia691d758265148da1de291365d41c7c1d1f98ddd
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3810391
> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#82232}

Bug: v8:9407
Change-Id: I006ed3770564149ae146c614c3d693de9ec29e41
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3812289
Owners-Override: Francis McCabe <fgm@chromium.org>
Commit-Queue: Francis McCabe <fgm@chromium.org>
Reviewed-by: Francis McCabe <fgm@chromium.org>
Auto-Submit: Francis McCabe <fgm@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#82233}

This is a reland of commit ccde4205

Added a test case for terminating optimized bigint multiply and attached frame_state to the runtime call to provide deopt information to determine the throw location

Original change's description:
> [TurboFan] Support BigIntMultiply
>
> Bug: v8:9407
> Change-Id: Iab0a4ca8dd5d83444d1addd6043a5c8e3a8577a7
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3773773
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#82140}

Bug: v8:9407
Change-Id: Ia691d758265148da1de291365d41c7c1d1f98ddd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3810391
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82232}

The infrastructure runs everything already in Python3, so this is
mostly a clean-up.

For MB, a python2 holdover was removed and new lint errors were
fixed.

The renames were automated with:
git grep -e "/usr/bin/python$" |
  cut -d':' -f1 |
  xargs
  sed -i 's/#!\/usr\/bin\/python$/#!\/usr\/bin\/python3/1'

and
git grep -e "/usr/bin/env python$" |
  cut -d':' -f1 |
  xargs
  sed -i 's/#!\/usr\/bin\/env python$/#!\/usr\/bin\/env python3/1'

Bug: v8:13148
Change-Id: If4f3c7635e72fa134798d55314ac1aa92ddd01bf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3811499Reviewed-by: Liviu Rau <liviurau@google.com>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82231}

Resolves a TODO and enables future work.

Bug: v8:7700
Change-Id: Id361c057b644232f88e0b3e46e3ee8e530113eaf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3811580Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82230}

Bug: v8:12783, v8:7327

Change-Id: I7c4280b94abc8103472cbef0cf7bb226b918ae32
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3805886Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82229}

Move the translation array building to the "compile" rather than
"generate code" phase of maglev compilation, as a graph processor after
register allocation. This allows it to be done on a background thread.

Drive-by: Use the new OptimizedOut functionality of the translation
array builder.

Bug: v8:7700
Change-Id: If4202737f1eeb38281f306c23f408105c5fb0ef1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3811501Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82228}

Several small optimisations for TranslationArray:

  a) Store opcodes and register codes as unsigned values (no need to
     shift in the sign bit when encoding/decoding). Note that skips over
     register codes will decode them as if they were signed -- this is
     ok since we don't use the skipped value.

  b) Use the static knowledge that opcodes and register codes need 7
     bits to avoid the VLQEncode loop when building (still use a
     VLQDecode when decoding since decode time matters less).

  c) Add a special opcode for "optimized out", instead of using a
     literal, since this will be a common case.

Change-Id: I9758e5b889ecc3f1a3fa4d840867f2a3d481e75f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3812040
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82227}

addressing mode, pt.2

Compiler generates the below instructions for compressed pointer:

  [ DecompressTaggedPointer
  movl r8,[r8+0x13]
  REX.W addq r8,r14
  ]
  addl [r8+0x7],0xe6

This CL optimize the pointer decompression by using complex
addressing mode in x64:

  movl r8,[r8+0x13]
  addl [r14+r8*1+0x7],0xe6

Bug: v8:13056, v8:7703
Change-Id: I5beec9803d595d2e97367d53ae4497387e0830fe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3754285
Commit-Queue: Hao A Xu <hao.a.xu@intel.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82226}

Bug: v8:13116
Cq-Include-Trybots: luci.v8.try.triggered:v8_linux64_gc_stress_dbg_ng_triggered
Change-Id: I0041fd3820d464e142269c99cdf2d24ea890b286
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3812041Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Almothana Athamneh <almuthanna@chromium.org>
Auto-Submit: Almothana Athamneh <almuthanna@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82225}

Revert "Reland "[infra] Enable sandbox for x64 and arm64 builders and add a set of builders with Sandbox off""

This reverts commit fe327545.

Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20TSAN%20-%20stress-incremental-marking/8615/overview

Original change's description:
> Reland "[infra] Enable sandbox for x64 and arm64 builders and add a set of builders with Sandbox off"
>
> This is a reland of commit 2055c3b4
>
> Original change's description:
> > [infra] Enable sandbox for x64 and arm64 builders and add a set of builders with Sandbox off
> >
> > Bug: v8:13058
> > Change-Id: If9d500f46f02ed3588d2b0e3904567c61aaddd12
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3810184
> > Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> > Commit-Queue: Almothana Athamneh <almuthanna@chromium.org>
> > Cr-Commit-Position: refs/heads/main@{#82213}
>
> Bug: v8:13058
> Change-Id: I315fd1cd5c36464b1a15c635c8f31825769c3eb0
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3812042
> Auto-Submit: Almothana Athamneh <almuthanna@chromium.org>
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Commit-Queue: Almothana Athamneh <almuthanna@chromium.org>
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#82221}

Bug: v8:13058
Change-Id: Icb621fac3758384e0b04520585f5c998563c1f6f
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3811289Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Auto-Submit: Almothana Athamneh <almuthanna@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82224}

Bug: v8:13058
Change-Id: I2a90e3ef4f4b455d6ece47a809defc975f09e1bf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3810351Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Almothana Athamneh <almuthanna@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82223}

Bug: v8:13145
Change-Id: Ie507d3db4ac1d6096ddb12e7d2d8895e18886642
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3810182Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Almothana Athamneh <almuthanna@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82222}

Reland "[infra] Enable sandbox for x64 and arm64 builders and add a set of builders with Sandbox off"

This is a reland of commit 2055c3b4

Original change's description:
> [infra] Enable sandbox for x64 and arm64 builders and add a set of builders with Sandbox off
>
> Bug: v8:13058
> Change-Id: If9d500f46f02ed3588d2b0e3904567c61aaddd12
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3810184
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Commit-Queue: Almothana Athamneh <almuthanna@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#82213}

Bug: v8:13058
Change-Id: I315fd1cd5c36464b1a15c635c8f31825769c3eb0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3812042
Auto-Submit: Almothana Athamneh <almuthanna@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Almothana Athamneh <almuthanna@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82221}

The "Deoptimized function count" displayed in profview tool
should be the sum of deopt-eager, deopt-lazy and deopt-soft.

Change-Id: I42252930c3685f1ca721691f983abb8adeb492e6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3793469Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Jialu Zhang <jialu.zhang@intel.com>
Cr-Commit-Position: refs/heads/main@{#82220}

Introduces a CheckSymbol to guard a reference equality for values in an
equality comparison with Symbol feedback.

Bug: v8:7700
Change-Id: Ieb012b292f2d955faf76e485e6636a2d293fa007
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3811500
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82219}

If the same WebAssembly module gets compiled multiple times, the
compilation result of the first compilation gets reused for later
compilations. With streaming compilation functions get compiled before
the whole module got downloaded, so it cannot be determined if the
currently compiled module has already been compiled or not. Therefore,
to check if the WebAssembly module has already been compiled, we compare
if the hash of the header section matches the hash of any of the already
compiled modules. If so, no function gets compiled until all bytes were
received. Then a full module check can be done, and either an existing
module can be reused, or the whole module gets compiled.

While compilation is avoided after a prefix_cache_hit, decoding still has
to happen. In the existing implementation, validation for lazy
compilation also happened in addition to decoding. This lead to the
problem that validation of lazy compilation could post a foreground task
when an error was detected, and later another foreground task got posted
when all bytes were received to do the full module check. Having two
foreground tasks at the same time violates an invariant in the
AsyncCompileJob.

With this CL we avoid the initial function validation after a
prefix_cache_hit to avoid the task for the error handling. Validation
will anyways happen again if the full module check fails later, or
validation is unnecessary if the full module check succeeds, as the
module has already been validated before.

R=clemensb@chromium.org

Bug: v8:13147, v8:12852
Change-Id: Iae24c056057f3a5dfd2f61accd1f9f0d35412996
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3812038
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82218}

In the previous CL
(https://chromium-review.googlesource.com/c/v8/v8/+/3778969), we
executed i::Compiler::Compile regardless of the function has been
compiled or not.  That caused DCHECK failures in the Compile function,
which allows to compile only once.

Bug: chromium:1347319
Change-Id: I240591cbec46dc4fac4028a80a8ba5ab2f05c450
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3806929Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Yoshisato Yanagisawa <yyanagisawa@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82217}

This CL fixes a crash when we build the scope chain after re-parsing
for Debugger.evaluateOnCallFrame.

The following script causes the crash:

class A {
  test(){
    debugger;
  }
  f = (x) => {}
}
let a = new A()
a.test()

The current scope search tries to be smart and descends deeper
into the scope tree based on source position. That is not a sound
approach as V8 doesn't guarantee that sibling scopes don't overlap.

In the above case V8 creates an instance initializer scope where
f is assigned (and the initializer scope is the parent scope for
the arrow function). The problem is that the initializer scope
uses the same source range as the class `A` itself, so when we
look for the scope for `test`, we descend wrongly into the
initializer scope and can't recover.

The solution is to not try and be too smart:
  - First, find the closure scope with a straight-up DFS.
  - Once we have that, descend from there and try to find the
    closest fitting scope around the break position.

R=bmeurer@chromium.org, jarin@chromium.org

Bug: chromium:1348186
Change-Id: Ic5e20c4d12b3d768f76a17367dc0f87bcc73763b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3807594Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82216}

Revert "[infra] Enable sandbox for x64 and arm64 builders and add a set of builders with Sandbox off"

This reverts commit 2055c3b4.

Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Clusterfuzz%20Linux64%20-%20release%20builder/29801/overview

Original change's description:
> [infra] Enable sandbox for x64 and arm64 builders and add a set of builders with Sandbox off
>
> Bug: v8:13058
> Change-Id: If9d500f46f02ed3588d2b0e3904567c61aaddd12
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3810184
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Commit-Queue: Almothana Athamneh <almuthanna@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#82213}

Bug: v8:13058
Change-Id: I63b86420d12fb4bf0333e9e52b17763c9d80afce
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3811498
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Owners-Override: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82215}

There are a same name field equivalence_id_ in both
BytecodeRegisterOptimizer and RegisterInfo, but one of them is int,
another one is uint32_t, it's better to change them as same type
to avoid addtional or potential type casting.

Change-Id: I509f850d82a9a0fc30168fae83a0bd6565b7000e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3811138Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Wenqin Yang <wenqin.yang@intel.com>
Cr-Commit-Position: refs/heads/main@{#82214}