Change-Id: Iceaba4dcb9f3bc457e03735a94b615764757a635
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2290854
Auto-Submit: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68780}

PersistentHandles::NewHandle/LocalHeap::NewPersistentHandle currently
erase the type of the object. This patch templatizes them to preserve
the type and introduces versions that take Handle<T>

Bug: v8:10315
Change-Id: I899179a5b842b7b16144b340f6cd2b91e1db228f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2287501
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68779}

This CL ports the atomic object start bitmap from blink.
Using the bitmap for mixin tracing is left as a followup.

Bug: chromium:1056170
Change-Id: I4998a0d9d76708a7bab0634e04354809dfc8c78f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2287504Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68778}

The test creates a mock platform. The bug was that the lifetime of the
mock platform was shoter than the lifetime of the isolate. Even though
the mock platform restores the old platfrom, a background thread may
still have a pointer to the mock platform leading to UAF.

Bug: v8:10690
Tbr: dinfuehr@chromium.rg
Change-Id: Ic14bf408e5e3e9e7d07e01af545bb88c21462300
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2290850Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68777}

... and introduce a bottleneck for collecting reusable zone memory
statistics.

Tbr: jgruber@chromium.org
Bug: v8:10572
Change-Id: I418f8b495c0d89c0eb73f4e19bc4315acfadb480
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2287500Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68776}

This reverts commit 8ba517e1.

Reason for revert: causing Chromium test failures on external/wpt/wasm/jsapi/functions/entry-different-function-realm.html, e.g. here: https://ci.chromium.org/p/v8/builders/ci/V8%20Blink%20Mac/3045

Original change's description:
> [wasm] Make an "incumbent context" available for module instantiation
> 
> A Wasm module's start function might be imported from JavaScript, and
> as such might contain calls to Blink. For such a case, we must make
> sure that an "incumbent context" is available.
> See microtask queue handling for a similar example.
> 
> Bug: chromium:1096558
> Change-Id: I2e3c0fc20d4e3581e490822c3ac63ce2c5e1e990
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2284982
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#68760}

TBR=jkummerow@chromium.org,verwaest@chromium.org

Change-Id: Ib36d2198cf686f561a2a64034faf0479686f3500
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:1096558
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2290853Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68775}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/2f694ac..3fd005e

Rolling v8/third_party/aemu-linux-x64: Y1_xyAnxWY49mUT2otmospCKTrX01gsjJxt9x-qV0RsC..s9pb0zCLuc3Aj9A3n8IG3qBVpc2wOmQ1A32bDtG1idwC

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/5d5af4e..e4221b4

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/6402141..9af33fa

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/77b632f..21dcb28

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I3836af60d3bd8673de45d391815fc02aaa6980e0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2290712Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#68774}

Bug: v8:10686
Change-Id: I5a7b47dd4ed10142a795de56c4739ab072e63421
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2286814
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Frank Tang <ftang@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68773}

Partial implementation of v128.const, only the optimized case for all 0s
and all 1s. The other cases bailout to TurboFan for now, and will be
added in subsequent patches.

Bug: v8:9909
Change-Id: I3240c1c5f4259c45d51edca00fec37047bc1b3a5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2284212
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68772}

Change-Id: I256c351bea62fede28f6cfaa0be149729abffbd9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2271132Reviewed-by: Bill Budge <bbudge@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68771}

This reverts commit bebb2bdc.

Reason for revert: Breaks GarbageCollectionWithLocalHeap test.
https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20debug/31107

Original change's description:
> [heap] Allow LocalHeap on the main thread
> 
> This changes the safepoint scope to skip LocalHeap that is active
> for the current thread to avoid deadlocking.
> 
> Bug: v8:10315
> Change-Id: I45e80ae66d0dbbe768107aa9cf0603204c644d9f
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2289983
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#68769}

TBR=ulan@chromium.org,dinfuehr@chromium.org

Change-Id: Ifba8218f9104afed3f2d92258296067f8f424062
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10315
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2290573Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68770}

This changes the safepoint scope to skip LocalHeap that is active
for the current thread to avoid deadlocking.

Bug: v8:10315
Change-Id: I45e80ae66d0dbbe768107aa9cf0603204c644d9f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2289983Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68769}

When local heap is parked it is not allowed to dereference any handles.
A GC might be relocating objects at that point.

Change-Id: I557682d47f8f0acfe041506833f6b397feb4438b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2289981Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68768}

Motivation: With rtt.sub now allowed in constant expressions, we have
to generalize WasmInitExpr to be able to handle expressions with
operands. This is the second CL that prepares the ground for this
change.

Changes:
- Remove the error from read-value-type when reading a generic rtt.
- Add validation for HeapTypeImmediate in ModuleDecoder. Use it to
  validate null constants immediates, which was missing. Add tests.
- Change ValueType::name to print rtt depths as integers.
- Move global initializer building in wasm-module-builder to its own
  function.

Bug: v8:7748
Change-Id: Ic041e1c7d032f2a1063a21fec1bfe96cb0d8120e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2284983
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68767}

MemMove makes an indirect call to memmove_function which is
overwritten in init_memcopy_functions to an address not
permitted by CFI to be called indirectly.

This CL disables CFI_ICALL for this function.

BUG=chromium:584575

Change-Id: I372f0c13a1900bf3c48484db9ba7ff4a3b3fc7e9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2289010Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Will Harris <wfh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68766}

With this change, if we pass --trace-turbo-stack-accesses, output will
be something like:

=== Stack access counters ===
Number of functions: xx
Name: wasm-function#1, Loads: xx, Stores: xx
...
Total Loads: xx, Total Stores: xx

This only applies to optimized/wasm functions.

Bug: v8:10663
Change-Id: I0b08e3fa321b76dc53942c8fbffd14759978c7b2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2283913
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Reviewed-by: Seth Brenith <seth.brenith@microsoft.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68765}

TryCatch creates normal handles for Exception and Message objects.

Bug: v8:10537
Change-Id: I6ccd531242bfdc7a97ff5d8314d2f31086a28b07
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2284490Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68764}

Change-Id: I52fc8025a4a878e4494ef9134a8c2bd1cec25fe1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2289903Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#68763}

This reverts commit d6a14abe.

Reason for revert: Caused TSAN failures.

Original change's description:
> [heap] Move start of incremental marking in allocation
> 
> Move start of incremental marking out of
> RefillLinearAllocationAreaFromFreeList. This avoids a potential
> safepoint while holding allocation_mutex_.
> 
> Bug: v8:10315
> Change-Id: Ieb60ac68f26199eea7b6b7ad6d874851382f3d69
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2287496
> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#68751}

TBR=ulan@chromium.org,dinfuehr@chromium.org

Change-Id: Ic928413884115ac01917a8db591af83cbbc9cc5a
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10315
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2289977Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68762}

This reverts commit 273f4e42.

Reason for revert: Based on another need that needs to be reverted because of TSAN failures.

Original change's description:
> [heap] Avoid ParkedMutexGuard during allocation
> 
> Since main thread allocation does not start incremental marking anymore
> while holding allocation_mutex_, background allocation does not need
> ParkedMutexGuard anymore to avoid deadlocks.
> 
> This also means background thread allocation isn't paused anymore to
> perform a GC, which already resulted in subtle bugs (e.g. in
> ExpandBackground with incremental marking). We also do not
> stop-the-world anymore while holding allocation_mutex_.
> 
> Bug: v8:10315
> Change-Id: Iadf00bc26434c765722b82a10497ab06151f15cc
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2289771
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#68754}

TBR=ulan@chromium.org,dinfuehr@chromium.org

Change-Id: I3a16c13626c891e8063564fc05fd2d3fc427d159
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10315
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2289975Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68761}

A Wasm module's start function might be imported from JavaScript, and
as such might contain calls to Blink. For such a case, we must make
sure that an "incumbent context" is available.
See microtask queue handling for a similar example.

Bug: chromium:1096558
Change-Id: I2e3c0fc20d4e3581e490822c3ac63ce2c5e1e990
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2284982Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68760}

Motivation: With rtt.sub now allowed in constant expressions, we have
to generalize WasmInitExpr to be able to handle expressions with
operands. This CL prepares the ground for this change and adds no
functionality.

Changes:
- ValueType::heap_representation and HeapType::representation now
  return HeapType::Representation.
- Add ValueType::is_rtt().
- WasmInitExpr:
  - Make kind private. Rename val -> operator, make it private. Add
    accessors.
  - Rename kGlobalIndex -> kGlobalGet.
  - Squash global_index and function_index into index.
  - Add heap_type Immediate. Use it for RefNullConst. TypeOf in
    module-decoder.cc can now fully determine the type of a
    WasmInitExpr.
  - Add class constructors/static method constructors for each Operator
    kind.
  - Delete copy constructor. WasmInitExpr will use std::unique_ptr for
    its operands.
- consume_init_expr now uses a stack.
- A few minor improvements.

Bug: v8:7748
Change-Id: I3ba3ee7ac2d6bc58e887790c37110ceb80658985
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2284483
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68759}

In previous change https://crrev.com/c/2274308 , I attempted to fix an
issue where FindOptimalSpillingPos could sometimes fail to find the
LiveRange that covers the top of the loop. However, I misunderstood how
TopLevelLiveRange::GetChildCovers behaves, so I introduced a different
case where FindOptimalSpillingPos would fail to find the right
LiveRange. This change updates GetChildCovers to do what I had thought
it would do, so it can find the right LiveRange in all cases.

     chromium:1102243

Bug: chromium:1101958, chromium:1101954, chromium:1102257,
Change-Id: If91c642c3f7f5e3a8b4cfaa3b3577865c84afcb6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2288660Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#68758}

After native-context-independent codegen, verify that the resulting
Code object does not embed any nc-dependent objects, and that no code
dependencies have been created.

Bug: v8:8888
Change-Id: I894e74b27e86e7727ff17aa0dbfdd908373a5e55
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2284498
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68757}

Change-Id: I3800486f18a3693c9e2d3ace0a6f8ee626efc84e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2289780
Commit-Queue: Georg Neis <neis@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68756}

By introducing a globally known map for each generic type.
These maps are never used to allocate objects, they only
serve as sentinels for generic heap types.

Bug: v8:7748
Change-Id: I950a8c712dc1510759a833fe9122b9e9a6222dc2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2288860
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68755}

Since main thread allocation does not start incremental marking anymore
while holding allocation_mutex_, background allocation does not need
ParkedMutexGuard anymore to avoid deadlocks.

This also means background thread allocation isn't paused anymore to
perform a GC, which already resulted in subtle bugs (e.g. in
ExpandBackground with incremental marking). We also do not
stop-the-world anymore while holding allocation_mutex_.

Bug: v8:10315
Change-Id: Iadf00bc26434c765722b82a10497ab06151f15cc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2289771Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68754}

The tool is no longer supported since we migrated to Turbofan.

Change-Id: I55b911f47867b2a6985ce14f973cd837f71ec4b4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2288859Reviewed-by: Daniel Clifford <danno@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68753}

For 64-bit binary operations, Liftoff on arm made the assumption that
register pairs are always ordered, i.e. the register code for the low
word is lower than the register code for the high word.
Ensuring this was only implemented in {GetUnusedRegister} in
https://crrev.com/c/2168875. Other cases were missing though, e.g.
return values, but also different places were we
construct register pairs internally.

Thus, this CL removes this constraint again and instead handles
unordered register pairs in 64-bit binary operations on arm.

R=thibaudm@chromium.org

Bug: chromium:1101304
Change-Id: I4cd9fb1577f82ab06d34c9dde6533cf04a2cade7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2287870Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68752}

Move start of incremental marking out of
RefillLinearAllocationAreaFromFreeList. This avoids a potential
safepoint while holding allocation_mutex_.

Bug: v8:10315
Change-Id: Ieb60ac68f26199eea7b6b7ad6d874851382f3d69
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2287496
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68751}

Change-Id: I90612ae0e54b46e7147d9a3392783f56da598b2b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2287499
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68750}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/4222272..2f694ac

Rolling v8/third_party/aemu-linux-x64: Cht8VcqmH1adKCbBa1TuNhvNv-lMJJ0W5LvFyKpchi8C..Y1_xyAnxWY49mUT2otmospCKTrX01gsjJxt9x-qV0RsC

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/7cbda52..5d5af4e

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/e62496b..6402141

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/faaecad..77b632f

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I2abc382797809382a8c6a28cf8bd3d0e97ae3305
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2288599Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#68749}

Reflect recent change to the proposal

http://tc39.es/proposal-intl-DateTimeFormat-formatRange/#sec-intl.datetimeformat.prototype.formatRange

Bug: v8:10681
Change-Id: Ie2e0e85816aeaeb2615d482ccd3ea345a5056c93
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2286813
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68748}

Change-Id: I997abb5576224d4e7fe00ef593afa0265ef80e16
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2288428Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#68747}

This rounds up all SIMD instructions as included in the proposal as of
https://github.com/WebAssembly/simd/commit/9f1295a494b4db98ad7e93cd6368239218233b3e.

Bug: v8:10180
Change-Id: Icd4cb0aeddede6a611de6f8f3916dc036977c499
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2285789
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68746}

And removed the ifdef guards around instruction-selector and
tests since v128.const is now implemented for x86, x64, arm, arm64.

Bug: v8:8460
Change-Id: I0ed8aede0a07db2fd286bf0c3385eba1079558f8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2285149
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68745}

Bug: v8:8425
Change-Id: I3a2485e9983ed14c25bde705a5906c50a78c651d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1768873Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68744}

Change-Id: Ic60a47a931c8c359dce27ea5c774592bed1d4762
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2287230
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#68743}

The second argument of FromParameterIndex should be the parameter count, including the receiver.

Previously it worked by chance, because the code was trying to access the receiver but did not include it in the parameter count, accessing the first argument. This does not work anymore when the arguments are reversed (V8_REVERSE_JSARGS).

Change-Id: I8ca9054a99d074c130f9a9b444e7b8a379840991
Bug: v8:10201
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2282531Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68742}

--trace-wasm-decoder should not imply --single-threaded, as
--single-threaded implies --no-liftoff. Hence we cannot trace the
decoder in Liftoff mode.

R=thibaudm@chromium.org

Change-Id: I3e4f0ea119288ef88c4b00dd2f2a11244b77c204
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2287492Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68741}