Change-Id: I60b9cb6e0f7552fbdc35b62b6b379c8ac5f203e8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2716323Reviewed-by: Milad Fa <mfarazma@redhat.com>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/master@{#73007}

The available constants are now:

 JSObject {
  kMaxElementCount = kMaxUInt32,
  kMaxElementIndex = kMaxElementCount - 1,
 }

 JSArray {
  kMaxArrayLength = JSObject::kMaxElementCount,
  kMaxArrayIndex = JSObject::kMaxElementIndex,
 }

I also updated the codebase to use the new constants.

Change-Id: I3142f9ff9627c9acb1d4493729b490150fdcdf50
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2712755Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73006}

It had essentially become a synonym for BytecodeArrayAccessor.
This removes the BytecodeArrayIterator class and renames
BytecodeArrayAccessor to BytecodeArrayIterator.

Change-Id: I79cf8574f3c8804822f90c8f921c17ca7ab85f48
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2715523
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73005}

Bug: v8:10855
Change-Id: I0f28603421ba36176d177bfcc25f18a26a097c29
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2716062Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Gus Caplan <snek@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73004}

We were using CmpInstanceType instead of CmpObjectType in some places,
which meant that we were reading the value at the instance type field
offset within objects directly, rather than first loading their map and
reading the instance type there.

Bug: chromium:1180434
Change-Id: I4771b4f8f9a32bdc35944c6e6cd30c54e4ac8b6c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2716292
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73003}

Bug: v8:11321
Change-Id: Ica350e9a613d6dddb17569ce5b2df072ceb2c050
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2717156
Auto-Submit: Sathya Gunasekaran  <gsathya@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73002}

These functions are defined in WasmGraphBuilder, so we do not need to
invoke them in mcgraph() or gasm_.

Change-Id: Ibd97add56d22bff7eb99addd78bf599057b21041
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2717302Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73001}

Assert that the lock is help whenever AssignUnsafe is called.
LazyMutex::AssertHeld resolves to a DCHECK so this should not
regress production performance (other than the call itself
that might not be inlined).

Bug: chromium:1056170
Change-Id: Ic2005d180e6960c24dff7743aa3e0d5e57a63d80
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2716286Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73000}

Bug: v8:7790
Change-Id: Iae4374e352aea0169d4fe1eba5d825c16efe3940
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2715198
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72999}

When calling new WebAssembly.Table, the returned error message refers
accidentally to the WebAssembly.Module() constructor.

There will be a corresponding Chromium CL fixing expected error messages
in WPTs.

R=ahaas@chromium.org

Bug: v8:11356
Change-Id: I57f5e071d5c542615523345283d7c3613fb7a616
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2663155Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Emanuel Ziegler <ecmziegler@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72998}

The precise type is only used for validation. For code generation,
knowing the kind is more than enough. Hence, only store and pass the
ValueKind in Liftoff, and not the full ValueType.

R=manoskouk@chromium.org

Bug: v8:11477
Change-Id: Ia42c0fa419f75b508bd2f210c767b631e93d3398
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2707170
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72997}

These are headers that are used by the inspector, debugger and other
parts of chrome so they should be in the main v8_headers target.

test-api-interceptors.cc does not use anything from v8-util.h so remove
the include and some other unneeded using declarations.

Bug: v8:7330
Change-Id: Iea1546de3fc2dbc1c41f0dd7109b6c7ef5557045
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2716384
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Auto-Submit: Dan Elphick <delphick@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72996}

Upcoming CLs will need atomic accessors for non-smi values. This CL
adds the full set of relaxed and acquire/release indexed accessors,
and I also take the opportunity to update the old
`synchronized_set(i, v)` style to `set(i, v, ReleaseStoreTag)`.

Bug: v8:7790
Change-Id: Ic4fa4ec52319ec943415f0e9ae515a00b04cbbc3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2717305
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72995}

No-Try: true
Bug: v8:11134
Change-Id: Ic63d0ffc0d64a3f06048cf811a526afd46e34cae
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2714548
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72994}

Add missing dependencies to wasm_test_common and lib_wasm_fuzzer_common,
reducing gn check errors from 174 to 170.

Bug: v8:7330
Change-Id: I30eaba6e411e714ee3648eb2df165239b3cff5e5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2716382
Auto-Submit: Dan Elphick <delphick@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72993}

Besides, implement extended add pairwise and i64x2.abs
in liftoff.

Port: aee85229
Port: 8136e399
Port: 31aab838

Bug: v8:11086 v8:11416
Change-Id: I77539c745b67c6b9d4205b4e5e96504e5ad3da13
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2717150
Auto-Submit: Liu yu <liuyu@loongson.cn>
Reviewed-by: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/master@{#72992}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/ac7b73c..446bf3e

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/src/buildtools/+log/80d14c9..4c78ef9

Rolling v8/third_party/aemu-linux-x64: GzdPpQtyS5ZFre4nU7kS8n0fu_RX5NV9C2PkWL0tWEYC..qI8e328VwkWv64EapCvG3Xj9_hDpKQFuJWeVdUHz7W0C

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/832539c..81c9d30

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/e71d028..5fe664f

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/bf8c8f3..cfd0f62

TBR=v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I611cd60376faf9e6aa611143e7dbf704f46a8f44
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2716636Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#72991}

Besides, skip write barrier for storing Smis.

Port: a3776a63
Port: 1c507667
Change-Id: I4626c1811e3e23e06adccd65fabc8bc41b6628f0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2717301
Auto-Submit: Liu yu <liuyu@loongson.cn>
Reviewed-by: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/master@{#72990}

Use external refs to load the masks neded for i8x16.swizzle. Before it
would need 3 instructions (2 moves + 1 pshufd), now it requires 2 moves.
Also on AVX we can relax the dst == src requirement, which can
potentially save a move too.

Bug: v8:11346
Change-Id: If350529de7272a7b178e12778a5e02813b34631c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2713168Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72989}

Compact some of the name definitions for wasm opcodes. With the
proposal being in phase 4, the instruction set is fixed, we can now
merge some of the adhoc i64x2 instructions in with the rest.

Bug: v8:11384
Change-Id: I94553b9f2daaa4804deaf1bb18933847897a4213
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2708759Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72988}

Extract code sequence into macro-assembler for reuse between Liftoff and
TurboFan.

Bug: v8:11086
Change-Id: I914051dd8126e89f297e892da1b5c1917b47d7f1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2707763Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72987}

Extract code sequence out into macro-assembler for sharing between
Liftoff and TurboFan.

Bug: v8:11415
Change-Id: I76a5124eea917dc15385c90ce82fccdb31619295
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2707772Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72986}

Extract code sequence into macro-assembler for sharing between Liftoff
and TurboFan.

Bug: v8:11416
Change-Id: I8cdce30db8081f6b6c96cca1cbacd035dfc03de4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2707768
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72985}

Extract code sequence into macro-assembler for sharing between Liftoff
and TurboFan. Relax the register aliasing requirements (remove the
DCHECKS), this will not affect codegen for TurboFan since the
instruction selector already sets the correct restrictions, but makes it
more flexible for use in Liftoff.

Bug: v8:11416
Change-Id: I5f3f37b21d8f7e96ff7e472cb96dcda5f28679cf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2707765
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72984}

This is a reland of 0ef2eea7

The fixes are adding missing SSE4_1 scopes to ia32. I realize
the x64 codegen is missing the scopes to, so fix them as well.

Original change's description:
> [wasm-simd][ia32] Optimize some signed integer widening sequences
>
> Optimize ia32 code sequences. This is the same sequences as x64, which
> have been optimized based on supported extensions.
>
> Bug: v8:11464
> Change-Id: I10396a928a431cdd2de9b22bb8a395bc0adb4694
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2704897
> Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
> Commit-Queue: Zhi An Ng <zhin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#72926}

Bug: v8:11464
Change-Id: Ib66a63de26bcc3bb3626922b642fe5df6bff8bdb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2713211Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72983}

Port 679af80e

Original Commit Message:

    Avoid duplicating the list of parameter registers to push in the
    WasmCompileLazy builtin by reusing the existing arrays from
    wasm-linkage.h.

    Also verify the computed results against different constants.

R=clemensb@chromium.org, joransiu@ca.ibm.com, junyan@redhat.com, midawson@redhat.com
BUG=
LOG=N

Bug: v8:11377
Change-Id: I7277e865c30d83dd4d13aa501d913fb0d88526b7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2716322Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#72982}

Bug: v8:11415
Change-Id: I50a805cb97d4d2aadc064da61db2983e0557cf6a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2707771Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72981}

Bug: v8:11086
Change-Id: I3413a6cd3e9ea6078ce014a0596c51b092e44cfe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2707778Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72980}

Conservative tracing of an in construction objects might enter an
infinite recursion if the object holds a reference to itself.
The second time we try to trace the object it will be already marked and
we can bail out of tracing it again.

Bug: chromium:1056170
Change-Id: I74e99ca70c83f00d47299562d291adf7ba4a5808
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2715065
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72979}

Change-Id: I38197dc313b049a612fb34472db3b647990747dc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2715086Reviewed-by: Milad Fa <mfarazma@redhat.com>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/master@{#72978}

With a recent change we reserve the maximum memory size also on 32-bit
platforms, up to 1GB. This change, however, caused failing tests in the
cases where no maximum memory size was defined and where WebAssembly
defines an implicit maximum memory size of 4GB. With this CL we do not
reserve more memory than the initial size if no maximum memory size is
defined.

R=clemensb@chromium.org

Bug: v8:11493
Change-Id: I62b62fd4faa7a480275b75421a98f73539646eab
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2712756
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72977}

The arity depends on the exception type now. Take the max over all
exceptions since we only need a conservative estimate.

R=clemensb@chromium.org

Bug: v8:8091
Change-Id: Id5a3e12d89c5d48219e8981e16c2b679d80b67db
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2691051Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72976}

WasmGraphBuilder often failed to use GraphAssembler infrastructure and
went with directly invoking graph()->NewNode(). This made the code more
verbose, especially in cases where effect() and control() had to be
passes directly to NewNode().
This CL eliminates these invocations in obvious cases. It does not try
to refactor complicated code with branches, diamond patterns, etc.

Additional changes:
- Define a few more operators in GraphAssembler.
- Move Branch() helper in WasmGraphAssembler.
- Define NumberConstant() helper in WasmGraphAssembler.
- Define Merge() helper with varargs in WasmGraphBuilder.
- Omit IntPtrConstant() wrapper for constant offsets of Load and Store.

Change-Id: I571d5286be8881504cb2060195fbd181d1fce67d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2712804Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72975}

Bug: chromium:1177804
Change-Id: Ic8044fb4bfe414101edb923a9bb6e71282808e58
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2706351Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72974}

Functional change: Allow rtts as exception values.
Additional change: Remove liftoff subtyping TODO in anticipation of
removal of full ValueType usage in Liftoff.

Bug: v8:7748
Change-Id: I676a7fa6417d6e86bb148b4f5b9b086cc704928e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2714702Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72973}

The flag should not be set after an exception is thrown in a runtime
function. The unwinder still runs after the destructor, and should take
care of setting the flag depending on the catching frame.

R=ahaas@chromium.org,jkummerow@chromium.org

Bug: chromium:1180690
Change-Id: I0013c90f759a5145309f6e08d61ed36aeecbac63
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2713103Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72972}

Bug: v8:11375
Change-Id: I85503d4930a160026409761664e796c03de358d7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2707546Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72971}

R=clemensb@chromium.org

Bug: chromium:1180457
Change-Id: I50b776af243fa17856945fecc018a87356694a97
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2712242
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72970}

Follow-up from https://crrev.com/c/2649147/. There are still 2 usages of
_wrapper functions in the interpreter, these are slightly more annoying
to get rid of since the definitions have a ifdef for MSCV/OS_WIN.

Bug: v8:11384
Change-Id: Ic5ca860678f406e1c832c99398b235707da058f9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2713166Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72969}

Its double methods were unused so we were using it as an ObjectData*
wrapper.

Bug: v8:7790
Change-Id: If6bd21fc23485f1e14aa3e71aea7c7821bd03315
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2715185Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72968}