This change slipped into https://crrev.com/c/2820970 and wasn't
intended. We actually need to rule out __proto__ here explicitly,
otherwise it starts showing up in previews for embedder objects
(i.e. for HTMLAllCollection, etc.).

Bug: chromium:1197019
Change-Id: Iadde73747c157c2b5b013b11a6b8a30cc4394a7e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2831481
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Philip Pfaffe <pfaffe@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74009}

Bug: chromium:1199345
Change-Id: I33bf71b33f43919fec4684054b5bf0a0787930ca
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2831478Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74008}

This is a reland of abe4858b

Reason: It was speculatively reverted but it doesn't seem to have been
the culprit.

TBR=neis@chromium.org

Original change's description:
> [compiler] Do MapRef::CanBeDeprecated and ::CanTransition concurrently
>
> CanBeDeprecated looks at the DescriptorArray, and CanTransition at the
> instance_type. Both are safe to read concurrently and we just had to
> enable them with the macro.
>
> Bug: v8:7790
> Change-Id: Iafe6470f2d64a9ed38383cb9e4d00dd6f23d05d7
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2826539
> Reviewed-by: Georg Neis <neis@chromium.org>
> Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#73995}

Bug: v8:7790
Change-Id: I51d29d53b208fe9b6b27adc46561a4e1009e8d6f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2831488Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74007}

Optimize FPUCanonicalizeNaN
Float Round reutrn qNan when input is Nan
FMaxMin return qNan with Nan inputs

Change-Id: I7568be3d27d030e49f292a956b3084b54bdf8577
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2814725
Commit-Queue: Brice Dobry <brice.dobry@futurewei.com>
Reviewed-by: Brice Dobry <brice.dobry@futurewei.com>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74006}

This makes it much easier to read the code, since that code otherwise
looks unreachable.

R=thibaudm@chromium.org

Change-Id: I8720f8e23a6932d83b7ef6a1f26632095ecfeb43
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2826120Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74005}

Changes:
- Remove redundant argument from PopControl(), FallThruTo();
- Rename FallThruTo() -> FallThrough();
- Do not Kill() the environment at control end in
  graph-builder-interface, as this is not needed.
- Move some things around and remove dead code.

Change-Id: Ia2e2fb5c3a60c32838d42e5916691b38642b30bc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2830792
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74004}

The "num_exceptions" field of the control block must be updated before
entering the stack check, because it is used in
"GetCurrentDebugSideTable" to compute the correct indices for the debug
side table.

R=clemensb@chromium.org

Bug: chromium:1199526
Change-Id: I54f1e4244bf84d0a78b47a764fedc83b54758d01
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2831483
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74003}

No-Try: true
Bug: chromium:1196595
Change-Id: Id6fcb704cad66c5a41232821df30721e49ede2b6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2817613Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Liviu Rau <liviurau@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74002}

This reverts commit abe4858b.

Reason for revert: Speculative revert for TSAN issues (https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20TSAN%20-%20no-concurrent-marking/3342/overview)

Original change's description:
> [compiler] Do MapRef::CanBeDeprecated and ::CanTransition concurrently
>
> CanBeDeprecated looks at the DescriptorArray, and CanTransition at the
> instance_type. Both are safe to read concurrently and we just had to
> enable them with the macro.
>
> Bug: v8:7790
> Change-Id: Iafe6470f2d64a9ed38383cb9e4d00dd6f23d05d7
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2826539
> Reviewed-by: Georg Neis <neis@chromium.org>
> Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#73995}

Bug: v8:7790
Change-Id: I3a068c7d3b04d6b94af74e172960d5756e84103e
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2831486
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#74001}

This reverts commit ae0752df.

Reason for revert: Predictably, constexpr issues on non-clang compilers.

Original change's description:
> [codegen] Add static interface descriptors
>
> Add a new CRTP StaticCallInterfaceDescriptor class, which provides
> static constexpr getters for a descriptor's registers, parameter counts,
> and so on. Each CallInterfaceDescriptor subclass is changed to extend
> StaticCallInterfaceDescriptor, with StaticCallInterfaceDescriptor itself
> extending CallInterfaceDescriptor to still provide a dynamic lookup
> where needed.
>
> StaticCallInterfaceDescriptor provides a couple of customisation points,
> where it reads its CRTP derived descriptor's static fields and
> functions, with default fallbacks where appropriate. With these
> customisation points, the definition of CallInterfaceDescriptor
> subclasses is simplified to:
>
>     a) Providing parameter names (as before)
>     b) Providing parameter types (as before)
>     c) Optionally setting flags (like kNoContext or kAllowVarArgs) as
>        static booleans on the class.
>     d) Optionally providing a `registers()` method that returns a
>        std::array<Register, N> of registers that may be used for
>        parameters (if not provided, this defaults to the implementation
>        specific default register set).
>
> Parameter registers (and register count) are automagically set based on
> the number of parameters and number of given registers, with extra magic
> to ignore no_reg registers (to reduce ia32 special casing). The
> CallInterfaceDescriptorData is initialized based on these static
> functions, rather than manual per-descriptor initializers.
>
> This allows us to skip loading descriptors dynamically for CallBuiltin
> in Sparkplug, and instead lets us use a bit of template magic to
> statically set up arguments for the calls. Any other users of statically
> known descriptors will also benefit, thanks to C++ picking the static
> methods over the dynamic methods on the base class when available.
>
> Because we can remove various virtual functions and trigger heavier
> inlining of constantly known values, binary size slightly decreases with
> this change.
>
> Note that torque-generated descriptors are changed to use the same magic,
> rather than having Torque-specific magic, for consistency.
>
> Bug: v8:11420
> Change-Id: Icc5e238b6313a08734feb564204a13226b450c22
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2814518
> Auto-Submit: Leszek Swirski <leszeks@chromium.org>
> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Commit-Queue: Clemens Backes <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#73996}

Bug: v8:11420
Change-Id: Ie5469c9253fc140590ac30b72db6eb1d93f86806
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2831485
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#74000}

This CL adds an IsTemplateForApiObject method to FunctionTemplate
allowing the embedder to check whether a given API object was
instantiated by this template without including parent templates
in the search. It also replaces the v8::ApiObject in the fast API
with a raw v8::Value pointer to allow use of standard C++ casts.

Bug: chromium:1052746
Change-Id: I0812ec8b4daaa5f5005aabf10b63e1e84e0b8f03
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2595310
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73999}

This fixes the binary size regression introduced by https://chromium-review.googlesource.com/c/v8/v8/+/2247561

Bug: v8:11643
Change-Id: Ic615b1820620dc7bfadce3075ce04b4d6d1f4b64
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2831160
Commit-Queue: Wenyu Zhao <wenyu.zhao@anu.edu.au>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73998}

This reverts commit dcd91455.

Reason for revert: Breaks TSAN no-concurrent-marking - https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20TSAN%20-%20no-concurrent-marking/3341/overview

Original change's description:
> [heap] Do not scan main thread handles when starting marking
>
> We do not need to scan main thread handles when starting incremental
> marking. This reduces the time to start incremental marking.
>
> Bug: v8:11645
> Change-Id: Ib99a13e7875f50fbfe5346ac0e186d8960ea1337
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2826124
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#73994}

Bug: v8:11645
Change-Id: I5e2325ef326b79b1807b52384cc5473d126ca6cb
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2831482
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#73997}

Add a new CRTP StaticCallInterfaceDescriptor class, which provides
static constexpr getters for a descriptor's registers, parameter counts,
and so on. Each CallInterfaceDescriptor subclass is changed to extend
StaticCallInterfaceDescriptor, with StaticCallInterfaceDescriptor itself
extending CallInterfaceDescriptor to still provide a dynamic lookup
where needed.

StaticCallInterfaceDescriptor provides a couple of customisation points,
where it reads its CRTP derived descriptor's static fields and
functions, with default fallbacks where appropriate. With these
customisation points, the definition of CallInterfaceDescriptor
subclasses is simplified to:

    a) Providing parameter names (as before)
    b) Providing parameter types (as before)
    c) Optionally setting flags (like kNoContext or kAllowVarArgs) as
       static booleans on the class.
    d) Optionally providing a `registers()` method that returns a
       std::array<Register, N> of registers that may be used for
       parameters (if not provided, this defaults to the implementation
       specific default register set).

Parameter registers (and register count) are automagically set based on
the number of parameters and number of given registers, with extra magic
to ignore no_reg registers (to reduce ia32 special casing). The
CallInterfaceDescriptorData is initialized based on these static
functions, rather than manual per-descriptor initializers.

This allows us to skip loading descriptors dynamically for CallBuiltin
in Sparkplug, and instead lets us use a bit of template magic to
statically set up arguments for the calls. Any other users of statically
known descriptors will also benefit, thanks to C++ picking the static
methods over the dynamic methods on the base class when available.

Because we can remove various virtual functions and trigger heavier
inlining of constantly known values, binary size slightly decreases with
this change.

Note that torque-generated descriptors are changed to use the same magic,
rather than having Torque-specific magic, for consistency.

Bug: v8:11420
Change-Id: Icc5e238b6313a08734feb564204a13226b450c22
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2814518
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73996}

CanBeDeprecated looks at the DescriptorArray, and CanTransition at the
instance_type. Both are safe to read concurrently and we just had to
enable them with the macro.

Bug: v8:7790
Change-Id: Iafe6470f2d64a9ed38383cb9e4d00dd6f23d05d7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2826539Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73995}

We do not need to scan main thread handles when starting incremental
marking. This reduces the time to start incremental marking.

Bug: v8:11645
Change-Id: Ib99a13e7875f50fbfe5346ac0e186d8960ea1337
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2826124Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73994}

- This is a reland of d435eaa5
- Fix vtunedomain

Original change's description:
> [api] Add v8::Isolate::ThrowError helper
>
> Add a ThrowError helper to encourage throwing full Error objects
> instead of just v8::Strings.
>
> Bug: v8:11195
> Change-Id: I15d75b1d39b817de3b9026a836b57a70d7c16a28
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2811738
> Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> Reviewed-by: Dan Elphick <delphick@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Reviewed-by: Marja Hölttä <marja@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#73958}

Bug: v8:11195
Change-Id: I3cffaa4f122d74705476c3f8791b549f85d8c87b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2826534Reviewed-by: Dan Elphick <delphick@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73993}

This reverts commit 2a09af7e.

Reason for revert: Breaks gcc (https://logs.chromium.org/logs/v8/buildbucket/cr-buildbucket.appspot.com/8849798091364623904/+/u/build/compile/stdout?format=raw)

Original change's description:
> [heap] Make Heap::MaxRegularHeapObjectSize an inlineable constexpr
>
> Bug: v8:11263
> Change-Id: Ia86ae814434aed9795f98d80e987a1ed10fa9a1f
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2821540
> Reviewed-by: Michael Stanton <mvstanton@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#73991}

Bug: v8:11263
Change-Id: Iae78ae9df689e3a4653171dc34cd5fa84afc1ba0
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2831476
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#73992}

Bug: v8:11263
Change-Id: Ia86ae814434aed9795f98d80e987a1ed10fa9a1f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2821540Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73991}

Add compile-only opt-in builder equivalent
to "V8 Linux - vtunejit" on CQ.

Bug: v8:11653
Change-Id: I8f2033f299b85113e60cec6aa8771b02c7e610c9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2826542Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Almothana Athamneh <almuthanna@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73990}

Bug: v8:11650
Change-Id: Ice830eda80e81faf920c73214f7cd8f4230af6d9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2831472
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73989}

Instead, bail out of inline literal creation if a deprecated map is
found. This makes it easier to compile on the background thread.

Bug: v8:7790
Change-Id: I87941938d4f13dcf49230cf246c33bf2f49897f5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2745134
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73988}

Add --compile-only and --repeat-compile=N options for benchmarking
compilation performance.

Change-Id: Ibcdce94ef0d2a24374badeca114f44b693adb2ac
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2827903
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73987}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/e966858..e00ea2a

Rolling v8/third_party/aemu-linux-x64: V4pHBauOtd8S1jDOxP65uQ5t1vxtzWpESymTE3h7ZMMC..9sUPtFCh9UkUuiYa9MoTXIK9ycaDI3CAdFHoa7zIT9cC

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/3898886..02b5d39

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/b1cc5ed..9ceff71

TBR=v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I20c5b2a59bb597c5bf5b4b305b222fe03aa0175d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2830252Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#73986}

- represent smis as fake heap numbers
- numbers nodes (both smi and heap numbers) reference a child node whose
  name is "value" and whose entry is the string representation of that
  number

That feature is disabled by default, and can be enabled by passing
captureNumericValue: true when calling HeapProfiler.takeHeapSnapshot

This patch slightly refactors some functions that operate on "essential
objects". We now check that the object is essential before trying to
create the entry. Otherwise, we would end up with smi objects created,
but not referenced anywhere.

Design doc:
https://docs.google.com/document/d/1Qh1zxyn0SS5wzJzitD6ecBJTdFbQkJogSMwxDRsn44o/edit

Change-Id: Ibbe6e79a54c4f9eace72bc0a0ccb622a97698e00
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2806747Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Arnaud Renevier <arenevier@fb.com>
Cr-Commit-Position: refs/heads/master@{#73985}

Port 06a2c2e0

Original Commit Message:

    We currently allow OSR (On-Stack Replacement) of arbitrarily deep return
    addresses. This is in direct violation of Intel CET's shadow stack,
    which we plan to enable eventually.

    This change works around this by postponing OSR until after we return to
    the old code. The main changes are:
    - Reserve a slot in Liftoff frames to store the OSR target,
    - Skip the return address modification, and instead store the new code
    pointer in the dedicated slot,
    - Upon returning to the old code, check the slot and do an indirect jump
    to the new code if needed.

    CET also prevents indirect jumps to arbitrary locations, so the last
    point is also a CET violation. Valid indirect jump targets must be
    marked with the ENDBRANCH instruction, which I will do in a follow-up
    CL.

R=thibaudm@chromium.org, joransiu@ca.ibm.com, junyan@redhat.com, midawson@redhat.com
BUG=
LOG=N

Change-Id: Id972de1ba7556474cb00b377ea3a38eb4332eae3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2828870Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#73984}

Bug: v8:11589
Change-Id: I6f43e6382b3441adf59dbaea58d766013cf3793b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2826712Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73983}

The typing of br_table was relaxed in
https://github.com/WebAssembly/spec/pull/1305. Before, we had to compute
the greatest lower bound of all branch types and make sure that stack
values are subtypes of that type. Now, we have to check that the stack
values are subtypes of each individual branch. This makes a difference
only in polymorphic stacks, but greatly simplifies the code, especially
with the upcoming introduction of a much more complex type system in
wasm-gc.

Change-Id: I6e3b410cfe0e71a97623b3030b3575ef707c4900
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2827897
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73982}

This is a reland of 6ec52d90. The failing
tests have been adapted at the blink side.

Original change's description:
> [wasm] Enable wasm threads by default in V8
>
> Finer grained control of platforms that support threads are
> enforced by chromium.
>
> Bug: chromium:1167733
> Change-Id: Ic34a4950aebf6ba394053b79df97b703af333636
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2810190
> Reviewed-by: Lutz Vahl <vahl@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#73919}

Bug: chromium:1167733
Cq-Include-Trybots: luci.v8.try:v8_linux_blink_rel
Change-Id: I56a00a24f17fef8a8050ee6f4b28fc13c7d3fb30
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2826540Reviewed-by: Lutz Vahl <vahl@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73981}

Bug: v8:11165
Change-Id: I022a50cc25ab57f6bb24739c0e65ebe599371e3d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2826129Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Michaël Zasso <mic.besace@gmail.com>
Cr-Commit-Position: refs/heads/master@{#73980}

Drive-by: cleanup PersistentTest and MarkerTest

Bug: chromium:1056170
Change-Id: I85d674cda7d580e8cd7be807791ba883b0f7a111
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2827898
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73979}

This test relies on non-concurrent optimizations to precisely test
transitions between the different tiers.

Disable flags that invalidate this test:
--no-always-opt to test transiation from Ignition to Sparkplug
--deopt-every-n-times=0 to test transition from Sparkplug to TF

Bug: v8:11656
Change-Id: I85047015d3f7cfdf00bddad59c9742d5d8f5d223
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2827902
Auto-Submit: Patrick Thier <pthier@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73978}

We currently allow OSR (On-Stack Replacement) of arbitrarily deep return
addresses. This is in direct violation of Intel CET's shadow stack,
which we plan to enable eventually.

This change works around this by postponing OSR until after we return to
the old code. The main changes are:
- Reserve a slot in Liftoff frames to store the OSR target,
- Skip the return address modification, and instead store the new code
pointer in the dedicated slot,
- Upon returning to the old code, check the slot and do an indirect jump
to the new code if needed.

CET also prevents indirect jumps to arbitrary locations, so the last
point is also a CET violation. Valid indirect jump targets must be
marked with the ENDBRANCH instruction, which I will do in a follow-up
CL.

Bug: v8:11654
Change-Id: I6925005211aa95d60803b9409e3c07c7c226b25c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2826127
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73977}

This should catch potential build file misconfigurations.

Change-Id: I1bd1f808a4758e0d3b71c862cfc34e7b01e6fbd9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2827894
Auto-Submit: Dan Elphick <delphick@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73976}

Change-Id: I8db5f0b4cb1cfa23e210ac43b50680ce96e622b8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2826538
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73975}

- Allow pass/fail for all test-heap/LeakNativeContextVia* tests in
stress_concurrent_inlining mode.
- Don't capture stack locations in lambdas passed between threads.

Bug: v8:7790,v8:11650
Change-Id: I6c23b527d5f96f2f4b2354d16f39d832dea17e71
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2827895
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73974}

An exploitation technique that abuses `pop` and `shift` to create a JS
array with a negative length was publicly disclosed some time ago.

Add extra checks to break the technique.

Bug: chromium:1198696
Change-Id: Ie008e9ae60bbdc3b25ca3a986d3cdc5e3cc00431
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2823707Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Sergei Glazunov <glazunov@google.com>
Cr-Commit-Position: refs/heads/master@{#73973}

Changes:
- Implement function subtyping in wasm-subtyping.cc.
- Add Signature::Build(), which takes initializer lists for the return
  and parameter types.
- Only throw kTrapFuncSigMismatch in call_indirect, change that trap's
  message.
- Add a missing "return 0" in function-body-decoder-impl.h
- Fix a faulty check in wasm-objects.cc.
- Improve some comments.
- Write tests. Improve readability of subtyping-unittest.

Bug: v8:7748
Change-Id: I1caba09d5bd01cfd4d6125f300cd9c16af7aba99
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2822633Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73972}

No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:11650
Change-Id: I12857a479f95f8c60a921118cf68f7f88a81a822
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2826537
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73971}

- FLAG_turbo_inline_js_wasm_calls data race
- Map::instance_descriptors non-atomic concurrent loads
- Skip one more cctest incompatible with stress_concurrent_inlining

Bug: v8:7790,v8:11648,v8:11651
Change-Id: Ie4833373a1da34497f4cfe129254071d8a5772dd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2827891Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73970}