OSR code doesn't hang off any JSFunction or SFI, so we missed it when
starting up the profiler. This meant we didn't properly attribute
ticks to SFI code. The ticks ended up going to the caller instead.

There is a weak cache of OSR code per native context, so iterate that
on profiler startup and log all the code objects.

Change-Id: I2e9738b86a488b37f36ac89803561607dc76f745
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2414216
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69964}

This CL updates the tool instructions to reflect changes in the tool.
Removes the empty <br> tags from the tool's panel templates.

Bug: v8:10644, v8:10727

Change-Id: I0b3db6adcd37518f9cdaf2839094ef86eff52dfb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2413253Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Zeynep Cankara <zcankara@google.com>
Cr-Commit-Position: refs/heads/master@{#69963}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/be363dc..b5fefa9

Rolling v8/third_party/aemu-linux-x64: 8YjsZy1I3YIJIOUKErXW54SHjiEX62hd9SqYjmop19oC..cw5KjATCqXEo2ji2ep1Vx88VOe8DdIMAsfq3dV86XzYC

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/0063ad8..d03abd8

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/52fdd1f..a787cd5

Rolling v8/third_party/icu: https://chromium.googlesource.com/chromium/deps/icu/+log/79326ef..d7eebbf

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/e075ddd..06a2576

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I03cb09a9bca4db0c5bca354f24c18a6dbb4cbbee
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2415111Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#69962}

Implement f32x4 and f64x2 nearest, trunc, ceil, and floor for ia32 and
x64. arm and arm64 will follow in a future patch, now they just bail out
into a runtime call.

Bug: v8:10906
Change-Id: I8c90ba6825e0360ca1251a1f706f9dbcba7afdbf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2411691
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69961}

Add lowering for I64x2 in S128Const and converting Int64x2 to
Int32x2.

Bug: v8:10507
Change-Id: I5bc40ae135fa00e31e901337b1a315f6ead14b02
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2410800Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69960}

This reverts commit 2000aea5.

Reason for revert: Breaks NumFuzz.

Original change's description:
> Reland^4 "[flags] warn about contradictory flags"
> 
> This is a reland of 0ba115e6
> Changes compared to last reland:
> - Fix Python code trying to write to expected_outcomes, which is now a
>   computed property.
> - Fix remaining place in d8.cc that ignored the --fuzzing flag.
> - Expect flag contradictions for --cache in code_serializer variant.
> 
> Original change's description:
> > Reland^3 "[flags] warn about contradictory flags"
> >
> > Changes:
> > - Also allow second parameter influenced by --cache to be reassigned.
> > - Fix --stress-opt to only --always-opt in the last iteration as before.
> >
> > Original change's description:
> > > Reland^2 "[flags] warn about contradictory flags"
> > >
> > > This is a reland of d8f8a7e2
> > > Change compared to last reland:
> > > - Do not check for d8 flag contradictions in the presence of --fuzzing
> > > - Allow identical re-declaration of --cache=*
> > >
> > > Original change's description:
> > > > Reland "[flags] warn about contradictory flags"
> > > >
> > > > This is a reland of b8f91666
> > > > Difference to previous CL: Additional functionality to specify
> > > > incompatible flags based on GN variables and extra-flags, used
> > > > to fix the issues that came up on the waterfall.
> > > >
> > > > This also changes the rules regarding repeated flags: While
> > > > explicitly repeated flags are allowed for boolean values as long
> > > > as they are identical, repeated flags or explicit flags in the
> > > > presence of an active implication are disallowed for non-boolean
> > > > flags. The latter simplifies specifying conflict rules in
> > > > variants.py. Otherwise a rule like
> > > >
> > > > INCOMPATIBLE_FLAGS_PER_EXTRA_FLAG = {
> > > >   "--gc-interval=*": ["--gc-interval=*"],
> > > > }
> > > >
> > > > wouldn't work because specifying the same GC interval twice
> > > > wouldn't actually count as a conflict. This was an issue with
> > > > test/mjsunit/wasm/gc-buffer.js, which specifies
> > > > --gc-interval=500 exactly like the extra flag by the stress bot.
> > > >
> > > > Also, this now expands contradictory flags checking to d8 flags
> > > > for consistency.
> > > >
> > > > Original change's description:
> > > > > [flags] warn about contradictory flags
> > > > >
> > > > > Design Doc: https://docs.google.com/document/d/1lkvu8crkK7Ei39qjkPCFijpNyxWXsOktG9GB-7K34jM/
> > > > >
> > > > > Bug: v8:10577
> > > > > Change-Id: Ib9cfdffa401c48c895bf31caed5ee03545beddab
> > > > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154792
> > > > > Reviewed-by: Clemens Backes <clemensb@chromium.org>
> > > > > Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> > > > > Reviewed-by: Georg Neis <neis@chromium.org>
> > > > > Reviewed-by: Tamer Tas <tmrts@chromium.org>
> > > > > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > > > > Cr-Commit-Position: refs/heads/master@{#68168}
> > > >
> > > > Bug: v8:10577
> > > > Change-Id: I268e590ee18a535b13dee14eeb15ddd0a9ee8341
> > > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2235115
> > > > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > > > Reviewed-by: Tamer Tas <tmrts@chromium.org>
> > > > Reviewed-by: Clemens Backes <clemensb@chromium.org>
> > > > Reviewed-by: Georg Neis <neis@chromium.org>
> > > > Cr-Commit-Position: refs/heads/master@{#68989}
> > >
> > > Bug: v8:10577
> > > Change-Id: I31d2794d4f9ff630f3444210100c64d67d881276
> > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2339464
> > > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > > Reviewed-by: Clemens Backes <clemensb@chromium.org>
> > > Cr-Commit-Position: refs/heads/master@{#69339}
> >
> > Bug: v8:10577
> > Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_rel_ng
> > Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_isolates_rel_ng
> > Change-Id: I4a69dc57a102782cb453144323e3752ac8278624
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2352770
> > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> > Reviewed-by: Clemens Backes <clemensb@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#69433}
> 
> Change-Id: Ib6d2aeb495210f581ac671221c265df58e8e5e70
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2398640
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Reviewed-by: Tamer Tas <tmrts@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69954}

TBR=clemensb@chromium.org,tebbi@chromium.org,tmrts@chromium.org

Change-Id: I2dc80bcad9f74c29298902e01939e7e7f3336cf6
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2415133Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69959}

The {offset_reg} parameter was introduced so that the signature of
StoreTaggedPointer is the same as for Store, and also to prepare for
potential later uses. However, handling the parameter would introduce
additional complexity, and chances are low that it will ever be used.
That's why this CL just removes it.

R=thibaudm@chromium.org

Bug: v8:7581
Change-Id: Ib419a72e1d9f36b8d9a3dbbce538ce57bb37d476
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2412182Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69958}

Bug: chromium:1126467
Change-Id: Id10117b99fa28504780dd6c0a7850bb17e5e94ef
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2414210
Auto-Submit: Almothana Athamneh <almuthanna@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69957}

This is a reland of effbbb8c

Original change's description:
> Roll test262
>
> https://chromium.googlesource.com/external/github.com/tc39/test262/+log/e8cdf92..6397602
>
> Bug: v8:7834, v8:4628, v8:10903, v8:10905
> Change-Id: I65bf15d6308126a4955abe0a6b0647834f4ff066
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2405804
> Reviewed-by: Shu-yu Guo <syg@chromium.org>
> Commit-Queue: Frank Tang <ftang@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69899}

Bug: v8:7834
Bug: v8:4628
Bug: v8:10903
Bug: v8:10905
Bug: v8:10921
Change-Id: I615279b2a370daa2d7ce1fbdaa13f1ade12f8101
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2413482Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69956}

They are suspected to be causing Canary crashes, confirmed through
local reverts and repro attempts.

This reverts:
- "Reland "[serializer] Change deferring to use forward refs""
  commit 76d684cc.
- "Reland "[serializer] Remove new space""
  commit 81231c23.
- "[serializer] Clean-up and de-macro ReadDataCase"
  commit c06d24b9.
- "[serializer] DCHECK deserializer allocations are initialized"
  commit fbc1f32d.

Bug: chromium:1128872
Change-Id: Id2bb3b8fac526fdf9ffb033222ae08cd423f8238
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2414220Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69955}

This is a reland of 0ba115e6
Changes compared to last reland:
- Fix Python code trying to write to expected_outcomes, which is now a
  computed property.
- Fix remaining place in d8.cc that ignored the --fuzzing flag.
- Expect flag contradictions for --cache in code_serializer variant.

Original change's description:
> Reland^3 "[flags] warn about contradictory flags"
>
> Changes:
> - Also allow second parameter influenced by --cache to be reassigned.
> - Fix --stress-opt to only --always-opt in the last iteration as before.
>
> Original change's description:
> > Reland^2 "[flags] warn about contradictory flags"
> >
> > This is a reland of d8f8a7e2
> > Change compared to last reland:
> > - Do not check for d8 flag contradictions in the presence of --fuzzing
> > - Allow identical re-declaration of --cache=*
> >
> > Original change's description:
> > > Reland "[flags] warn about contradictory flags"
> > >
> > > This is a reland of b8f91666
> > > Difference to previous CL: Additional functionality to specify
> > > incompatible flags based on GN variables and extra-flags, used
> > > to fix the issues that came up on the waterfall.
> > >
> > > This also changes the rules regarding repeated flags: While
> > > explicitly repeated flags are allowed for boolean values as long
> > > as they are identical, repeated flags or explicit flags in the
> > > presence of an active implication are disallowed for non-boolean
> > > flags. The latter simplifies specifying conflict rules in
> > > variants.py. Otherwise a rule like
> > >
> > > INCOMPATIBLE_FLAGS_PER_EXTRA_FLAG = {
> > >   "--gc-interval=*": ["--gc-interval=*"],
> > > }
> > >
> > > wouldn't work because specifying the same GC interval twice
> > > wouldn't actually count as a conflict. This was an issue with
> > > test/mjsunit/wasm/gc-buffer.js, which specifies
> > > --gc-interval=500 exactly like the extra flag by the stress bot.
> > >
> > > Also, this now expands contradictory flags checking to d8 flags
> > > for consistency.
> > >
> > > Original change's description:
> > > > [flags] warn about contradictory flags
> > > >
> > > > Design Doc: https://docs.google.com/document/d/1lkvu8crkK7Ei39qjkPCFijpNyxWXsOktG9GB-7K34jM/
> > > >
> > > > Bug: v8:10577
> > > > Change-Id: Ib9cfdffa401c48c895bf31caed5ee03545beddab
> > > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154792
> > > > Reviewed-by: Clemens Backes <clemensb@chromium.org>
> > > > Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> > > > Reviewed-by: Georg Neis <neis@chromium.org>
> > > > Reviewed-by: Tamer Tas <tmrts@chromium.org>
> > > > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > > > Cr-Commit-Position: refs/heads/master@{#68168}
> > >
> > > Bug: v8:10577
> > > Change-Id: I268e590ee18a535b13dee14eeb15ddd0a9ee8341
> > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2235115
> > > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > > Reviewed-by: Tamer Tas <tmrts@chromium.org>
> > > Reviewed-by: Clemens Backes <clemensb@chromium.org>
> > > Reviewed-by: Georg Neis <neis@chromium.org>
> > > Cr-Commit-Position: refs/heads/master@{#68989}
> >
> > Bug: v8:10577
> > Change-Id: I31d2794d4f9ff630f3444210100c64d67d881276
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2339464
> > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > Reviewed-by: Clemens Backes <clemensb@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#69339}
>
> Bug: v8:10577
> Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_rel_ng
> Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_isolates_rel_ng
> Change-Id: I4a69dc57a102782cb453144323e3752ac8278624
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2352770
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69433}

Change-Id: Ib6d2aeb495210f581ac671221c265df58e8e5e70
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2398640
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Tamer Tas <tmrts@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69954}

dst might not be the same as src0 (since we don't define them to be
equals in the instruction-selector if AVX is enabled), so the minps
and maxps comparisons were incorrect.

I found this while trying to run some spec tests, so not adding any
unittest, eventually when the spec tests are enabled, this will be
covered.

Bug: v8:10835
Change-Id: I4fbc1dfe949e4137e057e73c0d5dfb8534a00b8f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2411484Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69953}

While the sampler checked if the sampled thread had the Isolate locked
(if locks are being used) under Linux, the check was not done under
Windows (or Fuchsia) which meant that in a multi-threading application
under Windows, thread locking was not checked making it prone to seg
faults and the like as the profiler would be using isolate->js_entry_sp
to determine the stack to walk but isolate->js_entry_sp is the stack
pointer for the thread that currently has the Isolate lock so, if the
sampled thread does not have the lock, the sampler woud be iterating
over the wrong stack, one that might actually be actively changing on
another thread. The fix was to move the lock check into CpuSampler
and Ticker (--prof) so all OSes would do the correct check.

The basic concept is that on all operating systems a CpuProfiler, and
so its corresponding CpuCampler, the profiler is tied to a thread.
This is not based on first principles or anything, it's simply the
way it works in V8, though it is a useful conceit as it makes
visualization and interpretation of profile data much easier.

To collect a sample on a thread associated with a profiler the thread
must be stopped for obvious reasons -- walking the stack of a running
thread is a formula for disaster. The mechanism for stopping a thread
is OS-specific and is done in sample.cc. There are currently three
basic approaches, one for Linux/Unix variants, one for Windows and one
for Fuchsia. The approaches vary as to which thread actually collects
the sample -- under Linux the sample is actually collected on the
(interrupted) sampled thread whereas under Fuchsia/Windows it's on
a separate thread.

However, in a multi-threaded environment (where Locker is used), it's
not sufficient for the sampled thread to be stopped. Because the stack
walk involves looking in the Isolate heap, no other thread can be
messing with the heap while the sample is collected. The only ways to
ensure this would be to either stop all threads whenever collecting a
sample, or to ensure that the thread being sampled holds the Isolate
lock so prevents other threads from messing with the heap. While there
might be something to be said for the "stop all threads" approach, the
current approach in V8 is to only stop the sampled thread so, if in a
multi-threaded environment, the profiler must check if the thread being
sampled holds the Isolate lock.

Since this check must be done, independent of which thread the sample
is being collected on (since it varies from OS to OS), the approach is
to save the thread id of the thread to be profiled/sampled when the
CpuSampler is instantiated (on all OSes it is instantiated on the
sampled thread) and then check that thread id against the Isolate lock
holder thread id before collecting a sample. If it matches, we know
sample.cc has stop the sampled thread, one way or another, and we know
that no other thread can mess with the heap (since the stopped thread
holds the Isolate lock) so it's safe to walk the stack and collect data
from the heap so the sample can be taken. It it doesn't match, we can't
safely collect the sample so we don't.

Bug: v8:10850
Change-Id: Iba6cabcd3e11a19c261c004103e37e806934dc6f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2411343Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69952}

Bug: v8:7481, v8:9084, v8:8664
Change-Id: Iccbf78bf11a4e8ca5d105772fa5f654fbe6542cd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2410791
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69951}

I/O is quite expensive on the bots. This cuts down a bit of it by
printing slightly fewer characters per test in verbose mode.

This leads to an overall speed improvement of ~20% for large test
suites, e.g. Test262 output-collection time goes from ~2m30 to ~2m.

The averages to a 5-10% overall speed improvement for slow tryjobs.

Bug: v8:10916
Change-Id: I56dcb072af8eb32a1e09e17a05db5782c6d79315
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2414038
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69950}

This is a reland of b5f37051

Got reverted since it was breaking the bots
(https://bugs.chromium.org/p/v8/issues/detail?id=10918)

The solution is to keep the JSDataView class as kSerialized but change
its method to do a direct heap access. In this way, its map it will
still be serialized (which was the cause of the bot failure).

In order to keep incrementally skipping serialization, we can introduce
new macros that allow a per-method skip of serialization rather than
per-class.

Original change's description:
> [compiler] Replace JSDataView with direct reads
>
> Bug: v8:7790
> Change-Id: Id01c2e4359aa4294816ffe14c08a586a9b9b10c2
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2404768
> Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69904}

Bug: v8:7790, v8:10918
Change-Id: Ifdfe504272369e7cc1332fe53992739f9d0be385
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2413258Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69949}

Enable --concurrent-allocation to see whether this flag causes any
regressions.

Bug: v8:10315
Change-Id: Iafe80c048ad7f04186207c8c570f7cf85397f02f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2413260Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69948}

This CL is non-functional by itself and it prepares extending
IsJSCompatibleSignature to wasm-gc types.

Bug: v8:7748
Change-Id: I0bf02d55e83ed020ef63b4eedf641d9405c3a689
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2413251Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69947}

No-Try: true
Bug: v8:10923
Change-Id: I254a6190aa7aad69a7e11c58e78429a45eec9962
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2414208
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69946}

Change-Id: I564e60a04616f98cf0ad5258c994e53b6ab8f4eb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2410010Reviewed-by: Michael Dawson <midawson@redhat.com>
Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Reviewed-by: Michael Hablich <hablich@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#69945}

Bug: chromium:1126467
Change-Id: I91321aad9c959873f66c222f3bc0b24c44c3af5c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2414033Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Almothana Athamneh <almuthanna@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69944}

- inspector-test.cc
- isolate-unittest.cc

Bug: v8:10884
Change-Id: I3d02526806ddb56edb087ff2a5407ad9e78ab567
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2413263Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69943}

Bug: chromium:1126467
Change-Id: Ieea946e254ece3a746d50f90f57c2957d2136cda
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2412178
Commit-Queue: Almothana Athamneh <almuthanna@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69942}

Deopt tracing is both verbose and hard to read. This CL splits verbose
tracing into a new --trace-deopt-verbose flag (s.t. --trace-deopt now
emits single-line events only), refactors tracing methods to all be on
the Deoptimizer class, and clarifies output.

Bug: v8:8888
Change-Id: I3cf8e6878e5e996ca9a2e276ab8ba2d5b18d91a7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2413252
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69941}

This is a reland of ff0c5cfa

TSAN issue fixed in https://crrev.com/c/2410057

Original change's description:
> [offthread] Enable off-thread finalization in --future
>
> Enable the new LocalHeap-based off-thread finalization behind --future.
>
> Bug: chromium:1011762
> Change-Id: I4b33fc300a34530d75aa1a3e197e0d1326994efa
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2403252
> Commit-Queue: Leszek Swirski <leszeks@chromium.org>
> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
> Auto-Submit: Leszek Swirski <leszeks@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69813}

Bug: chromium:1011762
Change-Id: I89013a4f6437f062194e7abdaa68c17f0b285edf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2412169Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69940}

Liftoff code is never relocated and never serialized, thus relocation
information is not needed.

This results in slightly less information being printed when
disassembling code, because the disassembler sometimes uses relocation
information to show the kind of a call (e.g. internal wasm call vs.
builtin call). This is an acceptable regression IMO.

R=thibaudm@chromium.org

Bug: v8:10777
Change-Id: I019913a41b47466fba7b7f216ab51b91475cd984
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2412186Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69939}

Bug: v8:10315
Change-Id: If64ff0bcd441ecce4113f70ba72373949f076efe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2409276Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69938}

With the --always_promote_young_mc flag the mark-compact collector
cannot gracefully handle allocation failures when evacuating the young
generation. In some scenarios this causes OOM crashes without invoking
NearHeapLimitCallback.

This CL ensures that the young generation is evacuated before the old
generation because old generation evacuation can be aborted if needed.
Additionally, the CL cleans up usages of CanExpandOldGeneration.

Bug: v8:10843
Change-Id: I50d83912137afa3d3dac797dd4c6bddb51612334
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2404829
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69937}

This CL deletes the image on the timeline overview which
only reflects the last uploaded timeline-track data
and updates the timelineOverviewIndicator on mousemove and
chunk zoom events.

Bug: v8:10644

Change-Id: Ib0a43083d2461cc343a0c946cfddaf4fdc514687
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2413257Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Zeynep Cankara <zcankara@google.com>
Cr-Commit-Position: refs/heads/master@{#69936}

Bug: chromium:1056170
Change-Id: I4f935e1e653b2b713e690d9cd7d8a624d7bf1536
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2413259
Auto-Submit: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69935}

For "else" and "catch" statements, the Ref to the end label should only
be added if the current block is unreachable, not the parent block.

In the added regression test, the "true" block ends in an unreachable
state with a stack height less than the target height of the end label.
This is valid due to the semantics of unreachable code, but we should
not add the Ref in this case because its stack height is invalid.

R=clemensb@chromium.org

Fixed: chromium:1092130
Change-Id: Iebaf5e7d6516278ccd3c8268ac331069e109d882
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2412181
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69934}

Methods are now fully replaced with SafepointScope and are not supposed
to be used anymore.

Bug: v8:10315
Change-Id: I16f9c37b1849590d74fa55c92b8ea5cc83cd7cce
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2413256Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69933}

Since the string-table's data pointer is written inside a mutex, but
read outside of it, we need to acq/rel access to it.

There's no support in C++ for an std::atomic<std::unique_ptr>, so this
patch changes the std::unique_ptr<Data> into a std::atomic<Data*>, and
handles the deletion manually. StringTable::Data still uses

std::unique_ptr as the general pointer-passing contract, we just
carefully set and release the unique_ptrs when accessing and setting
the StringTable's atomic Data pointer.

Change-Id: I711a56825e2f5f9b2db63d1874e09c2627af54b8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2410057
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69932}

Introduced in a8a1776e. The chromium build checks against an explicit
list of compilation units with static initializers, thus it's easier
to use

 static Constant() { ... }

than

 static const kConstant;

Bug: v8:8888
Change-Id: I2625130dd3d92607b46c0cc615623907149f800e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2413255
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69931}

This is needed for preserving test coverage for the mode that runs
without local heaps. Flags that depend on --local-heaps are also
disabled in this variant.

Bug: v8:10828
Change-Id: I4a3b219e5235945278d8356f4efd886a97ffa16a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2404456
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69930}

This commit adds support for capture groups (as in e.g. /x(123|abc)y/)
in the experimental regexp engine.  Now every InterpreterThread owns a
register array containing (sub)match boundaries. There is a new
instruction to record the current input index in some register.

Submatches in quantifier bodies should be reported only if they occur
during the last repetition.  Thus we reset those registers before
attempting to match the body of a quantifier.  This is implemented with
another new instruction.

Because of concerns for the growing sizeof the NfaInterpreter object
(which is allocated on the stack), this commit replaces the
`SmallVector` members of the NfaInterpreter with zone-allocated arrays.
Register arrays, which for a fixed regexp are all the same size, are
allocated with a RecyclingZoneAllocator for cheap memory reclamation via
a linked list of equally-sized free blocks.

Possible optimizations for management of register array memory:
1. If there are few register per thread, then it is likely faster to
   store them inline in the InterpreterThread struct.
2. re2 implements copy-on-write:  InterpreterThreads can share the same
   register array. If a thread attempts to write to shared register
   array, the register array is cloned first.
3. The register at index 1 contains the end of the match; this is only
   written to right before an ACCEPT statement.  We could make ACCEPT
   equivalent to what's currently CAPTURE 1 followed by ACCEPT.  We
   could then save the memory for register 1 for threads that haven't
   finished yet.  This is particularly interesting if now optimization 1
   kicks in.

Cq-Include-Trybots: luci.v8.try:v8_linux64_fyi_rel_ng
Bug: v8:10765
Change-Id: I2c0503206ce331e13ac9912945bb66736d740197
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2390770
Commit-Queue: Martin Bidlingmaier <mbid@google.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69929}

Making test failures more convenient to debug than simply failing
a .ToHandleChecked() call.

Change-Id: Ieb4553bec8886d1a4eb0dbf0c7bc53ac6435a82c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2412528
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69928}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/62cb86f..be363dc

Rolling v8/third_party/aemu-linux-x64: cG1zzefbD24rFmPDujqP0rrEG0uXUhH8axBOrD619hoC..8YjsZy1I3YIJIOUKErXW54SHjiEX62hd9SqYjmop19oC

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/534924e..0063ad8

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/b71187b..52fdd1f

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I02d2cd22c57d032d8b7b8cf810c78b90b3897edd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2413268Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#69927}

Bug: v8:10201
Change-Id: I313405983696546b817c96a820343e6cb9e3fdd4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2408977Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Yu Yin <xwafish@gmail.com>
Cr-Commit-Position: refs/heads/master@{#69926}

Port 068cf20e

Original Commit Message:

    Implement f32x4 and f64x2 nearest, trunc, ceil, and floor.

    These instructions were accepted into the proposal [0], this change
    removes all the ifdefs and todo guarding the prototypes, and moves these
    instructions out of the post-mvp flag.

    [0] https://github.com/WebAssembly/simd/pull/232

R=zhin@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I02086255f635f1d47586fc74dd754426f6beccb0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2411675Reviewed-by: Milad Farazmand <mfarazma@redhat.com>
Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#69925}