[email protected]

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I4fec7bef2c61c594ecc8fd529de89dfd8985cf6d
Reviewed-on: https://chromium-review.googlesource.com/1165264
Reviewed-by: V8 Autoroller <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/6.9@{#26}
Cr-Branched-From: d7b61ab-refs/heads/6.9.427@{#1}
Cr-Branched-From: b7e108d-refs/heads/master@{#54504}

This reverts commit caed2cc.

Reason for revert: Breaks layout tests, e.g.

https://test-results.appspot.com/data/layout_results/V8-Blink_Linux_64__dbg_/14924/webkit_layout_tests%20%28with%20patch%29/layout-test-results/results.html

crash log for renderer (pid <unknown>):
STDOUT: <empty>
STDERR: 
STDERR: 
STDERR: #
STDERR: # Fatal error in ../../v8/src/base/platform/elapsed-timer.h, line 24
STDERR: # Debug check failed: !IsStarted().
STDERR: #
STDERR: #
STDERR: #
STDERR: #FailureMessage Object: 0x7ffc46707640#0 0x565409263b6f base::debug::StackTrace::StackTrace()
STDERR: #1 0x56540a8a32fb gin::(anonymous namespace)::PrintStackTrace()
STDERR: #2 0x56540a8980d8 V8_Fatal()
STDERR: #3 0x56540a897e35 v8::base::(anonymous namespace)::DefaultDcheckHandler()
STDERR: v8#4 0x565407971f02 v8::base::ElapsedTimer::Start()
STDERR: v8#5 0x565407d08edf v8::internal::TimedHistogram::Start()
STDERR: v8#6 0x565407e500d5 v8::internal::IncrementalMarking::AdvanceIncrementalMarkingOnAllocation()
STDERR: v8#7 0x565407e4f977 v8::internal::IncrementalMarking::Observer::Step()
STDERR: v8#8 0x565407e48092 v8::internal::AllocationObserver::AllocationStep()
STDERR: v8#9 0x565407eb0751 v8::internal::SpaceWithLinearArea::InlineAllocationStep()
STDERR: v8#10 0x565407eb3e44 v8::internal::NewSpace::EnsureAllocation()
STDERR: v8#11 0x565407e258ff v8::internal::NewSpace::AllocateRaw()
STDERR: v8#12 0x565407e06b2d v8::internal::Heap::AllocateRaw()
STDERR: v8#13 0x565407e432ef v8::internal::Heap::AllocateRawWithLightRetry()
STDERR: v8#14 0x565407e433cf v8::internal::Heap::AllocateRawWithRetryOrFail()
STDERR: v8#15 0x565407e04d48 v8::internal::Factory::NewFixedArrayWithFiller()
STDERR: v8#16 0x565407fd6339 v8::internal::HashTable<>::New()
STDERR: v8#17 0x565407fd7be8 v8::internal::HashTable<>::EnsureCapacity()
STDERR: v8#18 0x565407fc7e95 v8::internal::Dictionary<>::Add()
STDERR: v8#19 0x565407fcf453 v8::internal::BaseNameDictionary<>::Add()
STDERR: v8#20 0x565407f89ee4 v8::internal::LookupIterator::ApplyTransitionToDataProperty()
STDERR: v8#21 0x5654080036e2 v8::internal::Object::AddDataProperty()
STDERR: v8#22 0x56540793061f v8::internal::(anonymous namespace)::DefineDataProperty()
STDERR: v8#23 0x56540792da59 v8::internal::(anonymous namespace)::InstantiateObject()
STDERR: v8#24 0x56540792b75a v8::internal::(anonymous namespace)::InstantiateFunction()
STDERR: v8#25 0x56540792b4db v8::internal::ApiNatives::InstantiateFunction()
STDERR: v8#26 0x5654079594bf v8::FunctionTemplate::GetFunction()
STDERR: v8#27 0x56540a7af74e blink::V8ObjectConstructor::CreateInterfaceObject()
STDERR: v8#28 0x56540a7afe01 blink::V8PerContextData::ConstructorForTypeSlowCase()
STDERR: v8#29 0x56540a7afdd6 blink::V8PerContextData::ConstructorForTypeSlowCase()
STDERR: v8#30 0x56540a7afdd6 blink::V8PerContextData::ConstructorForTypeSlowCase()
STDERR: v8#31 0x56540a7afcb4 blink::V8PerContextData::CreateWrapperFromCacheSlowCase()
STDERR: v8#32 0x56540a7aef73 blink::V8DOMWrapper::CreateWrapper()
STDERR: v8#33 0x56540a7abf6b blink::ScriptWrappable::Wrap()
STDERR: v8#34 0x56540a677199 blink::V8Document::documentElementAttributeGetterCallback()
STDERR: v8#35 0x565407a0aec3 v8::internal::FunctionCallbackArguments::Call()
STDERR: v8#36 0x565407a097be v8::internal::(anonymous namespace)::HandleApiCallHelper<>()
STDERR: v8#37 0x565407a0877b v8::internal::Builtins::InvokeApiFunction()
STDERR: v8#38 0x565407fe785a v8::internal::Object::GetPropertyWithAccessor()
STDERR: v8#39 0x565407fe697e v8::internal::Object::GetProperty()
STDERR: v8#40 0x565407ec8c71 v8::internal::LoadIC::Load()
STDERR: v8#41 0x565407ed6401 v8::internal::__RT_impl_Runtime_LoadIC_Miss()
STDERR: v8#42 0x5654087593f2 <unknown>
STDERR: [16162:16185:1122/143518.356897:WARNING:crash_handler_host_linux.cc(341)] Could not translate tid, attempt = 1 retry ...


Original change's description:
> [heap] Improve embedder tracing during incremental marking
> 
> Add a path into embedder tracing on allocation. This is safe as as Blink
> is not allowed to call into V8 during object construction.
> 
> Bug: chromium:843903
> Change-Id: I5af053c3169f5a33778ebce5d7c5c43e4efb1aa4
> Reviewed-on: https://chromium-review.googlesource.com/c/1348749
> Commit-Queue: Michael Lippautz <[email protected]>
> Reviewed-by: Ulan Degenbaev <[email protected]>
> Cr-Commit-Position: refs/heads/master@{#57757}

[email protected],[email protected]

Change-Id: Ide2c0b284b52bee17573adcc89f14be4e40dab91
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:843903
Reviewed-on: https://chromium-review.googlesource.com/c/1349189
Reviewed-by: Yang Guo <[email protected]>
Commit-Queue: Yang Guo <[email protected]>
Cr-Commit-Position: refs/heads/master@{#57759}

TBR=v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com

Change-Id: I56afaa9112b1cedbec09ad071937e4993b94eb1d
Reviewed-on: https://chromium-review.googlesource.com/c/1382814
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/7.2@{v8#26}
Cr-Branched-From: 6acd03c-refs/heads/7.2.502@{#1}
Cr-Branched-From: b03041d-refs/heads/master@{#57910}

TBR=v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com

Change-Id: I99fb51aafaa19369cc390574f16870d1deaade10
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1537571
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/7.4@{v8#26}
Cr-Branched-From: 3e8a733-refs/heads/7.4.288@{#1}
Cr-Branched-From: d077f9b-refs/heads/master@{#60039}

TBR=v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com

Change-Id: I88f60682186cf534e2f5fcd41c2ad9a09c183133
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2064948
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/8.1@{v8#26}
Cr-Branched-From: a4dcd39-refs/heads/8.1.307@{#1}
Cr-Branched-From: f22c213-refs/heads/master@{#66031}

RISC-V: Add instruction cache flushing

The named LoadIC code was missing a check for "names" that
convert to TypedArray indices. This was flushed out by the
recent bump of the max TypedArray size from 2^32-1 to 2^32.
Named StoreICs had the same bug; fixed here as well.

(cherry picked from commit c90353e)

Bug: v8:4153
Fixed: chromium:1104608
Change-Id: I6bd2552d6ccc238104f92e7b95d19970d4a75dae
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2295606
Reviewed-by: Igor Sheludko <[email protected]>
Commit-Queue: Jakob Kummerow <[email protected]>
Cr-Original-Commit-Position: refs/heads/master@{#68840}
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2307226
Cr-Commit-Position: refs/branch-heads/8.5@{v8#26}
Cr-Branched-From: a7f8bc4-refs/heads/8.5.210@{#1}
Cr-Branched-From: dd58472-refs/heads/master@{#68510}

TBR=v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com

Change-Id: Iafdd4c021f83d3b5453ff2aaf527aeb161bd4f54
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1836113
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/7.8@{v8#26}
Cr-Branched-From: 73694fd-refs/heads/7.8.279@{#1}
Cr-Branched-From: 2314928-refs/heads/master@{#63555}

TBR=v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com

Change-Id: I10ca605175df30236c5206a1add7ef5f99892426
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1833863
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/7.7@{v8#26}
Cr-Branched-From: 4035531-refs/heads/7.7.299@{#1}
Cr-Branched-From: 1320c91-refs/heads/master@{#62881}

TBR=v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com

Change-Id: Ie35d8cf2a66e3b87d267137045120fa870161464
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1880339
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/7.9@{v8#26}
Cr-Branched-From: be181e2-refs/heads/7.9.317@{#1}
Cr-Branched-From: 0d7889d-refs/heads/master@{#64307}

Merged: [mips][wasm-simd] Use signed extract lane
Revision: 185cc91

Merged: [mips][wasm-simd] Implement f64x2 min max
Revision: 496adfc

Merged: [mips64] Prevent input registers' value from changing in some 32-bit operations.
Revision: a1a8780

Merged: [mips64][codegen] Fix the case that register rd is the same as rs in Shr and Sar
Revision: e99f6ff

Bug: v8:10074
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
[email protected]

Change-Id: I783e1cf3f512ec38a9fbeba8e1889f6a91e2a87b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1967106
Reviewed-by: Michael Hablich <[email protected]>
Reviewed-by: Bill Budge <[email protected]>
Reviewed-by: Deepti Gandluri <[email protected]>
Commit-Queue: Bill Budge <[email protected]>
Cr-Commit-Position: refs/branch-heads/8.0@{v8#26}
Cr-Branched-From: 69827db-refs/heads/8.0.426@{v8#2}
Cr-Branched-From: 2fe1552-refs/heads/master@{#65318}

Revision: 48d5f1b

NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
[email protected]

Change-Id: I5942238e8e371cb4f29e3ffdbff44951da54d7e6
Reviewed-on: https://chromium-review.googlesource.com/c/1478203
Reviewed-by: Michael Achenbach <[email protected]>
Commit-Queue: Michael Achenbach <[email protected]>
Cr-Commit-Position: refs/branch-heads/7.3@{v8#26}
Cr-Branched-From: 9df9418-refs/heads/7.3.492@{v8#2}
Cr-Branched-From: be213cf-refs/heads/master@{#59024}

BUG=chromium:899028
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
[email protected]

Change-Id: I20d06fb59c76967c86114dca08e88f15b7279a13
Reviewed-on: https://chromium-review.googlesource.com/c/1309757
Reviewed-by: Michael Achenbach <[email protected]>
Commit-Queue: Sergiy Byelozyorov <[email protected]>
Cr-Commit-Position: refs/branch-heads/7.1@{v8#26}
Cr-Branched-From: f70aaa8-refs/heads/7.1.302@{#1}
Cr-Branched-From: 1dbcc78-refs/heads/master@{#56462}

Func::type() was broken for functions created with Func::make().

(cherry picked from commit 0d89458)

Bug: v8:9364
Change-Id: I2867bcf00d9e5c1488165a804598c9ca8081ff25
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1655648
Auto-Submit: Jakob Kummerow <[email protected]>
Commit-Queue: Tamer Tas <[email protected]>
Reviewed-by: Tamer Tas <[email protected]>
Reviewed-by: Andreas Haas <[email protected]>
Reviewed-by: Michael Starzinger <[email protected]>
Cr-Original-Commit-Position: refs/heads/master@{#62167}
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1680543
Reviewed-by: Jakob Kummerow <[email protected]>
Cr-Commit-Position: refs/branch-heads/7.6@{v8#26}
Cr-Branched-From: 2cb2573-refs/heads/7.6.303@{#1}
Cr-Branched-From: 201c509-refs/heads/master@{#61902}

Revision: d915b8d

BUG=v8:9122
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true

Change-Id: I8d575c021499936aa92263a098937373a59dc126
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1600336
Reviewed-by: Jakob Gruber <[email protected]>
Commit-Queue: Jakob Gruber <[email protected]>
Cr-Commit-Position: refs/branch-heads/7.5@{v8#26}
Cr-Branched-From: 35b9bf5-refs/heads/7.5.288@{#1}
Cr-Branched-From: 912b391-refs/heads/master@{#60911}

(cherry picked from commit cc14c70)

Bug: chromium:986235, chromium:1087523
No-Try: true
No-Presubmit: true
No-Tree-Checks: true
Tbr: [email protected]
Change-Id: I56d226f6a29ee7dc5fa8f368cf2c0e3b143c5925
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2241514
Commit-Queue: Michael Lippautz <[email protected]>
Reviewed-by: Michael Lippautz <[email protected]>
Cr-Commit-Position: refs/branch-heads/8.3@{v8#26}
Cr-Branched-From: 1668abd-refs/heads/8.3.110@{#1}
Cr-Branched-From: 04a7a68-refs/heads/master@{#66926}

(cherry picked from commit f3d4639)

Bug: chromium:1085804
No-Try: true
No-Presubmit: true
No-Tree-Checks: true
TBR: [email protected]
Change-Id: I36f2ce90aceb682c90290fd57d7eaa01f64da668
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2245596
Commit-Queue: Georg Neis <[email protected]>
Reviewed-by: Georg Neis <[email protected]>
Cr-Commit-Position: refs/branch-heads/8.4@{v8#26}
Cr-Branched-From: 88ed2e3-refs/heads/8.4.371@{#1}
Cr-Branched-From: 35f88bf-refs/heads/master@{#67773}

For SIMD instructions that use aligned moves (like movaps or movapd), we
don't have correct memory alignment for SIMD moves yet. Switch to to
movupd.

Bug: v8:9198
Bug: v8:10831
Bug: chromium:1134039
(cherry picked from commit ab23ff3)

Change-Id: Icae9ea0eb68f8159d662d46f7a0eb7c8dd4675d6
No-Try: true
No-Presubmit: true
No-Tree-Checks: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2468629
Reviewed-by: Bill Budge <[email protected]>
Commit-Queue: Zhi An Ng <[email protected]>
Cr-Commit-Position: refs/branch-heads/8.6@{v8#26}
Cr-Branched-From: a64aed2-refs/heads/8.6.395@{#1}
Cr-Branched-From: a626bc0-refs/heads/master@{#69472}

This reverts commit b6856a1.

Reason for revert: Test uses flag that does not exist.

Original change's description:
> [ia32][wasm-simd] Fix aligned moves in codegen
>
> For SIMD instructions that use aligned moves (like movaps or movapd), we
> don't have correct memory alignment for SIMD moves yet. Switch to to
> movupd.
>
> Bug: v8:9198
> Bug: v8:10831
> Bug: chromium:1134039
> (cherry picked from commit ab23ff3)
>
> Change-Id: Icae9ea0eb68f8159d662d46f7a0eb7c8dd4675d6
> No-Try: true
> No-Presubmit: true
> No-Tree-Checks: true
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2468629
> Reviewed-by: Bill Budge <[email protected]>
> Commit-Queue: Zhi An Ng <[email protected]>
> Cr-Commit-Position: refs/branch-heads/8.6@{v8#26}
> Cr-Branched-From: a64aed2-refs/heads/8.6.395@{#1}
> Cr-Branched-From: a626bc0-refs/heads/master@{#69472}

[email protected],[email protected],[email protected]

Change-Id: I3b22eacea656a9104ad56a0f956b21f7d5c1522c
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:9198
Bug: v8:10831
Bug: chromium:1134039
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2469598
Reviewed-by: Zhi An Ng <[email protected]>
Commit-Queue: Zhi An Ng <[email protected]>
Cr-Commit-Position: refs/branch-heads/8.6@{v8#28}
Cr-Branched-From: a64aed2-refs/heads/8.6.395@{#1}
Cr-Branched-From: a626bc0-refs/heads/master@{#69472}

Revision: ce2ec03

BUG=chromium:1157044
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
[email protected]

Change-Id: Ia0e41fdd948b81c81bc805cb0e0bb7435c7df1e3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2621085
Reviewed-by: Jakob Gruber <[email protected]>
Cr-Commit-Position: refs/branch-heads/8.8@{v8#26}
Cr-Branched-From: 2dbcdc1-refs/heads/8.8.278@{#1}
Cr-Branched-From: 366d30c-refs/heads/master@{#71094}

This CL fixes a bug in which we did not correctly handle the
case if CompileTopLevel would not return any result. Check the
result of CompileTopLevel, correctly handle pending
exceptions and break out of the loop if top-level compile
did not succeed.

Bug: v8:11598
No-Try: true
No-Presubmit: true
No-Tree-Checks: true
Change-Id: I3408d171c462474cbe8829218c6011f31804fd01
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2790173
Commit-Queue: Kim-Anh Tran <[email protected]>
Reviewed-by: Benedikt Meurer <[email protected]>
Cr-Commit-Position: refs/branch-heads/9.0@{v8#26}
Cr-Branched-From: bd0108b-refs/heads/9.0.257@{#1}
Cr-Branched-From: 349bcc6-refs/heads/master@{#73001}

… TurboFan graph"

Revision: b681c30

NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
[email protected]

Change-Id: I94d53a637bec61499fd0e0ee8c05e1f8517f3aa2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2840323
Reviewed-by: Junliang Yan <[email protected]>
Commit-Queue: Milad Fa <[email protected]>
Cr-Commit-Position: refs/branch-heads/9.1@{v8#26}
Cr-Branched-From: 0e4ac64-refs/heads/9.1.269@{#1}
Cr-Branched-From: f565e72-refs/heads/master@{#73847}

TBR=v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com

Change-Id: Id43304a4ef8398ec191115cf92d4225d02b8ed37
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3097347
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/9.3@{v8#26}
Cr-Branched-From: 7744dce-refs/heads/9.3.345@{#1}
Cr-Branched-From: 4b6b4ca-refs/heads/master@{#75728}

Merged: Rewrite scopes of initializers in for-in/of destructured declarations
Revision: f1f2285

Merged: Properly fix-up ClassLiterals in ReparentExpressionScope()
Revision: 48a903e

NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
[email protected]

Bug: chromium:740591
Change-Id: I8697ff18d9588204e5911dc905771fe380e60752
Reviewed-on: https://chromium-review.googlesource.com/594470
Reviewed-by: Adam Klein <[email protected]>
Cr-Commit-Position: refs/branch-heads/6.1@{v8#26}
Cr-Branched-From: 1bf2e10-refs/heads/6.1.534@{#1}
Cr-Branched-From: e825c43-refs/heads/master@{#46746}

[email protected]

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: Ic136ec0a9c8d9f36a9c12c4d4713ca9f51e1ba54
Reviewed-on: https://chromium-review.googlesource.com/1094711
Reviewed-by: v8 autoroll <[email protected]>
Cr-Commit-Position: refs/branch-heads/6.8@{v8#26}
Cr-Branched-From: 44d7d7d-refs/heads/6.8.275@{#1}
Cr-Branched-From: 5754f66-refs/heads/master@{#53286}

Change-Id: I3b534fda6036f782172cfb7b8b6f7b205e292b17
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4393488
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/11.2@{v8#26}
Cr-Branched-From: 755511a-refs/heads/11.2.214@{#1}
Cr-Branched-From: e6b1cce-refs/heads/main@{#86014}

Change-Id: I273f0e4bc0c1219305278f8185c69bd3bf39e74a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3915113
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/10.6@{v8#26}
Cr-Branched-From: 41bc743-refs/heads/10.6.194@{#1}
Cr-Branched-From: d5f29b9-refs/heads/main@{#82548}

Revision: d30af61

NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
[email protected], [email protected]

Bug: v8:7648
Change-Id: I169a17c7d8acf605f713021acced1320d8e20c5c
Reviewed-on: https://chromium-review.googlesource.com/1013602
Reviewed-by: Michael Hablich <[email protected]>
Reviewed-by: Clemens Hammacher <[email protected]>
Commit-Queue: Clemens Hammacher <[email protected]>
Cr-Commit-Position: refs/branch-heads/6.7@{v8#26}
Cr-Branched-From: 8457e81-refs/heads/6.7.288@{v8#2}
Cr-Branched-From: e921be5-refs/heads/master@{#52547}

…and mips64

Related to commit c2a0acd

TruncateInt64ToInt32 is used to sign extend the lower 32 bits of int64 in loong64 and mips64；

The 32-bit arithmetic instructions in MIPS ISA require inputs to be sign-extended 32-bit integers, but it is expensive to sign-extend the parameters before each operation; So MIPS64 expect 32-bit integers to be always sign-extended in Turbo；

LoongArch has no instructions for 32-bit integer comparison, so it also expects 32-bit integers to always be sign-extended in Turbo.

(cherry picked from commit e1ec580)

Change-Id: Idb62100b1b1d4c61099a77e926c299dcb5b715fc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4297218
Reviewed-by: Tobias Tebbi <[email protected]>
Commit-Queue: Liu Yu <[email protected]>
Cr-Commit-Position: refs/branch-heads/11.1@{v8#26}
Cr-Branched-From: c77793a-refs/heads/11.1.277@{#1}
Cr-Branched-From: 95b79bf-refs/heads/main@{#85479}

[email protected]

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Ia12b14c2d8e2097a68f5beb356c885763b6d05b4
Reviewed-on: https://chromium-review.googlesource.com/901364
Reviewed-by: v8 autoroll <[email protected]>
Cr-Commit-Position: refs/branch-heads/6.5@{v8#26}
Cr-Branched-From: 73c55f5-refs/heads/6.5.254@{#1}
Cr-Branched-From: 594a1a0-refs/heads/master@{#50664}

This is a reland of commit 5fef8ed

Original change's description:
> Whitespace to trigger builders
>
>
> (cherry picked from commit a0927f2335aca0df713503669fc5f32a766ccb2b)
>
> Bug: chromium:1411452
> Change-Id: I5858324baf229093f89a4e86e8aff1ff629341f1
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4231452
> Auto-Submit: Liviu Rau <[email protected]>
> Commit-Queue: Liviu Rau <[email protected]>
> Bot-Commit: Rubber Stamper <[email protected]>
> Reviewed-by: Liviu Rau <[email protected]>
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4231971
> Cr-Commit-Position: refs/branch-heads/10.9@{v8#22}
> Cr-Branched-From: 8ade6bf-refs/heads/10.9.194@{#1}
> Cr-Branched-From: 9ff2515-refs/heads/main@{#84164}

Bug: chromium:1411452
Change-Id: I6fb82d6142645e03bf45b2b109af3653883666f7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4231793
Reviewed-by: Liviu Rau <[email protected]>
Commit-Queue: Liviu Rau <[email protected]>
Bot-Commit: Rubber Stamper <[email protected]>
Cr-Commit-Position: refs/branch-heads/10.9@{v8#26}
Cr-Branched-From: 8ade6bf-refs/heads/10.9.194@{#1}
Cr-Branched-From: 9ff2515-refs/heads/main@{#84164}

[email protected]

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Ie8357844c849b32960771ab136029d1bb1c28696
Reviewed-on: https://chromium-review.googlesource.com/669489
Reviewed-by: v8 autoroll <[email protected]>
Cr-Commit-Position: refs/branch-heads/6.2@{v8#26}
Cr-Branched-From: efa2ac4-refs/heads/6.2.414@{#1}
Cr-Branched-From: a861ebb-refs/heads/master@{#47693}

Change-Id: I5c8dbc00fce44f912637d0405eb57f3baf123885
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4557124
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/11.4@{v8#26}
Cr-Branched-From: 8a8a1e7-refs/heads/11.4.183@{#1}
Cr-Branched-From: 5483d8e-refs/heads/main@{#87241}

[email protected]

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I72f4398b12e370d940f8a3f3d2f98378fa956e3b
Reviewed-on: https://chromium-review.googlesource.com/973041
Reviewed-by: v8 autoroll <[email protected]>
Cr-Commit-Position: refs/branch-heads/6.6@{v8#26}
Cr-Branched-From: d500271-refs/heads/6.6.346@{#1}
Cr-Branched-From: 265ef0b-refs/heads/master@{#51624}

Inner functions which called eval, and were the kind of functions
that can use `super`, were erroneously not marked as "uses_super_property",
leading to downstream crashes when the runtime tried to load the
[[HomeObject]] from them.

This patch eliminates the public Scope::uses_super_property()
API and ensures that callers always call Scope::NeedsHomeObject()
instead.

This is a minimal fix designed for easy merging; it's likely that
in the long run we should remove most mentions of "uses super property"
and replace them with "needs home object" for clarity.

NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true

Bug: v8:5516, chromium:774994
Change-Id: Id269dd33e35bd40f6b59a3d3e19330687afa64f8
Reviewed-on: https://chromium-review.googlesource.com/721879
Reviewed-by: Marja Hölttä <[email protected]>
Commit-Queue: Adam Klein <[email protected]>
Cr-Original-Commit-Position: refs/heads/master@{#48619}(cherry picked from commit 94a71d7)
Reviewed-on: https://chromium-review.googlesource.com/727762
Reviewed-by: Michael Hablich <[email protected]>
Commit-Queue: Marja Hölttä <[email protected]>
Cr-Commit-Position: refs/branch-heads/6.3@{v8#26}
Cr-Branched-From: 094a7c9-refs/heads/6.3.292@{#1}
Cr-Branched-From: 18b8fbb-refs/heads/master@{#48432}

Revision: 3ecb047

BUG=chromium:789393
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
[email protected]

Change-Id: I6db4e3575be59f6acbb2801786622f21d1d0be0f
Reviewed-on: https://chromium-review.googlesource.com/849654
Reviewed-by: Adam Klein <[email protected]>
Cr-Commit-Position: refs/branch-heads/6.4@{v8#26}
Cr-Branched-From: 0407506-refs/heads/6.4.388@{#1}
Cr-Branched-From: a5fc4e0-refs/heads/master@{#49724}

Revision: a77c91f

BUG=chromium:1364149,chromium:1370423
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
[email protected]

Change-Id: I5fceb6cc0cf7b413c2fee56af248c4234288116c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3944988
Reviewed-by: Leszek Swirski <[email protected]>
Reviewed-by: Igor Sheludko <[email protected]>
Commit-Queue: Camillo Bruni <[email protected]>
Cr-Commit-Position: refs/branch-heads/10.7@{v8#26}
Cr-Branched-From: 4d2145c-refs/heads/10.7.193@{#1}
Cr-Branched-From: 9521696-refs/heads/main@{#83201}

Change-Id: I04ac502115dd997e13f3450e117758e9be3d219b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4644755
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/11.5@{v8#26}
Cr-Branched-From: 0c4044b-refs/heads/11.5.150@{#1}
Cr-Branched-From: b71d303-refs/heads/main@{#87781}

MoveOptimization merged moves based on canonicalized
`InstructionOperand`s, which ignores word representations. This can
lead to issues with tagged and Word32 representations, which could
happen on the same value and are not interchangeable.
This CL removes the canonicalization, only merging completely identical
moves.

Bug: chromium:1468148
(cherry picked from commit 17b0350)

Change-Id: Icb740134e28a7ea5a5164c600f2ca90a4311bd34
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4747582
Reviewed-by: Nico Hartmann <[email protected]>
Commit-Queue: Nico Hartmann <[email protected]>
Auto-Submit: Tobias Tebbi <[email protected]>
Cr-Commit-Position: refs/branch-heads/11.6@{v8#26}
Cr-Branched-From: e29c028-refs/heads/11.6.189@{v8#3}
Cr-Branched-From: 95cbef2-refs/heads/main@{#88340}

…t holey

Bug: chromium:1473247
(cherry picked from commit ae7dc61)

Change-Id: I6bbeaed7def5fed3d70d53d3553edf9d8f355b80
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4831821
Auto-Submit: Leszek Swirski <[email protected]>
Owners-Override: Leszek Swirski <[email protected]>
Commit-Queue: Leszek Swirski <[email protected]>
Reviewed-by: Darius Mercadier <[email protected]>
Commit-Queue: Darius Mercadier <[email protected]>
Cr-Commit-Position: refs/branch-heads/11.7@{v8#26}
Cr-Branched-From: fe60869-refs/heads/11.7.439@{#1}
Cr-Branched-From: aeb4552-refs/heads/main@{#89415}

If the elements are not simple, or change in the slow case of the
clone IC, then the fast case must be skipped. This is more
conservative than neccessary (since some elements kinds have compatible
binary layout) but also less risky.

Drive-By: Update out of date comment.

Bug: chromium:1488365

(cherry picked from commit f20fca6)

Change-Id: I478a71209be035654dc2cc635b14b33a6e449f1f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4915664
Commit-Queue: Olivier Flückiger <[email protected]>
Reviewed-by: Igor Sheludko <[email protected]>
Auto-Submit: Olivier Flückiger <[email protected]>
Cr-Commit-Position: refs/branch-heads/11.8@{v8#26}
Cr-Branched-From: 935bdbf-refs/heads/11.8.172@{#1}
Cr-Branched-From: b82a911-refs/heads/main@{#89779}

Change-Id: If760a1102e5c357d86288691acf5b6603d584b59
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5116044
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/12.1@{v8#26}
Cr-Branched-From: b74ef6f-refs/heads/12.1.285@{#1}
Cr-Branched-From: 32857fb-refs/heads/main@{#91313}

Two things were wrong:

 * CopyingPhase::InlineBlock did not skip Phis whose use-count was
   0. This lead to visiting Phis whose input had been removed from the
   graph.

 * [debug only] Operations with use-count of 0 were not always skipped
   when --turboshaft-opt-bisect was used, which could also lead to
   visiting operations with Invalid inputs.

Bug: v8:12781, chromium:1512481
(cherry picked from commit 9e99707)

Change-Id: I7b8d8863fe3599471893d95844f3c57feb2a55a8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5155973
Commit-Queue: Darius Mercadier <[email protected]>
Reviewed-by: Clemens Backes <[email protected]>
Cr-Commit-Position: refs/branch-heads/12.0@{v8#26}
Cr-Branched-From: ed7b4ca-refs/heads/12.0.267@{#1}
Cr-Branched-From: 210e75b-refs/heads/main@{#90651}

This CL fixes a use-after-free of the InspectorSession. This can
happen for workers since they are killed (and the DevToolsSession
detached) during an interrupt.

The problem is that we might have already entered the inspector and
the inspector entered JavaScript land. This could mean that we detach
a session on which we are currently operating on (e.g. building a
console message to send it to the frontend).

The fix is to postpone interrupts until after we are done building
console messages so we don't lose the DevTools session half-way
through it.

[email protected]

(cherry picked from commit 41dd803)

Fixed: b:323813642
Change-Id: I495d926830bc0ed129b0632d454b2d94f3123180
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5280692
Bot-Commit: Rubber Stamper <[email protected]>
Auto-Submit: Simon Zünd <[email protected]>
Commit-Queue: Rubber Stamper <[email protected]>
Commit-Queue: Simon Zünd <[email protected]>
Cr-Commit-Position: refs/branch-heads/12.2@{#26}
Cr-Branched-From: 6eb5a96-refs/heads/12.2.281@{#1}
Cr-Branched-From: 44cf56d-refs/heads/main@{#91934}

This CL fixes a use-after-free of the InspectorSession. This can
happen for workers since they are killed (and the DevToolsSession
detached) during an interrupt.

The problem is that we might have already entered the inspector and
the inspector entered JavaScript land. This could mean that we detach
a session on which we are currently operating on (e.g. building a
console message to send it to the frontend).

The fix is to postpone interrupts until after we are done building
console messages so we don't lose the DevTools session half-way
through it.

[email protected]

(cherry picked from commit 41dd803)

(cherry picked from commit 72c073c)

Fixed: b:323813642
Change-Id: I495d926830bc0ed129b0632d454b2d94f3123180
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5280692
Bot-Commit: Rubber Stamper <[email protected]>
Auto-Submit: Simon Zünd <[email protected]>
Commit-Queue: Rubber Stamper <[email protected]>
Commit-Queue: Simon Zünd <[email protected]>
Cr-Original-Commit-Position: refs/branch-heads/12.2@{#26}
Cr-Original-Branched-From: 6eb5a96-refs/heads/12.2.281@{#1}
Cr-Original-Branched-From: 44cf56d-refs/heads/main@{#91934}
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5362664
Commit-Queue: Zakhar Voit <[email protected]>
Reviewed-by: Simon Zünd <[email protected]>
Cr-Commit-Position: refs/branch-heads/12.0@{#40}
Cr-Branched-From: ed7b4ca-refs/heads/12.0.267@{#1}
Cr-Branched-From: 210e75b-refs/heads/main@{#90651}

(cherry picked from commit b852ad7)

Bug: chromium:330575498
Change-Id: I395f0ed6d823b7d1e139da6551486e3627d65724
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5378419
Commit-Queue: Jakob Kummerow <[email protected]>
Reviewed-by: Jakob Kummerow <[email protected]>
Auto-Submit: Manos Koukoutos <[email protected]>
Cr-Original-Commit-Position: refs/heads/main@{#92941}
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5380191
Commit-Queue: Francis McCabe <[email protected]>
Reviewed-by: Francis McCabe <[email protected]>
Cr-Commit-Position: refs/branch-heads/12.3@{#26}
Cr-Branched-From: a86e197-refs/heads/12.3.219@{#1}
Cr-Branched-From: 21869f7-refs/heads/main@{#92385}

…contexts"

This is a reland of commit 819f64c

CL is unchanged. Blink needs rebaselining here.

Original change's description:
> [api] Fix instantiation of DictionaryTemplate across contexts
>
> The current version would allow instantiating the same template (which
> is per Isolate) across various contexts without creating the proper
> new map transitions. Map::Copy() was not sufficient to handle this
> case.
>
> Instead, rely on the already existing template instantiations cache
> which is context specific.
>
> Bug: chromium:333182464
> Change-Id: I44f76ca120ba24a3f17d50f6307c83d9734a9c08
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5443270
> Reviewed-by: Toon Verwaest <[email protected]>
> Commit-Queue: Michael Lippautz <[email protected]>
> Cr-Commit-Position: refs/heads/main@{#93304}

(cherry picked from commit b505dbe)

Bug: chromium:333182464
Change-Id: Iab273403a0b645ae5b8d501a93202fed904ccd44
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5463594
Reviewed-by: Shu-yu Guo <[email protected]>
Commit-Queue: Shu-yu Guo <[email protected]>
Auto-Submit: Michael Lippautz <[email protected]>
Commit-Queue: Michael Lippautz <[email protected]>
Cr-Commit-Position: refs/branch-heads/12.4@{#26}
Cr-Branched-From: 309640d-refs/heads/12.4.254@{#1}
Cr-Branched-From: 5dc2470-refs/heads/main@{#92862}

(cherry picked from commit 0d63633)

Bug: 336413783
Change-Id: I919b9db712462c4a2eaf014c460adb7eed19896d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5471667
Auto-Submit: Alexander Schulze <[email protected]>
Reviewed-by: Michael Achenbach <[email protected]>
Commit-Queue: Alexander Schulze <[email protected]>
Cr-Original-Commit-Position: refs/heads/main@{#93513}
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5611286
Commit-Queue: Michael Achenbach <[email protected]>
Cr-Commit-Position: refs/branch-heads/12.5@{#26}
Cr-Branched-From: 15b9756-refs/heads/12.5.227@{#1}
Cr-Branched-From: 497d857-refs/heads/main@{#93350}

So far the generic wrapper was only used for calling internal wasm
functions, which allowed it to make the assumption that the implicit
parameter was a WasmTrustedInstanceData object.
Add support for passing a WasmApiFunctionRef, which enables using it for
calling re-exported imports, and also fixes a correctness issue with the
JSPI variant of the wrapper.

(cherry picked from commit d2d190f)

Bug: 342415789
Change-Id: I1c7545ac70585b3c2689956d64c816692b0c274c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5617392
Bot-Commit: Rubber Stamper <[email protected]>
Commit-Queue: Adam Klein <[email protected]>
Cr-Commit-Position: refs/branch-heads/12.6@{#26}
Cr-Branched-From: 3c9fa12-refs/heads/12.6.228@{#2}
Cr-Branched-From: 981bb15-refs/heads/main@{#93835}

Fixed: 343507800
(cherry picked from commit 70d2fe6)

Change-Id: I8d4ddb81de353e50064788b5192a88512ab58e0d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5703777
Reviewed-by: Toon Verwaest <[email protected]>
Commit-Queue: Toon Verwaest <[email protected]>
Auto-Submit: Leszek Swirski <[email protected]>
Cr-Commit-Position: refs/branch-heads/12.7@{#26}
Cr-Branched-From: 35cc908-refs/heads/12.7.224@{#1}
Cr-Branched-From: 6d60e67-refs/heads/main@{#94324}

Bug: 354758515

(cherry picked from commit 636350e)

Change-Id: I33900b6aadd92da18a24a16b1a3c69fa02860fa5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5784823
Reviewed-by: Shu-yu Guo <[email protected]>
Commit-Queue: Deepti Gandluri <[email protected]>
Cr-Commit-Position: refs/branch-heads/12.8@{#26}
Cr-Branched-From: 70cbb39-refs/heads/12.8.374@{#1}
Cr-Branched-From: 451b63e-refs/heads/main@{#95151}

This reverts commit 67169ad.

Reason for revert: Crashes on 128 branch

Original change's description:
> Merged: [runtime] Empty scope info + not compiled = no outer
>
> Bug: 354758515
>
> (cherry picked from commit 636350e)
>
> Change-Id: I33900b6aadd92da18a24a16b1a3c69fa02860fa5
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5784823
> Reviewed-by: Shu-yu Guo <[email protected]>
> Commit-Queue: Deepti Gandluri <[email protected]>
> Cr-Commit-Position: refs/branch-heads/12.8@{#26}
> Cr-Branched-From: 70cbb39-refs/heads/12.8.374@{#1}
> Cr-Branched-From: 451b63e-refs/heads/main@{#95151}

Bug: 354758515
Change-Id: I27043daa070e7af09b3efa6fcae53a5847210f05
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5797857
Commit-Queue: Rubber Stamper <[email protected]>
Auto-Submit: Deepti Gandluri <[email protected]>
Bot-Commit: Rubber Stamper <[email protected]>
Cr-Commit-Position: refs/branch-heads/12.8@{#38}
Cr-Branched-From: 70cbb39-refs/heads/12.8.374@{#1}
Cr-Branched-From: 451b63e-refs/heads/main@{#95151}

Change-Id: I659e428c750de7b943d708213bd5929f64dc5d72
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5837846
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/12.9@{#26}
Cr-Branched-From: 64a21d7-refs/heads/12.9.202@{#1}
Cr-Branched-From: da4200b-refs/heads/main@{#95679}